Add pre-flight check in main.yml that catches missing cryptography/SECP384R1
before deployment starts, replacing the cryptic error from community.crypto
internals with an actionable message pointing users to run ./algo or uv sync.
Root cause of the CI ipsec/both test failures: cryptography 46.0.5 wraps
the ec module with _ModuleWithDeprecations (for SECT curve deprecation),
which breaks community.crypto's ec.__dict__.get("SECP384R1") lookup.
The fix in community.crypto 3.1.1 uses getattr() instead.
Changes:
- Add SECP384R1 pre-flight check to main.yml (conditional on ipsec_enabled)
- Add cryptography>=42.0.0 as explicit dependency in pyproject.toml
- Upgrade community.crypto to >=3.1.1 (fixes __dict__ vs getattr bug)
- Add ansible-galaxy collection install step to CI
- Use venv Python interpreter for local deployments in add_host tasks
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
