From 2a146b22c8771eeb7987e0f112d0d69838f10f2d Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Mon, 1 Sep 2025 15:22:25 -0300 Subject: [PATCH 1/4] Fix: handlers: linting (loop-var-prefix) (#1) --- handlers/main.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/handlers/main.yml b/handlers/main.yml index 02c41c3..5def284 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -8,21 +8,25 @@ - name: Remove Onionspray generated settings config files ansible.builtin.file: - path: "{{ onionspray_path }}/{{ item.project_name }}.conf" + path: "{{ onionspray_path }}/{{ onionspray_project_settings.project_name }}.conf" state: absent no_log: true loop: "{{ onionspray_project_settings }}" + loop_control: + loop_var: onionspray_project_settings - name: Remove Onionspray generated project directories ansible.builtin.file: - path: "{{ onionspray_path }}/projects/{{ item.project_name }}/" + path: "{{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/" state: absent no_log: true loop: "{{ onionspray_project_settings }}" + loop_control: + loop_var: onionspray_project_settings - name: Generate Onionspray configs ansible.builtin.command: - cmd: "{{ onionspray_path }}/onionspray config {{ onionspray_path }}/{{ item.project_name }}.tconf" + cmd: "{{ onionspray_path }}/onionspray config {{ onionspray_path }}/{{ onionspray_project_settings.project_name }}.tconf" become: true become_user: "{{ onionspray_user }}" # Workaround allowing to run Git even if the shell is set to /sbin/nologin @@ -33,6 +37,8 @@ changed_when: true no_log: true loop: "{{ onionspray_project_settings }}" + loop_control: + loop_var: onionspray_project_settings - name: Reload systemctl daemon ansible.builtin.systemd: -- GitLab From dab99e3c7a4a55414bad9370b38d062130e52a7f Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Mon, 1 Sep 2025 15:32:10 -0300 Subject: [PATCH 2/4] Fix: certs: copy: use the current onionspray_site.onion_address instead of onionspray_site.tor_addr --- tasks/certs/copy.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tasks/certs/copy.yml b/tasks/certs/copy.yml index ec15d24..8bc3285 100644 --- a/tasks/certs/copy.yml +++ b/tasks/certs/copy.yml @@ -15,7 +15,7 @@ - name: "certs | copy | Copy Onion TLS certificate for {{ mapping }}" ansible.builtin.copy: content: "{{ onionspray_site.tls.certificate }}" - dest: "{{ onionspray_path }}/projects/{{ settings.project_name }}/ssl/{ onionspray_site.tor_addr | truncate(20, True, '')-v3.cert" + dest: "{{ onionspray_path }}/projects/{{ settings.project_name }}/ssl/{ onionspray_site.onion_address | truncate(20, True, '')-v3.cert" owner: "{{ onionspray_user }}" group: "{{ onionspray_user }}" mode: "600" @@ -32,7 +32,7 @@ - name: "certs | copy | Copy Onion TLS secret key for {{ mapping }}" ansible.builtin.copy: content: "{{ onionspray_site.tls.secret_key }}" - dest: "{{ onionspray_path }}/projects/{{ settings.project_name }}/ssl/{ onionspray_site.tor_addr | truncate(20, True, '')-v3.pem" + dest: "{{ onionspray_path }}/projects/{{ settings.project_name }}/ssl/{ onionspray_site.onion_address | truncate(20, True, '')-v3.pem" owner: "{{ onionspray_user }}" group: "{{ onionspray_user }}" mode: "600" -- GitLab From 7fe6e26da4de4c4b056044e69960779560487d7b Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Mon, 1 Sep 2025 15:50:05 -0300 Subject: [PATCH 3/4] Fix: tasks: linting (loop-var-prefix) (#1) --- tasks/certs/copy.yml | 18 +++--- tasks/certs/main.yml | 4 +- tasks/certs/upload.yml | 27 ++++----- tasks/keys/copy.yml | 12 ++-- tasks/keys/main.yml | 10 ++-- tasks/keys/upload.yml | 18 +++--- tasks/logs/s3/check.yml | 28 ++++----- tasks/logs/s3/main.yml | 4 +- tasks/main.yml | 12 ++-- tasks/projects.yml | 4 +- templates/projects/project.tconf.j2 | 90 ++++++++++++++--------------- 11 files changed, 114 insertions(+), 113 deletions(-) diff --git a/tasks/certs/copy.yml b/tasks/certs/copy.yml index 8bc3285..d315efd 100644 --- a/tasks/certs/copy.yml +++ b/tasks/certs/copy.yml @@ -6,21 +6,21 @@ # SPDX-License-Identifier: AGPL-3.0-or-later # -- name: "certs | copy | Copy Onion Service certificates for {{ mapping }}" +- name: "certs | copy | Copy Onion Service certificates for {{ onionspray_project_mapping }}" tags: - certificates when: - - settings[mapping] is defined + - onionspray_project_settings[onionspray_project_mapping] is defined block: - - name: "certs | copy | Copy Onion TLS certificate for {{ mapping }}" + - name: "certs | copy | Copy Onion TLS certificate for {{ onionspray_project_mapping }}" ansible.builtin.copy: content: "{{ onionspray_site.tls.certificate }}" - dest: "{{ onionspray_path }}/projects/{{ settings.project_name }}/ssl/{ onionspray_site.onion_address | truncate(20, True, '')-v3.cert" + dest: "{{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/ssl/{ onionspray_site.onion_address | truncate(20, True, '')-v3.cert" owner: "{{ onionspray_user }}" group: "{{ onionspray_user }}" mode: "600" no_log: true - loop: "{{ settings[mapping] }}" + loop: "{{ onionspray_project_settings[onionspray_project_mapping] }}" loop_control: loop_var: onionspray_site label: onionspray_site.onion_address @@ -29,17 +29,17 @@ - onionspray_site.tls.secret_key is defined - onionspray_site.onion_address is defined - - name: "certs | copy | Copy Onion TLS secret key for {{ mapping }}" + - name: "certs | copy | Copy Onion TLS secret key for {{ onionspray_project_mapping }}" ansible.builtin.copy: content: "{{ onionspray_site.tls.secret_key }}" - dest: "{{ onionspray_path }}/projects/{{ settings.project_name }}/ssl/{ onionspray_site.onion_address | truncate(20, True, '')-v3.pem" + dest: "{{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/ssl/{ onionspray_site.onion_address | truncate(20, True, '')-v3.pem" owner: "{{ onionspray_user }}" group: "{{ onionspray_user }}" mode: "600" no_log: true - loop: "{{ settings[mapping] }}" + loop: "{{ onionspray_project_settings[onionspray_project_mapping] }}" loop_control: - loop_var: site + loop_var: onionspray_site label: onionspray_site.onion_address when: - onionspray_site.tls.certificate is defined diff --git a/tasks/certs/main.yml b/tasks/certs/main.yml index 4289bcd..272bcb4 100644 --- a/tasks/certs/main.yml +++ b/tasks/certs/main.yml @@ -14,11 +14,11 @@ no_log: true loop: ['hardmaps', 'softmaps'] loop_control: - loop_var: mapping + loop_var: onionspray_project_mapping - name: certs | main | Upload Onion Service certificates ansible.builtin.include_tasks: certs/upload.yml no_log: true loop: ['hardmaps', 'softmaps'] loop_control: - loop_var: mapping + loop_var: onionspray_project_mapping diff --git a/tasks/certs/upload.yml b/tasks/certs/upload.yml index 8898354..98624b2 100644 --- a/tasks/certs/upload.yml +++ b/tasks/certs/upload.yml @@ -6,22 +6,23 @@ # SPDX-License-Identifier: AGPL-3.0-or-later # -- name: "certs | upload | Upload Onion Service certificates for {{ mapping }}" +- name: "certs | upload | Upload Onion Service certificates for {{ onionspray_project_mapping }}" tags: - certificates when: - - settings[mapping] is defined + - onionspray_project_settings[onionspray_project_mapping] is defined block: #- name: certs | upload | Debug onionspray cert uploader command line invocation # ansible.builtin.debug: # msg: > # {{ onionspray_cert_uploader_script }} {{ onionspray_provider }} {{ inventory_hostname }} - # {{ settings.project_name }} {{ onionspray_site.onion_address }} {{ onionspray_site.upstream }} {{ onionspray_user }} + # {{ onionspray_project_settings.project_name }} {{ onionspray_site.onion_address }} + # {{ onionspray_site.upstream }} {{ onionspray_user }} # {{ onionspray_path }} # {{ onionspray_keyring }} # {{ onionspray_secrets_manager }} # no_log: true - # loop: "{{ settings[mapping] }}" + # loop: "{{ onionspray_project_settings[onionspray_project_mapping] }}" # loop_control: # loop_var : onionspray_site # label : "{{ onionspray_site.onion_address }}" @@ -29,11 +30,11 @@ # - onionspray_site.onion_address