* chore: Conservative dependency updates for security
- Update Ansible from 9.1.0 to 9.2.0 (one minor version bump only)
- Update Jinja2 to ~3.1.6 to fix CVE-2025-27516 (critical security fix)
- Pin netaddr to 1.3.0 (current stable version)
This is a minimal, conservative update focused on:
1. Critical security fix for Jinja2
2. Minor ansible update for bug fixes
3. Pinning netaddr to prevent surprises
No changes to Ansible collections - keeping them unpinned for now.
* fix: Address linter issues (ruff, yamllint, shellcheck)
- Fixed ruff configuration by moving linter settings to [tool.ruff.lint] section
- Fixed ruff code issues:
- Moved imports to top of files (E402)
- Removed unused variables or commented them out
- Updated string formatting from % to .format()
- Replaced dict() calls with literals
- Fixed assert False usage in tests
- Fixed yamllint issues:
- Added missing newlines at end of files
- Removed trailing spaces
- Added document start markers (---) to YAML files
- Fixed 'on:' truthy warnings in GitHub workflows
- Fixed shellcheck issues:
- Properly quoted variables in shell scripts
- Fixed A && B || C pattern with proper if/then/else
- Improved FreeBSD rc script quoting
All linters now pass without errors related to our code changes.
* fix: Additional yamllint fixes for GitHub workflows
- Added document start markers (---) to test-effectiveness.yml
- Fixed 'on:' truthy warning by quoting as 'on:'
- Removed trailing spaces from main.yml
- Added missing newline at end of test-effectiveness.yml
* fix: Add IPv6 support for WireGuard endpoint addresses
Fixes issue where IPv6 addresses in WireGuard configuration files were
not properly formatted with square brackets when used with port numbers.
The WireGuard client configuration template now detects IPv6 addresses
using the ansible.utils.ipv6 filter and wraps them in brackets as required
by the WireGuard configuration format.
Example outputs:
- IPv4: 192.168.1.1:51820
- IPv6: [2600:3c01::f03c:91ff:fedf:3b2a]:51820
- Hostname: vpn.example.com:51820
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: Correct Azure requirements file path to fix deployment failures
The previous fix in commit 7acdca0 updated to Azure collection v3.7.0 but
referenced the incorrect requirements file name. The file is now called
requirements.txt instead of requirements-azure.txt in v3.7.0.
This fixes the Azure deployment failure where pip cannot find the
requirements file, preventing users from deploying VPN servers on Azure.
Also added no_log: true to prevent potential credential leakage during
the pip installation process.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: resolve AWS CloudFormation linter warnings (#14294)
This commit addresses all the CloudFormation linting issues identified in issue #14294:
- Remove unused PublicSSHKeyParameter from CloudFormation template and task parameters
The SSH public key is now injected directly via cloud-init template instead of
being passed as a CloudFormation parameter
- Update ImageIdParameter type from String to AWS::EC2::Image::Id for better type safety
- Remove obsolete DependsOn attributes that are automatically enforced by CloudFormation
through Ref and GetAtt functions
All changes verified with cfn-lint which now passes without warnings.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: Replace ansible.utils.ipv6 filter with simple colon detection
The ansible.utils.ipv6 filter is not available in the test environment,
causing the Smart Test Selection workflow to fail. This change replaces
it with a simple string check for colons (':') which reliably detects
IPv6 addresses since they contain colons while IPv4 addresses do not.
The fix maintains the same functionality:
- IPv6 addresses: [2600:3c01::f03c:91ff:fedf:3b2a]:51820
- IPv4 addresses: 192.168.1.1:51820
This resolves the failing workflow tests in PR #14782.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* adding preshared key generation
* adding preshared folder
* Update client.conf.j2
adding preshared key options
* adding preshared keys to server template
* making sure private preshared is right
* making sure preshared keygen working for main.yml
* changing private to preshared for name
* changing to preshared dir instead of public
* generate service IPs dynamically
* update cloud-init tests
* exclude ipsec and wireguard ranges from the random service ip
* Update docs
* @davidemyers: update wireguard docs for linux
* Move to netaddr filter
* AllowedIPs fix
* WireGuard IPs fix
<!--- Provide a general summary of your changes in the Title above -->
## Description
Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes#1330 and closes#1162
Configures Ansible to use python3 on the server side. Closes#1024
Removes unneeded playbooks, reorganises a lot of variables
Reorganises the `config` folder. Closes#1330
<details><summary>Here is how the config directory looks like now</summary>
<p>
```
configs/X.X.X.X/
|-- ipsec
| |-- apple
| | |-- desktop.mobileconfig
| | |-- laptop.mobileconfig
| | `-- phone.mobileconfig
| |-- manual
| | |-- cacert.pem
| | |-- desktop.p12
| | |-- desktop.ssh.pem
| | |-- ipsec_desktop.conf
| | |-- ipsec_desktop.secrets
| | |-- ipsec_laptop.conf
| | |-- ipsec_laptop.secrets
| | |-- ipsec_phone.conf
| | |-- ipsec_phone.secrets
| | |-- laptop.p12
| | |-- laptop.ssh.pem
| | |-- phone.p12
| | `-- phone.ssh.pem
| `-- windows
| |-- desktop.ps1
| |-- laptop.ps1
| `-- phone.ps1
|-- ssh-tunnel
| |-- desktop.pem
| |-- desktop.pub
| |-- laptop.pem
| |-- laptop.pub
| |-- phone.pem
| |-- phone.pub
| `-- ssh_config
`-- wireguard
|-- desktop.conf
|-- desktop.png
|-- laptop.conf
|-- laptop.png
|-- phone.conf
`-- phone.png
```
</p>
</details>
## Motivation and Context
This refactoring is focused to aim to the 1.0 release
## How Has This Been Tested?
Deployed to several cloud providers with various options enabled and disabled
## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] Refactoring
## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
- [x] I have read the **CONTRIBUTING** document.
- [x] My code follows the code style of this project.
- [x] My change requires a change to the documentation.
- [x] I have updated the documentation accordingly.
- [x] All new and existing tests passed.
* Refactoring, booleans declaration and update users fix
* Make server_name more FQDN compatible
* Rename variables
* Define the default value for store_cakey
* Skip a prompt about the SSH user if deploying to localhost
* Disable reboot for non-cloud deployments
* Enable EC2 volume encryption by default
* Add default server value (localhost) for the local installation
Delete empty files
* Add default region to aws_region_facts
* Update docs
* EC2 credentials fix
* Warnings fix
* Update deploy-from-ansible.md
* Fix a typo
* Remove lightsail from the docs
* Disable EC2 encryption by default
* rename droplet to server
* Disable dependencies
* Disable tls_cipher_suite
* Convert wifi-exclude to a string. Update-users fix
* SSH access congrats fix
* 16.04 > 18.04
* Dont ask for the credentials if specified in the environment vars
* GCE server name fix
- Adds an extra line after the if statement. Jinja2 trims such blocks by default in Ansible. Fixes#965
- More appropriate way to configure DNS servers
- Removes `DNS` option from the wireguard server config
- Fixes dnscrypt-proxy restart
