mirror of
https://github.com/trailofbits/algo.git
synced 2026-10-01 22:15:00 +02:00
ba7297268a
* Simplify codebase: modernize loops, split templates, improve CI This PR consolidates several simplification phases: ## Ansible Modernization - Modernize `with_items` to `loop` across ~50 task files - Add OS detection facts (is_ubuntu, os_family_lowercase) - Condense inline YAML syntax where appropriate ## Template Splitting - Split 568-line dnscrypt-proxy.toml.j2 into focused partials: - global.toml.j2 (core settings) - sources.toml.j2 (resolver sources) - filters.toml.j2 (blocking rules) - cache.toml.j2 (caching config) ## CI Workflow Improvements - Create setup-algo composite action for shared CI setup - Re-enable integration tests with health checks - Fix smart-tests.yml silent lint failures (remove || true) - Use env variables for GitHub SHAs (security) ## server.yml Async Simplification - Reorganize VPN service configuration with clear sections - Add performance_parallel_services toggle - Simplify status display from json_query to inline conditionals - Keep services explicit for readability 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * Fix with_items to loop conversion: preserve list flattening with_items automatically flattens nested lists, but loop does NOT. The mechanical conversion broke iteration over list variables. Wrong: loop: - "{{ users }}" # ['alice', 'bob'] treated as ONE item Fixed: loop: "{{ users }}" # Iterates over alice, bob correctly For combined lists (users + server): loop: "{{ users + [IP_subject_alt_name] }}" Fixes IPsec certificate generation creating files named literally '['alice', 'bob'].key' instead of separate alice.key and bob.key. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * Fix integration test: use strongswan-starter service name on Ubuntu 20.04+ The StrongSwan service is named 'strongswan-starter' on Ubuntu 20.04+, not 'strongswan'. The test was checking the wrong service name, causing false failures even when StrongSwan was actually running. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * Fix IPsec path issues: remove trailing slashes and fix test paths 1. Remove trailing slashes from ipsec_config_path and ipsec_pki_path in roles/strongswan/defaults/main.yml (causes double slashes) 2. Fix integration test to check correct subdirectories: - .p12 files are in ipsec/manual/ - .mobileconfig files are in ipsec/apple/ 3. Fix strongswan service name check (strongswan-starter on Ubuntu 20.04+) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
59 lines
2.2 KiB
YAML
59 lines
2.2 KiB
YAML
---
|
|
- name: Build python virtual environment
|
|
import_tasks: venv.yml
|
|
|
|
- name: Include prompts
|
|
import_tasks: prompts.yml
|
|
|
|
- block:
|
|
- set_fact:
|
|
algo_region: >-
|
|
{%- if region is defined -%}{{ region }}{%- elif _algo_region.user_input is defined and _algo_region.user_input | length > 0 -%}{{ cs_zones[_algo_region.user_input | int - 1]['name'] }}{%- else -%}{{ cs_zones[default_zone | int - 1]['name'] }}{%- endif -%}
|
|
|
|
- name: Security group created
|
|
cs_securitygroup:
|
|
name: "{{ algo_server_name }}-security_group"
|
|
description: AlgoVPN security group
|
|
register: cs_security_group
|
|
|
|
- name: Security rules created
|
|
cs_securitygroup_rule:
|
|
security_group: "{{ cs_security_group.name }}"
|
|
protocol: "{{ item.proto }}"
|
|
start_port: "{{ item.start_port }}"
|
|
end_port: "{{ item.end_port }}"
|
|
cidr: "{{ item.range }}"
|
|
loop:
|
|
- { proto: tcp, start_port: "{{ ssh_port }}", end_port: "{{ ssh_port }}", range: 0.0.0.0/0 }
|
|
- { proto: udp, start_port: 4500, end_port: 4500, range: 0.0.0.0/0 }
|
|
- { proto: udp, start_port: 500, end_port: 500, range: 0.0.0.0/0 }
|
|
- { proto: udp, start_port: "{{ wireguard_port }}", end_port: "{{ wireguard_port }}", range: 0.0.0.0/0 }
|
|
|
|
- name: Set facts
|
|
set_fact:
|
|
image_id: "{{ cloud_providers.cloudstack.image }}"
|
|
size: "{{ cloud_providers.cloudstack.size }}"
|
|
disk: "{{ cloud_providers.cloudstack.disk }}"
|
|
|
|
- name: Server created
|
|
cs_instance:
|
|
name: "{{ algo_server_name }}"
|
|
root_disk_size: "{{ disk }}"
|
|
template: "{{ image_id }}"
|
|
security_groups: "{{ cs_security_group.name }}"
|
|
zone: "{{ algo_region }}"
|
|
service_offering: "{{ size }}"
|
|
user_data: "{{ lookup('template', 'files/cloud-init/base.yml') }}"
|
|
register: cs_server
|
|
|
|
- set_fact:
|
|
cloud_instance_ip: "{{ cs_server.default_ip }}"
|
|
ansible_ssh_user: algo
|
|
ansible_ssh_port: "{{ ssh_port }}"
|
|
cloudinit: true
|
|
environment:
|
|
CLOUDSTACK_KEY: "{{ algo_cs_key }}"
|
|
CLOUDSTACK_SECRET: "{{ algo_cs_token }}"
|
|
CLOUDSTACK_ENDPOINT: "{{ algo_cs_url }}"
|
|
no_log: true
|