From 69334dab64f9099e80023f58ca97dc74e9ef9c7d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Fri, 22 Aug 2025 16:18:15 +0200 Subject: [PATCH 01/29] Add role to deploy test helpers repo --- ansible/deploy-test-helpers.yml | 17 +++ ansible/inventory | 3 +- ansible/roles/test_helpers/defaults/main.yml | 1 + ansible/roles/test_helpers/tasks/main.yml | 108 ++++++++++++++++++ .../test_helpers/templates/jsonth.service | 20 ++++ tf/environments/dev/main.tf | 101 ++++++++++++++++ 6 files changed, 249 insertions(+), 1 deletion(-) create mode 100644 ansible/deploy-test-helpers.yml create mode 100644 ansible/roles/test_helpers/defaults/main.yml create mode 100644 ansible/roles/test_helpers/tasks/main.yml create mode 100644 ansible/roles/test_helpers/templates/jsonth.service diff --git a/ansible/deploy-test-helpers.yml b/ansible/deploy-test-helpers.yml new file mode 100644 index 00000000..bccfddf2 --- /dev/null +++ b/ansible/deploy-test-helpers.yml @@ -0,0 +1,17 @@ +--- +- name: Deploy test helpers + hosts: + - test-helpers.dev.ooni.io + - test-helpers.prod.ooni.io + become: true + roles: + - role: bootstrap + - role: nginx + - role: prometheus_node_exporter + vars: + node_exporter_port: 9100 + node_exporter_host: "0.0.0.0" + prometheus_nginx_proxy_config: + - location: /metrics/node_exporter + proxy_pass: http://127.0.0.1:9100/metrics + - role: test_helpers \ No newline at end of file diff --git a/ansible/inventory b/ansible/inventory index 3a23e524..eede599b 100644 --- a/ansible/inventory +++ b/ansible/inventory @@ -45,4 +45,5 @@ openvpn2.htz-fsn.prod.ooni.nu [aws-backend] fastpath.dev.ooni.io -# fastpath.prod.ooni.io \ No newline at end of file +# fastpath.prod.ooni.io +test-helpers.dev.ooni.io \ No newline at end of file diff --git a/ansible/roles/test_helpers/defaults/main.yml b/ansible/roles/test_helpers/defaults/main.yml new file mode 100644 index 00000000..5b636ac5 --- /dev/null +++ b/ansible/roles/test_helpers/defaults/main.yml @@ -0,0 +1 @@ +test_helpers_url: https://github.com/ooni/ooniprobe-rs/releases/download/0.1.0-dfe5/ooniprobe-helpers@0.1.0-dfe5.tar.gz diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml new file mode 100644 index 00000000..47dc176b --- /dev/null +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -0,0 +1,108 @@ +--- + +# For prometheus scrape requests +- name: Allow traffic on port 9100 + become: true + tags: prometheus-proxy + blockinfile: + path: /etc/ooni/nftables/tcp/9100.nft + create: yes + block: | + add rule inet filter input tcp dport 9100 counter accept comment "node exporter" + notify: + - reload nftables + + +# For incoming test helper traffic +- name: Allow traffic on port 8000 (echo) + become: true + tags: test-helpers + blockinfile: + path: /etc/ooni/nftables/tcp/8000.nft + create: yes + block: | + add rule inet filter input tcp dport 8000 counter accept comment "echo" + notify: + - reload nftables + +- name: Allow traffic on port 8001 (json) + become: true + tags: test-helpers + blockinfile: + path: /etc/ooni/nftables/tcp/8001.nft + create: yes + block: | + add rule inet filter input tcp dport 8001 counter accept comment "json" + notify: + - reload nftables + +# Create test helpers user +- name: Create the testhelpers user + ansible.builtin.user: + name: "testhelpers" + shell: "/bin/bash" + create_home: no + system: yes + become: yes + +# Install test helpers +- name: Donwload binaries for test helpers + ansible.builtin.get_url: + url: "{{test_helpers_url}}" + dest: "/tmp/test-helpers.tar.gz" + mode: '0600' + become: true + +- name: Extract tar content + ansible.builtin.unarchive: + src: "/tmp/test-helpers.tar.gz" + dest: "/tmp/test-helpers" + remote_src: yes + become: yes + +- name: Make jsonth accessible system wide + ansible.builtin.copy: + src: "/tmp/test-helpers/jsonth" + dest: "/usr/local/bin/" + mode: '0755' + become: yes + +- name: Make echo accessible system wide + ansible.builtin.copy: + src: "/tmp/test-helpers/echo" + dest: "/usr/local/bin/" + mode: '0755' + become: yes + +- name: Clean up temporary files + ansible.builtin.file: + path: "/tmp/test-helpers" + state: absent + become: yes + +- name: Remove downloaded tarball + ansible.builtin.file: + path: "/tmp/test-helpers.tar.gz" + state: absent + become: yes + +# Create systemd units +- name: Create jsonth.service file + tags: test-helpers + ansible.builtin.template: + src: templates/jsonth.service + dest: /etc/systemd/system/jsonth.service + mode: '0755' + owner: root + +- name: reload systemd + tags: test-helpers + shell: systemctl daemon-reload + +- name: Start jupyter + tags: test-helpers + systemd: + name: jsonth.service + state: started + enabled: yes + \ No newline at end of file diff --git a/ansible/roles/test_helpers/templates/jsonth.service b/ansible/roles/test_helpers/templates/jsonth.service new file mode 100644 index 00000000..ebd3c660 --- /dev/null +++ b/ansible/roles/test_helpers/templates/jsonth.service @@ -0,0 +1,20 @@ +[Unit] +Description=Test helper that will respond with a json showing the headers it received +After=network.target +StartLimitIntervalSec=60 +StartLimitBurst=3 + +[Service] +Type=simple +ExecStart=/usr/local/bin/jsonth +Restart=on-failure +RestartSec=5 +User=testhelpers +Group=testhelpers +ProtectSystem=full +ProtectHome=yes +NoNewPrivileges=yes +PrivateTmp=yes + +[Install] +WantedBy=multi-user.target diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf index 