{"action":"created","issue":{"url":"https://api.github.com/repos/trailofbits/algo/issues/976","repository_url":"https://api.github.com/repos/trailofbits/algo","labels_url":"https://api.github.com/repos/trailofbits/algo/issues/976/labels{/name}","comments_url":"https://api.github.com/repos/trailofbits/algo/issues/976/comments","events_url":"https://api.github.com/repos/trailofbits/algo/issues/976/events","html_url":"https://github.com/trailofbits/algo/pull/976","id":327821983,"node_id":"MDExOlB1bGxSZXF1ZXN0MTkxNTIyNDM5","number":976,"title":"Large refactor to support Ansible 2.5","user":{"login":"jackivanov","id":17044561,"node_id":"MDQ6VXNlcjE3MDQ0NTYx","avatar_url":"https://avatars0.githubusercontent.com/u/17044561?v=4","gravatar_id":"","url":"https://api.github.com/users/jackivanov","html_url":"https://github.com/jackivanov","followers_url":"https://api.github.com/users/jackivanov/followers","following_url":"https://api.github.com/users/jackivanov/following{/other_user}","gists_url":"https://api.github.com/users/jackivanov/gists{/gist_id}","starred_url":"https://api.github.com/users/jackivanov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jackivanov/subscriptions","organizations_url":"https://api.github.com/users/jackivanov/orgs","repos_url":"https://api.github.com/users/jackivanov/repos","events_url":"https://api.github.com/users/jackivanov/events{/privacy}","received_events_url":"https://api.github.com/users/jackivanov/received_events","type":"User","site_admin":false},"labels":[{"id":577201176,"node_id":"MDU6TGFiZWw1NzcyMDExNzY=","url":"https://api.github.com/repos/trailofbits/algo/labels/needs_tests","name":"needs_tests","color":"5319e7","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":45,"created_at":"2018-05-30T17:13:01Z","updated_at":"2018-07-07T12:43:17Z","closed_at":null,"author_association":"COLLABORATOR","pull_request":{"url":"https://api.github.com/repos/trailofbits/algo/pulls/976","html_url":"https://github.com/trailofbits/algo/pull/976","diff_url":"https://github.com/trailofbits/algo/pull/976.diff","patch_url":"https://github.com/trailofbits/algo/pull/976.patch"},"body":"The huge update is coming. We need people to get it tested and reviewed. It remains a Work-in-Progress.\r\n\r\n### Under the hood Ansible fixes\r\n- Upgrade to Ansible 2.5\r\n- Removes unneeded libraries that been merged to the Ansible upstream\r\n- Generate the ssh key with `openssl_` native modules\r\n- Organize how facts are gathered and rid of unneeded playbooks\r\n- Use proper boolean variable declarations\r\n- Deprecate tags usage and move to the extra variables schema. Described [here](https://github.com/trailofbits/algo/blob/495bcf941e7edd0dddb7e392a9c6768ca3497fde/docs/deploy-from-ansible.md) (Fixes #933)\r\n- Rename the main playbook to `main.yml` and split it into 3 parts: `input.yml`, `cloud.yml` and `server.yml`\r\n- Removes prompts in the `algo` script and moves them to `input.yml` and particular roles (Fixes #942 and Fixes #833)\r\n- Travis-CI only performs tests via Docker\r\n\r\n### Cloud provider fixes\r\n- Add a new cloud provider - Vultr (Fixes #623)\r\n- Enables EC2 volume encryption by default (Fixes #989)\r\n- Determine available regions for cloud providers at runtime (except Azure) (Fixes #941)\r\n\r\n### Usability fixes\r\n- Adds more compatible server name (Reference #987)\r\n- Readme and documentation fixes\r\n- Dump all the config options used into `configs/$server_ip/config.yml`\r\n- Simplifies the update-users script to only ask for the CA password and the server IP. All the other options are taken from the new configuration dump (Fixes #885)\r\n\r\n### Changes to the server\r\n- Remove FreeBSD kernel rebuild since it is not required in FreeBSD 