Fix Ansible 12 double-templating and Jinja2 spacing issues

dguido · claude · dguido · commit cb4620d8a44d · 2025-09-15T09:47:39.000-04:00
This PR fixes critical deployment issues and improves code consistency for Ansible 12 compatibility. ## Fixed Issues ### 1. Double-templating bug (Issue #14835) Fixed 7 instances of invalid double-templating that breaks deployments: - Changed `{{ lookup('file', '{{ var }}') }}` to `{{ lookup('file', var) }}` - Affects Azure, DigitalOcean, GCE, Linode, and IPsec configurations - Added comprehensive test to prevent regression ### 2. Jinja2 spacing inconsistencies Fixed 33+ spacing issues for better code quality: - Removed spaces between Jinja2 blocks: `}} {%` → `}}{%` - Fixed operator spacing: `int -1` → `int - 1` - Fixed filter spacing: `|b64encode` → `| b64encode` - Consolidated multiline expressions to single lines ### 3. Test suite improvements Enhanced boolean type checking test to be more targeted: - Excludes external dependencies and CloudFormation templates - Only tests Algo's actual codebase - Verified with mutation testing - Added comprehensive documentation ## Testing - All 87 unit tests pass - 0 Jinja2 spacing issues remaining (verified by ansible-lint) - Ansible syntax checks pass for all playbooks - Mutation testing confirms tests catch real issues 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
diff --git a/files/cloud-init/base.yml b/files/cloud-init/base.yml
@@ -30,7 +30,7 @@ users:
     shell: /bin/bash
     lock_passwd: true
     ssh_authorized_keys:
-      - "{{ lookup('file', '{{ SSH_keys.public }}') }}"
+      - "{{ lookup('file', SSH_keys.public) }}"
 
