nik/homelab
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: ensure boolean evaluation for pia_force_reregister and pia_force_key_rotation in registration conditions
Some checks failed
validate / lint (push) Failing after 2s
Details

Browse Source
This commit is contained in:
Nik Afiq 2026-08-25 20:59:40 +09:00
parent 2e64687bb9
commit e757850c3b
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
ansible/roles/pia-gateway/tasks/register.yaml
View File

@ -73,7 +73,16 @@
register: pia_wg_conf_stat register: pia_wg_conf_stat
- name: PIA registration - name: PIA registration
when: pia_force_reregister or pia_force_key_rotation or not pia_wg_conf_stat.stat.exists # | bool on both flags: -e pia_force_reregister=true (the plain
# key=value CLI form this role's own README documents) sets the var as
# a STRING "true", not a real boolean — recent ansible-core versions
# reject using a string directly in a `when:` boolean expression
# ("Conditional result (True) was derived from value of type 'str'"),
# confirmed live (2026-08-25) against the exact documented invocation.
# | bool coerces either a real bool (the defaults/main.yaml default,
# unaffected either way) or a "true"/"false" string (the CLI-override
# case) into an actual boolean, so both invocation styles work.
when: (pia_force_reregister | bool) or (pia_force_key_rotation | bool) or not pia_wg_conf_stat.stat.exists
block: block:
- name: Ensure WireGuard config directory exists - name: Ensure WireGuard config directory exists
ansible.builtin.file: ansible.builtin.file:
@ -85,7 +94,7 @@
- name: Determine which private key path this run will use - name: Determine which private key path this run will use
ansible.builtin.set_fact: ansible.builtin.set_fact:
pia_active_key_path: "{{ (pia_wg_config_dir + '/' + pia_wg_interface + '.key.new') if pia_force_key_rotation else (pia_wg_config_dir + '/' + pia_wg_interface + '.key') }}" pia_active_key_path: "{{ (pia_wg_config_dir + '/' + pia_wg_interface + '.key.new') if (pia_force_key_rotation | bool) else (pia_wg_config_dir + '/' + pia_wg_interface + '.key') }}"
# Rotation stages the new key at a separate *.key.new path and only # Rotation stages the new key at a separate *.key.new path and only
# promotes it (see the "Promote the rotated key" block at the end # promotes it (see the "Promote the rotated key" block at the end
# of this file) after PIA has accepted it AND the new config has # of this file) after PIA has accepted it AND the new config has
@ -353,7 +362,7 @@
# either. # either.
- name: Promote the rotated key now that registration and config write both succeeded - name: Promote the rotated key now that registration and config write both succeeded
when: pia_force_key_rotation when: pia_force_key_rotation | bool
block: block:
- name: Check whether a previous key exists to back up - name: Check whether a previous key exists to back up
ansible.builtin.stat: ansible.builtin.stat: