Implementing blocks and additional fail hints #487 (#497)

change the troubleshooting url

config.cfg

@@ -78,3 +78,8 @@ cloud_providers:
     size: f1-micro
     image: ubuntu-1604 # ubuntu-1604 / ubuntu-1704
   local:
+
+fail_hint:
+  - Sorry, but something went wrong!
+  - Please check the troubleshooting guide.
+  - https://trailofbits.github.io/algo/troubleshooting.html

deploy.yml

@@ -5,6 +5,7 @@
     - config.cfg
 
   pre_tasks:
+    - block:
         - name: Local pre-tasks
           include: playbooks/local.yml
           tags: [ 'always' ]
@@ -14,6 +15,11 @@
           become: false
           when: Deployed_By_Algo is defined and Deployed_By_Algo == "Y"
           tags: [ 'local' ]
+      rescue:
+        - debug: var=fail_hint
+          tags: always
+        - fail:
+          tags: always
 
   roles:
     - { role: cloud-digitalocean, tags: ['digitalocean'] }
@@ -23,10 +29,16 @@
     - { role: local, tags: ['local'] }
 
   post_tasks:
+    - block:
       - name: Local post-tasks
         include: playbooks/post.yml
         become: false
         tags: [ 'cloud' ]
+      rescue:
+        - debug: var=fail_hint
+          tags: always
+        - fail:
+          tags: always
 
 - name: Configure the server and install required software
   hosts: vpn-host
@@ -37,9 +49,15 @@
     - config.cfg
 
   pre_tasks:
+    - block:
       - name: Common pre-tasks
         include: playbooks/common.yml
         tags: [ 'digitalocean', 'ec2', 'gce', 'azure', 'local', 'pre' ]
+      rescue:
+        - debug: var=fail_hint
+          tags: always
+        - fail:
+          tags: always
 
   roles:
     - { role: security, tags: [ 'security' ] }
@@ -48,6 +66,7 @@
     - { role: vpn, tags: [ 'vpn' ] }
 
   post_tasks:
+    - block:
       - debug:
           msg:
             - "{{ congrats.common.split('\n') }}"
@@ -70,3 +89,8 @@
         become: no
         tags: always
         when: Store_CAKEY is defined and Store_CAKEY == "N"
+      rescue:
+        - debug: var=fail_hint
+          tags: always
+        - fail:
+          tags: always

roles/cloud-azure/tasks/main.yml

@@ -1,13 +1,13 @@
 ---
-
+- block:
-- set_fact:
+    - set_fact:
         resource_group: "Algo_{{ region }}"
         secret: "{{ azure_secret | default(lookup('env','AZURE_SECRET'), true) }}"
         tenant: "{{ azure_tenant | default(lookup('env','AZURE_TENANT'), true) }}"
         client_id: "{{ azure_client_id | default(lookup('env','AZURE_CLIENT_ID'), true) }}"
         subscription_id: "{{ azure_subscription_id | default(lookup('env','AZURE_SUBSCRIPTION_ID'), true) }}"
 
-- name: Create a resource group
+    - name: Create a resource group
       azure_rm_resourcegroup:
         secret: "{{ secret }}"
         tenant: "{{ tenant }}"
@@ -18,7 +18,7 @@
         tags:
           Environment: Algo
 
-- name: Create a virtual network
+    - name: Create a virtual network
       azure_rm_virtualnetwork:
         secret: "{{ secret }}"
         tenant: "{{ tenant }}"
@@ -30,7 +30,7 @@
         tags:
           Environment: Algo
 
-- name: Create a security group
+    - name: Create a security group
       azure_rm_securitygroup:
         secret: "{{ secret }}"
         tenant: "{{ tenant }}"
@@ -59,7 +59,7 @@
             priority: 120
             direction: Inbound
 
-- name: Create a subnet
+    - name: Create a subnet
       azure_rm_subnet:
         secret: "{{ secret }}"
         tenant: "{{ tenant }}"
@@ -73,7 +73,7 @@
         tags:
           Environment: Algo
 