 write_files:
   - path: /etc/ssh/sshd_config
diff --git a/input.yml b/input.yml
@@ -109,35 +109,22 @@
         - name: Set facts based on the input
           set_fact:
             algo_server_name: >-
-              {% if server_name is defined %}{% set _server = server_name %}
-              {%- elif _algo_server_name.user_input is defined and _algo_server_name.user_input | length > 0 -%}
+              {% if server_name is defined %}{% set _server = server_name %}{%- elif _algo_server_name.user_input is defined and _algo_server_name.user_input | length > 0 -%}
               {%- set _server = _algo_server_name.user_input -%}
               {%- else %}{% set _server = defaults['server_name'] %}{% endif -%}
-              {{ _server | regex_replace('(?!\.)(\W | _)', '-') }}
+              {{ _server | regex_replace('(?!\.)(\W|_)', '-') }}
             algo_ondemand_cellular: >-
-              {% if ondemand_cellular is defined %}{{ ondemand_cellular | bool }}
-              {%- elif _ondemand_cellular.user_input is defined %}{{ booleans_map[_ondemand_cellular.user_input] | default(defaults['ondemand_cellular']) }}
-              {%- else %}{{ false }}{% endif %}
+              {% if ondemand_cellular is defined %}{{ ondemand_cellular | bool }}{%- elif _ondemand_cellular.user_input is defined %}{{ booleans_map[_ondemand_cellular.user_input] | default(defaults['ondemand_cellular']) }}{%- else %}{{ false }}{% endif %}
             algo_ondemand_wifi: >-
-              {% if ondemand_wifi is defined %}{{ ondemand_wifi | bool }}
-              {%- elif _ondemand_wifi.user_input is defined %}{{ booleans_map[_ondemand_wifi.user_input] | default(defaults['ondemand_wifi']) }}
-              {%- else %}{{ false }}{% endif %}
+              {% if ondemand_wifi is defined %}{{ ondemand_wifi | bool }}{%- elif _ondemand_wifi.user_input is defined %}{{ booleans_map[_ondemand_wifi.user_input] | default(defaults['ondemand_wifi']) }}{%- else %}{{ false }}{% endif %}
             algo_ondemand_wifi_exclude: >-
-              {% if ondemand_wifi_exclude is defined %}{{ ondemand_wifi_exclude | b64encode }}
-              {%- elif _ondemand_wifi_exclude.user_input is defined and _ondemand_wifi_exclude.user_input | length > 0 -%}
-              {{ _ondemand_wifi_exclude.user_input | b64encode }}
-              {%- else %}{{ '_null' | b64encode }}{% endif %}
+              {% if ondemand_wifi_exclude is defined %}{{ ondemand_wifi_exclude | b64encode }}{%- elif _ondemand_wifi_exclude.user_input is defined and _ondemand_wifi_exclude.user_input | length > 0 -%}
+              {{ _ondemand_wifi_exclude.user_input | b64encode }}{%- else %}{{ '_null' | b64encode }}{% endif %}
             algo_dns_adblocking: >-
-              {% if dns_adblocking is defined %}{{ dns_adblocking | bool }}
-              {%- elif _dns_adblocking.user_input is defined %}{{ booleans_map[_dns_adblocking.user_input] | default(defaults['dns_adblocking']) }}
-              {%- else %}{{ false }}{% endif %}
+              {% if dns_adblocking is defined %}{{ dns_adblocking | bool }}{%- elif _dns_adblocking.user_input is defined %}{{ booleans_map[_dns_adblocking.user_input] | default(defaults['dns_adblocking']) }}{%- else %}{{ false }}{% endif %}
             algo_ssh_tunneling: >-
-              {% if ssh_tunneling is defined %}{{ ssh_tunneling | bool }}
-              {%- elif _ssh_tunneling.user_input is defined %}{{ booleans_map[_ssh_tunneling.user_input] | default(defaults['ssh_tunneling']) }}
-              {%- else %}{{ false }}{% endif %}
+              {% if ssh_tunneling is defined %}{{ ssh_tunneling | bool }}{%- elif _ssh_tunneling.user_input is defined %}{{ booleans_map[_ssh_tunneling.user_input] | default(defaults['ssh_tunneling']) }}{%- else %}{{ false }}{% endif %}
             algo_store_pki: >-
-              {% if ipsec_enabled %}{%- if store_pki is defined %}{{ store_pki | bool }}
-              {%- elif _store_pki.user_input is defined  %}{{ booleans_map[_store_pki.user_input] | default(defaults['store_pki']) }}
-              {%- else %}{{ false }}{% endif %}{% endif %}
+              {% if ipsec_enabled %}{%- if store_pki is defined %}{{ store_pki | bool }}{%- elif _store_pki.user_input is defined %}{{ booleans_map[_store_pki.user_input] | default(defaults['store_pki']) }}{%- else %}{{ false }}{% endif %}{% endif %}
       rescue:
         - include_tasks: playbooks/rescue.yml
diff --git a/roles/cloud-azure/tasks/main.yml b/roles/cloud-azure/tasks/main.yml
@@ -7,9 +7,7 @@
 
 - set_fact:
     algo_region: >-
-      {% if region is defined %}{{ region }}
-      {%- elif _algo_region.user_input %}{{ azure_regions[_algo_region.user_input | int -1 ]['name'] }}
-      {%- else %}{{ azure_regions[default_region | int - 1]['name'] }}{% endif %}
+      {% if region is defined %}{{ region }}{%- elif _algo_region.user_input %}{{ azure_regions[_algo_region.user_input | int - 1]['name'] }}{%- else %}{{ azure_regions[default_region | int - 1]['name'] }}{% endif %}
 
 - name: Create AlgoVPN Server
   azure_rm_deployment:
@@ -24,7 +22,7 @@
     location: "{{ algo_region }}"
     parameters:
       sshKeyData:
-        value: "{{ lookup('file', '{{ SSH_keys.public }}') }}"
+        value: "{{ lookup('file', SSH_keys.public) }}"
       WireGuardPort:
         value: "{{ wireguard_port }}"
       vmSize:
diff --git a/roles/cloud-azure/tasks/prompts.yml b/roles/cloud-azure/tasks/prompts.yml
@@ -10,9 +10,7 @@
     - name: Set the default region
       set_fact:
         default_region: >-
-          {% for r in azure_regions %}
-          {%- if r['name'] == "eastus" %}{{ loop.index }}{% endif %}
-          {%- endfor %}
+          {% for r in azure_regions %}{%- if r['name'] == "eastus" %}{{ loop.index }}{% endif %}{%- endfor %}
 
