Localhost deployment fails on Aliyun

[nickolasclarke]

Expected behavior:

edit: going to put all the issues I found with deploying to aliyun in here:

1. streisand_ipv4_address should be set to the external IP
2. ss config.json should be owned by root:nogroup instead of root:root
3. unattended-upgrades service starts automatically.
4. openVPN firewall service starts automatically.
5. ss-server starts automatically.

Actual Behavior:

1. streisand_ipv4_address gets set to instance's internal IP when deploying with localhost playbook on aliyun, which causes most services to break.
2. SS config.json is owned by root:root
3. unattended-upgrades service does not start
4. openVPN firewall service does not start
5. using the external ip in config.json does not bind properly and ss-server fails to start.

Solutions:

1. allow user to spec the external IP in a prompt, otherwise continue to do our best effort to get the IP.
2. change ownership to root:nogroup
3. ?
4. ?
5. use '0.0.0.0' as the server address in the config.json.

Additional Details:

Log output from Ansible or other relevant services (link to Gist for longer output):

1. SS config:

 systemd[1]: Started Shadowsocks-libev Default Server Service.
-- Subject: Unit shadowsocks-libev.service has finished start-up
-- Defined-By: systemd
-- Unit shadowsocks-libev.service has finished starting up.
--
-- The start-up result is done.
ss-server[16718]:  2017-08-19 11:29:44 ERROR: Invalid config path.
systemd[1]: shadowsocks-libev.service: Main process exited, code=exited, status=255/n/a
systemd[1]: shadowsocks-libev.service: Unit entered failed state.
systemd[1]: shadowsocks-libev.service: Failed with result 'exit-code'.

Target Cloud Provider: Aliyun

Operating System of target host: Ubuntu 16.04

[nickolasclarke]

currently we try our darnedest to figure out what the external IP is in the localhost.yml and detect-provider.yml playbooks. We have workarounds for AWS and GCE. Aliyun is similar to those platforms. Since Aliyun is not currently a supported platform, and this could possibly be an issue on other providers, I wonder if it would be best to simply prompt for an external IP when the localhost deployment is selected, and try our best otherwise if that is not filled.

thoughts? Is there a more elegant way to get at a WAN IP that would be more universal than what we have already?

[cpu]

Could you just set streisand_ipv4_address as an inventory host var?

[nickolasclarke]

@cpu yes, I could. Short of manually editing the file, I'd like to add a conditional prompt for that. At first I thought this should be an env var that is consumed by a playbook later to set streisand_ipv4_address, but then I thought it may be more appropriate to add a vars_prompt to playbooks/localhost.yml.

In this I'll:

1. prompt for the user to set streisand_ipv4_address if they want to. This would go above the tasks block. I'd need to make it conditional in case the provider-detect.yml successfully set streisand_ipv4_address Otherwise, it should prompt.
2. then make the tasks block conditional that tries to set streisand_ipv4_address with ansible_default_ipv4.address if the above approaches do not set the var.

Does that approach make sense?

[cpu]

It seems like there are all sorts of problems here unique to Aliyun. I'm still expressing an opinion that we should be extremely selective in what new code we add to Streisand and another provider is a big commitment, especially if it appears to be all sorts of non-standard.

change ownership to root:nogroup

The shadowsocks role already does this. Can you determine why it didn't work on Aliyun but works elsewhere?

[nickolasclarke]

@cpu yeah, I agree. I'm not interested in making any code changes that are specific to aliyun, but rather make changes that would potentially apply to all non-standard deployments.

[cpu]

Makes sense! Improvements in that department would be great. Thanks for clarifying!