Feat: Initial refactor for the Onionprobe Ansible role (WIP) (#1)

---

# Docker-in-Docker CI workflow.

#

# GitLab CI config adapted from

# https://ansible.readthedocs.io/projects/molecule/ci/#gitlab-ci

#

# Disabled, since Tor's GitLab don't support DinD, as of 2024-10-09:

#

# * https://gitlab.torproject.org/tpo/tpa/renovate-cron/-/issues/2

# * https://gitlab.torproject.org/tpo/core/onionmasq/-/issues/112

#

#pytest_docker:

#  stage: test

#

#  image: docker:stable-dind

#

#  services:

#    - docker:dind

#

#  before_script:

#    - apk add --no-cache

#      python3 python3-dev py3-pip gcc git curl build-base

#      autoconf automake py3-cryptography linux-headers

#      musl-dev libffi-dev openssl-dev openssh

#    - python3 -m pip install ansible molecule-plugins[docker] pytest-ansible

#    - python3 --version

#    - ansible --version

#    - molecule --version

#    - pytest --version

#    - docker info

#

#  script:

#    - pytest -k docker -r A

# Podman CI workflow

# This may also need privileged containers.

pytest_podman:

  stage: test

  before_script:

    - apt-get update

    - apt install -y sudo python3-pip ansible

    - python3 -m pip install molecule-plugins[podman] pytest-ansible --break-system-packages

    - python3 -m pip install molecule-plugins[podman] --break-system-packages

    - sudo -u podman python3 --version

    - sudo -u podman ansible --version

    - sudo -u podman molecule --version

    - sudo -u podman pytest --version

    - sudo -u podman podman info

    - sudo -u podman mkdir -p molecule/podman/roles && sudo -u podman ln -s ../../.. molecule/podman/roles/onionprobe

  script:

    #- sudo -u podman pytest -k podman -r A

    - sudo -u podman molecule test -s podman

# Run Ansible tests directly in the CI containers

#  before_script:

#    - apt-get update

#    - apt install -y python3-pip ansible

#    - python3 -m pip install molecule pytest-ansible --break-system-packages

#    - python3 -m pip install molecule --break-system-packages

#    - python3 --version

#    - ansible --version

#    - molecule --version

#    - pytest --version

#    - mkdir -p molecule/podman/roles && ln -s ../../.. molecule/podman/roles/onionprobe

#

#  script:

#    #- pytest -k local -r A

#    - molecule test -s local

This [Ansible][] role manages [Onionprobe][] installations.

By default, it sets up a [standalone monitoring node][standalone] using [Docker][]

as the container manager, but 

## Usage

Sample usage in an Ansible playbook:

```yaml

- name: Onionprobe

  hosts: myonionprober

  roles:

    - onionprobe

```

[standalone]: https://onionservices.torproject.org/apps/web/onionprobe/standalone/

## Variables

Check [defaults/main.yml](defaults/main.yml) for a commented list of variables.

---

#

# Basic

# Onionprobe Ansible role configuration

#

# Copyright (C) 2024 The Tor Project, Inc.

# SPDX-License-Identifier: GPL-3.0-or-later

#

# Control the managed node's mode of operation

onionprobe_project_name: onionprobe-monitor

onionprobe_mode: monitor

onionprobe_config_generation_script: ''

onionprobe_config: ''

onionprobe_configurator_entrypoint: ''

onionprobe_configurator_params: ''

onionprobe_container_runtime: 'docker'