     - pause:
         prompt: |
diff --git a/roles/cloud-cloudstack/tasks/main.yml b/roles/cloud-cloudstack/tasks/main.yml
@@ -8,9 +8,7 @@
 - block:
     - set_fact:
         algo_region: >-
-          {% if region is defined %}{{ region }}
-          {%- elif _algo_region.user_input is defined and _algo_region.user_input | length > 0 %}{{ cs_zones[_algo_region.user_input | int -1 ]['name'] }}
-          {%- else %}{{ cs_zones[default_zone | int - 1]['name'] }}{% endif %}
+          {%- if region is defined -%}{{ region }}{%- elif _algo_region.user_input is defined and _algo_region.user_input | length > 0 -%}{{ cs_zones[_algo_region.user_input | int - 1]['name'] }}{%- else -%}{{ cs_zones[default_zone | int - 1]['name'] }}{%- endif -%}
 
     - name: Security group created
       cs_securitygroup:
diff --git a/roles/cloud-cloudstack/tasks/prompts.yml b/roles/cloud-cloudstack/tasks/prompts.yml
@@ -54,8 +54,8 @@
     - name: Set the default zone
       set_fact:
         default_zone: >-
-          {% for z in cs_zones %}
-          {%- if z['name'] == "ch-gva-2" %}{{ loop.index }}{% endif %}
+          {%- for z in cs_zones -%}
+          {%- if z['name'] == "ch-gva-2" %}{{ loop.index }}{% endif -%}
           {%- endfor %}
 
     - pause:
diff --git a/roles/cloud-digitalocean/tasks/main.yml b/roles/cloud-digitalocean/tasks/main.yml
@@ -6,7 +6,7 @@
   digital_ocean_sshkey:
     oauth_token: "{{ algo_do_token }}"
     name: "{{ SSH_keys.comment }}"
-    ssh_pub_key: "{{ lookup('file', '{{ SSH_keys.public }}') }}"
+    ssh_pub_key: "{{ lookup('file', SSH_keys.public) }}"
   register: do_ssh_key
 
 - name: Creating a droplet...
diff --git a/roles/cloud-digitalocean/tasks/prompts.yml b/roles/cloud-digitalocean/tasks/prompts.yml
@@ -32,9 +32,7 @@
 - name: Set default region
   set_fact:
     default_region: >-
-      {% for r in do_regions %}
-      {%- if r['slug'] == "nyc3" %}{{ loop.index }}{% endif %}
-      {%- endfor %}
+      {% for r in do_regions %}{%- if r['slug'] == "nyc3" %}{{ loop.index }}{% endif %}{%- endfor %}
 
 - pause:
     prompt: |
@@ -51,6 +49,4 @@
 - name: Set additional facts
   set_fact:
     algo_do_region: >-
-      {% if region is defined %}{{ region }}
-      {%- elif _algo_region.user_input %}{{ do_regions[_algo_region.user_input | int -1 ]['slug'] }}
-      {%- else %}{{ do_regions[default_region | int - 1]['slug'] }}{% endif %}
+      {% if region is defined %}{{ region }}{%- elif _algo_region.user_input %}{{ do_regions[_algo_region.user_input | int - 1]['slug'] }}{%- else %}{{ do_regions[default_region | int - 1]['slug'] }}{% endif %}
diff --git a/roles/cloud-ec2/tasks/prompts.yml b/roles/cloud-ec2/tasks/prompts.yml
@@ -82,8 +82,8 @@
     - name: Set the default region
       set_fact:
         default_region: >-
-          {% for r in aws_regions %}
-          {%- if r['region_name'] == "us-east-1" %}{{ loop.index }}{% endif %}
+          {%- for r in aws_regions -%}
+          {%- if r['region_name'] == "us-east-1" %}{{ loop.index }}{% endif -%}
           {%- endfor %}
 
