* Fix DigitalOcean cloud-init compatibility issue causing SSH timeout on port 4160
This commit addresses the issue described in GitHub issue #14800 where DigitalOcean
deployments fail during the "Wait until SSH becomes ready..." step due to cloud-init
not processing the write_files directive correctly.
## Problem
- DigitalOcean's cloud-init shows "Unhandled non-multipart (text/x-not-multipart) userdata" warning
- write_files module gets skipped, leaving SSH on default port 22 instead of port 4160
- Algo deployment times out when trying to connect to port 4160
## Solution
Added proactive detection and remediation to the DigitalOcean role:
1. Check if SSH is listening on the expected port (4160) after droplet creation
2. If not, automatically apply the SSH configuration manually via SSH on port 22
3. Verify SSH is now listening on the correct port before proceeding
## Changes
- Added SSH port check with 30-second timeout
- Added fallback remediation block that:
- Connects via SSH on port 22 to apply Algo's SSH configuration
- Backs up the original sshd_config
- Applies the correct SSH settings (port 4160, security hardening)
- Restarts the SSH service
- Verifies the fix worked
This ensures DigitalOcean deployments succeed even when cloud-init fails to process
the user_data correctly, maintaining backward compatibility and reliability.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Implement cleaner fix for DigitalOcean cloud-init encoding issue
This replaces the previous workaround with two targeted fixes that address
the root cause of the "Unhandled non-multipart (text/x-not-multipart) userdata"
issue that prevents write_files from being processed.
## Root Cause
Cloud-init receives user_data as binary/bytes instead of UTF-8 string,
causing it to fail parsing and skip the write_files directive that
configures SSH on port 4160.
## Cleaner Solutions Implemented
### Fix 1: String Encoding (user_data | string)
- Added explicit string conversion to user_data template lookup
- Ensures DigitalOcean API receives proper UTF-8 string, not bytes
- Minimal change with maximum compatibility
### Fix 2: Use runcmd Instead of write_files
- Replaced write_files approach with runcmd shell commands
- Bypasses the cloud-init parsing issue entirely
- More reliable as it executes direct shell commands
- Includes automatic SSH config backup for safety
## Changes Made
- `roles/cloud-digitalocean/tasks/main.yml`: Added | string filter to user_data
- `files/cloud-init/base.yml`: Replaced write_files with runcmd approach
- Removed complex SSH detection/remediation workaround (no longer needed)
## Benefits
- ✅ Fixes root cause instead of working around symptoms
- ✅ Much simpler and more maintainable code
- ✅ Backward compatible - no API changes required
- ✅ Handles both potential failure modes (encoding + parsing)
- ✅ All tests pass, linters clean
This should resolve DigitalOcean SSH timeout issues while being much
cleaner than the previous workaround approach.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix cloud-init header format for DigitalOcean compatibility
The space in '# cloud-config' (introduced in PR #14775) breaks cloud-init
YAML parsing on DigitalOcean, causing SSH configuration to be skipped.
Cloud-init documentation requires '#cloud-config' without a space.
Fixes#14800🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Revert to write_files approach for SSH configuration
Using write_files is more maintainable and Ansible-native than runcmd.
The root cause was the cloud-config header format, not write_files itself.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix Ansible deprecation and variable warnings
- Replace deprecated network filters with ansible.utils equivalents:
- ipaddr → ansible.utils.ipaddr
- ipmath → ansible.utils.ipmath
- ipv4 → ansible.utils.ipv4
- ipv6 → ansible.utils.ipv6
- next_nth_usable → ansible.utils.next_nth_usable
- Fix reserved variable name: no_log → algo_no_log
- Fix SSH user groups warning by explicitly specifying groups parameter
Addresses deprecation warnings that would become errors after 2024-01-01.
