trailofbits/algo

Allow disabling IPv6 when creating new Algo servers

quinncomendant opened this issue · 1 comments

Is your feature request related to a problem? Please describe.
It can be convenient to have only an IPv4 address assigned to a server, with no IPv6 address:

  • Example 1: if you create a server in Hetzner's USA locations (ash and hil), the IPv6 address assigned will be geolocated in Germany. This is annoying because when connected to a USA VPN, websites will automatically use the German language. It doesn't seem to be possible to get an IPv6 address geolocated to the USA with Hetzner.
  • Example 2: It is useful to have a consistent, single IP address when reviewing server logs or adding an IP address to an ACL allow list on 3rd-party services. Having both IPv4 and IPv6 addresses mean two addresses must be considered.

Describe the solution you'd like
I would like an Algo config option to disable creation of IPv6 addresses.

For example, adding ipv6_support: false to the config.cfg file or running algo via ansible-playbook main.yml -e "ipv6_support=false"

Describe alternatives you've considered
I've tried the above config options, but they don't work because ipv6_support is overridden in roles/common/tasks/facts.yml:

- name: Set IPv6 support as a fact
  set_fact:
    ipv6_support: "{% if ansible_default_ipv6['gateway'] is defined %}true{% else %}false{% endif %}"
  tags: always

It does work if I edit this file to the following:

- name: Set IPv6 support as a fact
  set_fact:
    ipv6_support: false
  tags: always

Using this, creating a server does correctly exclude IPv6 configurations. Although, an additional option for Hetzner servers must be used to avoid creating an IPv6 address (the equivilent hcloud argument is --without-ipv6; I'm not sure what the equivalent is for the hcloud ansible role).

Thanks!

Also would like to request this feature as a large number of web sites are not able to be accessed through ipv6 yet