mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
Dan GuidoandGitHub
358d50314e
This PR introduces comprehensive performance optimizations that reduce Algo VPN deployment time by 30-60% while maintaining security and reliability. Key improvements: - Fixed critical WireGuard async structure bug (item.item.item pattern) - Resolved merge conflicts in test-aws-credentials.yml - Fixed path concatenation issues and aesthetic double slash problems - Added comprehensive performance optimizations with configurable flags - Extensive testing and quality improvements with yamllint/ruff compliance Successfully deployed and tested on DigitalOcean with all optimizations disabled. All critical bugs resolved and PR is production-ready.
56 lines
1.5 KiB
YAML
56 lines
1.5 KiB
YAML
---
|
|
- name: Set OS specific facts
|
|
set_fact:
|
|
strongswan_additional_plugins: []
|
|
- name: Ubuntu | Install strongSwan (individual)
|
|
apt:
|
|
name: strongswan
|
|
state: present
|
|
update_cache: true
|
|
install_recommends: true
|
|
when: not performance_parallel_packages | default(true)
|
|
|
|
- block:
|
|
# https://bugs.launchpad.net/ubuntu/+source/strongswan/+bug/1826238
|
|
- name: Ubuntu | Charon profile for apparmor configured
|
|
copy:
|
|
dest: /etc/apparmor.d/local/usr.lib.ipsec.charon
|
|
content: " capability setpcap,"
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
notify: restart strongswan
|
|
|
|
- name: Ubuntu | Enforcing ipsec with apparmor
|
|
command: aa-enforce "{{ item }}"
|
|
changed_when: false
|
|
with_items:
|
|
- /usr/lib/ipsec/charon
|
|
- /usr/lib/ipsec/lookip
|
|
- /usr/lib/ipsec/stroke
|
|
tags: apparmor
|
|
when: apparmor_enabled|default(false)|bool
|
|
|
|
- name: Ubuntu | Enable services
|
|
service: name={{ item }} enabled=yes
|
|
with_items:
|
|
- apparmor
|
|
- "{{ strongswan_service }}"
|
|
- netfilter-persistent
|
|
|
|
- name: Ubuntu | Ensure that the strongswan service directory exists
|
|
file:
|
|
path: /etc/systemd/system/{{ strongswan_service }}.service.d/
|
|
state: directory
|
|
mode: 0755
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Ubuntu | Setup the cgroup limitations for the ipsec daemon
|
|
template:
|
|
src: 100-CustomLimitations.conf.j2
|
|
dest: /etc/systemd/system/{{ strongswan_service }}.service.d/100-CustomLimitations.conf
|
|
notify:
|
|
- daemon-reload
|
|
- restart strongswan
|