mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
984831bcab
* fix: add explicit bool filters for Ansible 12 jinja2_native compatibility Ansible 12 enables jinja2_native by default, which means string values like "true"/"false" are no longer automatically coerced to booleans in when: conditions and Jinja2 if statements. Add | bool filters to all boolean variable references in tasks, templates, and handlers. Also reformats long single-line Jinja2 conditionals into multi-line for readability, fixes GCE default() calls for native mode, adds help command to the algo script, and updates test fixtures to register the bool filter. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add j2lint for Jinja2 template linting Add j2lint (aristanetworks/j2lint) to catch syntax errors, spacing issues, and operator formatting in Jinja2 templates. Integrated into pre-commit hooks, lint.yml CI, and smart-tests.yml. Rules S3/S5/S6/S7/V1 are ignored — they enforce conventions incompatible with Ansible's config-file-embedded templates. Also fixes int+1 → int + 1 operator spacing in server.conf.j2. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: resolve all ansible-lint warnings and enforce zero-tolerance policy Fix 18 jinja[spacing] errors across 12 files by moving Jinja2 block delimiters to prevent YAML >- folding from introducing trailing spaces. Fix 27 key-order[task] warnings across 17 files by reordering task keys to canonical order (name → when → tags → environment → become → block). Promote key-order[task] and yaml[line-length] from warn_list to hard errors by removing warn_list entirely from .ansible-lint. Add zero-tolerance warning policy to CLAUDE.md explaining why warnings are unacceptable in a security tool and documenting resolution order. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
41 lines
999 B
YAML
41 lines
999 B
YAML
---
|
|
- name: Include tasks for Debian/Ubuntu
|
|
include_tasks: ubuntu.yml
|
|
when: is_debian_based | bool
|
|
|
|
- name: dnscrypt-proxy ip-blacklist configured
|
|
template:
|
|
src: ip-blacklist.txt.j2
|
|
dest: "{{ config_prefix | default('/') }}etc/dnscrypt-proxy/ip-blacklist.txt"
|
|
mode: '0644'
|
|
notify:
|
|
- restart dnscrypt-proxy
|
|
|
|
- name: dnscrypt-proxy configured
|
|
template:
|
|
src: dnscrypt-proxy.toml.j2
|
|
dest: "{{ config_prefix | default('/') }}etc/dnscrypt-proxy/dnscrypt-proxy.toml"
|
|
mode: '0644'
|
|
notify:
|
|
- restart dnscrypt-proxy
|
|
|
|
- name: Include DNS adblocking tasks
|
|
import_tasks: dns_adblocking.yml
|
|
when: algo_dns_adblocking | bool
|
|
|
|
- meta: flush_handlers
|
|
|
|
- name: Ensure dnscrypt-proxy socket is enabled and started
|
|
systemd:
|
|
name: dnscrypt-proxy.socket
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
when: uses_systemd_socket | bool
|
|
|
|
- name: dnscrypt-proxy enabled and started
|
|
service:
|
|
name: dnscrypt-proxy
|
|
state: started
|
|
enabled: true
|