All linter checks pass with only cosmetic warnings remaining.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add comprehensive protection for cloud-config header format
- Add inline documentation explaining critical #cloud-config format requirement
- Exclude files/cloud-init/ from yamllint and ansible-lint to prevent automatic 'fixes'
- Create detailed README.md documenting the issue and protection measures
- Reference GitHub issue #14800 for future maintainers
This prevents regression of the critical cloud-init header format that
causes deployment failures when changed from '#cloud-config' to '# cloud-config'.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add test for cloud-init header format to prevent regression
This test ensures the cloud-init header remains exactly ''#cloud-config''
without a space. The regression in PR #14775 that added a space broke
DigitalOcean deployments by causing cloud-init YAML parsing to fail,
resulting in SSH timeouts on port 4160.
Co-authored-by: Dan Guido <dguido@users.noreply.github.com>
* Refactor SSH config template and fix MOTD task permissions
- Use dedicated sshd_config template instead of inline content
- Add explicit become: true to MOTD task to fix permissions warning
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix no_log variable references after renaming to algo_no_log
Update all remaining references from old 'no_log' variable to 'algo_no_log'
in WireGuard, SSH tunneling, and StrongSwan roles. This fixes deployment
failures caused by undefined variable references.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: Correct YAML indentation in cloud-init template for DigitalOcean
The indent filter was not indenting the first line of the sshd_config content,
causing invalid YAML structure that cloud-init couldn't parse. This resulted
in SSH timeouts during deployment as the port was never changed from 22 to 4160.
- Add first=True parameter to indent filter to ensure all lines are indented
- Remove extra indentation in base template to prevent double-indentation
- Add comprehensive test suite to validate template rendering and prevent regressions
Fixes deployment failures where cloud-init would show:
"Invalid format at line X: expected <block end>, but found '<scalar>'"
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Dan Guido <dguido@users.noreply.github.com>
* fix: Remove POSIX-incompatible 'local' keyword from install.sh
The install.sh script uses #\!/usr/bin/env sh (POSIX shell) but was using
the 'local' keyword in the tryGetMetadata function, which is a bash-specific
feature. This caused shellcheck to fail with SC3043 warnings in CI.
Fixed by removing 'local' keywords from variable declarations in the
tryGetMetadata function. The variables are still function-scoped in practice
since they're assigned at the beginning of the function.
This resolves the CI failure introduced in PR #14788 (run #919).
* ci: Make ansible-lint stricter and fix basic issues
- Remove || true from ansible-lint CI job to enforce linting
- Enable name[play] rule - all plays should be named
- Enable yaml[new-line-at-end-of-file] rule
- Move name[missing] from skip_list to warn_list (first step)
- Add names to plays in main.yml and users.yml
- Document future linting improvements in comments
This makes the CI stricter while fixing the easy issues first.
More comprehensive fixes for the 113 name[missing] warnings can
be addressed in future PRs.
* fix: Add name[missing] to skip_list temporarily
The ansible-lint CI is failing because name[missing] was not properly
added to skip_list. This causes 113 name[missing] errors to fail the CI.
Adding it to skip_list for now to fix the CI. The rule can be moved to
warn_list and eventually enabled once all tasks are properly named in
future PRs.
* fix: Fix ansible-lint critical errors
- Fix schema[tasks] error in roles/local/tasks/prompts.yml by removing with_items loop
- Add missing newline at end of requirements.yml
- Replace ignore_errors with failed_when in reboot task
- Add pipefail to shell command with pipes in strongswan openssl task
These fixes address all critical ansible-lint errors that were causing CI failures.
* use password module to generate password
* fix variable reference
* reduce character set to meet origin design
* CA and p12 password chanes
- Move the CA_password generation task to the native lookup plugin
- Get rid of unneeded tasks
* Keep custom dnscrypt-proxy conffile when upgrading
* Unattended upgrade tuning
- Upgrade the 50unattended-upgrades file with latest options
- Keep the common unattended upgrade options in one file
- Enable removing of unused kernels and dependencies to save some space
With preexisting wait_for implementation, deployment to Ubuntu on Lightsail failed with a connection reset error on this task. It appears that Ansible’s wait_for_connection is the recommended way. I have successfully gotten past this task after this change, however I’d appreciate more eyes on this.
