How do I prevent ansible templates from being confused by the content they receive?

Question

I am using ansible to provision wordpress installs, and to do so I have a template for the wp-config.php.

My wp-config.php.j2 template has a substitution for the keys and salts, it looks like this

{{ wordpress_keys.content }}

the wordpress_keys comes from a task, which looks like this:

- name: retrieve new wordpress keys and salts
  uri:
    url: "https://api.wordpress.org/secret-key/1.1/salt/"
    method: GET
    return_content: yes
  register: wordpress_keys

The problem is that sometimes the keys and salts have 'special' characters in them, like <>, {}, etc. and this seems to be causing ansible to generate an error like this:

fatal: [ddc-wpchange2.ddc.prod] => {'msg': "AnsibleError: Failed to template define('AUTH_KEY',
'1=MFI*+!d^1/y;}za6$Qfw4vo{bv!gV?lmX ?^P h/5L?szDv &V<~in+.~^oOdCFpyt]Tu8FSmGE}@||,Pe(:(1%CjjAwhq{Gi#j- ');\ndefine('LOGGED_IN_KEY',
'BJ6c9#/XDBVDB-8Q+ctK9DLZiKUzPYbM&aMlO!.v7COPb8=[9HdU&Y7%SzE{&xh');\ndefine('NONCE_KEY', '.xB:3|/#|^2*JMh6+t$Ek:DG+wEqyO4:QZmMo}g|MeZi~LrvNpJ-z(8/S ,P.,N');\ndefine('AUTH_SALT', '-pzZ6 l40^8++a@t_sldj_CK{{V%]u-#cK44dAig%v<');\ndefine('SECURE_AUTH_SALT', '?ONdE{--{6CQT_Jrn0N4xHhI|}Rz2y1cc9Cj22XOkITU|)BJm@BgPd5.lPW-?e;');\ndefine('LOGGED_IN_SALT', 'O_Q7}Q.fx,Gt#0m30-@$k +~>dSk k6gz/I+>$k~h9)<6(M~F+}UFU: 'y+zF= o1:>p1S:2FB6)e~vO_#[-i1ur}V?y$>EOyF;{lkU8Y;y0Znt');\n: template error while templating string: unexpected ']'", 'failed': True}

The error does not happen all the time, only when some special chars are present.

My question is... How can I just substitute in the results from the request, without having this happen? Is there some sort of escaping or quoting that would work?

Thanks,
John

score 5 · Answer 1 · answered May 08 '15 at 19:32

Escaping certain characters is going to be difficult, because not only would the uri module need to support that, but the templating engine engine would have to unescape as well.

Instead, here's a workaround:

Modify the task so the content is saved to a file instead of a variable:

- name: retrieve new wordpress keys and salts
  uri:
    url: "https://api.wordpress.org/secret-key/1.1/salt/"
    method: GET
    dest: wp_keys.php
    return_content: yes

Then add a line to your wp-config.php.j2 template that includes wp_keys.php.

score 2 · Accepted Answer · answered May 16 '15 at 18:27

So I ended up abandoning the template solution. Instead I used wp-cli to generate the wp-config.php file for me. I only did this because the template solution would randomly fail to work with the template getting confused by the content it was receiving.

How do I prevent ansible templates from being confused by the content they receive?

2 Answers2