Refactor the Onionprobe Ansible role

---

#

# Basic

# Onionprobe Ansible role configuration

#

# Copyright (C) 2024 The Tor Project, Inc.

# SPDX-License-Identifier: GPL-3.0-or-later

#

# Control the managed node's mode of operation

onionprobe_project_name: onionprobe-monitor

onionprobe_mode: monitor

onionprobe_config_generation_script: ''

onionprobe_config: ''

onionprobe_configurator_entrypoint: ''

onionprobe_configurator_params: ''

onionprobe_container_runtime: 'docker'

# Onionprobe installation mode: controls how it's installed.

#

# Available options:

#

# 'distro'    : installs Onionprobe from a package, if available in the distro;

#               this will be a system-wide installation, meaning that all users

#               in the system with shell access will be able to run Onionprobe.

#

#               Requirements:

#

#               * The 'onionprobe' package must be available through the system's

#                 package manager.

#

# 'pip'       : installs Onionprobe and it's dependencies using pip.

#               this won't be a system-wide installation in the sense that other

#               users with shell access won't have access to Onionprobe, since

#               it's installed in a restricted virtualenv.

#

#               Requirements (automatically handled on Debian-like systems):

#

#               * Pip.

#

#               * Virtualenv.

#

# 'repository': installs the needed dependencies and clone the Onionprobe repository.

#

#               Any users in the system may read (and sometimes execute) most of the

#               files in this working copy; in general no credentials are stored in

#               this folder; while some files are protected with restrictive file

#               permissions, others cannot otherwise they cannot be shared with

#               containers in the standalone operation more described below.

#

#               In general this should be safe, as Onionprobe by default does

#               not need any credentials to be stored on it's configuration

#               files.

#

#               * Dependencies must be available in the distribution.

#

onionprobe_installation: repository

# Onionprobe operation mode: specifies how it should run.

#

# Available options:

#

# 'manual'    : do not manage the way Onionprobe runs: this is left to the operator

#               to configure elsewhere.

#

# 'single'    : runs just the Onionprobe service, and nothing else.

#

#               Requirements:

#

#               * Systemd must be available in the system, and is used to

#                 manage the service.

#

# 'standalone': runs the full standalone monitoring monitoring node:

#               https://onionservices.torproject.org/apps/web/onionprobe/standalone/

#

#               Requirements:

#

#               * Variable 'onionprobe_installation' must be set to

#                 'repository', as the package usually don't ship the needed

#                 container configuration.

#

# Monitor mode

#               * Docker Compose or Podman Compose must be installed and

#                 configured.

#

#               * Systemd must be available in the system, as it's used to

#                 manage the service.

#

onionprobe_operation: standalone

# Whether to automatically enable the service

onionprobe_monitor_enable_service: true

# Onionprobe Project name

#

# This is mainly used as an identifier to configure and distinguish services.

onionprobe_project_name: onionprobe

# Onionprobe virtualenv

#

# Sets virtualenv location used by the 'pip' installation method.

onionprobe_virtualenv: "{{ onionprobe_path }}/venv"

# Repository version

#

# Ensure Onionprobe's repository version is set to a specific version.

#

# Allowed values are specified at

# https://docs.ansible.com/ansible/latest/collections/ansible/builtin/git_module.html

#

# Having it set to 'HEAD' may not be alwayes considered a good practice:

# https://ansible.readthedocs.io/projects/lint/rules/latest/

#

#onionprobe_repository_version: 1.2.0

onionprobe_repository_version: HEAD

#

# User, group and folder

onionprobe_monitor_user: onionprobe-monitor

onionprobe_monitor_service: onionprobe-monitor

onionprobe_monitor_uid: 2000

onionprobe_monitor_gid: 2000

onionprobe_monitor_path: /var/lib/onionprobe-monitor

#

onionprobe_user    : onionprobe

onionprobe_group   : onionprobe

onionprobe_uid     : 2000

onionprobe_gid     : 2000

onionprobe_path    : /var/lib/onionprobe

# Repository

#

# Repository location

#

# Defaults to the upstream Onionprobe repository, but can be overriden to

# point to a fork.

#

onionprobe_repo: https://gitlab.torproject.org/tpo/onion-services/onionprobe.git

# Prometheus

onionprobe_monitor_prometheus_web_external_url: 'http://localhost:9090'