03fbd04b..c41670c2 100644 --- a/tf/environments/dev/main.tf +++ b/tf/environments/dev/main.tf @@ -683,6 +683,107 @@ module "fastpath_builder" { ecs_cluster_name = module.ooniapi_cluster.cluster_name } + +#### Test Helpers Machine + +module "ooni_test_helpers" { + source = "../../modules/ec2" + + stage = local.environment + + vpc_id = module.network.vpc_id + subnet_id = module.network.vpc_subnet_public[0].id + private_subnet_cidr = module.network.vpc_subnet_private[*].cidr_block + dns_zone_ooni_io = local.dns_zone_ooni_io + + key_name = module.adm_iam_roles.oonidevops_key_name + instance_type = "t3a.small" + + name = "oonitesthelpers" + ingress_rules = [{ + from_port = 22, + to_port = 22, + protocol = "tcp", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 80, # Echo test helper + to_port = 80, + protocol = "tcp", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 8000, # Echo test helper + to_port = 8000, + protocol = "tcp", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 8001, # Json test helper + to_port = 8001, + protocol = "tcp", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 9100, # Prometheus monitoring + to_port = 9100, + protocol = "tcp" + cidr_blocks = ["${module.ooni_monitoring_proxy.aws_instance_private_ip}/32"] + }] + + egress_rules = [{ + from_port = 0, + to_port = 0, + protocol = "-1", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 0, + to_port = 0, + protocol = "-1", + ipv6_cidr_blocks = ["::/0"], + }] + + sg_prefix = "oonitesthelpers" + tg_prefix = "tshp" + + disk_size = 20 + + tags = merge( + local.tags, + { Name = "ooni-tier0-testhelpers" } + ) +} + +resource "aws_route53_record" "testhelpers_alias" { + zone_id = local.dns_zone_ooni_io + name = "test-helpers.${local.environment}.ooni.io" + type = "CNAME" + ttl = 300 + + records = [ + module.ooni_test_helpers.aws_instance_public_dns + ] +} + +resource "aws_route53_record" "testhelpers_echo_alias" { + zone_id = local.dns_zone_ooni_io + name = "echo-th.${local.environment}.ooni.io" + type = "CNAME" + ttl = 300 + + records = [ + module.ooni_test_helpers.aws_instance_public_dns + ] +} + +resource "aws_route53_record" "testhelpers_json_alias" { + zone_id = local.dns_zone_ooni_io + name = "json-th.${local.environment}.ooni.io" + type = "CNAME" + ttl = 300 + + records = [ + module.ooni_test_helpers.aws_instance_public_dns + ] +} + + #### OONI Run service module "ooniapi_oonirun_deployer" { From cc15c5ecb3219ac0fda00b0f334682cf0b33edd3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Mon, 25 Aug 2025 11:56:26 +0200 Subject: [PATCH 02/29] Change test helpers url --- ansible/roles/test_helpers/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/roles/test_helpers/defaults/main.yml b/ansible/roles/test_helpers/defaults/main.yml index 5b636ac5..2cef1999 100644 --- a/ansible/roles/test_helpers/defaults/main.yml +++ b/ansible/roles/test_helpers/defaults/main.yml @@ -1 +1 @@ -test_helpers_url: https://github.com/ooni/ooniprobe-rs/releases/download/0.1.0-dfe5/ooniprobe-helpers@0.1.0-dfe5.tar.gz +test_helpers_url: https://github.com/ooni/test-helpers/releases/download/0.1.0-dbca/test-helpers@0.1.0-dbca.tar.gz From 0904feae8d5c6a34cb8eece536befdabf24f5ae1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Mon, 25 Aug 2025 13:41:53 +0200 Subject: [PATCH 03/29] Set up echo and jsonth services --- ansible/roles/test_helpers/handlers/main.yml | 17 ++++++++++ ansible/roles/test_helpers/tasks/main.yml | 31 ++++++++++++++++++- .../roles/test_helpers/templates/echo.service | 20 ++++++++++++ .../test_helpers/templates/jsonth.service | 2 +- 4 files changed, 68 insertions(+), 2 deletions(-) create mode 100644 ansible/roles/test_helpers/handlers/main.yml create mode 100644 ansible/roles/test_helpers/templates/echo.service diff --git a/ansible/roles/test_helpers/handlers/main.yml b/ansible/roles/test_helpers/handlers/main.yml new file mode 100644 index 00000000..c9efe5d9 --- /dev/null +++ b/ansible/roles/test_helpers/handlers/main.yml @@ -0,0 +1,17 @@ +- name: restart echo + tags: test-helpers + ansible.builtin.systemd_service: + name: echo + state: restarted + +- name: restart jsonth + tags: test-helpers + ansible.builtin.systemd_service: + name: jsonth + state: restarted + +- name: reload nftables + tags: nftables + ansible.builtin.systemd_service: + name: nftables + state: reloaded \ No newline at end of file diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml index 47dc176b..e646144e 100644 --- a/ansible/roles/test_helpers/tasks/main.yml +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -53,6 +53,13 @@ mode: '0600' become: true +- name: Create test helpers temp dir + ansible.builtin.file: + path: "/tmp/test-helpers" + state: directory + mode: "0700" + become: yes + - name: Extract tar content ansible.builtin.unarchive: src: "/tmp/test-helpers.tar.gz" @@ -65,6 +72,7 @@ src: "/tmp/test-helpers/jsonth" dest: "/usr/local/bin/" mode: '0755' + remote_src: yes become: yes - name: Make echo accessible system wide @@ -72,6 +80,7 @@ src: "/tmp/test-helpers/echo" dest: "/usr/local/bin/" mode: '0755' + remote_src: yes become: yes - name: Clean up temporary files @@ -87,6 +96,7 @@ become: yes # Create systemd units + - name: Create jsonth.service file tags: test-helpers ansible.builtin.template: @@ -94,15 +104,34 @@ dest: /etc/systemd/system/jsonth.service mode: '0755' owner: root + notify: + - restart jsonth + +- name: Create echo.service