mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
984831bcab
* fix: add explicit bool filters for Ansible 12 jinja2_native compatibility Ansible 12 enables jinja2_native by default, which means string values like "true"/"false" are no longer automatically coerced to booleans in when: conditions and Jinja2 if statements. Add | bool filters to all boolean variable references in tasks, templates, and handlers. Also reformats long single-line Jinja2 conditionals into multi-line for readability, fixes GCE default() calls for native mode, adds help command to the algo script, and updates test fixtures to register the bool filter. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add j2lint for Jinja2 template linting Add j2lint (aristanetworks/j2lint) to catch syntax errors, spacing issues, and operator formatting in Jinja2 templates. Integrated into pre-commit hooks, lint.yml CI, and smart-tests.yml. Rules S3/S5/S6/S7/V1 are ignored — they enforce conventions incompatible with Ansible's config-file-embedded templates. Also fixes int+1 → int + 1 operator spacing in server.conf.j2. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: resolve all ansible-lint warnings and enforce zero-tolerance policy Fix 18 jinja[spacing] errors across 12 files by moving Jinja2 block delimiters to prevent YAML >- folding from introducing trailing spaces. Fix 27 key-order[task] warnings across 17 files by reordering task keys to canonical order (name → when → tags → environment → become → block). Promote key-order[task] and yaml[line-length] from warn_list to hard errors by removing warn_list entirely from .ansible-lint. Add zero-tolerance warning policy to CLAUDE.md explaining why warnings are unacceptable in a security tool and documenting resolution order. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
57 lines
2.9 KiB
YAML
57 lines
2.9 KiB
YAML
---
|
|
ipsec_config_path: configs/{{ IP_subject_alt_name }}/ipsec
|
|
ipsec_pki_path: "{{ ipsec_config_path }}/.pki"
|
|
strongswan_shell: /usr/sbin/nologin
|
|
strongswan_home: /var/lib/strongswan
|
|
strongswan_service: "{{ 'strongswan-starter' if ansible_facts['distribution_version'] is version('20.04', '>=') else 'strongswan' }}"
|
|
BetweenClients_DROP: true
|
|
algo_ondemand_cellular: false
|
|
algo_ondemand_wifi: false
|
|
algo_ondemand_wifi_exclude: _null
|
|
algo_dns_adblocking: false
|
|
ipv6_support: false
|
|
dns_encryption: true
|
|
# Random UUID for CA name constraints - prevents certificate reuse across different Algo deployments
|
|
# This unique identifier ensures each CA can only issue certificates for its specific server instance
|
|
openssl_constraint_random_id: "{{ IP_subject_alt_name | to_uuid }}.algo"
|
|
# Subject Alternative Name (SAN) configuration - CRITICAL for client compatibility
|
|
# Modern clients (especially macOS/iOS) REQUIRE SAN extension in server certificates
|
|
# Without SAN, IKEv2 connections will fail with certificate validation errors
|
|
subjectAltName_type: "{{ 'DNS' if IP_subject_alt_name | regex_search('[a-z]') else 'IP' }}"
|
|
subjectAltName: >-
|
|
{{ subjectAltName_type }}:{{ IP_subject_alt_name }}{%- if ipv6_support | bool -%},IP:{{ ansible_default_ipv6['address'] }}{%- endif -%}
|
|
subjectAltName_USER: email:{{ item }}@{{ openssl_constraint_random_id }}
|
|
# yamllint disable rule:line-length
|
|
nameConstraints: >-
|
|
critical,permitted;{{ subjectAltName_type }}:{{ IP_subject_alt_name }}{{- '/255.255.255.255' if subjectAltName_type == 'IP' else '' -}}{%- if subjectAltName_type == 'IP' -%},permitted;DNS:{{ openssl_constraint_random_id }},excluded;DNS:.com,excluded;DNS:.org,excluded;DNS:.net,excluded;DNS:.gov,excluded;DNS:.edu,excluded;DNS:.mil,excluded;DNS:.int,excluded;IP:10.0.0.0/255.0.0.0,excluded;IP:172.16.0.0/255.240.0.0,excluded;IP:192.168.0.0/255.255.0.0{%- else -%},excluded;IP:0.0.0.0/0.0.0.0{%- endif -%},permitted;email:{{ openssl_constraint_random_id }},excluded;email:.com,excluded;email:.org,excluded;email:.net,excluded;email:.gov,excluded;email:.edu,excluded;email:.mil,excluded;email:.int{%- if ipv6_support | bool -%},permitted;IP:{{ ansible_default_ipv6['address'] }}/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff,excluded;IP:fc00:0:0:0:0:0:0:0/fe00:0:0:0:0:0:0:0,excluded;IP:fe80:0:0:0:0:0:0:0/ffc0:0:0:0:0:0:0:0,excluded;IP:2001:db8:0:0:0:0:0:0/ffff:fff8:0:0:0:0:0:0{%- else -%},excluded;IP:::/0{%- endif -%}
|
|
# yamllint enable rule:line-length
|
|
openssl_bin: openssl
|
|
strongswan_enabled_plugins:
|
|
- aes
|
|
- gcm
|
|
- hmac
|
|
- kernel-netlink
|
|
- nonce
|
|
- openssl
|
|
- pem
|
|
- pgp
|
|
- pkcs12
|
|
- pkcs7
|
|
- pkcs8
|
|
- pubkey
|
|
- random
|
|
- revocation
|
|
- sha2
|
|
- socket-default
|
|
- stroke
|
|
- x509
|
|
|
|
ciphers:
|
|
defaults:
|
|
ike: aes256gcm16-prfsha512-ecp384!
|
|
esp: aes256gcm16-ecp384!
|
|
|
|
pkcs12_PayloadCertificateUUID: "{{ 900000 | random | to_uuid | upper }}"
|
|
VPN_PayloadIdentifier: "{{ 800000 | random | to_uuid | upper }}"
|
|
CA_PayloadIdentifier: "{{ 700000 | random | to_uuid | upper }}"
|