is defined # - onionspray_site.certificate_upload is defined # - onionspray_site.certificate_upload == true - # - onionspray_cert_uploader_script | length != 0 and mapping in settings + # - onionspray_cert_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings #- name: certs | upload | Ensure certificate file existence and permissions # ansible.builtin.file: - # path : "{{ onionspray_path }}/projects/{{ settings.project_name }}/ssl/{{ onionspray_site.onion_address|truncate(20, True, '') }}-v3.cert" + # path : "{{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/ssl/{{ onionspray_site.onion_address|truncate(20, True, '') }}-v3.cert" # owner : "{{ onionspray_user }}" # group : "{{ onionspray_user }}" # state : touch @@ -46,11 +47,11 @@ # - onionspray_site.onion_address is defined # - onionspray_site.certificate_upload is defined # - onionspray_site.certificate_upload == true - # - onionspray_cert_uploader_script | length != 0 and mapping in settings + # - onionspray_cert_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings #- name: certs | upload | Ensure the TLS private key file existence and permissions # ansible.builtin.file: - # path : "{{ onionspray_path }}/projects/{{ settings.project_name }}/ssl/{{ site.onion_address|truncate(20, True, '') }}-v3.pem" + # path : "{{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/ssl/{{ site.onion_address|truncate(20, True, '') }}-v3.pem" # owner : "{{ onionspray_user }}" # group : "{{ onionspray_user }}" # state : touch @@ -63,13 +64,13 @@ # - onionspray_site.onion_address is defined # - onionspray_site.certificate_upload is defined # - onionspray_site.certificate_upload == true - # - onionspray_cert_uploader_script | length != 0 and mapping in settings + # - onionspray_cert_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings - - name: "certs | upload | Upload Onion Service certs for {{ mapping }}" + - name: "certs | upload | Upload Onion Service certs for {{ onionspray_project_mapping }}" ansible.builtin.command: cmd: > {{ onionspray_cert_uploader_script }} {{ onionspray_provider }} {{ inventory_hostname }} - {{ settings.project_name }} {{ onionspray_site.onion_address }} {{ onionspray_site.upstream_address }} {{ onionspray_user }} + {{ onionspray_project_settings.project_name }} {{ onionspray_site.onion_address }} {{ onionspray_site.upstream_address }} {{ onionspray_user }} {{ onionspray_path }} {{ onionspray_keyring }} {{ onionspray_secrets_manager }} @@ -78,7 +79,7 @@ become : true become_user : "{{ lookup('env', 'USER') }}" no_log : true - loop : "{{ settings[mapping] }}" + loop : "{{ onionspray_project_settings[onionspray_project_mapping] }}" loop_control : loop_var : onionspray_site #label : "{{ onionspray_site.onion_address }}" @@ -86,7 +87,7 @@ - onionspray_site.onion_address is defined - onionspray_site.certificate_upload is defined - onionspray_site.certificate_upload - - onionspray_cert_uploader_script | length != 0 and mapping in settings + - onionspray_cert_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings notify : Restart Onionspray # This task always change something (even if only the mtime of a file) diff --git a/tasks/keys/copy.yml b/tasks/keys/copy.yml index 18002e0..0b7d6cd 100644 --- a/tasks/keys/copy.yml +++ b/tasks/keys/copy.yml @@ -6,13 +6,13 @@ # SPDX-License-Identifier: AGPL-3.0-or-later # -- name: "keys | copy | Copy Onion Service keys for {{ mapping }}" +- name: "keys | copy | Copy Onion Service keys for {{ onionspray_project_mapping }}" tags: - keys when: - - settings[mapping] is defined + - onionspray_project_settings[onionspray_project_mapping] is defined block: - - name: "keys | copy | Copy Onion v3 public key for {{ mapping }}" + - name: "keys | copy | Copy Onion v3 public key for {{ onionspray_project_mapping }}" ansible.builtin.copy: content: "{{ onionspray_site.public_key_base64 | b64decode }}" dest: "{{ onionspray_path }}/secrets/{{ onionspray_site.onion_address }}.v3pub.key" @@ -20,7 +20,7 @@ group: "{{ onionspray_user }}" mode: "600" no_log: true - loop: "{{ settings[mapping] }}" + loop: "{{ onionspray_project_settings[onionspray_project_mapping] }}" loop_control: loop_var: onionspray_site label: onionspray_site.onion_address @@ -29,7 +29,7 @@ - onionspray_site.secret_key_base64 is defined - onionspray_site.onion_address is defined - - name: "keys | copy | Copy Onion v3 secret key for {{ mapping }}" + - name: "keys | copy | Copy Onion v3 secret key for {{ onionspray_project_mapping }}" ansible.builtin.copy: content: "{{ onionspray_site.secret_key_base64 | b64decode }}" dest: "{{ onionspray_path }}/secrets/{{ onionspray_site.onion_address }}.v3sec.key" @@ -37,7 +37,7 @@ group: "{{ onionspray_user }}" mode: "600" no_log: true - loop: "{{ settings[mapping] }}" + loop: "{{ onionspray_project_settings[onionspray_project_mapping] }}" loop_control: loop_var: onionspray_site label: onionspray_site.onion_address diff --git a/tasks/keys/main.yml b/tasks/keys/main.yml index 918d345..4639d0e 100644 --- a/tasks/keys/main.yml +++ b/tasks/keys/main.yml @@ -6,19 +6,19 @@ # SPDX-License-Identifier: AGPL-3.0-or-later # -- name: keys | main | Base keys configuration +- name: "keys | main | Base keys configuration for {{ onionspray_project_settings.project_name }}" ansible.builtin.include_tasks: keys/base.yml -- name: keys | main | Copy Onion Service keys +- name: "keys | main | Copy Onion Service keys for {{ onionspray_project_settings.project_name }}" ansible.builtin.include_tasks: keys/copy.yml no_log: true loop: ['hardmaps', 'softmaps'] loop_control: - loop_var: mapping + loop_var: onionspray_project_mapping -- name: keys | main | Upload Onion Service keys +- name: "keys | main | Upload Onion Service keys for {{ onionspray_project_settings.project_name }}" ansible.builtin.include_tasks: keys/upload.yml no_log: true loop: ['hardmaps', 'softmaps'] loop_control: - loop_var: mapping + loop_var: onionspray_project_mapping diff --git a/tasks/keys/upload.yml b/tasks/keys/upload.yml index 441bf5b..5c79a5b 100644 --- a/tasks/keys/upload.yml +++ b/tasks/keys/upload.yml @@ -6,11 +6,11 @@ # SPDX-License-Identifier: AGPL-3.0-or-later # -- name: "keys | upload | Upload Onion Service keys for {{ mapping }}" +- name: "keys | upload | Upload Onion Service keys for {{ onionspray_project_mapping }}" tags: - keys when: - - settings[mapping] is defined + - onionspray_project_settings[onionspray_project_mapping] is defined block: #- name: Debug onionspray key uploader command line invocation # ansible.builtin.debug: @@ -18,7 +18,7 @@ # {{ onionspray_key_uploader_script }} {{ onionspray_provider }} {{ inventory_hostname }} # {{ onionspray_project.name }} {{ onionspray_site.onion_address }} {{ onionspray_site.upstream_address }} {{ onionspray_user }} # {{ onionspray_path }} - # loop : "{{ onionspray_project[mapping] }}" + # loop : "{{ onionspray_project[onionspray_project_mapping] }}" # loop_control : # loop_var : onionspray_site # label : "{{ onionspray_site.onion_address }}" @@ -26,7 +26,7 @@ # - onionspray_site.onion_address is defined # - onionspray_site.keys_upload is defined # - onionspray_site.keys_upload == true - # - onionspray_key_uploader_script | length != 0 and mapping in settings + # - onionspray_key_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings #- name: Ensure the public key file existence and permissions # ansible.builtin.file: @@ -42,7 +42,7 @@ # - onionspray_site.onion_address is defined # - onionspray_site.keys_upload is defined # - onionspray_site.keys_upload == true - # - onionspray_key_uploader_script | length != 0 and mapping in settings + # - onionspray_key_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings #- name: Ensure the private key file existence and permissions # ansible.builtin.file: @@ -58,9 +58,9 @@ # - onionspray_site.onion_address is defined # - onionspray_site.keys_upload is defined # - onionspray_site.keys_upload == true - # - onionspray_key_uploader_script | length != 0 and mapping in settings + # - onionspray_key_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings - - name: "keys | upload | Upload Onion Service keys for {{ mapping }}" + - name: "keys | upload | Upload Onion Service keys for {{ onionspray_project_mapping }}" ansible.builtin.command: cmd: > {{ onionspray_key_uploader_script }} {{ onionspray_provider }} {{ inventory_hostname }} @@ -72,7 +72,7 @@ connection : local become : true become_user : "{{ lookup('env', 'USER') }}" - loop : "{{ onionspray_project[mapping] }}" + loop : "{{ onionspray_project[onionspray_project_mapping] }}" loop_control: loop_var : onionspray_site label : "{{ onionspray_site.onion_address }}" @@ -80,7 +80,7 @@ - onionspray_site.onion_address is defined - onionspray_site.keys_upload is defined - onionspray_site.keys_upload - - onionspray_key_uploader_script | length != 0 and mapping in settings + - onionspray_key_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings notify : Restart Onionspray # This task always change something (even if only the mtime of a file) diff --git a/tasks/logs/s3/check.yml b/tasks/logs/s3/check.yml index 6ff05f5..5a2cd7a 100644 --- a/tasks/logs/s3/check.yml +++ b/tasks/logs/s3/check.yml @@ -8,7 +8,7 @@ - name: s3 | check | Check the S3 sync logs when: - - settings.log_s3_check | default(false) + - onionspray_project_settings.log_s3_check | default(false) block: #- name: logs | s3 | Find S3 sync logs # ansible.builtin.find: @@ -18,39 +18,39 @@ - name: s3 | check | Check the latest S3 sync log ansible.builtin.stat: - path: "{{ onionspray_path }}/projects/{{ settings.project_name }}/log/s3-sync.log" - register: s3_sync_log_latest + path: "{{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/log/s3-sync.log" + register: onionspray_s3_sync_log_latest #- name: s3 | check | Check if we have a latest S3 sync log # ansible.builtin.debug: - # var: s3_sync_log_latest + # var: onionspray_s3_sync_log_latest - name: s3 | check | Display the S3 sync log modification time in UTC ansible.builtin.debug: - var: "'%Y-%m-%d %H:%M:%S' | strftime(s3_sync_log_latest.stat.mtime | string, utc=true)" - when: s3_sync_log_latest.stat is defined and s3_sync_log_latest.stat.mtime is defined + var: "'%Y-%m-%d %H:%M:%S' | strftime(onionspray_s3_sync_log_latest.stat.mtime | string, utc=true)" + when: onionspray_s3_sync_log_latest.stat is defined and onionspray_s3_sync_log_latest.stat.mtime is defined - # Trying to access s3_sync_log_latest.stat.* here throws an error: + # Trying to access onionspray_s3_sync_log_latest.stat.* here throws an error: # # ansible.utils.unsafe_proxy.AnsibleUnsafeText object' has no attribute 'path # - # Maybe it's an Ansible bug, so avoiding any s3_sync_log_latest.stat key directly. + # Maybe it's an Ansible bug, so avoiding any onionspray_s3_sync_log_latest.stat key directly. #- name: s3 | check | Display info on the latest S3 sync log # ansible.builtin.debug: # msg: # - "Size in bytes for the latest S3 sync log: {{ item.size | string }}" # - "Creation time on the latest S3 sync log: {{ item.ctime | string }}" # - "Modification time on the latest S3 sync log: {{ item.mtime | string }}" - # with_items: "{{ s3_sync_log_latest.stat }}" - # when: s3_sync_log_latest.failed == False and s3_sync_log_latest.stat.path is defined + # with_items: "{{ onionspray_s3_sync_log_latest.stat }}" + # when: onionspray_s3_sync_log_latest.failed == False and onionspray_s3_sync_log_latest.stat.path is defined - name: s3 | check | Get the last few lines of the latest S3 sync log ansible.builtin.command: - cmd: "/usr/bin/tail -n 5 {{ onionspray_path }}/projects/{{ settings.project_name }}/log/s3-sync.log" + cmd: "/usr/bin/tail -n 5 {{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/log/s3-sync.log" when: > - s3_sync_log_latest.path is defined and - s3_sync_log_latest.stat.path == onionspray_path + '/log/s3-sync.log' and not - s3_sync_log_latest.failed + onionspray_s3_sync_log_latest.path is defined and + onionspray_s3_sync_log_latest.stat.path == onionspray_path + '/log/s3-sync.log' and not + onionspray_s3_sync_log_latest.failed register: s3_sync_log_lines changed_when: false diff --git a/tasks/logs/s3/main.yml b/tasks/logs/s3/main.yml index e39d9d3..68dbac4 100644 --- a/tasks/logs/s3/main.yml +++ b/tasks/logs/s3/main.yml @@ -13,5 +13,5 @@ ansible.builtin.include_tasks: logs/s3/check.yml loop: "{{ onionspray_project_settings }}" loop_control: - loop_var: settings - label: settings.project_name + loop_var: onionspray_project_settings + label: onionspray_project_settings.project_name diff --git a/tasks/main.yml b/tasks/main.yml index 0904f78..6ad1140 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -16,22 +16,22 @@ ansible.builtin.include_tasks: keys/main.yml loop: "{{ onionspray_project_settings }}" loop_control: - loop_var: settings - label: settings.project_name + loop_var: onionspray_project_settings + label: onionspray_project_settings.project_name - name: Certificate handling ansible.builtin.include_tasks: certs/main.yml loop: "{{ onionspray_project_settings }}" loop_control: - loop_var: settings - label: settings.project_name + loop_var: onionspray_project_settings + label: onionspray_project_settings.project_name - name: Projects configuration ansible.builtin.include_tasks: projects.yml loop: "{{ onionspray_project_settings }}" loop_control: - loop_var: settings - label: settings.project_name + loop_var: onionspray_project_settings + label: onionspray_project_settings.project_name - name: Build ansible.builtin.include_tasks: build.yml diff --git a/tasks/projects.yml b/tasks/projects.yml index 072a320..e9a5775 100644 --- a/tasks/projects.yml +++ b/tasks/projects.yml @@ -6,10 +6,10 @@ # SPDX-License-Identifier: AGPL-3.0-or-later # -- name: projects | Generate project settings +- name: "projects | Generate project settings for {{ onionspray_project_settings.project_name }}" ansible.builtin.template: src: projects/project.tconf.j2 - dest: "{{ onionspray_path }}/{{ settings.project_name }}.tconf" + dest: "{{ onionspray_path }}/{{ onionspray_project_settings.project_name }}.tconf" owner: "{{ onionspray_user }}" group: "{{ onionspray_user }}" mode: "600" diff --git a/templates/projects/project.tconf.j2 b/templates/projects/project.tconf.j2 index 983ea95..a6b56c6 100644 --- a/templates/projects/project.tconf.j2 +++ b/templates/projects/project.tconf.j2 @@ -1,5 +1,5 @@ # -# Onionspray configuration file for project {{ settings.project_name }} +# Onionspray configuration file for project {{ onionspray_project_settings.project_name }} # # Copyright (C) 2025 The Tor Project, Inc. # SPDX-License-Identifier: AGPL-3.0-or-later @@ -12,8 +12,8 @@ # General # -{% if settings.project_name is defined %} -set project {{ settings.project_name }} +{% if onionspray_project_settings.project_name is defined %} +set project {{ onionspray_project_settings.project_name }} {% endif %} # @@ -28,95 +28,95 @@ set nginx_proxy_ssl_trusted_certificate {{ onionspray_ca_file }} # Proxy # -{% if settings.x_from_onion_value is defined %} -set x_from_onion_value {{ settings.x_from_onion_value }} +{% if onionspray_project_settings.x_from_onion_value is defined %} +set x_from_onion_value {{ onionspray_project_settings.x_from_onion_value }} {% endif %} -{%- if settings.inject_headers_upstream is defined %} -set inject_headers_upstream {{ settings.inject_headers_upstream }} +{%- if onionspray_project_settings.inject_headers_upstream is defined %} +set inject_headers_upstream {{ onionspray_project_settings.inject_headers_upstream }} {% endif %} -{%- if settings.nginx_resolver is defined %} -set nginx_resolver {{ settings.nginx_resolver }} +{%- if onionspray_project_settings.nginx_resolver is defined %} +set nginx_resolver {{ onionspray_project_settings.nginx_resolver }} {% endif %} -{%- if settings.nginx_tmpfile_size is defined %} -set nginx_tmpfile_size {{ settings.nginx_tmpfile_size }} +{%- if onionspray_project_settings.nginx_tmpfile_size is defined %} +set nginx_tmpfile_size {{ onionspray_project_settings.nginx_tmpfile_size }} {% endif %} -{%- if settings.nginx_cache_seconds is defined %} -set nginx_cache_seconds {{ settings.nginx_cache_seconds }} +{%- if onionspray_project_settings.nginx_cache_seconds is defined %} +set nginx_cache_seconds {{ onionspray_project_settings.nginx_cache_seconds }} {% endif %} -{%- if settings.nginx_cache_size is defined %} -set nginx_cache_size {{ settings.nginx_cache_size }} +{%- if onionspray_project_settings.nginx_cache_size is defined %} +set nginx_cache_size {{ onionspray_project_settings.nginx_cache_size }} {% endif %} -{%- if settings.nginx_x_onion_circuit_id is defined %} -set nginx_x_onion_circuit_id {{ settings.nginx_x_onion_circuit_id }} +{%- if onionspray_project_settings.nginx_x_onion_circuit_id is defined %} +set nginx_x_onion_circuit_id {{ onionspray_project_settings.nginx_x_onion_circuit_id }} {% endif %} # # Logging # -{% if settings.log_separate is defined %} -set log_separate {{ settings.log_separate }} +{% if onionspray_project_settings.log_separate is defined %} +set log_separate {{ onionspray_project_settings.log_separate }} {% endif %} # # Tor # -{% if settings.tor_export_circuit_id is defined %} -set tor_export_circuit_id {{ settings.tor_export_circuit_id }} +{% if onionspray_project_settings.tor_export_circuit_id is defined %} +set tor_export_circuit_id {{ onionspray_project_settings.tor_export_circuit_id }} {% endif %} -{%- if settings.tor_intros_per_daemon is defined %} -set tor_intros_per_daemon {{ settings.tor_intros_per_daemon }} +{%- if onionspray_project_settings.tor_intros_per_daemon is defined %} +set tor_intros_per_daemon {{ onionspray_project_settings.tor_intros_per_daemon }} {% endif %} -{%- if settings.tor_single_onion is defined %} -set tor_single_onion {{ settings.tor_single_onion }} +{%- if onionspray_project_settings.tor_single_onion is defined %} +set tor_single_onion {{ onionspray_project_settings.tor_single_onion }} {% endif %} -{%- if settings.tor_pow_enabled is defined %} -set tor_pow_enabled {{ settings.tor_pow_enabled }} +{%- if onionspray_project_settings.tor_pow_enabled is defined %} +set tor_pow_enabled {{ onionspray_project_settings.tor_pow_enabled }} {% endif %} -{%- if settings.tor_pow_queue_rate is defined %} -set tor_pow_queue_rate {{ settings.tor_pow_queue_rate }} +{%- if onionspray_project_settings.tor_pow_queue_rate is defined %} +set tor_pow_queue_rate {{ onionspray_project_settings.tor_pow_queue_rate }} {% endif %} -{%- if settings.tor_pow_queue_burst is defined %} -set tor_pow_queue_burst {{ settings.tor_pow_queue_burst }} +{%- if onionspray_project_settings.tor_pow_queue_burst is defined %} +set tor_pow_queue_burst {{ onionspray_project_settings.tor_pow_queue_burst }} {% endif %} -{%- if settings.tor_intro_dos_defense is defined %} -set tor_intro_dos_defense {{ settings.tor_intro_dos_defense }} +{%- if onionspray_project_settings.tor_intro_dos_defense is defined %} +set tor_intro_dos_defense {{ onionspray_project_settings.tor_intro_dos_defense }} {% endif %} -{%- if settings.tor_intro_dos_burst_per_sec is defined %} -set tor_intro_dos_burst_per_sec {{ settings.tor_intro_dos_burst_per_sec }} +{%- if onionspray_project_settings.tor_intro_dos_burst_per_sec is defined %} +set tor_intro_dos_burst_per_sec {{ onionspray_project_settings.tor_intro_dos_burst_per_sec }} {% endif %} -{%- if settings.tor_intro_dos_rate_per_sec is defined %} -set tor_intro_dos_rate_per_sec {{ settings.tor_intro_dos_rate_per_sec }} +{%- if onionspray_project_settings.tor_intro_dos_rate_per_sec is defined %} +set tor_intro_dos_rate_per_sec {{ onionspray_project_settings.tor_intro_dos_rate_per_sec }} {% endif %} -{%- if settings.tor_max_streams is defined %} -set tor_max_streams {{ settings.tor_max_streams }} +{%- if onionspray_project_settings.tor_max_streams is defined %} +set tor_max_streams {{ onionspray_project_settings.tor_max_streams }} {% endif %} -{%- if settings.tor_max_streams_close_circuit is defined %} -set tor_max_streams_close_circuit {{ settings.tor_max_streams_close_circuit }} +{%- if onionspray_project_settings.tor_max_streams_close_circuit is defined %} +set tor_max_streams_close_circuit {{ onionspray_project_settings.tor_max_streams_close_circuit }} {% endif %} # # Foreign maps # -{% for foreignmap in settings.foreignmaps | default([]) %} +{% for foreignmap in onionspray_project_settings.foreignmaps | default([]) %} foreignmap {{ foreignmap.onion_address }} {{ foreignmap.upstream_address }} {% endfor %} @@ -124,7 +124,7 @@ foreignmap {{ foreignmap.onion_address }} {{ foreignmap.upstream_address }} # Hardmaps # -{% for hardmap in settings.hardmaps | default([]) %} +{% for hardmap in onionspray_project_settings.hardmaps | default([]) %} hardmap {{ hardmap.onion_address | default('%NEW_V3_ONION%') }} {{ hardmap.upstream_address }} {% endfor %} @@ -132,7 +132,7 @@ hardmap {{ hardmap.onion_address | default('%NEW_V3_ONION%') }} {{ hardmap.upstr # Softmaps # -{% for softmap in settings.softmaps | default([]) %} +{% for softmap in onionspray_project_settings.softmaps | default([]) %} softmap {{ softmap.onion_address | default('%NEW_V3_ONION%') }} {{ softmap.upstream_address }} {% endfor %} @@ -140,4 +140,4 @@ softmap {{ softmap.onion_address | default('%NEW_V3_ONION%') }} {{ softmap.upstr # Other # -{{ settings.custom_settings | default('') }} +{{ onionspray_project_settings.custom_settings | default('') }} -- GitLab From d67aff3b6db596f62626183914cba48445a102bb Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Mon, 1 Sep 2025 16:36:02 -0300 Subject: [PATCH 4/4] Fix: rename onionspray_project_settings as onionspray_projects; other variable updates (#1) --- ChangeLog.md | 8 +-- README.md | 16 ++--- defaults/main.yml | 13 ++--- handlers/main.yml | 18 +++--- molecule/local/converge.yml | 6 +- molecule/podman/converge.yml | 6 +- tasks/certs/base.yml | 2 +- tasks/certs/copy.yml | 10 ++-- tasks/certs/upload.yml | 31 +++++----- tasks/keys/copy.yml | 6 +- tasks/keys/main.yml | 6 +- tasks/keys/upload.yml | 24 ++++---- tasks/logs/s3/check.yml | 6 +- tasks/logs/s3/main.yml | 6 +- tasks/main.yml | 18 +++--- tasks/projects.yml | 4 +- templates/logs/logrotate.j2 | 12 ++-- templates/projects/project.tconf.j2 | 90 ++++++++++++++--------------- 18 files changed, 140 insertions(+), 142 deletions(-) diff --git a/ChangeLog.md b/ChangeLog.md index b2fbab0..8752547 100644 --- a/ChangeLog.md +++ b/ChangeLog.md @@ -62,7 +62,7 @@ The configuration format has changed again, and operators wishing to upgrade should update their configuration accordingly: * Variables `onionspray_project_settings` and `onionspray_keys` are now - unified into the former. + unified into `onionspray_projects`. * Some variable names have been changed. New new format is fully documented in the [defaults file][defaults/main.yml], @@ -78,8 +78,8 @@ onionspray_provider: 'myprovider' onionspray_key_uploader_script : '../scripts/upload-keys-to-onionspray-instances' onionspray_cert_uploader_script: '../scripts/upload-certs-to-onionspray-instances' -onionspray_project_settings: - - project_name: "example1" +onionspray_projects: + - name: "example1" # Onion Service proxying using Onionspray's hardmap config hardmaps: # Onion Service mapping to example.null @@ -137,7 +137,7 @@ onionspray_project_settings: set block_err This subdomain is forbidden. set block_host_re ^forbidden\. - - project_name: "example2" + - name: "example2" # Onion Service proxying using Onionspray's softmap config softmaps: # Onion Service mapping to example.org, using Onionbalance diff --git a/README.md b/README.md index be3a016..692e358 100644 --- a/README.md +++ b/README.md @@ -57,7 +57,7 @@ example of a basic playbook: ``` You can configure your project(s), i.e. the website(s) that Onionspray will -handle, using the `onionspray_project_settings` variable, a list of +handle, using the `onionspray_projects` variable, a list of dictionaries. You may also want to (re)define other values: check the [defaults][] for a complete list of variables and their usage. @@ -67,8 +67,8 @@ As an example, you could have a minimal config at `host_vars/myhost.yml`, just telling which upstream website you want to have a proxy for: ```yaml -onionspray_project_settings: - - project_name: "exampleorg" +onionspray_projects: + - name: "exampleorg" # Onion Service proxying using Onionspray's hardmap config hardmaps: # Onion Service mapping to example.org @@ -101,8 +101,8 @@ Finally, add the results in the variable definitions for your host, such as `host_vars/myhost.yml`: ```yaml -onionspray_project_settings: - - project_name: "examplenet" +onionspray_projects: + - name: "examplenet" # Onion Service proxying using Onionspray's hardmap config hardmaps: # Onion Service mapping to example.net @@ -134,8 +134,8 @@ onionspray_provider: 'myprovider' onionspray_key_uploader_script : '../scripts/upload-keys-to-onionspray-instances' onionspray_cert_uploader_script: '../scripts/upload-certs-to-onionspray-instances' -onionspray_project_settings: - - project_name: "example1" +onionspray_projects: + - name: "example1" # Onion Service proxying using Onionspray's hardmap config hardmaps: # Onion Service mapping to example.null @@ -193,7 +193,7 @@ onionspray_project_settings: set block_err This subdomain is forbidden. set block_host_re ^forbidden\. - - project_name: "example2" + - name: "example2" # Onion Service proxying using Onionspray's softmap config softmaps: # Onion Service mapping to example.org, using Onionbalance diff --git a/defaults/main.yml b/defaults/main.yml index bdbb0cb..ff484f5 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -155,18 +155,13 @@ onionspray_selfsigned_cert_state_or_province: The Internet # such as the secrets manager. onionspray_provider: 'onionspray' -# A list of dictionaries, each dictionary representing a project (i.e. a -# clearnet website that Onionspray will proxy). -# -# The supported fields per dictionary are listed below. -# -# ### `onionspray_project_settings` +# Onionspray projects # # A list of dictionaries, each dictionary representing a project (i.e. a clearnet # website that Onionspray will proxy). The supported fields per dictionary are # listed below. # -# #### `project_name` +# #### `name` # # REQUIRED: the name of your Onionspray project, used to set the configuration # and settings filenames. @@ -389,11 +384,11 @@ onionspray_provider: 'onionspray' # # If additional settings are neded (those not explicitly supported by this role), # you can put them in this variable and they will be appended to the generated -# `PROJECT_NAME.conf` configuration file. +# configuration file. # # Defaults to an empty string. # -onionspray_project_settings: [] +onionspray_projects: [] # # Uploading keys and certificates from external locations, diff --git a/handlers/main.yml b/handlers/main.yml index 5def284..c3f0830 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -8,25 +8,25 @@ - name: Remove Onionspray generated settings config files ansible.builtin.file: - path: "{{ onionspray_path }}/{{ onionspray_project_settings.project_name }}.conf" + path: "{{ onionspray_path }}/{{ onionspray_project.name }}.conf" state: absent no_log: true - loop: "{{ onionspray_project_settings }}" + loop: "{{ onionspray_projects }}" loop_control: - loop_var: onionspray_project_settings + loop_var: onionspray_project - name: Remove Onionspray generated project directories ansible.builtin.file: - path: "{{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/" + path: "{{ onionspray_path }}/projects/{{ onionspray_project.name }}/" state: absent no_log: true - loop: "{{ onionspray_project_settings }}" + loop: "{{ onionspray_projects }}" loop_control: - loop_var: onionspray_project_settings + loop_var: onionspray_project - name: Generate Onionspray configs ansible.builtin.command: - cmd: "{{ onionspray_path }}/onionspray config {{ onionspray_path }}/{{ onionspray_project_settings.project_name }}.tconf" + cmd: "{{ onionspray_path }}/onionspray config {{ onionspray_path }}/{{ onionspray_project.name }}.tconf" become: true become_user: "{{ onionspray_user }}" # Workaround allowing to run Git even if the shell is set to /sbin/nologin @@ -36,9 +36,9 @@ become_flags: "su -s /bin/bash - {{ onionspray_user }} /bin/bash -c" changed_when: true no_log: true - loop: "{{ onionspray_project_settings }}" + loop: "{{ onionspray_projects }}" loop_control: - loop_var: onionspray_project_settings + loop_var: onionspray_project - name: Reload systemctl daemon ansible.builtin.systemd: diff --git a/molecule/local/converge.yml b/molecule/local/converge.yml index 900eccd..33661ce 100644 --- a/molecule/local/converge.yml +++ b/molecule/local/converge.yml @@ -17,12 +17,12 @@ gather_facts: true vars: - onionspray_project_settings: - - project_name: "example1" + onionspray_projects: + - name: "example1" softmaps: - upstream_address: example.com - upstream_address: example.org - - project_name: "example2" + - name: "example2" hardmaps: # Bogus data for testing purposes - onion_address: yetkvkuqlr23sdzkf2mynt7aixfjzq6pjys2ffurr3hzpyfxrc7swpqd diff --git a/molecule/podman/converge.yml b/molecule/podman/converge.yml index 709f888..5320c86 100644 --- a/molecule/podman/converge.yml +++ b/molecule/podman/converge.yml @@ -13,12 +13,12 @@ gather_facts: true vars: - onionspray_project_settings: - - project_name: "example1" + onionspray_projects: + - name: "example1" softmaps: - upstream_address: example.com - upstream_address: example.org - - project_name: "example2" + - name: "example2" hardmaps: # Bogus data for testing purposes - onion_address: yetkvkuqlr23sdzkf2mynt7aixfjzq6pjys2ffurr3hzpyfxrc7swpqd diff --git a/tasks/certs/base.yml b/tasks/certs/base.yml index 7caa49a..920c4dd 100644 --- a/tasks/certs/base.yml +++ b/tasks/certs/base.yml @@ -43,7 +43,7 @@ - name: certs | base | Create the project certs folder ansible.builtin.file: - path : "{{ onionspray_path }}/projects/{{ settings.project_name }}/ssl" + path : "{{ onionspray_path }}/projects/{{ onionspray_project.name }}/ssl" owner : "{{ onionspray_user }}" group : "{{ onionspray_user }}" state : directory diff --git a/tasks/certs/copy.yml b/tasks/certs/copy.yml index d315efd..d4ee472 100644 --- a/tasks/certs/copy.yml +++ b/tasks/certs/copy.yml @@ -10,17 +10,17 @@ tags: - certificates when: - - onionspray_project_settings[onionspray_project_mapping] is defined + - onionspray_project[onionspray_project_mapping] is defined block: - name: "certs | copy | Copy Onion TLS certificate for {{ onionspray_project_mapping }}" ansible.builtin.copy: content: "{{ onionspray_site.tls.certificate }}" - dest: "{{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/ssl/{ onionspray_site.onion_address | truncate(20, True, '')-v3.cert" + dest: "{{ onionspray_path }}/projects/{{ onionspray_project.name }}/ssl/{ onionspray_site.onion_address | truncate(20, True, '')-v3.cert" owner: "{{ onionspray_user }}" group: "{{ onionspray_user }}" mode: "600" no_log: true - loop: "{{ onionspray_project_settings[onionspray_project_mapping] }}" + loop: "{{ onionspray_project[onionspray_project_mapping] }}" loop_control: loop_var: onionspray_site label: onionspray_site.onion_address @@ -32,12 +32,12 @@ - name: "certs | copy | Copy Onion TLS secret key for {{ onionspray_project_mapping }}" ansible.builtin.copy: content: "{{ onionspray_site.tls.secret_key }}" - dest: "{{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/ssl/{ onionspray_site.onion_address | truncate(20, True, '')-v3.pem" + dest: "{{ onionspray_path }}/projects/{{ onionspray_project.name }}/ssl/{ onionspray_site.onion_address | truncate(20, True, '')-v3.pem" owner: "{{ onionspray_user }}" group: "{{ onionspray_user }}" mode: "600" no_log: true - loop: "{{ onionspray_project_settings[onionspray_project_mapping] }}" + loop: "{{ onionspray_project[onionspray_project_mapping] }}" loop_control: loop_var: onionspray_site label: onionspray_site.onion_address diff --git a/tasks/certs/upload.yml b/tasks/certs/upload.yml index 98624b2..eac0ffd 100644 --- a/tasks/certs/upload.yml +++ b/tasks/certs/upload.yml @@ -10,19 +10,19 @@ tags: - certificates when: - - onionspray_project_settings[onionspray_project_mapping] is defined + - onionspray_project[onionspray_project_mapping] is defined block: - #- name: certs | upload | Debug onionspray cert uploader command line invocation + #- name: "certs | upload | Debug onionspray cert uploader command line invocation for {{ onionspray_project_mapping }}" # ansible.builtin.debug: # msg: > # {{ onionspray_cert_uploader_script }} {{ onionspray_provider }} {{ inventory_hostname }} - # {{ onionspray_project_settings.project_name }} {{ onionspray_site.onion_address }} + # {{ onionspray_project.name }} {{ onionspray_site.onion_address }} # {{ onionspray_site.upstream }} {{ onionspray_user }} # {{ onionspray_path }} # {{ onionspray_keyring }} # {{ onionspray_secrets_manager }} # no_log: true - # loop: "{{ onionspray_project_settings[onionspray_project_mapping] }}" + # loop: "{{ onionspray_project[onionspray_project_mapping] }}" # loop_control: # loop_var : onionspray_site # label : "{{ onionspray_site.onion_address }}" @@ -30,11 +30,11 @@ # - onionspray_site.onion_address is defined # - onionspray_site.certificate_upload is defined # - onionspray_site.certificate_upload == true - # - onionspray_cert_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings + # - onionspray_cert_uploader_script | length != 0 and onionspray_project_mapping in onionspray_projects - #- name: certs | upload | Ensure certificate file existence and permissions + #- name: "certs | upload | Ensure certificate file existence and permissions for {{ onionspray_project_mapping }}" # ansible.builtin.file: - # path : "{{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/ssl/{{ onionspray_site.onion_address|truncate(20, True, '') }}-v3.cert" + # path : "{{ onionspray_path }}/projects/{{ onionspray_project.name }}/ssl/{{ onionspray_site.onion_address|truncate(20, True, '') }}-v3.cert" # owner : "{{ onionspray_user }}" # group : "{{ onionspray_user }}" # state : touch @@ -47,11 +47,11 @@ # - onionspray_site.onion_address is defined # - onionspray_site.certificate_upload is defined # - onionspray_site.certificate_upload == true - # - onionspray_cert_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings + # - onionspray_cert_uploader_script | length != 0 and onionspray_project_mapping in onionspray_projects - #- name: certs | upload | Ensure the TLS private key file existence and permissions + #- name: "certs | upload | Ensure the TLS private key file existence and permissions for {{ onionspray_project_mapping }}" # ansible.builtin.file: - # path : "{{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/ssl/{{ site.onion_address|truncate(20, True, '') }}-v3.pem" + # path : "{{ onionspray_path }}/projects/{{ onionspray_project.name }}/ssl/{{ onionspray_site.onion_address|truncate(20, True, '') }}-v3.pem" # owner : "{{ onionspray_user }}" # group : "{{ onionspray_user }}" # state : touch @@ -64,13 +64,14 @@ # - onionspray_site.onion_address is defined # - onionspray_site.certificate_upload is defined # - onionspray_site.certificate_upload == true - # - onionspray_cert_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings + # - onionspray_cert_uploader_script | length != 0 and onionspray_project_mapping in onionspray_projects - name: "certs | upload | Upload Onion Service certs for {{ onionspray_project_mapping }}" ansible.builtin.command: cmd: > {{ onionspray_cert_uploader_script }} {{ onionspray_provider }} {{ inventory_hostname }} - {{ onionspray_project_settings.project_name }} {{ onionspray_site.onion_address }} {{ onionspray_site.upstream_address }} {{ onionspray_user }} + {{ onionspray_project.name }} {{ onionspray_site.onion_address }} {{ onionspray_site.upstream_address }} + {{ onionspray_user }} {{ onionspray_path }} {{ onionspray_keyring }} {{ onionspray_secrets_manager }} @@ -79,15 +80,15 @@ become : true become_user : "{{ lookup('env', 'USER') }}" no_log : true - loop : "{{ onionspray_project_settings[onionspray_project_mapping] }}" + loop : "{{ onionspray_project[onionspray_project_mapping] }}" loop_control : loop_var : onionspray_site - #label : "{{ onionspray_site.onion_address }}" + #label : "{{ onionspray_site.onion_address }}" when: - onionspray_site.onion_address is defined - onionspray_site.certificate_upload is defined - onionspray_site.certificate_upload - - onionspray_cert_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings + - onionspray_cert_uploader_script | length != 0 and onionspray_project_mapping in onionspray_projects notify : Restart Onionspray # This task always change something (even if only the mtime of a file) diff --git a/tasks/keys/copy.yml b/tasks/keys/copy.yml index 0b7d6cd..064e7bc 100644 --- a/tasks/keys/copy.yml +++ b/tasks/keys/copy.yml @@ -10,7 +10,7 @@ tags: - keys when: - - onionspray_project_settings[onionspray_project_mapping] is defined + - onionspray_project[onionspray_project_mapping] is defined block: - name: "keys | copy | Copy Onion v3 public key for {{ onionspray_project_mapping }}" ansible.builtin.copy: @@ -20,7 +20,7 @@ group: "{{ onionspray_user }}" mode: "600" no_log: true - loop: "{{ onionspray_project_settings[onionspray_project_mapping] }}" + loop: "{{ onionspray_project[onionspray_project_mapping] }}" loop_control: loop_var: onionspray_site label: onionspray_site.onion_address @@ -37,7 +37,7 @@ group: "{{ onionspray_user }}" mode: "600" no_log: true - loop: "{{ onionspray_project_settings[onionspray_project_mapping] }}" + loop: "{{ onionspray_project[onionspray_project_mapping] }}" loop_control: loop_var: onionspray_site label: onionspray_site.onion_address diff --git a/tasks/keys/main.yml b/tasks/keys/main.yml index 4639d0e..431c5e2 100644 --- a/tasks/keys/main.yml +++ b/tasks/keys/main.yml @@ -6,17 +6,17 @@ # SPDX-License-Identifier: AGPL-3.0-or-later # -- name: "keys | main | Base keys configuration for {{ onionspray_project_settings.project_name }}" +- name: "keys | main | Base keys configuration for {{ onionspray_project.name }}" ansible.builtin.include_tasks: keys/base.yml -- name: "keys | main | Copy Onion Service keys for {{ onionspray_project_settings.project_name }}" +- name: "keys | main | Copy Onion Service keys for {{ onionspray_project.name }}" ansible.builtin.include_tasks: keys/copy.yml no_log: true loop: ['hardmaps', 'softmaps'] loop_control: loop_var: onionspray_project_mapping -- name: "keys | main | Upload Onion Service keys for {{ onionspray_project_settings.project_name }}" +- name: "keys | main | Upload Onion Service keys for {{ onionspray_project.name }}" ansible.builtin.include_tasks: keys/upload.yml no_log: true loop: ['hardmaps', 'softmaps'] diff --git a/tasks/keys/upload.yml b/tasks/keys/upload.yml index 5c79a5b..785b42d 100644 --- a/tasks/keys/upload.yml +++ b/tasks/keys/upload.yml @@ -10,13 +10,14 @@ tags: - keys when: - - onionspray_project_settings[onionspray_project_mapping] is defined + - onionspray_project[onionspray_project_mapping] is defined block: - #- name: Debug onionspray key uploader command line invocation + #- name: "Debug onionspray key uploader command line invocation for {{ onionspray_project_mapping }}" # ansible.builtin.debug: # msg: > # {{ onionspray_key_uploader_script }} {{ onionspray_provider }} {{ inventory_hostname }} - # {{ onionspray_project.name }} {{ onionspray_site.onion_address }} {{ onionspray_site.upstream_address }} {{ onionspray_user }} + # {{ onionspray_project.name }} {{ onionspray_site.onion_address }} {{ onionspray_site.upstream_address }} + # {{ onionspray_user }} # {{ onionspray_path }} # loop : "{{ onionspray_project[onionspray_project_mapping] }}" # loop_control : @@ -26,9 +27,9 @@ # - onionspray_site.onion_address is defined # - onionspray_site.keys_upload is defined # - onionspray_site.keys_upload == true - # - onionspray_key_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings + # - onionspray_key_uploader_script | length != 0 and onionspray_project_mapping in onionspray_projects - #- name: Ensure the public key file existence and permissions + #- name: "Ensure the public key file existence and permissions for {{ onionspray_project_mapping }}" # ansible.builtin.file: # path : "{{ onionspray_path }}/projects/{{ onionspray_project.name }}/{{ onionspray_site.onion_address }}-v3pub.key" # owner : "{{ onionspray_user }}" @@ -42,9 +43,9 @@ # - onionspray_site.onion_address is defined # - onionspray_site.keys_upload is defined # - onionspray_site.keys_upload == true - # - onionspray_key_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings + # - onionspray_key_uploader_script | length != 0 and onionspray_project_mapping in onionspray_projects - #- name: Ensure the private key file existence and permissions + #- name: "Ensure the private key file existence and permissions for {{ onionspray_project_mapping }}" # ansible.builtin.file: # path : "{{ onionspray_path }}/projects/{{ onionspray_project.name }}/{{ onionspray_site.onion_address }}-v3sec.key" # owner : "{{ onionspray_user }}" @@ -58,13 +59,14 @@ # - onionspray_site.onion_address is defined # - onionspray_site.keys_upload is defined # - onionspray_site.keys_upload == true - # - onionspray_key_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings + # - onionspray_key_uploader_script | length != 0 and onionspray_project_mapping in onionspray_projects - name: "keys | upload | Upload Onion Service keys for {{ onionspray_project_mapping }}" ansible.builtin.command: cmd: > {{ onionspray_key_uploader_script }} {{ onionspray_provider }} {{ inventory_hostname }} - {{ onionspray_project.name }} {{ onionspray_site.onion_address }} {{ onionspray_site.upstream_address }} {{ onionspray_user }} + {{ onionspray_project.name }} {{ onionspray_site.onion_address }} {{ onionspray_site.upstream_address }} + {{ onionspray_user }} {{ onionspray_path }} {{ onionspray_keyring }} {{ onionspray_secrets_manager }} @@ -75,12 +77,12 @@ loop : "{{ onionspray_project[onionspray_project_mapping] }}" loop_control: loop_var : onionspray_site - label : "{{ onionspray_site.onion_address }}" + #label : "{{ onionspray_site.onion_address }}" when: - onionspray_site.onion_address is defined - onionspray_site.keys_upload is defined - onionspray_site.keys_upload - - onionspray_key_uploader_script | length != 0 and onionspray_project_mapping in onionspray_project_settings + - onionspray_key_uploader_script | length != 0 and onionspray_project_mapping in onionspray_projects notify : Restart Onionspray # This task always change something (even if only the mtime of a file) diff --git a/tasks/logs/s3/check.yml b/tasks/logs/s3/check.yml index 5a2cd7a..4a11734 100644 --- a/tasks/logs/s3/check.yml +++ b/tasks/logs/s3/check.yml @@ -8,7 +8,7 @@ - name: s3 | check | Check the S3 sync logs when: - - onionspray_project_settings.log_s3_check | default(false) + - onionspray_project.log_s3_check | default(false) block: #- name: logs | s3 | Find S3 sync logs # ansible.builtin.find: @@ -18,7 +18,7 @@ - name: s3 | check | Check the latest S3 sync log ansible.builtin.stat: - path: "{{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/log/s3-sync.log" + path: "{{ onionspray_path }}/projects/{{ onionspray_project.name }}/log/s3-sync.log" register: onionspray_s3_sync_log_latest #- name: s3 | check | Check if we have a latest S3 sync log @@ -46,7 +46,7 @@ - name: s3 | check | Get the last few lines of the latest S3 sync log ansible.builtin.command: - cmd: "/usr/bin/tail -n 5 {{ onionspray_path }}/projects/{{ onionspray_project_settings.project_name }}/log/s3-sync.log" + cmd: "/usr/bin/tail -n 5 {{ onionspray_path }}/projects/{{ onionspray_project.name }}/log/s3-sync.log" when: > onionspray_s3_sync_log_latest.path is defined and onionspray_s3_sync_log_latest.stat.path == onionspray_path + '/log/s3-sync.log' and not diff --git a/tasks/logs/s3/main.yml b/tasks/logs/s3/main.yml index 68dbac4..6f694ee 100644 --- a/tasks/logs/s3/main.yml +++ b/tasks/logs/s3/main.yml @@ -11,7 +11,7 @@ - name: s3 | main | Check existing logs ansible.builtin.include_tasks: logs/s3/check.yml - loop: "{{ onionspray_project_settings }}" + loop: "{{ onionspray_projects }}" loop_control: - loop_var: onionspray_project_settings - label: onionspray_project_settings.project_name + loop_var: onionspray_project + label: onionspray_project.name diff --git a/tasks/main.yml b/tasks/main.yml index 6ad1140..bcc196a 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -14,24 +14,24 @@ - name: Key handling ansible.builtin.include_tasks: keys/main.yml - loop: "{{ onionspray_project_settings }}" + loop: "{{ onionspray_projects }}" loop_control: - loop_var: onionspray_project_settings - label: onionspray_project_settings.project_name + loop_var: onionspray_project + label: onionspray_project.name - name: Certificate handling ansible.builtin.include_tasks: certs/main.yml - loop: "{{ onionspray_project_settings }}" + loop: "{{ onionspray_projects }}" loop_control: - loop_var: onionspray_project_settings - label: onionspray_project_settings.project_name + loop_var: onionspray_project + label: onionspray_project.name - name: Projects configuration ansible.builtin.include_tasks: projects.yml - loop: "{{ onionspray_project_settings }}" + loop: "{{ onionspray_projects }}" loop_control: - loop_var: onionspray_project_settings - label: onionspray_project_settings.project_name + loop_var: onionspray_project + label: onionspray_project.name - name: Build ansible.builtin.include_tasks: build.yml diff --git a/tasks/projects.yml b/tasks/projects.yml index e9a5775..58c077a 100644 --- a/tasks/projects.yml +++ b/tasks/projects.yml @@ -6,10 +6,10 @@ # SPDX-License-Identifier: AGPL-3.0-or-later # -- name: "projects | Generate project settings for {{ onionspray_project_settings.project_name }}" +- name: "projects | Generate project settings for {{ onionspray_project.name }}" ansible.builtin.template: src: projects/project.tconf.j2 - dest: "{{ onionspray_path }}/{{ onionspray_project_settings.project_name }}.tconf" + dest: "{{ onionspray_path }}/{{ onionspray_project.name }}.tconf" owner: "{{ onionspray_user }}" group: "{{ onionspray_user }}" mode: "600" diff --git a/templates/logs/logrotate.j2 b/templates/logs/logrotate.j2 index 49bc40a..4a23152 100644 --- a/templates/logs/logrotate.j2 +++ b/templates/logs/logrotate.j2 @@ -36,11 +36,11 @@ {{ onionspray_path }}/onionspray ob-reload -a endscript } -{% for project in onionspray_project_settings %} +{% for project in onionspray_projects %} {% if project.log_rotation | default(true) %} -# Project logs for {{ project.project_name }} -{{ onionspray_path }}/projects/{{ project.project_name }}/log/*.log { +# Project logs for {{ project.name }} +{{ onionspray_path }}/projects/{{ project.name }}/log/*.log { su {{ onionspray_user }} {{ onionspray_user }} create 644 {{ onionspray_user }} {{ onionspray_user }} {{ project.log_rotation_frequency | default('hourly') }} @@ -59,7 +59,7 @@ INCLUDE_PATTERN="nginx-access*.log-*.gz" BUCKET_NAME="{{ project.log_s3_bucket_name | default('') }}" DATE="$(date -u '+%Y-%m-%dT%H:%mZ')" - SYNC_LOG="{{ onionspray_path }}/projects/{{ project.project_name }}/log/s3-sync.log" + SYNC_LOG="{{ onionspray_path }}/projects/{{ project.name }}/log/s3-sync.log" # AWS CLI configuration export AWS_ENDPOINT_URL="{{ s3_endpoint }}" @@ -94,8 +94,8 @@ # Reload Onionspray #{{ onionspray_path }}/onionspray --local nxreload -a #{{ onionspray_path }}/onionspray --local torreload -a - {{ onionspray_path }}/onionspray --local nxreload {{ project.project_name }} - {{ onionspray_path }}/onionspray --local torreload {{ project.project_name }} + {{ onionspray_path }}/onionspray --local nxreload {{ project.name }} + {{ onionspray_path }}/onionspray --local torreload {{ project.name }} endscript } {% endif %} diff --git a/templates/projects/project.tconf.j2 b/templates/projects/project.tconf.j2 index a6b56c6..8388d66 100644 --- a/templates/projects/project.tconf.j2 +++ b/templates/projects/project.tconf.j2 @@ -1,5 +1,5 @@ # -# Onionspray configuration file for project {{ onionspray_project_settings.project_name }} +# Onionspray configuration file for project {{ onionspray_project.name }} # # Copyright (C) 2025 The Tor Project, Inc. # SPDX-License-Identifier: AGPL-3.0-or-later @@ -12,8 +12,8 @@ # General # -{% if onionspray_project_settings.project_name is defined %} -set project {{ onionspray_project_settings.project_name }} +{% if onionspray_project.name is defined %} +set project {{ onionspray_project.name }} {% endif %} # @@ -28,95 +28,95 @@ set nginx_proxy_ssl_trusted_certificate {{ onionspray_ca_file }} # Proxy # -{% if onionspray_project_settings.x_from_onion_value is defined %} -set x_from_onion_value {{ onionspray_project_settings.x_from_onion_value }} +{% if onionspray_project.x_from_onion_value is defined %} +set x_from_onion_value {{ onionspray_project.x_from_onion_value }} {% endif %} -{%- if onionspray_project_settings.inject_headers_upstream is defined %} -set inject_headers_upstream {{ onionspray_project_settings.inject_headers_upstream }} +{%- if onionspray_project.inject_headers_upstream is defined %} +set inject_headers_upstream {{ onionspray_project.inject_headers_upstream }} {% endif %} -{%- if onionspray_project_settings.nginx_resolver is defined %} -set nginx_resolver {{ onionspray_project_settings.nginx_resolver }} +{%- if onionspray_project.nginx_resolver is defined %} +set nginx_resolver {{ onionspray_project.nginx_resolver }} {% endif %} -{%- if onionspray_project_settings.nginx_tmpfile_size is defined %} -set nginx_tmpfile_size {{ onionspray_project_settings.nginx_tmpfile_size }} +{%- if onionspray_project.nginx_tmpfile_size is defined %} +set nginx_tmpfile_size {{ onionspray_project.nginx_tmpfile_size }} {% endif %} -{%- if onionspray_project_settings.nginx_cache_seconds is defined %} -set nginx_cache_seconds {{ onionspray_project_settings.nginx_cache_seconds }} +{%- if onionspray_project.nginx_cache_seconds is defined %} +set nginx_cache_seconds {{ onionspray_project.nginx_cache_seconds }} {% endif %} -{%- if onionspray_project_settings.nginx_cache_size is defined %} -set nginx_cache_size {{ onionspray_project_settings.nginx_cache_size }} +{%- if onionspray_project.nginx_cache_size is defined %} +set nginx_cache_size {{ onionspray_project.nginx_cache_size }} {% endif %} -{%- if onionspray_project_settings.nginx_x_onion_circuit_id is defined %} -set nginx_x_onion_circuit_id {{ onionspray_project_settings.nginx_x_onion_circuit_id }} +{%- if onionspray_project.nginx_x_onion_circuit_id is defined %} +set nginx_x_onion_circuit_id {{ onionspray_project.nginx_x_onion_circuit_id }} {% endif %} # # Logging # -{% if onionspray_project_settings.log_separate is defined %} -set log_separate {{ onionspray_project_settings.log_separate }} +{% if onionspray_project.log_separate is defined %} +set log_separate {{ onionspray_project.log_separate }} {% endif %} # # Tor # -{% if onionspray_project_settings.tor_export_circuit_id is defined %} -set tor_export_circuit_id {{ onionspray_project_settings.tor_export_circuit_id }} +{% if onionspray_project.tor_export_circuit_id is defined %} +set tor_export_circuit_id {{ onionspray_project.tor_export_circuit_id }} {% endif %} -{%- if onionspray_project_settings.tor_intros_per_daemon is defined %} -set tor_intros_per_daemon {{ onionspray_project_settings.tor_intros_per_daemon }} +{%- if onionspray_project.tor_intros_per_daemon is defined %} +set tor_intros_per_daemon {{ onionspray_project.tor_intros_per_daemon }} {% endif %} -{%- if onionspray_project_settings.tor_single_onion is defined %} -set tor_single_onion {{ onionspray_project_settings.tor_single_onion }} +{%- if onionspray_project.tor_single_onion is defined %} +set tor_single_onion {{ onionspray_project.tor_single_onion }} {% endif %} -{%- if onionspray_project_settings.tor_pow_enabled is defined %} -set tor_pow_enabled {{ onionspray_project_settings.tor_pow_enabled }} +{%- if onionspray_project.tor_pow_enabled is defined %} +set tor_pow_enabled {{ onionspray_project.tor_pow_enabled }} {% endif %} -{%- if onionspray_project_settings.tor_pow_queue_rate is defined %} -set tor_pow_queue_rate {{ onionspray_project_settings.tor_pow_queue_rate }} +{%- if onionspray_project.tor_pow_queue_rate is defined %} +set tor_pow_queue_rate {{ onionspray_project.tor_pow_queue_rate }} {% endif %} -{%- if onionspray_project_settings.tor_pow_queue_burst is defined %} -set tor_pow_queue_burst {{ onionspray_project_settings.tor_pow_queue_burst }} +{%- if onionspray_project.tor_pow_queue_burst is defined %} +set tor_pow_queue_burst {{ onionspray_project.tor_pow_queue_burst }} {% endif %} -{%- if onionspray_project_settings.tor_intro_dos_defense is defined %} -set tor_intro_dos_defense {{ onionspray_project_settings.tor_intro_dos_defense }} +{%- if onionspray_project.tor_intro_dos_defense is defined %} +set tor_intro_dos_defense {{ onionspray_project.tor_intro_dos_defense }} {% endif %} -{%- if onionspray_project_settings.tor_intro_dos_burst_per_sec is defined %} -set tor_intro_dos_burst_per_sec {{ onionspray_project_settings.tor_intro_dos_burst_per_sec }} +{%- if onionspray_project.tor_intro_dos_burst_per_sec is defined %} +set tor_intro_dos_burst_per_sec {{ onionspray_project.tor_intro_dos_burst_per_sec }} {% endif %} -{%- if onionspray_project_settings.tor_intro_dos_rate_per_sec is defined %} -set tor_intro_dos_rate_per_sec {{ onionspray_project_settings.tor_intro_dos_rate_per_sec }} +{%- if onionspray_project.tor_intro_dos_rate_per_sec is defined %} +set tor_intro_dos_rate_per_sec {{ onionspray_project.tor_intro_dos_rate_per_sec }} {% endif %} -{%- if onionspray_project_settings.tor_max_streams is defined %} -set tor_max_streams {{ onionspray_project_settings.tor_max_streams }} +{%- if onionspray_project.tor_max_streams is defined %} +set tor_max_streams {{ onionspray_project.tor_max_streams }} {% endif %} -{%- if onionspray_project_settings.tor_max_streams_close_circuit is defined %} -set tor_max_streams_close_circuit {{ onionspray_project_settings.tor_max_streams_close_circuit }} +{%- if onionspray_project.tor_max_streams_close_circuit is defined %} +set tor_max_streams_close_circuit {{ onionspray_project.tor_max_streams_close_circuit }} {% endif %} # # Foreign maps # -{% for foreignmap in onionspray_project_settings.foreignmaps | default([]) %} +{% for foreignmap in onionspray_project.foreignmaps | default([]) %} foreignmap {{ foreignmap.onion_address }} {{ foreignmap.upstream_address }} {% endfor %} @@ -124,7 +124,7 @@ foreignmap {{ foreignmap.onion_address }} {{ foreignmap.upstream_address }} # Hardmaps # -{% for hardmap in onionspray_project_settings.hardmaps | default([]) %} +{% for hardmap in onionspray_project.hardmaps | default([]) %} hardmap {{ hardmap.onion_address | default('%NEW_V3_ONION%') }} {{ hardmap.upstream_address }} {% endfor %} @@ -132,7 +132,7 @@ hardmap {{ hardmap.onion_address | default('%NEW_V3_ONION%') }} {{ hardmap.upstr # Softmaps # -{% for softmap in onionspray_project_settings.softmaps | default([]) %} +{% for softmap in onionspray_project.softmaps | default([]) %} softmap {{ softmap.onion_address | default('%NEW_V3_ONION%') }} {{ softmap.upstream_address }} {% endfor %} @@ -140,4 +140,4 @@ softmap {{ softmap.onion_address | default('%NEW_V3_ONION%') }} {{ softmap.upstr # Other # -{{ onionspray_project_settings.custom_settings | default('') }} +{{ onionspray_project.custom_settings | default('') }} -- GitLab