mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
Florian KinderandGitHub
38e87c2f5a
* Fix Vultr startup script JSON serialization error
The startup_script module was failing with "Object of type 'bytes' is not
JSON serializable" because the lookup('template', ...) was returning bytes
instead of a string.
Added | string filter to explicitly convert the template result to a
string, matching the pattern used by the DigitalOcean cloud provider.
Also simplified from multiline block format to inline format for
consistency with other cloud providers.
Fixes the error: "Object of type 'bytes' is not JSON serializable by the
'tagless' profile."
* Add string filters to template lookups in cloud-init base template
Added | string filters to lookup() calls in the cloud-init base template
to ensure consistent string handling across all cloud providers.
The Vultr startup_script module requires all values to be JSON-serializable
strings, and lookup() can return bytes in some contexts. This change ensures
that both the SSH config template lookup and the SSH public key file lookup
explicitly return strings.
This is a defensive fix that improves compatibility with strict JSON
serialization requirements in some Ansible modules, while remaining
backward compatible with existing cloud providers.
Related to: vultr.cloud.startup_script JSON serialization requirements
* Use two-step fact assignment for Vultr startup script
Changed to set the cloud-init script as a fact first, then reference
that fact in the startup_script module. This follows the pattern used
by the Linode provider and avoids JSON serialization issues with nested
template lookups.
This approach ensures the template is fully evaluated and stored as a
string before being passed to the vultr.cloud.startup_script module,
which then base64-encodes it for the API.
Related to: JSON serialization with "tagless" profile in Ansible 2.19+
45 lines
1.2 KiB
YAML
45 lines
1.2 KiB
YAML
#cloud-config
|
|
# CRITICAL: The above line MUST be exactly "#cloud-config" (no space after #)
|
|
# This is required by cloud-init's YAML parser. Adding a space breaks parsing
|
|
# and causes all cloud-init directives to be skipped, resulting in SSH timeouts.
|
|
# See: https://github.com/trailofbits/algo/issues/14800
|
|
output: {all: '| tee -a /var/log/cloud-init-output.log'}
|
|
|
|
package_update: true
|
|
package_upgrade: true
|
|
|
|
packages:
|
|
- sudo
|
|
{% if performance_preinstall_packages | default(false) %}
|
|
# Universal tools always needed by Algo (performance optimization)
|
|
- git
|
|
- screen
|
|
- apparmor-utils
|
|
- uuid-runtime
|
|
- coreutils
|
|
- iptables-persistent
|
|
- cgroup-tools
|
|
{% endif %}
|
|
|
|
users:
|
|
- default
|
|
- name: algo
|
|
homedir: /home/algo
|
|
sudo: ALL=(ALL) NOPASSWD:ALL
|
|
groups: adm,netdev
|
|
shell: /bin/bash
|
|
lock_passwd: true
|
|
ssh_authorized_keys:
|
|
- "{{ lookup('file', SSH_keys.public) | string }}"
|
|
|
|
write_files:
|
|
- path: /etc/ssh/sshd_config
|
|
content: |
|
|
{{ lookup('template', 'files/cloud-init/sshd_config') | string | indent(width=6, first=True) }}
|
|
|
|
runcmd:
|
|
- set -x
|
|
- ufw --force reset
|
|
- sudo apt-get remove -y --purge sshguard || true
|
|
- systemctl restart sshd.service
|