file + tags: test-helpers + ansible.builtin.template: + src: templates/echo.service + dest: /etc/systemd/system/echo.service + mode: '0755' + owner: root + notify: + - restart echo - name: reload systemd tags: test-helpers shell: systemctl daemon-reload -- name: Start jupyter +- name: Start json tags: test-helpers systemd: name: jsonth.service state: started enabled: yes + +- name: Start echo + tags: test-helpers + systemd: + name: echo.service + state: started + enabled: yes \ No newline at end of file diff --git a/ansible/roles/test_helpers/templates/echo.service b/ansible/roles/test_helpers/templates/echo.service new file mode 100644 index 00000000..13388f7b --- /dev/null +++ b/ansible/roles/test_helpers/templates/echo.service @@ -0,0 +1,20 @@ +[Unit] +Description=Test helper that will start an echo session on request +After=network.target +StartLimitIntervalSec=60 +StartLimitBurst=3 + +[Service] +Type=simple +ExecStart=/usr/local/bin/echo --port 8000 +Restart=on-failure +RestartSec=5 +User=testhelpers +Group=testhelpers +ProtectSystem=full +ProtectHome=yes +NoNewPrivileges=yes +PrivateTmp=yes + +[Install] +WantedBy=multi-user.target diff --git a/ansible/roles/test_helpers/templates/jsonth.service b/ansible/roles/test_helpers/templates/jsonth.service index ebd3c660..fb908501 100644 --- a/ansible/roles/test_helpers/templates/jsonth.service +++ b/ansible/roles/test_helpers/templates/jsonth.service @@ -6,7 +6,7 @@ StartLimitBurst=3 [Service] Type=simple -ExecStart=/usr/local/bin/jsonth +ExecStart=/usr/local/bin/jsonth --port 8001 Restart=on-failure RestartSec=5 User=testhelpers From 620d5a1c94584ede7334140965ff3c9f7642fff1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Mon, 25 Aug 2025 13:42:35 +0200 Subject: [PATCH 04/29] Fix bad comment --- tf/environments/dev/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf index c41670c2..239ec335 100644 --- a/tf/environments/dev/main.tf +++ b/tf/environments/dev/main.tf @@ -706,7 +706,7 @@ module "ooni_test_helpers" { protocol = "tcp", cidr_blocks = ["0.0.0.0/0"], }, { - from_port = 80, # Echo test helper + from_port = 80, # dehydrated to_port = 80, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"], From b1ee5cc9eb5be1657571baa2c85426554708816a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Thu, 28 Aug 2025 12:19:56 +0200 Subject: [PATCH 05/29] fix certificate deadlock issue --- tf/environments/dev/main.tf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf index 239ec335..189fa7f6 100644 --- a/tf/environments/dev/main.tf +++ b/tf/environments/dev/main.tf @@ -1084,6 +1084,10 @@ resource "aws_acm_certificate" "ooniapi_frontend" { tags = local.tags subject_alternative_names = keys(local.ooniapi_frontend_alternative_domains) + + lifecycle { + create_before_destroy = true + } } resource "aws_route53_record" "ooniapi_frontend_cert_validation" { From 3beab5dfc3127384352cf364231d32777e4c2f9c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Thu, 28 Aug 2025 13:01:52 +0200 Subject: [PATCH 06/29] Routing test helper traffic with nginx --- ansible/roles/test_helpers/handlers/main.yml | 7 ++++- ansible/roles/test_helpers/tasks/main.yml | 28 +++++++++++++------- tf/environments/dev/main.tf | 4 +-- 3 files changed, 27 insertions(+), 12 deletions(-) diff --git a/ansible/roles/test_helpers/handlers/main.yml b/ansible/roles/test_helpers/handlers/main.yml index c9efe5d9..30593401 100644 --- a/ansible/roles/test_helpers/handlers/main.yml +++ b/ansible/roles/test_helpers/handlers/main.yml @@ -14,4 +14,9 @@ tags: nftables ansible.builtin.systemd_service: name: nftables - state: reloaded \ No newline at end of file + state: reloaded + +- name: reload nginx + service: + name: nginx + state: reloaded diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml index e646144e..636bd65a 100644 --- a/ansible/roles/test_helpers/tasks/main.yml +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -10,7 +10,7 @@ block: | add rule inet filter input tcp dport 9100 counter accept comment "node exporter" notify: - - reload nftables + - reload nftables # For incoming test helper traffic @@ -23,7 +23,7 @@ block: | add rule inet filter input tcp dport 8000 counter accept comment "echo" notify: - - reload nftables + - reload nftables - name: Allow traffic on port 8001 (json) become: true @@ -34,7 +34,7 @@ block: | add rule inet filter input tcp dport 8001 counter accept comment "json" notify: - - reload nftables + - reload nftables # Create test helpers user - name: Create the testhelpers user @@ -99,22 +99,22 @@ - name: Create jsonth.service file tags: test-helpers - ansible.builtin.template: + ansible.builtin.template: src: templates/jsonth.service dest: /etc/systemd/system/jsonth.service mode: '0755' owner: root - notify: + notify: - restart jsonth - + - name: Create echo.service file tags: test-helpers - ansible.builtin.template: + ansible.builtin.template: src: templates/echo.service dest: /etc/systemd/system/echo.service mode: '0755' owner: root - notify: + notify: - restart echo - name: reload systemd @@ -134,4 +134,14 @@ name: echo.service state: started enabled: yes - \ No newline at end of file + +# Nginx routing +- name: Copy nginx config + tags: test-helpers + ansible.builtin.template: + src: templates/test-helpers.conf + dest: /etc/nginx/sites-enabled/02-test-helpers.conf + mode: '744' + owner: nginx + notify: + - reload nginx \ No newline at end of file diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf index 189fa7f6..d4584f89 100644 --- a/tf/environments/dev/main.tf +++ b/tf/environments/dev/main.tf @@ -763,7 +763,7 @@ resource "aws_route53_record" "testhelpers_alias" { resource "aws_route53_record" "testhelpers_echo_alias" { zone_id = local.dns_zone_ooni_io - name = "echo-th.