mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
1cd4203c34
This commit addresses three critical compatibility issues with Ansible 12:
1. **Nested Jinja template deprecation warning**
- Fixed: `{{ lookup('file', '{{ SSH_keys.public }}') }}`
- Now: `{{ lookup('file', SSH_keys.public) }}`
- Location: files/cloud-init/base.sh:20
2. **String to boolean conversion errors in conditionals**
- Fixed: `when: item.item` (evaluates strings as truthy)
- Now: `when: item.item is defined and item.item != none`
- Location: roles/common/tasks/main.yml:20
3. **Sysctl list with None values causing boolean errors**
- Restructured list to dynamically exclude None entries
- IPv6 forwarding sysctl only added when ipv6_support is true
- Location: roles/common/tasks/ubuntu.yml:132
These changes maintain backward compatibility with older Ansible versions
while ensuring forward compatibility with Ansible 12's stricter type checking.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Claude <noreply@anthropic.com>
30 lines
797 B
Bash
30 lines
797 B
Bash
#!/bin/sh
|
|
set -eux
|
|
|
|
# shellcheck disable=SC2230
|
|
which sudo || until \
|
|
apt-get update -y && \
|
|
apt-get install sudo -yf --install-suggests; do
|
|
sleep 3
|
|
done
|
|
|
|
getent passwd algo || useradd -m -d /home/algo -s /bin/bash -G adm -p '!' algo
|
|
|
|
(umask 337 && echo "algo ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/10-algo-user)
|
|
|
|
cat <<EOF >/etc/ssh/sshd_config
|
|
{{ lookup('template', 'files/cloud-init/sshd_config') }}
|
|
EOF
|
|
|
|
test -d /home/algo/.ssh || sudo -u algo mkdir -m 0700 /home/algo/.ssh
|
|
echo "{{ lookup('file', SSH_keys.public) }}" | (sudo -u algo tee /home/algo/.ssh/authorized_keys && chmod 0600 /home/algo/.ssh/authorized_keys)
|
|
|
|
ufw --force reset
|
|
|
|
# shellcheck disable=SC2015
|
|
dpkg -l sshguard && until apt-get remove -y --purge sshguard; do
|
|
sleep 3
|
|
done || true
|
|
|
|
systemctl restart sshd.service
|