# Onionprobe installation mode: controls how it's installed.

#

# Available options:

#

# 'repository': installs the needed dependencies and clone the Onionprobe repository.

#

#               * Dependencies must be available in the distribution.

#

# 'distro'    : installs Onionprobe from a package, if available in the distro.

#

#               Requirements:

#

#               * The 'onionprobe' package must be available through the system's

#                 package manager.

#

# 'pip'       : installs Onionprobe and it's dependencies using pip.

#

#               Requirements:

#

#               * Pip.

#

#               * Virtualenv.

#

onionprobe_installation: repository

# Onionprobe operation mode: specifies how it should run.

#

# Available options:

#

# Monitor mode

# 'manual'    : do not manage the way Onionprobe runs: this is left to the operator

#               to configure elsewhere.

#

# 'single'    : runs just the Onionprobe service, and nothing else.

#

#               Requirements:

#

#               * Systemd must be available in the system, and is used to

#                 manage the service.

#

# 'standalone': runs the full standalone monitoring monitoring node:

#               https://onionservices.torproject.org/apps/web/onionprobe/standalone/

#

#               Requirements:

#

#               * Variable 'onionprobe_installation' must be set to

#                 'repository', as the package usually don't ship the needed

#                 container configuration.

#

#               * Docker Compose or Podman Compose must be installed and

#                 configured.

#

#               * Systemd must be available in the system, and is used to

#                 manage the service.

#

onionprobe_operation: monitor

# Whether to automatically enable the service

onionprobe_monitor_enable_service: true

# Onionprobe Project name

#

# This is mainly used as an identifier to configure and distinguish services.

onionprobe_project_name: onionprobe

# Onionprobe virtualenv

#

# Sets virtualenv location used by the 'pip' installation method.

onionprobe_virtualenv: /usr/local/share/onionprobe

#

# User, group and folder

onionprobe_monitor_user: onionprobe-monitor

onionprobe_monitor_service: onionprobe-monitor

onionprobe_monitor_uid: 2000

onionprobe_monitor_gid: 2000

onionprobe_monitor_path: /var/lib/onionprobe-monitor

#

# Repository

onionprobe_user    : onionprobe

onionprobe_group   : onionprobe

onionprobe_uid     : 2000

onionprobe_gid     : 2000

onionprobe_path    : /var/lib/onionprobe

# Repository location

onionprobe_repo: https://gitlab.torproject.org/tpo/onion-services/onionprobe.git

# Prometheus

onionprobe_monitor_prometheus_web_external_url: 'http://localhost:9090'

# Grafana

onionprobe_monitor_grafana_database_password: unsafe-password-please-change

onionprobe_monitor_grafana_smtp_enabled: false

onionprobe_monitor_grafana_smtp_host: localhost:25

onionprobe_monitor_grafana_smtp_user: ''

onionprobe_monitor_grafana_stmp_password: ''

onionprobe_monitor_grafana_smtp_starttls_policy: ''

onionprobe_monitor_grafana_server_domain: ''

onionprobe_monitor_grafana_server_root_url: ''

onionprobe_monitor_grafana_plugins_enable_alpha: false

# Alertmanager

onionprobe_monitor_alertmanager_template: alertmanager/alertmanager.yml.j2

onionprobe_monitor_smtp_smarthost: mail.example.org:587

onionprobe_monitor_smtp_email: changeme@example.org

onionprobe_monitor_smtp_username: changeme

onionprobe_monitor_smtp_auth_password: changeme

onionprobe_monitor_altermanager_default_recipient_email: changeme@example.org

#

# Service

#

# Service name

onionprobe_service : onionprobe

# Whether to automatically enable the service

#

# Systemd might not be available in some testing environments, where makes

# sense to keep the service disabled.

onionprobe_enable_service: true

#

# Onionprobe configuration file relative to the computed configuration path

#

# This is path is computed depending on the installation mode:

#

# 'distro'    : config path is set to /etc/onionprobe

# 'pip'       : config path is set to /var/lib/onionprobe/configs

# 'repository': config path is set to the value of onionprobe_path

#

# Examples:

#

#   # For repository installation, will look after

#   # {{ onionprobe_path }}/configs/tor.yaml

#   onionprobe_config: 'configs/tor.yaml'

#

#   # For repository installation, will look after

#   # {{ onionprobe_path }}/contrib/configs/myconfig.yaml

#   onionprobe_config: 'contrib/configs/myconfig.yaml'

#

#   # For pip and distro installation, will look after either

#   # {{ onionprobe_path }}/configs/myconfig.yaml or /etc/onionprobe/myconfig.yaml

#   onionprobe_config: 'myconfig.yaml'

#

onionprobe_config: 'configs/tor.yaml'