11+\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/trailofbits/algo/issues/comments/403213235","html_url":"https://github.com/trailofbits/algo/pull/976#issuecomment-403213235","issue_url":"https://api.github.com/repos/trailofbits/algo/issues/976","id":403213235,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMzIxMzIzNQ==","user":{"login":"davidemyers","id":26753976,"node_id":"MDQ6VXNlcjI2NzUzOTc2","avatar_url":"https://avatars2.githubusercontent.com/u/26753976?v=4","gravatar_id":"","url":"https://api.github.com/users/davidemyers","html_url":"https://github.com/davidemyers","followers_url":"https://api.github.com/users/davidemyers/followers","following_url":"https://api.github.com/users/davidemyers/following{/other_user}","gists_url":"https://api.github.com/users/davidemyers/gists{/gist_id}","starred_url":"https://api.github.com/users/davidemyers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidemyers/subscriptions","organizations_url":"https://api.github.com/users/davidemyers/orgs","repos_url":"https://api.github.com/users/davidemyers/repos","events_url":"https://api.github.com/users/davidemyers/events{/privacy}","received_events_url":"https://api.github.com/users/davidemyers/received_events","type":"User","site_admin":false},"created_at":"2018-07-07T12:43:17Z","updated_at":"2018-07-07T12:43:17Z","author_association":"NONE","body":"I believe I've recreated the issue @digeratus is seeing. I deployed by running `./algo` with an unchanged `config.cfg` and the options @digeratus mentioned previously.\r\n\r\nOnce the installation completes `dnscrypt-proxy` can't start because the listening address isn't getting assigned to the loopback device:\r\n```\r\nJul 07 12:06:27 vpn5 dnscrypt-proxy[14636]: listen udp 172.16.0.1:53: bind: cannot assign requested address\r\n```\r\n```\r\n# ip addr show dev lo\r\n1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000\r\n    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00\r\n    inet 127.0.0.1/8 scope host lo\r\n       valid_lft forever preferred_lft forever\r\n    inet6 ::1/128 scope host\r\n       valid_lft forever preferred_lft forever\r\n```\r\nThe file `/etc/systemd/network/10-algo-lo100.network` is present.\r\n\r\nAfter rebooting the listening address is present but `dnscrypt-proxy` still won't start:\r\n\r\n```\r\nJul 07 12:19:47 vpn5 audit[652]: AVC apparmor=\"STATUS\" operation=\"profile_load\" profile=\"unconfined\" name=\"/usr/sbin/dnscrypt-proxy\" pid=652 comm=\"apparmor_parser\"\r\nJul 07 12:19:51 vpn5 systemd[1]: dnscrypt-proxy.socket: TCP_DEFER_ACCEPT failed: Protocol not available\r\nJul 07 12:19:51 vpn5 systemd[1]: dnscrypt-proxy.socket: TCP_NODELAY failed: Protocol not available\r\nJul 07 12:19:51 vpn5 dnscrypt-proxy[868]: TLS handshake failure - Try changing or deleting the tls_cipher_suite value in the configuration file\r\nJul 07 12:20:23 vpn5 dnscrypt-proxy[868]: Unable to use source [public-resolvers]: [Get https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)]\r\nJul 07 12:20:23 vpn5 dnscrypt-proxy[868]: No servers configured\r\nJul 07 12:20:23 vpn5 systemd[1]: dnscrypt-proxy.service: Main process exited, code=exited, status=255/n/a\r\nJul 07 12:20:23 vpn5 systemd[1]: dnscrypt-proxy.service: Failed with result 'exit-code'.\r\n```\r\nBut it works after restarting it manually:\r\n```\r\nJul 07 12:28:52 vpn5 dnscrypt-proxy[1165]: TLS handshake failure - Try changing or deleting the tls_cipher_suite value in the configuration file\r\nJul 07 12:28:53 vpn5 dnscrypt-proxy[1165]: /etc/dnscrypt-proxy/public-resolvers.md: open sf-v6wp33pakb3ncbjt.tmp: read-only file system\r\nJul 07 12:28:53 vpn5 dnscrypt-proxy[1165]: /etc/dnscrypt-proxy/public-resolvers.md.minisig: open sf-efdyqwaelsy67k6t.tmp: read-only file system\r\nJul 07 12:28:53 vpn5 dnscrypt-proxy[1165]: Source [public-resolvers.md] loaded\r\nJul 07 12:28:53 vpn5 dnscrypt-proxy[1165]: dnscrypt-proxy 2.0.15\r\nJul 07 12:28:53 vpn5 dnscrypt-proxy[1165]: Now listening to 172.16.0.1:53 [UDP]\r\nJul 07 12:28:53 vpn5 dnscrypt-proxy[1165]: Now listening to 172.16.0.1:53 [TCP]\r\nJul 07 12:28:53 vpn5 dnscrypt-proxy[1165]: Wiring systemd TCP socket #0\r\nJul 07 12:28:53 vpn5 dnscrypt-proxy[1165]: [cloudflare] OK (DoH) - rtt: 4ms\r\nJul 07 12:28:53 vpn5 dnscrypt-proxy[1165]: [cloudflare-ipv6] OK (DoH) - rtt: 2ms\r\nJul 07 12:28:53 vpn5 dnscrypt-proxy[1165]: Server with the lowest initial latency: cloudflare-ipv6 (rtt: 2ms)\r\nJul 07 12:28:53 vpn5 dnscrypt-proxy[1165]: dnscrypt-proxy is ready - live servers: 2\r\n```\r\n"}}
{"actor":{"display_login":"davidemyers"}}