-- name: Create an instance
+    - name: Create an instance
       azure_rm_virtualmachine:
         secret: "{{ secret }}"
         tenant: "{{ tenant }}"
@@ -94,11 +94,11 @@
 
       # To-do: Add error handling - if vm_size requested is not available, can we fall back to another, ideally with a prompt?
 
-- set_fact:
+    - set_fact:
         ip_address: "{{ azure_rm_virtualmachine.ansible_facts.azure_vm.properties.networkProfile.networkInterfaces[0].properties.ipConfigurations[0].properties.publicIPAddress.properties.ipAddress }}"
         networkinterface_name: "{{ azure_rm_virtualmachine.ansible_facts.azure_vm.properties.networkProfile.networkInterfaces[0].name }}"
 
-- name: Ensure the network interface includes all required parameters
+    - name: Ensure the network interface includes all required parameters
       azure_rm_networkinterface:
         secret: "{{ secret }}"
         tenant: "{{ tenant }}"
@@ -110,7 +110,7 @@
         subnet_name: algo_subnet
         security_group_name: AlgoSecGroup
 
-- name: Add the instance to an inventory group
+    - name: Add the instance to an inventory group
       add_host:
         name: "{{ ip_address }}"
         groups: vpn-host
@@ -120,19 +120,24 @@
         cloud_provider: azure
         ipv6_support: no
 
-- set_fact:
+    - set_fact:
         cloud_instance_ip: "{{ ip_address }}"
 
-- name: Ensure the group azure exists in the dynamic inventory file
+    - name: Ensure the group azure exists in the dynamic inventory file
       lineinfile:
         state: present
         dest: configs/inventory.dynamic
         line: '[azure]'
 
-- name: Populate the dynamic inventory
+    - name: Populate the dynamic inventory
       lineinfile:
         state: present
         dest: configs/inventory.dynamic
         insertafter: '\[azure\]'
         regexp: "^{{ cloud_instance_ip }}.*"
         line: "{{ cloud_instance_ip }}"
+  rescue:
+    - debug: var=fail_hint
+      tags: always
+    - fail:
+      tags: always

roles/cloud-digitalocean/tasks/main.yml

@@ -1,9 +1,10 @@
-- name: Set the DigitalOcean Access Token fact
+- block:
+    - name: Set the DigitalOcean Access Token fact
       set_fact:
         do_token: "{{ do_access_token | default(lookup('env','DO_API_TOKEN'), true) }}"
         public_key: "{{ lookup('file', '{{ SSH_keys.public }}') }}"
 
-- block:
+    - block:
         - name: "Delete the existing Algo SSH keys"
           digital_ocean:
             state: absent
@@ -30,7 +31,7 @@
         - fail:
             msg: "Please, ensure that your API token is not read-only."
 
-- name: "Upload the SSH key"
+    - name: "Upload the SSH key"
       digital_ocean:
         state: present
         command: ssh
@@ -39,7 +40,7 @@
         name: "{{ SSH_keys.comment }}"
       register: do_ssh_key
 
-- name: "Creating a droplet..."
+    - name: "Creating a droplet..."
       digital_ocean:
         state: present
         command: droplet
@@ -53,7 +54,7 @@
         ipv6: yes
       register: do
 
-- name: Add the droplet to an inventory group
+    - name: Add the droplet to an inventory group
       add_host:
         name: "{{ do.droplet.ip_address }}"
         groups: vpn-host
@@ -65,17 +66,17 @@
         cloud_provider: digitalocean
         ipv6_support: true
 
-- set_fact:
+    - set_fact:
         cloud_instance_ip: "{{ do.droplet.ip_address }}"
 
-- name: Tag the droplet
+    - name: Tag the droplet
       digital_ocean_tag:
         name: "Environment:Algo"
         resource_id: "{{ do.droplet.id }}"
         api_token: "{{ do_token }}"
         state: present
 