${local.environment}.ooni.io" + name = "42.th.${local.environment}.ooni.io" type = "CNAME" ttl = 300 @@ -774,7 +774,7 @@ resource "aws_route53_record" "testhelpers_echo_alias" { resource "aws_route53_record" "testhelpers_json_alias" { zone_id = local.dns_zone_ooni_io - name = "json-th.${local.environment}.ooni.io" + name = "43.th.${local.environment}.ooni.io" type = "CNAME" ttl = 300 From d0a9298a9ebbf2592c5be4b212a67323176547b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Thu, 28 Aug 2025 13:08:55 +0200 Subject: [PATCH 07/29] nginx config for test helpers --- .../test_helpers/templates/test-helpers.conf | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 ansible/roles/test_helpers/templates/test-helpers.conf diff --git a/ansible/roles/test_helpers/templates/test-helpers.conf b/ansible/roles/test_helpers/templates/test-helpers.conf new file mode 100644 index 00000000..a8199377 --- /dev/null +++ b/ansible/roles/test_helpers/templates/test-helpers.conf @@ -0,0 +1,17 @@ +# nginx configuration for routing test helpers depending on their host name + +server { + listen 80; + server_name 42.th.dev.ooni.io; # echo + location / { + proxy_pass http://127.0.0.1:8001; + } +} + +server { + listen 80; + server_name 43.th.dev.ooni.io; # jsonth + location / { + proxy_pass http://127.0.0.1:8000; + } +} From 4c5fcc6ad7b3a9b3e97e223d94aeaca43edd00af Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Thu, 28 Aug 2025 14:11:38 +0200 Subject: [PATCH 08/29] Creating echo machine --- ...elpers.yml => deploy-echo-test-helper.yml} | 7 +- ansible/deploy-json-test-helper.yml | 20 +++++ ansible/roles/test_helpers/tasks/main.yml | 23 +---- ansible/roles/test_helpers/vars/main.yml | 3 + tf/environments/dev/main.tf | 87 +++++++++++++++---- 5 files changed, 103 insertions(+), 37 deletions(-) rename ansible/{deploy-test-helpers.yml => deploy-echo-test-helper.yml} (77%) create mode 100644 ansible/deploy-json-test-helper.yml create mode 100644 ansible/roles/test_helpers/vars/main.yml diff --git a/ansible/deploy-test-helpers.yml b/ansible/deploy-echo-test-helper.yml similarity index 77% rename from ansible/deploy-test-helpers.yml rename to ansible/deploy-echo-test-helper.yml index bccfddf2..d325b3dc 100644 --- a/ansible/deploy-test-helpers.yml +++ b/ansible/deploy-echo-test-helper.yml @@ -11,7 +11,10 @@ vars: node_exporter_port: 9100 node_exporter_host: "0.0.0.0" - prometheus_nginx_proxy_config: + prometheus_nginx_proxy_config: - location: /metrics/node_exporter proxy_pass: http://127.0.0.1:9100/metrics - - role: test_helpers \ No newline at end of file + - role: test_helpers + vars: + services: + - jsonth diff --git a/ansible/deploy-json-test-helper.yml b/ansible/deploy-json-test-helper.yml new file mode 100644 index 00000000..d325b3dc --- /dev/null +++ b/ansible/deploy-json-test-helper.yml @@ -0,0 +1,20 @@ +--- +- name: Deploy test helpers + hosts: + - test-helpers.dev.ooni.io + - test-helpers.prod.ooni.io + become: true + roles: + - role: bootstrap + - role: nginx + - role: prometheus_node_exporter + vars: + node_exporter_port: 9100 + node_exporter_host: "0.0.0.0" + prometheus_nginx_proxy_config: + - location: /metrics/node_exporter + proxy_pass: http://127.0.0.1:9100/metrics + - role: test_helpers + vars: + services: + - jsonth diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml index 636bd65a..1b9be3fa 100644 --- a/ansible/roles/test_helpers/tasks/main.yml +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -121,27 +121,10 @@ tags: test-helpers shell: systemctl daemon-reload -- name: Start json +- name: Start service tags: test-helpers systemd: - name: jsonth.service + name: "{{item}}.service" state: started enabled: yes - -- name: Start echo - tags: test-helpers - systemd: - name: echo.service - state: started - enabled: yes - -# Nginx routing -- name: Copy nginx config - tags: test-helpers - ansible.builtin.template: - src: templates/test-helpers.conf - dest: /etc/nginx/sites-enabled/02-test-helpers.conf - mode: '744' - owner: nginx - notify: - - reload nginx \ No newline at end of file + loop: "{{helpers}}" diff --git a/ansible/roles/test_helpers/vars/main.yml b/ansible/roles/test_helpers/vars/main.yml new file mode 100644 index 00000000..bb106ad6 --- /dev/null +++ b/ansible/roles/test_helpers/vars/main.yml @@ -0,0 +1,3 @@ + +# choices: jsonth, echo +helpers: "jsonth" \ No newline at end of file diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf index d4584f89..b1d3e3a8 100644 --- a/tf/environments/dev/main.tf +++ b/tf/environments/dev/main.tf @@ -591,7 +591,7 @@ resource "aws_route53_record" "monitoring_proxy_alias" { } -### Fastpath +### Fastpath module "ooni_fastpath" { source = "../../modules/ec2" @@ -684,8 +684,9 @@ module "fastpath_builder" { } -#### Test Helpers Machine +#### Test Helpers Machines +# jsonth and other http helpers module "ooni_test_helpers" { source = "../../modules/ec2" @@ -697,7 +698,7 @@ module "ooni_test_helpers" { dns_zone_ooni_io = local.dns_zone_ooni_io key_name = module.adm_iam_roles.oonidevops_key_name - instance_type = "t3a.small" + instance_type = "t3.micro" name = "oonitesthelpers" ingress_rules = [{ @@ -707,17 +708,12 @@ module "ooni_test_helpers" { cidr_blocks = ["0.0.0.0/0"], }, { from_port = 80, # dehydrated - to_port = 80, - protocol = "tcp", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 8000, # Echo test helper - to_port = 8000, + to_port = 80, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"], }, { - from_port = 8001, # Json test helper - to_port = 8001, + from_port = 8000, # Json test helper + to_port = 8000, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"], }, { @@ -750,6 +746,67 @@ module "ooni_test_helpers" { ) } +# Echo test helper, requires a dedicated machine bc it's a tcp server, +# not an HTTP server, so it's harder to reroute using nginx +module "ooni_test_helpers_echo" { + source = "../../modules/ec2" + + stage = local.environment + + vpc_id = module.network.vpc_id + subnet_id = module.network.vpc_subnet_public[0].id + private_subnet_cidr = module.network.vpc_subnet_private[*].cidr_block + dns_zone_ooni_io = local.dns_zone_ooni_io + + key_name = module.adm_iam_roles.oonidevops_key_name + instance_type = "t3.micro" + + name = "ooniechoth" + ingress_rules = [{ + from_port = 22, + to_port = 22, + protocol = "tcp", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 80, # dehydrated + to_port = 80, + protocol = "tcp", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 8000, # Echo test helper + to_port = 8000, + protocol = "tcp", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 9100, # Prometheus monitoring + to_port = 9100, + protocol = "tcp" + cidr_blocks = ["${module.ooni_monitoring_proxy.aws_instance_private_ip}/32"] + }] + + egress_rules = [{ + from_port = 0, + to_port = 0, + protocol = "-1", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 0, + to_port = 0, + protocol = "-1", + ipv6_cidr_blocks = ["::/0"], + }] + + sg_prefix = "ooniechoth" + tg_prefix = "echo" + + disk_size = 20 + + tags = merge( + local.tags, + { Name = "ooni-tier0-echoth" } + ) +} + resource "aws_route53_record" "testhelpers_alias" { zone_id = local.dns_zone_ooni_io name = "test-helpers.${local.environment}.ooni.io" @@ -763,7 +820,7 @@ resource "aws_route53_record" "testhelpers_alias" { resource "aws_route53_record" "testhelpers_echo_alias" { zone_id = local.dns_zone_ooni_io - name = "42.th.${local.environment}.ooni.io" + name = "42.th.${local.environment}.ooni.io" # json and others type = "CNAME" ttl = 300 @@ -774,12 +831,12 @@ resource "aws_route53_record" "testhelpers_echo_alias" { resource "aws_route53_record" "testhelpers_json_alias" { zone_id = local.dns_zone_ooni_io - name = "43.th.${local.environment}.ooni.io" + name = "43.th.${local.environment}.ooni.io" # echo type = "CNAME" ttl = 300 records = [ - module.ooni_test_helpers.aws_instance_public_dns + module.ooni_test_helpers_echo.aws_instance_public_dns ] } @@ -992,7 +1049,7 @@ module "ooniapi_oonimeasurements" { task_environment = { # it has to be a json-compliant array - OTHER_COLLECTORS = jsonencode(["http://fastpath.${local.environment}.ooni.io:8475"]) + OTHER_COLLECTORS = jsonencode(["http://fastpath.${local.environment}.ooni.io:8475"]) BASE_URL = "https://api.${local.environment}.ooni.io" S3_BUCKET_NAME = "ooni-data-eu-fra-test" } From 61d705eb3b54e48d3c1d7b270491a0fb840ea47e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Thu, 28 Aug 2025 16:10:33 +0200 Subject: [PATCH 09/29] Creating host for each th --- ansible/roles/test_helpers/tasks/main.yml | 23 ++++-------- .../roles/test_helpers/templates/echo.service | 2 +- .../test_helpers/templates/jsonth.service | 2 +- .../test_helpers/templates/test-helpers.conf | 17 --------- ansible/roles/test_helpers/vars/main.yml | 3 +- tf/environments/dev/main.tf | 35 ++++--------------- 6 files changed, 17 insertions(+), 65 deletions(-) delete mode 100644 ansible/roles/test_helpers/templates/test-helpers.conf diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml index 1b9be3fa..252a51f6 100644 --- a/ansible/roles/test_helpers/tasks/main.yml +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -97,34 +97,23 @@ # Create systemd units -- name: Create jsonth.service file +- name: Create .service file tags: test-helpers ansible.builtin.template: - src: templates/jsonth.service - dest: /etc/systemd/system/jsonth.service + src: templates/{{helper}}.service + dest: /etc/systemd/system/{{helper}}.service mode: '0755' owner: root notify: - - restart jsonth - -- name: Create echo.service file - tags: test-helpers - ansible.builtin.template: - src: templates/echo.service - dest: /etc/systemd/system/echo.service - mode: '0755' - owner: root - notify: - - restart echo + - "restart {{helper}}" - name: reload systemd tags: test-helpers shell: systemctl daemon-reload -- name: Start service +- name: Start helper tags: test-helpers systemd: - name: "{{item}}.service" + name: "{{helper}}.service" state: started enabled: yes - loop: "{{helpers}}" diff --git a/ansible/roles/test_helpers/templates/echo.service b/ansible/roles/test_helpers/templates/echo.service index 13388f7b..cffdf252 100644 --- a/ansible/roles/test_helpers/templates/echo.service +++ b/ansible/roles/test_helpers/templates/echo.service @@ -6,7 +6,7 @@ StartLimitBurst=3 [Service] Type=simple -ExecStart=/usr/local/bin/echo --port 8000 +ExecStart=/usr/local/bin/echo --port {{port}} Restart=on-failure RestartSec=5 User=testhelpers diff --git a/ansible/roles/test_helpers/templates/jsonth.service