     - pause:
@@ -102,9 +102,7 @@
 - name: Set algo_region and stack_name facts
   set_fact:
     algo_region: >-
-      {% if region is defined %}{{ region }}
-      {%- elif _algo_region.user_input %}{{ aws_regions[_algo_region.user_input | int -1 ]['region_name'] }}
-      {%- else %}{{ aws_regions[default_region | int - 1]['region_name'] }}{% endif %}
+      {%- if region is defined -%}{{ region }}{%- elif _algo_region.user_input -%}{{ aws_regions[_algo_region.user_input | int - 1]['region_name'] }}{%- else -%}{{ aws_regions[default_region | int - 1]['region_name'] }}{%- endif -%}
     stack_name: "{{ algo_server_name | replace('.', '-') }}"
 
 - block:
@@ -131,5 +129,5 @@
       register: _use_existing_eip
 
     - set_fact:
-        existing_eip: "{{ available_eip_addresses[_use_existing_eip.user_input | int -1 ]['allocation_id'] }}"
+        existing_eip: "{{ available_eip_addresses[_use_existing_eip.user_input | int - 1]['allocation_id'] }}"
   when: cloud_providers.ec2.use_existing_eip
diff --git a/roles/cloud-gce/tasks/prompts.yml b/roles/cloud-gce/tasks/prompts.yml
@@ -13,11 +13,11 @@
     credentials_file_path: >-
       {{ gce_credentials_file | default(_gce_credentials_file.user_input|default(None)) |
          default(lookup('env', 'GCE_CREDENTIALS_FILE_PATH'), true) }}
-    ssh_public_key_lookup: "{{ lookup('file', '{{ SSH_keys.public }}') }}"
+    ssh_public_key_lookup: "{{ lookup('file', SSH_keys.public) }}"
   no_log: true
 
 - set_fact:
-    credentials_file_lookup: "{{ lookup('file', '{{ credentials_file_path }}') }}"
+    credentials_file_lookup: "{{ lookup('file', credentials_file_path) }}"
   no_log: true
 
 - set_fact:
@@ -66,7 +66,7 @@
   set_fact:
     algo_region: >-
       {% if region is defined %}{{ region }}
-      {%- elif _gce_region.user_input %}{{ gce_regions[_gce_region.user_input | int -1 ] }}
+      {%- elif _gce_region.user_input %}{{ gce_regions[_gce_region.user_input | int - 1] }}
       {%- else %}{{ gce_regions[default_region | int - 1] }}{% endif %}
 
 - name: Get zones
diff --git a/roles/cloud-hetzner/tasks/prompts.yml b/roles/cloud-hetzner/tasks/prompts.yml
@@ -26,8 +26,8 @@
 - name: Set default region
   set_fact:
     default_region: >-
-      {% for r in hcloud_regions %}
-      {%- if r['location'] == "nbg1" %}{{ loop.index }}{% endif %}
+      {%- for r in hcloud_regions -%}
+      {%- if r['location'] == "nbg1" %}{{ loop.index }}{% endif -%}
       {%- endfor %}
 
 - pause:
@@ -45,6 +45,4 @@
 - name: Set additional facts
   set_fact:
     algo_hcloud_region: >-
-      {% if region is defined %}{{ region }}
-      {%- elif _algo_region.user_input %}{{ hcloud_regions[_algo_region.user_input | int -1 ]['location'] }}
-      {%- else %}{{ hcloud_regions[default_region | int - 1]['location'] }}{% endif %}
+      {%- if region is defined -%}{{ region }}{%- elif _algo_region.user_input -%}{{ hcloud_regions[_algo_region.user_input | int - 1]['location'] }}{%- else -%}{{ hcloud_regions[default_region | int - 1]['location'] }}{%- endif -%}
diff --git a/roles/cloud-lightsail/tasks/prompts.yml b/roles/cloud-lightsail/tasks/prompts.yml
@@ -62,5 +62,5 @@
     stack_name: "{{ algo_server_name | replace('.', '-') }}"
     algo_region: >-
       {% if region is defined %}{{ region }}
-      {%- elif _algo_region.user_input %}{{ lightsail_regions[_algo_region.user_input | int -1 ]['name'] }}
+      {%- elif _algo_region.user_input %}{{ lightsail_regions[_algo_region.user_input | int - 1]['name'] }}
       {%- else %}{{ lightsail_regions[default_region | int - 1]['name'] }}{% endif %}
diff --git a/roles/cloud-linode/tasks/prompts.yml b/roles/cloud-linode/tasks/prompts.yml
@@ -28,8 +28,8 @@
 - name: Set default region
   set_fact:
     default_region: >-
-      {% for r in linode_regions %}
-      {%- if r['id'] == "us-east" %}{{ loop.index }}{% endif %}
+      {%- for r in linode_regions -%}
+      {%- if r['id'] == "us-east" %}{{ loop.index }}{% endif -%}
       {%- endfor %}
 