# Grafana

onionprobe_monitor_grafana_database_password: unsafe-password-please-change

onionprobe_monitor_grafana_smtp_enabled: false

onionprobe_monitor_grafana_smtp_host: localhost:25

onionprobe_monitor_grafana_smtp_user: ''

onionprobe_monitor_grafana_stmp_password: ''

onionprobe_monitor_grafana_smtp_starttls_policy: ''

onionprobe_monitor_grafana_server_domain: ''

onionprobe_monitor_grafana_server_root_url: ''

onionprobe_monitor_grafana_plugins_enable_alpha: false

# Alertmanager

onionprobe_monitor_alertmanager_template: alertmanager/alertmanager.yml.j2

onionprobe_monitor_smtp_smarthost: mail.example.org:587

onionprobe_monitor_smtp_email: changeme@example.org

onionprobe_monitor_smtp_username: changeme

onionprobe_monitor_smtp_auth_password: changeme

onionprobe_monitor_altermanager_default_recipient_email: changeme@example.org

#

# Service

#

# Service name

onionprobe_service: onionprobe

# Whether to automatically enable the service

#

# Systemd might not be available in some testing environments, where makes

# sense to keep the service disabled.

onionprobe_enable_service: true

# Daemon options not specified in the Onionprobe configuration

#

# This setting is ignored by the standalone operation mode

onionprobe_daemon_opts: ''

# Onionprobe configuration folder

#

# When empty, the configuration path is computed depending on the installation

# mode:

#

#  'distro'    : config path is set to /etc/onionprobe

#  'pip'       : config path is set to {{ onionprobe_virtualenv }}/share/onionprobe/configs

#  'repository': config path is set to configs, and is relative to the {{ onionprobe_path }}

#

# Examples:

#

#   onionprobe_config_path: '{{ onionprobe_path }}'

#   onionprobe_config_path: '{{ onionprobe_path }}/configs'

#   onionprobe_config_path: '{{ onionprobe_path }}/contrib/configs'

#

onionprobe_config_path: ''

#

# Onionprobe configuration file relative to {{ onionprobe_config_path }}

#

# Do not leave this empty.

#

onionprobe_config: 'tor.yaml'

# Path for a configuration file to be copied to the remote host

#

# This file should be stored in the Ansible configuration folder/repository,

# and it's copied to the remote host.

#

# Leaving this empty means that no configuration file will be copied to

# the remote host, but {{ onionprobe_config }} can still be used to

# point to an existing file in the remote host.

onionprobe_config_src: ''

# Path where a config generation script is stored

#

# When empty, the configuration path is computed depending on the installation

# mode:

#

#  'distro'    : config path is set to /usr/share/onionprobe/examples

#  'pip'       : config path is set to {{ onionprobe_virtualenv }}/share/onionprobe/examples

#  'repository': config path is set to {{ onionprobe_path }}/packages

#

# Examples:

#

#   onionprobe_config_path: '/usr/share/onionprobe/examples'

#   onionprobe_config_path: '{{ onionprobe_path }}/packages'

#   onionprobe_config_path: '{{ onionprobe_virtualenv }}/share/onionprobe/examples

#

onionprobe_config_script_path: ''

# Path for a config generation script to be copied to the remote host

#

# This script should be stored in the Ansible configuration folder/repository,

# and it's copied to the remote host.

#

# Leaving this empty disables the config generation script (for the single operation

# mode) or uses the default one (for the standalone mode).

onionprobe_config_script_src : ''

#

# Standalone monitor mode options

#

# The container runtime to use

#

# Note that this role won't manage the container runtime installation.

# That needs to be done elsewhere.

#

onionprobe_container_runtime: 'docker'

# Config script parameters

#

# Allow passing parameters to the config generation script.

#

# Example:

#

#   onionprobe_config_script_params: >

#     --loop --wait 3600

#     --output_folder /srv/onionprobe/contrib/configs

#     --config_template /srv/onionprobe/configs/tor.yaml

#     --config_overrides rounds=20 descriptor_max_retries=20

#     descriptor_timeout=120 http_connect_timeout=120

#     http_connect_max_retries=6 http_read_timeout=120

#

# For the standalone operation mode, it's recommended to set "--wait" and

# "rounds=" params, so the configuration container stops periodically, ensuring

# that whenever it restarts a fresh configuration is picked.

onionprobe_config_script_params: ''

# Prometheus options as documented at

# https://prometheus.io/docs/prometheus/latest/command-line/prometheus/

onionprobe_prometheus_web_external_url: 'http://localhost:9090'

# Alertmanager options as documented at

# https://prometheus.io/docs/alerting/latest/configuration/

onionprobe_alertmanager_template                : alertmanager/alertmanager.yml.j2

onionprobe_smtp_smarthost                       : mail.example.org:587

onionprobe_smtp_email                           : changeme@example.org

onionprobe_smtp_username                        : changeme

onionprobe_smtp_auth_password                   : changeme

onionprobe_altermanager_default_recipient_email : changeme@example.org

# Sets the Alertmanager group ownership for the standalone monitor mode

#

# This depends on the UID and GID used by the Alertmanager container service:

# https://github.com/prometheus/alertmanager/blob/main/Dockerfile

#

# It may or may not match the default nobody/nogroup from your operating system.

#

# The default may for for most cases, so only customize these variables if you're

# having issues with the alertmanager container.

onionprobe_alertmanager_group: nogroup

# Grafana configuration

onionprobe_grafana_database_password: unsafe-password-please-change

# Grafana options as documented at

# https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/

onionprobe_grafana_smtp_enabled         : false

onionprobe_grafana_smtp_host            : localhost:25

onionprobe_grafana_smtp_user            : ''

onionprobe_grafana_stmp_password        : ''

onionprobe_grafana_smtp_starttls_policy : ''

onionprobe_grafana_server_domain        : ''

onionprobe_grafana_server_root_url      : ''

onionprobe_grafana_plugins_enable_alpha : false

---

#

# Onionprobe handlers

#

# Copyright (C) 2024 The Tor Project, Inc.

# SPDX-License-Identifier: GPL-3.0-or-later

#

- name: Restart the Onionprobe service

  when: onionprobe_enable_service is true

  ansible.builtin.systemd:

    name          : "{{ onionprobe_service }}"

    enabled       : true

    daemon_reload : true

    state         : restarted

---

- name: Converge

  hosts: all

  # Ensure Ansible become root when running on localhost

  become: true

  become_method: community.general.sudosu

  # Gathering facts requires a container with Python installed

  gather_facts: true

  vars:

    # Test the monitoring mode

    onionprobe_operation: standalone

    # Install via repository

    onionprobe_installation: repository

    # Configure Podman as the container runtime

    # This is still experimental as of 2024-10

    #onionprobe_container_runtime: podman

    # Do not enable the service, since the image is not started with systemd as PID 1

    onionprobe_enable_service: true

  pre_tasks:

    # Install the ACL package

    # https://stackoverflow.com/questions/46352173/ansible-failed-to-set-permissions-on-the-temporary#56379678

    - name: Install acl

      ansible.builtin.package:

        name: acl

    # Sudo is needed by some Ansible modules, and may not be available in the

    # container instance

    - name: Install sudo

      ansible.builtin.package:

        name: sudo

    - name: Create the admin group

      ansible.builtin.group:

        name: "admin"

    # Users in admin group should have passwordless sudo

    # This ensures the Onionspray build script runs

    - name: Configure passwordless sudo for the admin group

      ansible.builtin.lineinfile:

        create : true

        owner  : "root"

        group  : "root"

        mode   : "0600"

        line   : "%admin ALL=(ALL) NOPASSWD : ALL"

        path   : /etc/sudoers.d/90-admin

  roles:

    - onionprobe

---

# Runs the test on localhost

# https://ansible.readthedocs.io/projects/molecule/configuration/#molecule.driver.delegated.Delegated

driver:

  name: default

  options:

    managed: false

    ansible_connection_options:

      ansible_connection: local

platforms:

  - name: localhost

---

#

# Onionprobe Ansible role test tasks

#

# Copyright (C) 2024 The Tor Project, Inc.

# SPDX-License-Identifier: GPL-3.0-or-later

#

- name: deps | Install basic dependencies

  block:

    # Sudo is needed by some Ansible modules, and may not be available in the

    # container instance

    - name: deps | Install sudo

      ansible.builtin.package:

        name: sudo

    # This is only installed so paths like /etc/systemd/system become available.

    # Trying to start services will only throw errors like

    # "System has not been booted with systemd as init system (PID 1). Can't

    # operate. Failed to connect to bus: Host is down".

    - name: deps | Install systemd

      ansible.builtin.package:

        name: systemd

    # Install ansible.builtin.pip dependencies

    #- name: deps | Install setuptools

    #  ansible.builtin.apt:

    #    name:

    #      - python3-setuptools

    #      - python3-pip

    #      - python3-virtualenv

    #  when: ansible_os_family == 'Debian'

- name: deps | Create the needed groups

  block:

    - name: deps | Create the docker group

      when: onionprobe_container_runtime == 'docker'

      ansible.builtin.group:

        name : docker