-- name: Get droplets
+    - name: Get droplets
       uri:
         url: "https://api.digitalocean.com/v2/droplets?tag_name=Environment:Algo"
         method: GET
@@ -85,13 +86,13 @@
           Authorization: "Bearer {{ do_token }}"
       register: do_droplets
 
-- name: Ensure the group digitalocean exists in the dynamic inventory file
+    - name: Ensure the group digitalocean exists in the dynamic inventory file
       lineinfile:
         state: present
         dest: configs/inventory.dynamic
         line: '[digitalocean]'
 
-- name: Populate the dynamic inventory
+    - name: Populate the dynamic inventory
       lineinfile:
         state: present
         dest: configs/inventory.dynamic
@@ -100,3 +101,8 @@
         line: "{{ item.networks.v4[0].ip_address }}"
       with_items:
         - "{{ do_droplets.json.droplets }}"
+  rescue:
+    - debug: var=fail_hint
+      tags: always
+    - fail:
+      tags: always

roles/cloud-ec2/tasks/main.yml

@@ -1,9 +1,10 @@
-- set_fact:
+- block:
+    - set_fact:
         access_key: "{{ aws_access_key | default(lookup('env','AWS_ACCESS_KEY_ID'), true) }}"
         secret_key: "{{ aws_secret_key | default(lookup('env','AWS_SECRET_ACCESS_KEY'), true) }}"
         stack_name: "{{ aws_server_name | replace('.', '-') }}"
 
-- name: Locate official AMI for region
+    - name: Locate official AMI for region
       ec2_ami_find:
         aws_access_key: "{{ access_key }}"
         aws_secret_key: "{{ secret_key }}"
@@ -15,15 +16,15 @@
         region: "{{ region }}"
       register: ami_search
 
-- set_fact:
+    - set_fact:
         ami_image: "{{ ami_search.results[0].ami_id }}"
 
-- include: encrypt_image.yml
+    - include: encrypt_image.yml
       tags: [encrypted]
 
-- include: cloudformation.yml
+    - include: cloudformation.yml
 
-- name: Add new instance to host group
+    - name: Add new instance to host group
       add_host:
         hostname: "{{ stack.stack_outputs.PublicIP }}"
         groupname: vpn-host
@@ -33,10 +34,10 @@
         cloud_provider: ec2
         ipv6_support: yes
 
-- set_fact:
+    - set_fact:
         cloud_instance_ip: "{{ stack.stack_outputs.PublicIP }}"
 
-- name: Get EC2 instances
+    - name: Get EC2 instances
       ec2_remote_facts:
         aws_access_key: "{{ access_key }}"
         aws_secret_key: "{{ secret_key }}"
@@ -46,13 +47,13 @@
           "tag:Environment": Algo
       register: algo_instances
 
-- name: Ensure the group ec2 exists in the dynamic inventory file
+    - name: Ensure the group ec2 exists in the dynamic inventory file
       lineinfile:
         state: present
         dest: configs/inventory.dynamic
         line: '[ec2]'
 
-- name: Populate the dynamic inventory
+    - name: Populate the dynamic inventory
       lineinfile:
         state: present
         dest: configs/inventory.dynamic
@@ -61,3 +62,8 @@
         line: "{{ item.public_ip_address }}"
       with_items:
         - "{{ algo_instances.instances }}"
+  rescue:
+    - debug: var=fail_hint
+      tags: always
+    - fail:
+      tags: always

roles/cloud-gce/tasks/main.yml

@@ -1,15 +1,16 @@
-- set_fact:
+- block:
+    - set_fact:
         credentials_file_path: "{{ credentials_file | default(lookup('env','GCE_CREDENTIALS_FILE_PATH'), true) }}"
         ssh_public_key_lookup: "{{ lookup('file', '{{ SSH_keys.public }}') }}"
 
-- set_fact:
+    - set_fact:
         credentials_file_lookup: "{{ lookup('file', '{{ credentials_file_path }}') }}"
 
