Merge branch 'feat/ci' into 'main'

---

#

# Ansible Lint configuration the Onionprobe Ansible role

#

# For a detailed explanation of supported values, check the documentation at

# https://ansible.readthedocs.io/projects/lint/configuring/

#

# Copyright (C) 2024 The Tor Project, Inc.

# SPDX-License-Identifier: AGPL-3.0-or-later

#

# Excluded paths

exclude_paths:

  - .cache/ # implicit unless exclude_paths is defined in config

  - .gitlab-ci.yml

  - .molecule/roles

# Enable checking of loop variable prefixes in roles

loop_var_prefix: "^(__|{role}_)"

# Enforce variable names to follow pattern below, in addition to Ansible own

# requirements

var_naming_pattern: "^[a-z_][a-z0-9_]*$"

# Use default rules

use_default_rules: true

# Skip list

skip_list:

  - yaml[colons]

  - yaml[comments]

# Rules configuration

enable_list:

  - args

  - empty-string-compare

  - no-log-password

  - no-same-owner

  - name[prefix]

  - galaxy-version-incorrect

  - yaml

# Ansible-lint does not fail on warnings from the rules or tags listed below

warn_list:

  - experimental

# Offline mode disables installation of requirements.yml and schema refreshing

offline: true

# Define required Ansible's variables to satisfy syntax check

extra_vars:

  foo: bar

  multiline_string_variable: |

    line1

    line2

  complex_variable: ":{;\t$()"

# Allow setting custom prefix for name[prefix] rule

task_name_prefix: "{stem} | "

__pycache__

molecule/podman/roles

molecule/local/roles

---

#

# GitLab CI for the Onionspray Ansible role

#

# Copyright (C) 2024 The Tor Project, Inc.

# SPDX-License-Identifier: AGPL-3.0-or-later

#

# Linting

lint:

  stage: test

  image: debian:bookworm

  before_script:

    - apt-get update

    - apt install -y python3-pip ansible

    - python3 -m pip install ansible-lint --break-system-packages

    - ansible --version

    - ansible-lint --version

    - mkdir -p molecule/podman/roles && ln -s ../../.. molecule/podman/roles/onionspray

    - mkdir -p molecule/local/roles  && ln -s ../../.. molecule/local/roles/onionspray

  script:

    - ansible-lint

# Podman CI workflow

molecule_podman:

  stage: test

  image:

    name: containers.torproject.org/tpo/tpa/base-images/podman:bookworm

    docker:

      user: root

  before_script:

    - apt-get update

    - apt install -y sudo python3-pip ansible

    - python3 -m pip install molecule-plugins[podman] --break-system-packages

    - sudo -u podman python3 --version

    - sudo -u podman ansible --version

    - sudo -u podman molecule --version

    - sudo -u podman podman info

    - sudo -u podman mkdir -p molecule/podman/roles && sudo -u podman ln -s ../../.. molecule/podman/roles/onionspray

  script:

    - sudo -u podman molecule test -s podman

# Run Ansible tests directly in the CI containers

#molecule_local:

#  stage: test

#

#  image: debian:bookworm

#

#  before_script:

#    - apt-get update

#    - apt install -y python3-pip ansible

#    - python3 -m pip install molecule --break-system-packages

#    - python3 --version

#    - ansible --version

#    - molecule --version

#    - mkdir -p molecule/podman/roles && ln -s ../../.. molecule/podman/roles/onionspray

#

#  script:

#    - molecule test -s local

#

# Makefile for developing the Onionspray Ansible Role

#

# Copyright (C) 2024 The Tor Project, Inc.

# SPDX-License-Identifier: AGPL-3.0-or-later

#

# Provisioning

provision:

	@./scripts/provision

# Linting

lint:

	@ansible-lint

# Podman tests

test-podman:

	@molecule test -s podman

# Local tests

test-local:

	@molecule test -s local

	@echo Waiting for the service to boostrap before checking it...

	@sleep 30

	@sudo service onionspray status

---

- name: Converge

  hosts: all

  # Ensure Ansible become root when running on localhost

  become: true

  become_method: community.general.sudosu

  # Gathering facts requires a container with Python installed

  gather_facts: true

  vars:

    onionspray_proxied_domain: 'example.org'

  pre_tasks:

    # Install the ACL package

    # https://stackoverflow.com/questions/46352173/ansible-failed-to-set-permissions-on-the-temporary#56379678

    - name: Install acl

      ansible.builtin.package:

        name: acl

    # Sudo is needed by some Ansible modules, and may not be available in the

    # container instance

    - name: Install sudo

      ansible.builtin.package:

        name: sudo

    #- name: Create the admin group

    #  ansible.builtin.group:

    #    name: "admin"

    # Users in admin group should have passwordless sudo

    # This ensures the Onionspray build script runs

    #- name: Configure passwordless sudo for the admin group

    #  ansible.builtin.lineinfile:

    #    create : true

    #    owner  : "root"

    #    group  : "root"

    #    mode   : "0600"

    #    line   : "%admin ALL=(ALL) NOPASSWD : ALL"

    #    path   : /etc/sudoers.d/90-admin

  roles:

    - onionspray