 - pause:
@@ -47,7 +47,5 @@
 - name: Set additional facts
   set_fact:
     algo_linode_region: >-
-      {% if region is defined %}{{ region }}
-      {%- elif _algo_region.user_input %}{{ linode_regions[_algo_region.user_input | int -1 ]['id'] }}
-      {%- else %}{{ linode_regions[default_region | int - 1]['id'] }}{% endif %}
-    public_key: "{{ lookup('file', '{{ SSH_keys.public }}') }}"
+      {%- if region is defined -%}{{ region }}{%- elif _algo_region.user_input -%}{{ linode_regions[_algo_region.user_input | int - 1]['id'] }}{%- else -%}{{ linode_regions[default_region | int - 1]['id'] }}{%- endif -%}
+    public_key: "{{ lookup('file', SSH_keys.public) }}"
diff --git a/roles/cloud-scaleway/tasks/prompts.yml b/roles/cloud-scaleway/tasks/prompts.yml
@@ -26,6 +26,6 @@
     algo_scaleway_token: "{{ scaleway_token | default(_scaleway_token.user_input) | default(lookup('env', 'SCW_TOKEN'), true) }}"
     algo_region: >-
       {% if region is defined %}{{ region }}
-      {%- elif _algo_region.user_input %}{{ scaleway_regions[_algo_region.user_input | int -1 ]['alias'] }}
+      {%- elif _algo_region.user_input %}{{ scaleway_regions[_algo_region.user_input | int - 1]['alias'] }}
       {%- else %}{{ scaleway_regions.0.alias }}{% endif %}
   no_log: true
diff --git a/roles/cloud-vultr/tasks/prompts.yml b/roles/cloud-vultr/tasks/prompts.yml
@@ -58,6 +58,4 @@
 - name: Set the desired region as a fact
   set_fact:
     algo_vultr_region: >-
-      {% if region is defined %}{{ region }}
-      {%- elif _algo_region.user_input %}{{ vultr_regions[_algo_region.user_input | int -1 ]['id'] }}
-      {%- else %}{{ vultr_regions[default_region | int - 1]['id'] }}{% endif %}
+      {%- if region is defined -%}{{ region }}{%- elif _algo_region.user_input -%}{{ vultr_regions[_algo_region.user_input | int - 1]['id'] }}{%- else -%}{{ vultr_regions[default_region | int - 1]['id'] }}{%- endif -%}
diff --git a/roles/local/tasks/prompts.yml b/roles/local/tasks/prompts.yml
@@ -20,9 +20,7 @@
 - name: Set the facts
   set_fact:
     cloud_instance_ip: >-
-      {% if server is defined %}{{ server }}
-      {%- elif _algo_server.user_input %}{{ _algo_server.user_input }}
-      {%- else %}localhost{% endif %}
+      {%- if server is defined -%}{{ server }}{%- elif _algo_server.user_input -%}{{ _algo_server.user_input }}{%- else -%}localhost{%- endif -%}
 
 - block:
     - pause:
@@ -35,9 +33,7 @@
     - name: Set the facts
       set_fact:
         ansible_ssh_user: >-
-          {% if ssh_user is defined %}{{ ssh_user }}
-          {%- elif _algo_ssh_user.user_input %}{{ _algo_ssh_user.user_input }}
-          {%- else %}root{% endif %}
+          {%- if ssh_user is defined -%}{{ ssh_user }}{%- elif _algo_ssh_user.user_input -%}{{ _algo_ssh_user.user_input }}{%- else -%}root{%- endif -%}
   when: cloud_instance_ip != "localhost"
 
