fix: generate VPN passwords without pwgen, set EDITOR=nano

Use Ansible password lookup on the control node so install works before packages are installed on VPS and without pwgen on macOS. Export EDITOR=nano in Makefile for vault-edit.

Co-authored-by: Cursor <cursoragent@cursor.com>

Makefile

@@ -5,6 +5,8 @@
 SHELL := /bin/bash
 .DEFAULT_GOAL := help
 
+export EDITOR="nano"
+
 ANSIBLE         ?= ansible-playbook
 ANSIBLE_ADHOC   ?= ansible
 INVENTORY       ?= inventory/hosts.yml

README.md

@@ -198,7 +198,7 @@ hysteria2_user_passwords:
   friend: "custom-password"
 ```
 
-3. **Автогенерация** — `pwgen -s 40`, если пароль не задан.
+3. **Автогенерация** — Ansible `password` lookup (длина `hysteria2_password_length`), если пароль не задан.
 
 При `make update` пароли подтягиваются из `output/<server>/server-info.yml`, если не указаны в vault/inventory.
 

group_vars/all.yml.example

@@ -2,7 +2,7 @@
 # Email для Let's Encrypt (ACME)
 hysteria2_acme_email: admin@example.com
 
-# Длина автогенерируемых паролей (pwgen)
+# Длина автогенерируемых паролей VPN-пользователей
 hysteria2_password_length: 40
 
 # Обновлять систему перед установкой (apt update && apt upgrade)

roles/hysteria2/defaults/main.yml

@@ -9,7 +9,7 @@ hysteria2_acme_email: ""
 hysteria2_users: []
 
 # Опционально: фиксированные пароли { username: password }
-# Пустое значение или отсутствие ключа — автогенерация через pwgen
+# Пустое значение или отсутствие ключа — автогенерация на control node (Ansible password lookup)
 
 hysteria2_password_length: 40
 hysteria2_listen_port: 443

roles/hysteria2/tasks/install.yml

@@ -11,7 +11,7 @@
       ansible.builtin.apt:
         upgrade: dist
 
-- name: Install curl, micro, pwgen and qrencode
+- name: Install curl, micro and qrencode
   ansible.builtin.apt:
     name: "{{ _hysteria2_apt_packages }}"
     state: present
@@ -19,7 +19,7 @@
   vars:
     _hysteria2_apt_packages: >-
       {{
-        ['curl', 'micro', 'pwgen']
+        ['curl', 'micro']
         + (['qrencode'] if hysteria2_generate_qr_png | bool else [])
       }}
 

roles/hysteria2/tasks/users.yml

@@ -60,16 +60,24 @@
     - update
     - export
 
-- name: Generate missing user passwords with pwgen
-  ansible.builtin.command:
-    cmd: "pwgen -s {{ hysteria2_password_length }} 1"
-  register: _hysteria2_pwgen
-  changed_when: false
-  when: item.password | length == 0
+- name: Generate missing user passwords
+  ansible.builtin.set_fact:
+    _hysteria2_users_with_passwords: "{{ _hysteria2_users_with_passwords | default([]) + [ _entry ] }}"
+  vars:
+    _entry:
+      name: "{{ item.name }}"
+      password: >-
+        {{
+          lookup(
+            'password',
+            '/dev/null chars=ascii_letters,digits length=' ~ (hysteria2_password_length | string)
+          )
+          if item.password | length == 0
+          else item.password
+        }}
   loop: "{{ hysteria2_resolved_users }}"
   loop_control:
     label: "{{ item.name }}"
-    index_var: _hysteria2_user_idx
   tags:
     - install
     - update
@@ -77,25 +85,7 @@
 
 - name: Apply generated passwords
   ansible.builtin.set_fact:
-    hysteria2_resolved_users: "{{ hysteria2_resolved_users | default([]) + [ _entry ] }}"
-  vars:
-    _generated: >-
-      {{
-        _hysteria2_pwgen.results[_hysteria2_user_idx].stdout | default('')
-        if (
-          item.password | length == 0
-          and not (_hysteria2_pwgen.results[_hysteria2_user_idx].skipped | default(false))
-        )
-        else item.password
-      }}
-    _entry:
-      name: "{{ item.name }}"
-      password: "{{ _generated }}"
-  loop: "{{ hysteria2_resolved_users }}"
-  loop_control:
-    label: "{{ item.name }}"
-    index_var: _hysteria2_user_idx
-  when: _hysteria2_pwgen is defined
+    hysteria2_resolved_users: "{{ _hysteria2_users_with_passwords }}"
   tags:
     - install
     - update