# Path for a config generation script relative to the computed configuration path

#

# This is path is computed with the same logic for the onionprobe_config parameter

#

onionprobe_config_generation_script : ''

# Daemon options no specified in the Onionprobe configuration

onionprobe_daemon_opts: ''

#

# Standalone monitor mode options

#

# The container runtime to use

#

# Note that this role won't manage the container runtime installation.

# That needs to be done elsewhere.

#

onionprobe_container_runtime: 'docker'

# Configurator container parameters

onionprobe_configurator_entrypoint  : ''

onionprobe_configurator_params      : ''

# Prometheus options as documented at

# https://prometheus.io/docs/prometheus/latest/command-line/prometheus/

onionprobe_prometheus_web_external_url: 'http://localhost:9090'

# Alertmanager options as documented at

# https://prometheus.io/docs/alerting/latest/configuration/

onionprobe_alertmanager_template                : alertmanager/alertmanager.yml.j2

onionprobe_smtp_smarthost                       : mail.example.org:587

onionprobe_smtp_email                           : changeme@example.org

onionprobe_smtp_username                        : changeme

onionprobe_smtp_auth_password                   : changeme

onionprobe_altermanager_default_recipient_email : changeme@example.org

# Grafana configuration

onionprobe_grafana_database_password: unsafe-password-please-change

# Grafana options as documented at

# https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/

onionprobe_grafana_smtp_enabled         : false

onionprobe_grafana_smtp_host            : localhost:25

onionprobe_grafana_smtp_user            : ''

onionprobe_grafana_stmp_password        : ''

onionprobe_grafana_smtp_starttls_policy : ''

onionprobe_grafana_server_domain        : ''

onionprobe_grafana_server_root_url      : ''

onionprobe_grafana_plugins_enable_alpha : false

---

#

# Onionprobe handlers

#

# Copyright (C) 2024 The Tor Project, Inc.

# SPDX-License-Identifier: GPL-3.0-or-later

#

- name: Restart the Onionprobe service

  ansible.builtin.systemd:

    name: "{{ onionprobe_service }}"

    enabled: yes

    daemon_reload: yes

    state: restarted

---

- name: Converge

#

# Onionprobe Ansible role test playbook

#

# Copyright (C) 2024 The Tor Project, Inc.

# SPDX-License-Identifier: GPL-3.0-or-later

#

- name: Standalone, full monitor operation mode

  hosts: all

  # Gathering facts requires a container with Python installed

  gather_facts: true

  vars:

    # Test the monitoring mode

    onionprobe_operation: monitor

    # Configure Podman as the container runtime

    onionprobe_container_runtime: 'podman'

    onionprobe_container_runtime: podman

    # Do not enable the service, since the image is not started with systemd as PID 1

    onionprobe_enable_service: false

  pre_tasks:

    # Sudo is needed by some Ansible modules, and may not be available in the

    # container instance

    - name: Install sudo

      ansible.builtin.package:

        name: sudo

    # This is only installed so paths like /etc/systemd/system become available.

    # Trying to start services will only throw errors like

    # "System has not been booted with systemd as init system (PID 1). Can't

    # operate. Failed to connect to bus: Host is down".

    - name: Install systemd

      ansible.builtin.package:

        name: systemd

  roles:

    - onionprobe

- name: Single operation mode

  hosts: all

  # Gathering facts requires a container with Python installed

  gather_facts: true

  vars:

    # Test the monitoring mode

    onionprobe_operation: single

    # Do not enable the service, since the image is not started with systemd as PID 1

    onionprobe_monitor_enable_service: false

    onionprobe_enable_service: false

  pre_tasks:

    # Sudo is needed by some Ansible modules, and may not be available in the