b/ansible/roles/test_helpers/templates/jsonth.service index fb908501..eb4b4bf7 100644 --- a/ansible/roles/test_helpers/templates/jsonth.service +++ b/ansible/roles/test_helpers/templates/jsonth.service @@ -6,7 +6,7 @@ StartLimitBurst=3 [Service] Type=simple -ExecStart=/usr/local/bin/jsonth --port 8001 +ExecStart=/usr/local/bin/jsonth --port {{port}} Restart=on-failure RestartSec=5 User=testhelpers diff --git a/ansible/roles/test_helpers/templates/test-helpers.conf b/ansible/roles/test_helpers/templates/test-helpers.conf deleted file mode 100644 index a8199377..00000000 --- a/ansible/roles/test_helpers/templates/test-helpers.conf +++ /dev/null @@ -1,17 +0,0 @@ -# nginx configuration for routing test helpers depending on their host name - -server { - listen 80; - server_name 42.th.dev.ooni.io; # echo - location / { - proxy_pass http://127.0.0.1:8001; - } -} - -server { - listen 80; - server_name 43.th.dev.ooni.io; # jsonth - location / { - proxy_pass http://127.0.0.1:8000; - } -} diff --git a/ansible/roles/test_helpers/vars/main.yml b/ansible/roles/test_helpers/vars/main.yml index bb106ad6..671bb91e 100644 --- a/ansible/roles/test_helpers/vars/main.yml +++ b/ansible/roles/test_helpers/vars/main.yml @@ -1,3 +1,4 @@ # choices: jsonth, echo -helpers: "jsonth" \ No newline at end of file +helper: "jsonth" +port: "80" \ No newline at end of file diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf index b1d3e3a8..623b813c 100644 --- a/tf/environments/dev/main.tf +++ b/tf/environments/dev/main.tf @@ -687,7 +687,7 @@ module "fastpath_builder" { #### Test Helpers Machines # jsonth and other http helpers -module "ooni_test_helpers" { +module "ooni_test_helpers_json" { source = "../../modules/ec2" stage = local.environment @@ -700,23 +700,18 @@ module "ooni_test_helpers" { key_name = module.adm_iam_roles.oonidevops_key_name instance_type = "t3.micro" - name = "oonitesthelpers" + name = "oonijsonth" ingress_rules = [{ from_port = 22, to_port = 22, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"], }, { - from_port = 80, # dehydrated + from_port = 80, # jsonth to_port = 80, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"], }, { - from_port = 8000, # Json test helper - to_port = 8000, - protocol = "tcp", - cidr_blocks = ["0.0.0.0/0"], - }, { from_port = 9100, # Prometheus monitoring to_port = 9100, protocol = "tcp" @@ -768,16 +763,11 @@ module "ooni_test_helpers_echo" { protocol = "tcp", cidr_blocks = ["0.0.0.0/0"], }, { - from_port = 80, # dehydrated + from_port = 80, # echo to_port = 80, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"], }, { - from_port = 8000, # Echo test helper - to_port = 8000, - protocol = "tcp", - cidr_blocks = ["0.0.0.0/0"], - }, { from_port = 9100, # Prometheus monitoring to_port = 9100, protocol = "tcp" @@ -807,9 +797,9 @@ module "ooni_test_helpers_echo" { ) } -resource "aws_route53_record" "testhelpers_alias" { +resource "aws_route53_record" "testhelpers_json_alias" { zone_id = local.dns_zone_ooni_io - name = "test-helpers.${local.environment}.ooni.io" + name = "json.th.${local.environment}.ooni.io" # json type = "CNAME" ttl = 300 @@ -820,18 +810,7 @@ resource "aws_route53_record" "testhelpers_alias" { resource "aws_route53_record" "testhelpers_echo_alias" { zone_id = local.dns_zone_ooni_io - name = "42.th.${local.environment}.ooni.io" # json and others - type = "CNAME" - ttl = 300 - - records = [ - module.ooni_test_helpers.aws_instance_public_dns - ] -} - -resource "aws_route53_record" "testhelpers_json_alias" { - zone_id = local.dns_zone_ooni_io - name = "43.th.${local.environment}.ooni.io" # echo + name = "echo.th.${local.environment}.ooni.io" # echo type = "CNAME" ttl = 300 From 91bfe43d409be839ff52ac4c75d5c2c576f07739 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Thu, 28 Aug 2025 16:12:43 +0200 Subject: [PATCH 10/29] Fix bad module name --- tf/environments/dev/main.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf index 623b813c..0ee6ff45 100644 --- a/tf/environments/dev/main.tf +++ b/tf/environments/dev/main.tf @@ -799,18 +799,18 @@ module "ooni_test_helpers_echo" { resource "aws_route53_record" "testhelpers_json_alias" { zone_id = local.dns_zone_ooni_io - name = "json.th.${local.environment}.ooni.io" # json + name = "json.th.${local.environment}.ooni.io" type = "CNAME" ttl = 300 records = [ - module.ooni_test_helpers.aws_instance_public_dns + module.ooni_test_helpers_json.aws_instance_public_dns ] } resource "aws_route53_record" "testhelpers_echo_alias" { zone_id = local.dns_zone_ooni_io - name = "echo.th.${local.environment}.ooni.io" # echo + name = "echo.th.