 - pause:
@@ -50,6 +46,4 @@
 - name: Set the facts
   set_fact:
     IP_subject_alt_name: >-
-      {% if endpoint is defined %}{{ endpoint }}
-      {%- elif _endpoint.user_input %}{{ _endpoint.user_input }}
-      {%- else %}{{ cloud_instance_ip }}{% endif %}
+      {%- if endpoint is defined -%}{{ endpoint }}{%- elif _endpoint.user_input -%}{{ _endpoint.user_input }}{%- else -%}{{ cloud_instance_ip }}{%- endif -%}
diff --git a/roles/strongswan/defaults/main.yml b/roles/strongswan/defaults/main.yml
@@ -19,26 +19,10 @@ openssl_constraint_random_id: "{{ IP_subject_alt_name | to_uuid }}.algo"
 # Without SAN, IKEv2 connections will fail with certificate validation errors
 subjectAltName_type: "{{ 'DNS' if IP_subject_alt_name | regex_search('[a-z]') else 'IP' }}"
 subjectAltName: >-
-  {{ subjectAltName_type }}:{{ IP_subject_alt_name }}
-  {%- if ipv6_support -%},IP:{{ ansible_default_ipv6['address'] }}{%- endif -%}
+  {{ subjectAltName_type }}:{{ IP_subject_alt_name }}{%- if ipv6_support -%},IP:{{ ansible_default_ipv6['address'] }}{%- endif -%}
 subjectAltName_USER: email:{{ item }}@{{ openssl_constraint_random_id }}
 nameConstraints: >-
-  critical,permitted;{{ subjectAltName_type }}:{{ IP_subject_alt_name }}{{- '/255.255.255.255' if subjectAltName_type == 'IP' else '' -}}
-  {%- if subjectAltName_type == 'IP' -%}
-  ,permitted;DNS:{{ openssl_constraint_random_id }}
-  ,excluded;DNS:.com,excluded;DNS:.org,excluded;DNS:.net,excluded;DNS:.gov,excluded;DNS:.edu,excluded;DNS:.mil,excluded;DNS:.int
-  ,excluded;IP:10.0.0.0/255.0.0.0,excluded;IP:172.16.0.0/255.240.0.0,excluded;IP:192.168.0.0/255.255.0.0
-  {%- else -%}
-  ,excluded;IP:0.0.0.0/0.0.0.0
-  {%- endif -%}
-  ,permitted;email:{{ openssl_constraint_random_id }}
-  ,excluded;email:.com,excluded;email:.org,excluded;email:.net,excluded;email:.gov,excluded;email:.edu,excluded;email:.mil,excluded;email:.int
-  {%- if ipv6_support -%}
-  ,permitted;IP:{{ ansible_default_ipv6['address'] }}/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-  ,excluded;IP:fc00:0:0:0:0:0:0:0/fe00:0:0:0:0:0:0:0,excluded;IP:fe80:0:0:0:0:0:0:0/ffc0:0:0:0:0:0:0:0,excluded;IP:2001:db8:0:0:0:0:0:0/ffff:fff8:0:0:0:0:0:0
-  {%- else -%}
-  ,excluded;IP:::/0
-  {%- endif -%}
+  critical,permitted;{{ subjectAltName_type }}:{{ IP_subject_alt_name }}{{- '/255.255.255.255' if subjectAltName_type == 'IP' else '' -}}{%- if subjectAltName_type == 'IP' -%},permitted;DNS:{{ openssl_constraint_random_id }},excluded;DNS:.com,excluded;DNS:.org,excluded;DNS:.net,excluded;DNS:.gov,excluded;DNS:.edu,excluded;DNS:.mil,excluded;DNS:.int,excluded;IP:10.0.0.0/255.0.0.0,excluded;IP:172.16.0.0/255.240.0.0,excluded;IP:192.168.0.0/255.255.0.0{%- else -%},excluded;IP:0.0.0.0/0.0.0.0{%- endif -%},permitted;email:{{ openssl_constraint_random_id }},excluded;email:.com,excluded;email:.org,excluded;email:.net,excluded;email:.gov,excluded;email:.edu,excluded;email:.mil,excluded;email:.int{%- if ipv6_support -%},permitted;IP:{{ ansible_default_ipv6['address'] }}/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff,excluded;IP:fc00:0:0:0:0:0:0:0/fe00:0:0:0:0:0:0:0,excluded;IP:fe80:0:0:0:0:0:0:0/ffc0:0:0:0:0:0:0:0,excluded;IP:2001:db8:0:0:0:0:0:0/ffff:fff8:0:0:0:0:0:0{%- else -%},excluded;IP:::/0{%- endif -%}
 openssl_bin: openssl
 strongswan_enabled_plugins:
   - aes
diff --git a/roles/strongswan/tasks/client_configs.yml b/roles/strongswan/tasks/client_configs.yml
@@ -13,7 +13,7 @@
 
