mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
de11b86060
Add pre-flight check in main.yml that catches missing cryptography/SECP384R1
before deployment starts, replacing the cryptic error from community.crypto
internals with an actionable message pointing users to run ./algo or uv sync.
Root cause of the CI ipsec/both test failures: cryptography 46.0.5 wraps
the ec module with _ModuleWithDeprecations (for SECT curve deprecation),
which breaks community.crypto's ec.__dict__.get("SECP384R1") lookup.
The fix in community.crypto 3.1.1 uses getattr() instead.
Changes:
- Add SECP384R1 pre-flight check to main.yml (conditional on ipsec_enabled)
- Add cryptography>=42.0.0 as explicit dependency in pyproject.toml
- Upgrade community.crypto to >=3.1.1 (fixes __dict__ vs getattr bug)
- Add ansible-galaxy collection install step to CI
- Use venv Python interpreter for local deployments in add_host tasks
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
89 lines
3.4 KiB
YAML
89 lines
3.4 KiB
YAML
---
|
|
- name: Algo VPN Setup
|
|
hosts: localhost
|
|
become: false
|
|
tasks:
|
|
- name: Playbook dir stat
|
|
stat:
|
|
path: "{{ playbook_dir }}"
|
|
register: _playbook_dir
|
|
|
|
- name: Ensure Ansible is not being run in a world writable directory
|
|
assert:
|
|
that: _playbook_dir.stat.mode|int <= 775
|
|
msg: >
|
|
Ansible is being run in a world writable directory ({{ playbook_dir }}), ignoring it as an ansible.cfg source.
|
|
For more information see https://docs.ansible.com/ansible/devel/reference_appendices/config.html#cfg-in-world-writable-dir
|
|
|
|
- name: Ensure the requirements installed
|
|
debug:
|
|
msg: "{{ '192.168.1.1' | ansible.utils.ipaddr }}"
|
|
failed_when: false
|
|
no_log: true
|
|
register: ipaddr
|
|
|
|
- name: Extract ansible version from pyproject.toml
|
|
set_fact:
|
|
ansible_requirement: "{{ lookup('file', 'pyproject.toml') | regex_search('ansible==[0-9]+\\.[0-9]+\\.[0-9]+') }}"
|
|
|
|
- name: Parse ansible version requirement
|
|
set_fact:
|
|
required_ansible_version:
|
|
op: "{{ ansible_requirement | regex_replace('^ansible\\s*([~>=<]+)\\s*.*$', '\\1') }}"
|
|
ver: "{{ ansible_requirement | regex_replace('^ansible\\s*[~>=<]+\\s*(\\d+\\.\\d+(?:\\.\\d+)?).*$', '\\1') }}"
|
|
when: ansible_requirement is defined
|
|
|
|
- name: Get current ansible package version
|
|
command: uv pip list
|
|
register: uv_package_list
|
|
changed_when: false
|
|
|
|
- name: Extract ansible version from uv package list
|
|
set_fact:
|
|
current_ansible_version: "{{ uv_package_list.stdout | regex_search('ansible\\s+([0-9]+\\.[0-9]+\\.[0-9]+)', '\\1') | first }}"
|
|
|
|
- name: Verify Python meets Algo VPN requirements
|
|
assert:
|
|
that: (ansible_python.version.major|string + '.' + ansible_python.version.minor|string) is version('3.11', '>=')
|
|
msg: >
|
|
Python version is not supported.
|
|
You must upgrade to at least Python 3.11 to use this version of Algo.
|
|
See for more details - https://trailofbits.github.io/algo/troubleshooting.html#python-version-is-not-supported
|
|
|
|
- name: Verify Ansible meets Algo VPN requirements
|
|
assert:
|
|
that:
|
|
- current_ansible_version is version(required_ansible_version.ver, required_ansible_version.op)
|
|
- not ipaddr.failed
|
|
msg: >
|
|
Ansible version is {{ current_ansible_version }}.
|
|
You must update the requirements to use this version of Algo.
|
|
Try to run: uv sync
|
|
|
|
- name: Check cryptography library SECP384R1 support
|
|
command: >
|
|
{{ ansible_playbook_python }} -c
|
|
"from cryptography.hazmat.primitives.asymmetric.ec import SECP384R1"
|
|
changed_when: false
|
|
failed_when: false
|
|
register: _crypto_check
|
|
when: ipsec_enabled | default(true) | bool
|
|
|
|
- name: Verify cryptography library supports IPsec requirements
|
|
assert:
|
|
that: _crypto_check.rc == 0
|
|
msg: >
|
|
The Python cryptography library is missing or does not support SECP384R1.
|
|
IPsec/IKEv2 requires the cryptography package with elliptic curve support.
|
|
Fix: Run ./algo (manages dependencies automatically) or: uv sync && uv run ansible-playbook main.yml
|
|
when: ipsec_enabled | default(true) | bool
|
|
|
|
- name: Include prompts playbook
|
|
import_playbook: input.yml
|
|
|
|
- name: Include cloud provisioning playbook
|
|
import_playbook: cloud.yml
|
|
|
|
- name: Include server configuration playbook
|
|
import_playbook: server.yml
|