-- set_fact:
+    - set_fact:
         service_account_email: "{{ credentials_file_lookup.client_email | default(lookup('env','GCE_EMAIL')) }}"
         project_id: "{{ credentials_file_lookup.project_id | default(lookup('env','GCE_PROJECT')) }}"
 
-- name: "Creating a new instance..."
+    - name: "Creating a new instance..."
       gce:
         instance_names: "{{ server_name }}"
         zone: "{{ zone }}"
@@ -24,7 +25,7 @@
           - "environment-algo"
       register: google_vm
 
-- name: Add the instance to an inventory group
+    - name: Add the instance to an inventory group
       add_host:
         name: "{{ google_vm.instance_data[0].public_ip }}"
         groups: vpn-host
@@ -34,7 +35,7 @@
         cloud_provider: gce
         ipv6_support: no
 
-- name: Firewall configured
+    - name: Firewall configured
       local_action:
         module: gce_net
         name: "{{ google_vm.instance_data[0].network }}"
@@ -46,19 +47,24 @@
         credentials_file: "{{ credentials_file  }}"
         project_id: "{{ credentials_file_lookup.project_id }}"
 
-- set_fact:
+    - set_fact:
         cloud_instance_ip: "{{ google_vm.instance_data[0].public_ip }}"
 
-- name: Ensure the group gce exists in the dynamic inventory file
+    - name: Ensure the group gce exists in the dynamic inventory file
       lineinfile:
         state: present
         dest: configs/inventory.dynamic
         line: '[gce]'
 
-- name: Populate the dynamic inventory
+    - name: Populate the dynamic inventory
       lineinfile:
         state: present
         dest: configs/inventory.dynamic
         insertafter: '\[gce\]'
         regexp: "^{{ google_vm.instance_data[0].public_ip }}.*"
         line: "{{ google_vm.instance_data[0].public_ip }}"
+  rescue:
+    - debug: var=fail_hint
+      tags: always
+    - fail:
+      tags: always

roles/common/tasks/main.yml

@@ -1,28 +1,28 @@
 ---
-
+- block:
-- name: Gather Facts
+    - include: ubuntu.yml
-  setup:
-  tags:
-    - always
-
-- include: ubuntu.yml
       when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
 
-- include: freebsd.yml
+    - include: freebsd.yml
       when: ansible_distribution == 'FreeBSD'
 
-- name: Install tools
+    - name: Install tools
       package: name="{{ item }}" state=present
       with_items:
         - "{{ tools|default([]) }}"
       tags:
         - always
 
-- name: Sysctl tuning
+    - name: Sysctl tuning
       sysctl: name="{{ item.item }}" value="{{ item.value }}"
       with_items:
         - "{{ sysctl|default([]) }}"
       tags:
         - always
 
-- meta: flush_handlers
+    - meta: flush_handlers
+  rescue:
+    - debug: var=fail_hint
+      tags: always
+    - fail:
+      tags: always

roles/dns_adblocking/tasks/main.yml

@@ -1,29 +1,29 @@
 ---
-
+- block:
-- name: Dnsmasq installed
+    - name: Dnsmasq installed
       package: name=dnsmasq
 
-- name: Ensure that the dnsmasq user exist
+    - name: Ensure that the dnsmasq user exist
       user: name=dnsmasq groups=nogroup append=yes state=present
 
-- name: The dnsmasq directory created
+    - name: The dnsmasq directory created
       file: dest=/var/lib/dnsmasq state=directory mode=0755 owner=dnsmasq group=nogroup
 
-- include: ubuntu.yml
+    - include: ubuntu.yml
       when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
 
-- include: freebsd.yml
+    - include: freebsd.yml
       when: ansible_distribution == 'FreeBSD'
 
-- name: Dnsmasq configured
+    - name: Dnsmasq configured
       template: src=dnsmasq.conf.j2 dest="{{ config_prefix|default('/') }}etc/dnsmasq.conf"
       notify:
         - restart dnsmasq
 
-- name: Adblock script created
+    - name: Adblock script created
       template: src=adblock.sh dest=/usr/local/sbin/adblock.sh owner=root group="{{ root_group|default('root') }}" mode=0755
 