 - name: Set facts for mobileconfigs
   set_fact:
-    PayloadContentCA: "{{ lookup('file' , '{{ ipsec_pki_path }}/cacert.pem')|b64encode }}"
+    PayloadContentCA: "{{ lookup('file', ipsec_pki_path + '/cacert.pem') | b64encode }}"
 
 - name: Build the mobileconfigs
   template:
diff --git a/roles/wireguard/defaults/main.yml b/roles/wireguard/defaults/main.yml
@@ -7,15 +7,10 @@ wireguard_port_avoid: 53
 wireguard_port_actual: 51820
 keys_clean_all: false
 wireguard_dns_servers: >-
-  {% if algo_dns_adblocking | default(false) | bool or dns_encryption | default(false) | bool %}
-  {{ local_service_ip }}{{ ', ' + local_service_ipv6 if ipv6_support else '' }}
-  {% else %}
-  {% for host in dns_servers.ipv4 %}{{ host }}{% if not loop.last %},{% endif %}{% endfor %}
-  {%- if ipv6_support %},{% for host in dns_servers.ipv6 %}{{ host }}{% if not loop.last %},{% endif %}{% endfor %}{% endif %}
-  {% endif %}
+  {% if algo_dns_adblocking | default(false) | bool or dns_encryption | default(false) | bool %}{{ local_service_ip }}{{ ', ' + local_service_ipv6 if ipv6_support else '' }}{% else %}{% for host in dns_servers.ipv4 %}{{ host }}{% if not loop.last %},{% endif %}{% endfor %}{%- if ipv6_support %},{% for host in dns_servers.ipv6 %}{{ host }}{% if not loop.last %},{% endif %}{% endfor %}{% endif %}{% endif %}
 wireguard_client_ip: >-
-  {{ wireguard_network_ipv4 | ansible.utils.ipmath(index | int+2) }}
-  {{ ',' + wireguard_network_ipv6 | ansible.utils.ipmath(index | int+2) if ipv6_support else '' }}
+  {{ wireguard_network_ipv4 | ansible.utils.ipmath(index | int + 2) }}
+  {{ ',' + wireguard_network_ipv6 | ansible.utils.ipmath(index | int + 2) if ipv6_support else '' }}
 wireguard_server_ip: >-
   {{ wireguard_network_ipv4 | ansible.utils.ipaddr('1') }}
   {{ ',' + wireguard_network_ipv6 | ansible.utils.ipaddr('1') if ipv6_support else '' }}
diff --git a/server.yml b/server.yml
@@ -235,7 +235,7 @@
                   - "{{ congrats.common.split('\n') }}"
                   - "    {{ congrats.p12_pass if algo_ssh_tunneling or ipsec_enabled else '' }}"
                   - "    {{ congrats.ca_key_pass if algo_store_pki and ipsec_enabled else '' }}"
-                  - "    {{ congrats.ssh_access if algo_provider != 'local' else ''}}"
+                  - "    {{ congrats.ssh_access if algo_provider != 'local' else '' }}"
           tags: always
       rescue:
         - include_tasks: playbooks/rescue.yml
diff --git a/tests/test_bsd_ipv6.yml b/tests/test_bsd_ipv6.yml
diff --git a/tests/unit/test_comprehensive_boolean_scan.py b/tests/unit/test_comprehensive_boolean_scan.py
diff --git a/tests/unit/test_double_templating.py b/tests/unit/test_double_templating.py
diff --git a/users.yml b/users.yml
