mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
984831bcab
* fix: add explicit bool filters for Ansible 12 jinja2_native compatibility Ansible 12 enables jinja2_native by default, which means string values like "true"/"false" are no longer automatically coerced to booleans in when: conditions and Jinja2 if statements. Add | bool filters to all boolean variable references in tasks, templates, and handlers. Also reformats long single-line Jinja2 conditionals into multi-line for readability, fixes GCE default() calls for native mode, adds help command to the algo script, and updates test fixtures to register the bool filter. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add j2lint for Jinja2 template linting Add j2lint (aristanetworks/j2lint) to catch syntax errors, spacing issues, and operator formatting in Jinja2 templates. Integrated into pre-commit hooks, lint.yml CI, and smart-tests.yml. Rules S3/S5/S6/S7/V1 are ignored — they enforce conventions incompatible with Ansible's config-file-embedded templates. Also fixes int+1 → int + 1 operator spacing in server.conf.j2. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: resolve all ansible-lint warnings and enforce zero-tolerance policy Fix 18 jinja[spacing] errors across 12 files by moving Jinja2 block delimiters to prevent YAML >- folding from introducing trailing spaces. Fix 27 key-order[task] warnings across 17 files by reordering task keys to canonical order (name → when → tags → environment → become → block). Promote key-order[task] and yaml[line-length] from warn_list to hard errors by removing warn_list entirely from .ansible-lint. Add zero-tolerance warning policy to CLAUDE.md explaining why warnings are unacceptable in a security tool and documenting resolution order. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
103 lines
2.6 KiB
YAML
103 lines
2.6 KiB
YAML
---
|
|
- name: Ensure the required config directories exist
|
|
file:
|
|
dest: "{{ item }}"
|
|
state: directory
|
|
recurse: true
|
|
mode: "0755"
|
|
loop:
|
|
- "{{ wireguard_config_path }}/apple/ios"
|
|
- "{{ wireguard_config_path }}/apple/macos"
|
|
delegate_to: localhost
|
|
become: false
|
|
|
|
- name: Include tasks for Debian/Ubuntu
|
|
include_tasks: ubuntu.yml
|
|
when: is_debian_based | bool
|
|
tags: always
|
|
|
|
|
|
- name: Generate keys
|
|
import_tasks: keys.yml
|
|
delegate_to: localhost
|
|
become: false
|
|
tags: update-users
|
|
|
|
- tags: update-users
|
|
block:
|
|
- become: false
|
|
delegate_to: localhost
|
|
block:
|
|
- name: WireGuard user list updated
|
|
lineinfile:
|
|
dest: "{{ wireguard_pki_path }}/index.txt"
|
|
create: true
|
|
mode: "0600"
|
|
insertafter: EOF
|
|
line: "{{ item }}"
|
|
register: lineinfile
|
|
loop: "{{ users }}"
|
|
|
|
- set_fact:
|
|
wireguard_users: "{{ (lookup('file', wireguard_pki_path + '/index.txt')).split('\n') }}"
|
|
|
|
- name: WireGuard users config generated
|
|
template:
|
|
src: client.conf.j2
|
|
dest: "{{ wireguard_config_path }}/{{ item }}.conf"
|
|
mode: "0600"
|
|
loop: "{{ wireguard_users }}"
|
|
loop_control:
|
|
index_var: index
|
|
when: item in users
|
|
|
|
- include_tasks: mobileconfig.yml
|
|
loop:
|
|
- ios
|
|
- macos
|
|
loop_control:
|
|
loop_var: system
|
|
|
|
- name: Generate QR codes
|
|
shell: >
|
|
umask 077;
|
|
which segno &&
|
|
segno --scale=5 --output={{ item }}.png \
|
|
"{{ lookup('template', 'client.conf.j2') }}" || true
|
|
changed_when: false
|
|
loop: "{{ wireguard_users }}"
|
|
loop_control:
|
|
index_var: index
|
|
when: item in users
|
|
vars:
|
|
ansible_python_interpreter: "{{ ansible_playbook_python }}"
|
|
args:
|
|
chdir: "{{ wireguard_config_path }}"
|
|
executable: bash
|
|
no_log: true
|
|
|
|
- name: WireGuard configured
|
|
template:
|
|
src: server.conf.j2
|
|
dest: "{{ config_prefix | default('/') }}etc/wireguard/{{ wireguard_interface }}.conf"
|
|
mode: "0600"
|
|
notify: restart wireguard
|
|
|
|
- name: WireGuard enabled and started
|
|
service:
|
|
name: "{{ service_name }}"
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Delete the PKI directory
|
|
file:
|
|
path: "{{ wireguard_pki_path }}"
|
|
state: absent
|
|
become: false
|
|
delegate_to: localhost
|
|
when:
|
|
- not algo_store_pki
|
|
- not pki_in_tmpfs
|
|
|
|
- meta: flush_handlers
|