-- name: Adblock script added to cron
+    - name: Adblock script added to cron
       cron:
         name: Adblock hosts update
         minute: 10
@@ -31,11 +31,16 @@
         job: /usr/local/sbin/adblock.sh
         user: dnsmasq
 
-- name: Update adblock hosts
+    - name: Update adblock hosts
       shell: >
         sudo -u dnsmasq "/usr/local/sbin/adblock.sh"
 
-- meta: flush_handlers
+    - meta: flush_handlers
 
-- name: Dnsmasq enabled and started
+    - name: Dnsmasq enabled and started
       service: name=dnsmasq state=started enabled=yes
+  rescue:
+    - debug: var=fail_hint
+      tags: always
+    - fail:
+      tags: always

roles/local/tasks/main.yml

@@ -1,4 +1,6 @@
-- name: Add the instance to an inventory group
+---
+- block:
+    - name: Add the instance to an inventory group
       add_host:
         name: "{{ server_ip }}"
         groups: vpn-host
@@ -7,7 +9,7 @@
         cloud_provider: local
       when: server_ip != "localhost"
 
-- name: Add the instance to an inventory group
+    - name: Add the instance to an inventory group
       add_host:
         name: "{{ server_ip }}"
         groups: vpn-host
@@ -17,19 +19,24 @@
         cloud_provider: local
       when: server_ip == "localhost"
 
-- set_fact:
+    - set_fact:
         cloud_instance_ip: "{{ server_ip }}"
 
-- name: Ensure the group local exists in the dynamic inventory file
+    - name: Ensure the group local exists in the dynamic inventory file
       lineinfile:
         state: present
         dest: configs/inventory.dynamic
         line: '[local]'
 
-- name: Populate the dynamic inventory
+    - name: Populate the dynamic inventory
       lineinfile:
         state: present
         dest: configs/inventory.dynamic
         insertafter: '\[local\]'
         regexp: "^{{ server_ip }}.*"
         line: "{{ server_ip }}"
+  rescue:
+    - debug: var=fail_hint
+      tags: always
+    - fail:
+      tags: always

roles/security/tasks/main.yml

@@ -1,17 +1,17 @@
 ---
-
+- block:
-- name: Install tools
+    - name: Install tools
       apt: name="{{ item }}" state=latest
       with_items:
         - unattended-upgrades
 
-- name: Configure unattended-upgrades
+    - name: Configure unattended-upgrades
       template: src=50unattended-upgrades.j2 dest=/etc/apt/apt.conf.d/50unattended-upgrades owner=root group=root mode=0644
 
-- name: Periodic upgrades configured
+    - name: Periodic upgrades configured
       template: src=10periodic.j2 dest=/etc/apt/apt.conf.d/10periodic owner=root group=root mode=0644
 
-- name: Find directories for minimizing access
+    - name: Find directories for minimizing access
       stat:
         path: "{{ item }}"
       register: minimize_access_directories
@@ -23,36 +23,36 @@
         - '/sbin'
         - '/bin'
 
-- name: Minimize access
+    - name: Minimize access
       file: path='{{ item.stat.path }}' mode='go-w' recurse=yes
       when: item.stat.isdir
       with_items: "{{ minimize_access_directories.results }}"
       no_log: True
 
-- name: Change shadow ownership to root and mode to 0600
+    - name: Change shadow ownership to root and mode to 0600
       file: dest='/etc/shadow' owner=root group=root mode=0600
 
-- name: change su-binary to only be accessible to user and group root
+    - name: change su-binary to only be accessible to user and group root
       file: dest='/bin/su' owner=root group=root mode=0750
 
-- name: Collect Use of privileged commands
+    - name: Collect Use of privileged commands
       shell: >
         /usr/bin/find {/usr/local/sbin,/usr/local/bin,/sbin,/bin,/usr/sbin,/usr/bin} -xdev \( -perm -4000 -o -perm -2000 \) -type f | awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged" }'
       args:
         executable: /bin/bash
       register: privileged_programs
 