* generate service IPs dynamically
* update cloud-init tests
* exclude ipsec and wireguard ranges from the random service ip
* Update docs
* @davidemyers: update wireguard docs for linux
* Move to netaddr filter
* AllowedIPs fix
* WireGuard IPs fix
<!--- Provide a general summary of your changes in the Title above -->
## Description
Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes#1330 and closes#1162
Configures Ansible to use python3 on the server side. Closes#1024
Removes unneeded playbooks, reorganises a lot of variables
Reorganises the `config` folder. Closes#1330
<details><summary>Here is how the config directory looks like now</summary>
<p>
```
configs/X.X.X.X/
|-- ipsec
| |-- apple
| | |-- desktop.mobileconfig
| | |-- laptop.mobileconfig
| | `-- phone.mobileconfig
| |-- manual
| | |-- cacert.pem
| | |-- desktop.p12
| | |-- desktop.ssh.pem
| | |-- ipsec_desktop.conf
| | |-- ipsec_desktop.secrets
| | |-- ipsec_laptop.conf
| | |-- ipsec_laptop.secrets
| | |-- ipsec_phone.conf
| | |-- ipsec_phone.secrets
| | |-- laptop.p12
| | |-- laptop.ssh.pem
| | |-- phone.p12
| | `-- phone.ssh.pem
| `-- windows
| |-- desktop.ps1
| |-- laptop.ps1
| `-- phone.ps1
|-- ssh-tunnel
| |-- desktop.pem
| |-- desktop.pub
| |-- laptop.pem
| |-- laptop.pub
| |-- phone.pem
| |-- phone.pub
| `-- ssh_config
`-- wireguard
|-- desktop.conf
|-- desktop.png
|-- laptop.conf
|-- laptop.png
|-- phone.conf
`-- phone.png
```
</p>
</details>
## Motivation and Context
This refactoring is focused to aim to the 1.0 release
## How Has This Been Tested?
Deployed to several cloud providers with various options enabled and disabled
## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] Refactoring
## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
- [x] I have read the **CONTRIBUTING** document.
- [x] My code follows the code style of this project.
- [x] My change requires a change to the documentation.
- [x] I have updated the documentation accordingly.
- [x] All new and existing tests passed.
* Refactoring, booleans declaration and update users fix
* Make server_name more FQDN compatible
* Rename variables
* Define the default value for store_cakey
* Skip a prompt about the SSH user if deploying to localhost
* Disable reboot for non-cloud deployments
* Enable EC2 volume encryption by default
* Add default server value (localhost) for the local installation
Delete empty files
* Add default region to aws_region_facts
* Update docs
* EC2 credentials fix
* Warnings fix
* Update deploy-from-ansible.md
* Fix a typo
* Remove lightsail from the docs
* Disable EC2 encryption by default
* rename droplet to server
* Disable dependencies
* Disable tls_cipher_suite
* Convert wifi-exclude to a string. Update-users fix
* SSH access congrats fix
* 16.04 > 18.04
* Dont ask for the credentials if specified in the environment vars
* GCE server name fix
- Adds an extra line after the if statement. Jinja2 trims such blocks by default in Ansible. Fixes#965
- More appropriate way to configure DNS servers
- Removes `DNS` option from the wireguard server config
- Fixes dnscrypt-proxy restart
* Move to ansible-2.4.3
* Add Lightsail support #623
* Fixing the EC2 deployment
* Scaleway integration #623
* OpenStack cloud provider (DreamCompute optimised) #623
* Remove the security role
* Enable unattended-upgrades for clouds
* New requirements to make Azure and GCE work
If the common playbook is invoked with the "cloud" tag, non-cloud
tasks will be skipped. On GCE this causes "Install tools" to be skipped,
apparmor-utils is not installed, and then the "Enforcing ipsec with
apparmor" step fails.