-# Core dumps
+    # Core dumps
 
-- name: Restrict core dumps (with PAM)
+    - name: Restrict core dumps (with PAM)
       lineinfile: dest=/etc/security/limits.conf line="* hard core 0" state=present
 
-- name: Restrict core dumps (with sysctl)
+    - name: Restrict core dumps (with sysctl)
       sysctl: name=fs.suid_dumpable value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
 
-# Kernel fixes
+    # Kernel fixes
 
-- name: Disable Source Routed Packet Acceptance
+    - name: Disable Source Routed Packet Acceptance
       sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
       with_items:
         - net.ipv4.conf.all.accept_source_route
@@ -60,13 +60,13 @@
       notify:
         - flush routing cache
 
-- name: Disable ICMP Redirect Acceptance
+    - name: Disable ICMP Redirect Acceptance
       sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
       with_items:
         - net.ipv4.conf.all.accept_redirects
         - net.ipv4.conf.default.accept_redirects
 
-- name: Disable Secure ICMP Redirect Acceptance
+    - name: Disable Secure ICMP Redirect Acceptance
       sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
       with_items:
         - net.ipv4.conf.all.secure_redirects
@@ -74,12 +74,12 @@
       notify:
         - flush routing cache
 
-- name: Enable Bad Error Message Protection
+    - name: Enable Bad Error Message Protection
       sysctl: name=net.ipv4.icmp_ignore_bogus_error_responses value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present
       notify:
         - flush routing cache
 
-- name: Enable RFC-recommended Source Route Validation
+    - name: Enable RFC-recommended Source Route Validation
       sysctl: name="{{item}}" value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present
       with_items:
         - net.ipv4.conf.all.rp_filter
@@ -87,10 +87,15 @@
       notify:
         - flush routing cache
 
-- name: Do not send ICMP redirects (we are not a router)
+    - name: Do not send ICMP redirects (we are not a router)
       sysctl: name=net.ipv4.conf.all.send_redirects value=0
 
-- name: SSH config
+    - name: SSH config
       template: src=sshd_config.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0644
       notify:
         - restart ssh
+  rescue:
+    - debug: var=fail_hint
+      tags: always
+    - fail:
+      tags: always

roles/ssh_tunneling/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
-
+- block:
-- name: Ensure that the sshd_config file has desired options
+    - name: Ensure that the sshd_config file has desired options
       blockinfile:
         dest: /etc/ssh/sshd_config
         marker: '# {mark} ANSIBLE MANAGED BLOCK ssh_tunneling_role'
@@ -14,13 +14,13 @@
       notify:
         - restart ssh
 
-- name: Ensure that the algo group exist
+    - name: Ensure that the algo group exist
       group: name=algo state=present
 
-- name: Ensure that the jail directory exist
+    - name: Ensure that the jail directory exist
       file: path=/var/jail/ state=directory mode=0755 owner=root group="{{ root_group|default('root') }}"
 
-- name: Ensure that the SSH users exist
+    - name: Ensure that the SSH users exist
       user:
         name: "{{ item }}"
         groups: algo
@@ -36,7 +36,7 @@
         append: yes
       with_items: "{{ users }}"
 
-- name: The authorized keys file created
+    - name: The authorized keys file created
       file:
         src: '/var/jail/{{ item }}/.ssh/id_ecdsa.pub'
         dest: '/var/jail/{{ item }}/.ssh/authorized_keys'
@@ -45,28 +45,28 @@
         state: link
       with_items: "{{ users }}"
 
-- name: Generate SSH fingerprints
+    - name: Generate SSH fingerprints
       shell: >
         ssh-keyscan {{ IP_subject_alt_name }} 2>/dev/null
       register: ssh_fingerprints
 
-- name: Fetch users SSH private keys
+    - name: Fetch users SSH private keys
       fetch: src='/var/jail/{{ item }}/.ssh/id_ecdsa' dest=configs/{{ IP_subject_alt_name }}/{{ item }}.ssh.pem flat=yes
       with_items: "{{ users }}"
 
-- name: Change mode for SSH private keys
+    - name: Change mode for SSH private keys
       local_action: file path=configs/{{ IP_subject_alt_name }}/{{ item }}.ssh.pem mode=0600
       with_items: "{{ users }}"
       become: false
 
-- name: Fetch the known_hosts file
+    - name: Fetch the known_hosts file
       local_action:
         module: template
         src: known_hosts.j2
         dest: configs/{{ IP_subject_alt_name }}/known_hosts
       become: no
 
-- name: Build the client ssh config
+    - name: Build the client ssh config
       local_action:
         module: template
         src: ssh_config.j2
@@ -75,3 +75,8 @@
       become: no
       with_items:
         - "{{ users }}"
+  rescue:
+    - debug: var=fail_hint
+      tags: always
+    - fail:
+      tags: always

roles/vpn/tasks/main.yml

@@ -1,31 +1,36 @@
 ---
-
+- block:
-- name: Ensure that the strongswan group exist
+    - name: Ensure that the strongswan group exist
       group: name=strongswan state=present
 
-- name: Ensure that the strongswan user exist
+    - name: Ensure that the strongswan user exist
       user: name=strongswan group=strongswan state=present
 
-- include: ubuntu.yml
+    - include: ubuntu.yml
       when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
 
-- include: freebsd.yml
+    - include: freebsd.yml
       when: ansible_distribution == 'FreeBSD'
 
-- name: Install strongSwan
+    - name: Install strongSwan
       package: name=strongswan state=present
 
-- name: Get StrongSwan versions
+    - name: Get StrongSwan versions
       shell: >
         ipsec --versioncode | grep -oE "^U([0-9]*|\.)*" | sed "s/^U\|\.//g"
       register: strongswan_version
 
-- include: ipec_configuration.yml
+    - include: ipec_configuration.yml
-- include: openssl.yml
+    - include: openssl.yml
-- include: distribute_keys.yml
+    - include: distribute_keys.yml
-- include: client_configs.yml
+    - include: client_configs.yml
 
-- meta: flush_handlers
+    - meta: flush_handlers
 
-- name: strongSwan started
+    - name: strongSwan started
       service: name=strongswan state=started
+  rescue:
+    - debug: var=fail_hint
+      tags: always
+    - fail:
+      tags: always

users.yml

@@ -6,6 +6,7 @@
     - config.cfg
 
   tasks:
+    - block:
         - name: Add the server to the vpn-host group
           add_host:
             hostname: "{{ server_ip }}"
@@ -27,6 +28,11 @@
             timeout: 320
             state: present
           become: false
+      rescue:
+        - debug: var=fail_hint
+          tags: always
+        - fail:
+          tags: always
 
 - name: User management
   hosts: vpn-host
@@ -37,14 +43,20 @@
     - roles/vpn/defaults/main.yml
 
   pre_tasks:
+    - block:
         - name: Common pre-tasks
           include: playbooks/common.yml
+      rescue:
+        - debug: var=fail_hint
+          tags: always
+        - fail:
+          tags: always
 
   roles:
     - { role: ssh_tunneling, tags: [ 'ssh_tunneling' ], when: ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "y" }
 
   tasks:
-
+    - block:
         - name: Gather Facts
           setup:
 
@@ -195,13 +207,24 @@
             force: yes
           when: item not in users and ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "y"
           with_items: "{{ valid_users.stdout_lines | default('null') }}"
+      rescue:
+        - debug: var=fail_hint
+          tags: always
+        - fail:
+          tags: always
 
   post_tasks:
+    - block:
         - debug:
             msg:
               - "{{ congrats.common.split('\n') }}"
               - "    {{ congrats.p12_pass }}"
           tags: always
+      rescue:
+        - debug: var=fail_hint
+          tags: always
+        - fail:
+          tags: always
 
   handlers:
     - name: rereadcrls