${local.environment}.ooni.io" type = "CNAME" ttl = 300 From 1f08b62062faeb51e556838d9e7909d1482ef226 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Thu, 28 Aug 2025 16:46:38 +0200 Subject: [PATCH 11/29] Set up ansible for each test helper --- ansible/deploy-echo-test-helper.yml | 10 +++++----- ansible/deploy-json-test-helper.yml | 9 ++++----- ansible/inventory | 3 ++- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/ansible/deploy-echo-test-helper.yml b/ansible/deploy-echo-test-helper.yml index d325b3dc..101c2980 100644 --- a/ansible/deploy-echo-test-helper.yml +++ b/ansible/deploy-echo-test-helper.yml @@ -1,12 +1,11 @@ --- - name: Deploy test helpers hosts: - - test-helpers.dev.ooni.io - - test-helpers.prod.ooni.io + - echo.th.dev.ooni.io + - echo.th.prod.ooni.io become: true roles: - role: bootstrap - - role: nginx - role: prometheus_node_exporter vars: node_exporter_port: 9100 @@ -16,5 +15,6 @@ proxy_pass: http://127.0.0.1:9100/metrics - role: test_helpers vars: - services: - - jsonth + helper: echo + port: 80 + diff --git a/ansible/deploy-json-test-helper.yml b/ansible/deploy-json-test-helper.yml index d325b3dc..48dfcefa 100644 --- a/ansible/deploy-json-test-helper.yml +++ b/ansible/deploy-json-test-helper.yml @@ -1,12 +1,11 @@ --- - name: Deploy test helpers hosts: - - test-helpers.dev.ooni.io - - test-helpers.prod.ooni.io + - json.th.dev.ooni.io + - json.th.prod.ooni.io become: true roles: - role: bootstrap - - role: nginx - role: prometheus_node_exporter vars: node_exporter_port: 9100 @@ -16,5 +15,5 @@ proxy_pass: http://127.0.0.1:9100/metrics - role: test_helpers vars: - services: - - jsonth + helper: jsonth + port: 80 diff --git a/ansible/inventory b/ansible/inventory index eede599b..5b39bd18 100644 --- a/ansible/inventory +++ b/ansible/inventory @@ -46,4 +46,5 @@ openvpn2.htz-fsn.prod.ooni.nu [aws-backend] fastpath.dev.ooni.io # fastpath.prod.ooni.io -test-helpers.dev.ooni.io \ No newline at end of file +json.th.dev.ooni.io +echo.th.dev.ooni.io \ No newline at end of file From b77339300bed4d4aa1ca40129d912d9ee2095d61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Fri, 29 Aug 2025 10:19:37 +0200 Subject: [PATCH 12/29] Run prometheus without dehydrated when no https is required --- ansible/deploy-json-test-helper.yml | 1 + ansible/roles/prometheus_node_exporter/tasks/main.yml | 1 + tf/environments/dev/main.tf | 4 ++-- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/ansible/deploy-json-test-helper.yml b/ansible/deploy-json-test-helper.yml index 48dfcefa..ea35bd98 100644 --- a/ansible/deploy-json-test-helper.yml +++ b/ansible/deploy-json-test-helper.yml @@ -13,6 +13,7 @@ prometheus_nginx_proxy_config: - location: /metrics/node_exporter proxy_pass: http://127.0.0.1:9100/metrics + use_https: false - role: test_helpers vars: helper: jsonth diff --git a/ansible/roles/prometheus_node_exporter/tasks/main.yml b/ansible/roles/prometheus_node_exporter/tasks/main.yml index c79a618e..9a4510b7 100644 --- a/ansible/roles/prometheus_node_exporter/tasks/main.yml +++ b/ansible/roles/prometheus_node_exporter/tasks/main.yml @@ -12,6 +12,7 @@ vars: ssl_domains: - "{{ inventory_hostname }}" + when: use_https - include_tasks: install.yml diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf index 0ee6ff45..9cd05cc7 100644 --- a/tf/environments/dev/main.tf +++ b/tf/environments/dev/main.tf @@ -730,14 +730,14 @@ module "ooni_test_helpers_json" { ipv6_cidr_blocks = ["::/0"], }] - sg_prefix = "oonitesthelpers" + sg_prefix = "oonijsonth" tg_prefix = "tshp" disk_size = 20 tags = merge( local.tags, - { Name = "ooni-tier0-testhelpers" } + { Name = "ooni-tier0-jsonth" } ) } From ed6f3a204a72f8504bf6c9301efd98b63fcac6f0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Fri, 29 Aug 2025 10:57:31 +0200 Subject: [PATCH 13/29] removing unused listen 80 entry in prometheus config --- .../prometheus_node_exporter/templates/nginx-prometheus.j2 | 4 ---- 1 file changed, 4 deletions(-) diff --git a/ansible/roles/prometheus_node_exporter/templates/nginx-prometheus.j2 b/ansible/roles/prometheus_node_exporter/templates/nginx-prometheus.j2 index 6e7de3d5..5d9c6471 100644 --- a/ansible/roles/prometheus_node_exporter/templates/nginx-prometheus.j2 +++ b/ansible/roles/prometheus_node_exporter/templates/nginx-prometheus.j2 @@ -10,10 +10,6 @@ server { ssl_certificate /var/lib/dehydrated/certs/{{ inventory_hostname }}/fullchain.pem; ssl_certificate_key /var/lib/dehydrated/certs/{{ inventory_hostname }}/privkey.pem; ssl_trusted_certificate /var/lib/dehydrated/certs/{{ inventory_hostname }}/chain.pem; - {% else %} - listen 80; - - server_name {{ inventory_hostname }}; {% endif %} {% for config in prometheus_nginx_proxy_config %} From 94b24cd12b1b87e036bc0930689e0f79566f9225 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Fri, 29 Aug 2025 11:22:49 +0200 Subject: [PATCH 14/29] Allow services to run on port 80 --- ansible/roles/test_helpers/templates/echo.service | 2 ++ ansible/roles/test_helpers/templates/jsonth.service | 2 ++ 2 files changed, 4 insertions(+) diff --git a/ansible/roles/test_helpers/templates/echo.service b/ansible/roles/test_helpers/templates/echo.service index cffdf252..996e6aa1 100644 --- a/ansible/roles/test_helpers/templates/echo.service +++ b/ansible/roles/test_helpers/templates/echo.service @@ -15,6 +15,8 @@ ProtectSystem=full ProtectHome=yes NoNewPrivileges=yes PrivateTmp=yes +AmbientCapabilities=CAP_NET_BIND_SERVICE +CapabilityBoundingSet=CAP_NET_BIND_SERVICE [Install] WantedBy=multi-user.target diff --git a/ansible/roles/test_helpers/templates/jsonth.service b/ansible/roles/test_helpers/templates/jsonth.service index eb4b4bf7..54392c17 100644 --- a/ansible/roles/test_helpers/templates/jsonth.service +++ b/ansible/roles/test_helpers/templates/jsonth.service @@ -15,6 +15,8 @@ ProtectSystem=full ProtectHome=yes NoNewPrivileges=yes PrivateTmp=yes +AmbientCapabilities=CAP_NET_BIND_SERVICE +CapabilityBoundingSet=CAP_NET_BIND_SERVICE [Install] WantedBy=multi-user.target From 393803e2ee6cb27ccebcf6cd0248371c36b6e692 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Fri, 29 Aug 2025 12:10:45 +0200 Subject: [PATCH 15/29] Add port parameters to use a different port for test helpers metrics --- ansible/deploy-echo-test-helper.yml | 3 ++- ansible/deploy-json-test-helper.yml | 1 + .../prometheus_node_exporter/templates/nginx-prometheus.j2 | 6 +++++- ansible/roles/prometheus_node_exporter/vars/main.yml | 4 +++- 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/ansible/deploy-echo-test-helper.yml b/ansible/deploy-echo-test-helper.yml index 101c2980..fe6434a1 100644 --- a/ansible/deploy-echo-test-helper.yml +++ b/ansible/deploy-echo-test-helper.yml @@ -13,8 +13,9 @@ prometheus_nginx_proxy_config: - location: /metrics/node_exporter proxy_pass: http://127.0.0.1:9100/metrics + use_https: false + http_port: 8080 # if we leave port 80, it's taken by nginx - role: test_helpers vars: helper: echo port: 80 - diff --git a/ansible/deploy-json-test-helper.yml b/ansible/deploy-json-test-helper.yml index ea35bd98..ba08b1fc 100644 --- a/ansible/deploy-json-test-helper.yml +++ b/ansible/deploy-json-test-helper.yml @@ -14,6 +14,7 @@ - location: /metrics/node_exporter proxy_pass: http://127.0.0.1:9100/metrics use_https: false + http_port: 8080 # if we leave port 80, it's taken by nginx - role: test_helpers vars: helper: jsonth diff --git a/ansible/roles/prometheus_node_exporter/templates/nginx-prometheus.j2 b/ansible/roles/prometheus_node_exporter/templates/nginx-prometheus.j2 index 5d9c6471..a0019f86 100644 --- a/ansible/roles/prometheus_node_exporter/templates/nginx-prometheus.j2 +++ b/ansible/roles/prometheus_node_exporter/templates/nginx-prometheus.j2 @@ -2,7 +2,7 @@ server { {% if use_https %} - listen 443 ssl http2; + listen {{https_port}} ssl http2; server_name {{ inventory_hostname }}; include /etc/nginx/ssl_intermediate.conf; @@ -10,6 +10,10 @@ server { ssl_certificate /var/lib/dehydrated/certs/{{ inventory_hostname }}/fullchain.pem; ssl_certificate_key /var/lib/dehydrated/certs/{{ inventory_hostname }}/privkey.pem; ssl_trusted_certificate /var/lib/dehydrated/certs/{{ inventory_hostname }}/chain.pem; + {% else %} + listen {{http_port}}; + + server_name {{inventory_hostname}}; {% endif %} {% for config in prometheus_nginx_proxy_config %} diff --git a/ansible/roles/prometheus_node_exporter/vars/main.yml b/ansible/roles/prometheus_node_exporter/vars/main.yml index 1cf0521e..567f660b 100644 --- a/ansible/roles/prometheus_node_exporter/vars/main.yml +++ b/ansible/roles/prometheus_node_exporter/vars/main.yml @@ -1 +1,3 @@ -use_https: true \ No newline at end of file +use_https: true +http_port: 80 +https_port: 443 \ No newline at end of file From f5f5819bd9e14a1f55673facd2ca1b3c764855d3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Mon, 1 Sep 2025 11:01:14 +0200 Subject: [PATCH 16/29] Remove unused firewall rules --- ansible/roles/test_helpers/tasks/main.yml | 24 ----------------------- 1 file changed, 24 deletions(-) diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml index 252a51f6..bd728c14 100644 --- a/ansible/roles/test_helpers/tasks/main.yml +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -12,30 +12,6 @@ notify: - reload nftables - -# For incoming test helper traffic -- name: Allow traffic on port 8000 (echo) - become: true - tags: test-helpers - blockinfile: - path: /etc/ooni/nftables/tcp/8000.nft - create: yes - block: | - add rule inet filter input tcp dport 8000 counter accept comment "echo" - notify: - - reload nftables - -- name: Allow traffic on port 8001 (json) - become: true - tags: test-helpers - blockinfile: - path: /etc/ooni/nftables/tcp/8001.nft - create: yes - block: | - add rule inet filter input tcp dport 8001 counter accept comment "json" - notify: - - reload nftables - # Create test helpers user - name: Create the testhelpers user ansible.builtin.user: From 901639d95700528b6aaa2c852dc4dee0921bd2fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Mon, 1 Sep 2025 11:07:20 +0200 Subject: [PATCH 17/29] Updated comment --- tf/environments/dev/main.tf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf index 9cd05cc7..9815be3c 100644 --- a/tf/environments/dev/main.tf +++ b/tf/environments/dev/main.tf @@ -686,7 +686,6 @@ module "fastpath_builder" { #### Test Helpers Machines -# jsonth and other http helpers module "ooni_test_helpers_json" { source = "../../modules/ec2" @@ -742,7 +741,7 @@ module "ooni_test_helpers_json" { } # Echo test helper, requires a dedicated machine bc it's a tcp server, -# not an HTTP server, so it's harder to reroute using nginx +# not an HTTP server. It's impossible to reroute using nginx module "ooni_test_helpers_echo" { source = "../../modules/ec2" From e45f17300c35ba72c0eb044a60647ba5d4806602 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Thu, 4 Sep 2025 11:12:59 +0200 Subject: [PATCH 18/29] Add checksum for test helpers tar download --- ansible/roles/test_helpers/defaults/main.yml | 4 +++- ansible/roles/test_helpers/tasks/main.yml | 11 +++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/ansible/roles/test_helpers/defaults/main.yml b/ansible/roles/test_helpers/defaults/main.yml index 2cef1999..a431bc19 100644 --- a/ansible/roles/test_helpers/defaults/main.yml +++ b/ansible/roles/test_helpers/defaults/main.yml @@ -1 +1,3 @@ -test_helpers_url: https://github.com/ooni/test-helpers/releases/download/0.1.0-dbca/test-helpers@0.1.0-dbca.tar.gz +test_helpers_url: https://github.com/ooni/test-helpers/releases/download/0.1.0-1ac1/test-helpers@0.1.0-1ac1.tar.gz +# remember to remove the "sha256:" prefix from github +checksum: 9a7387050412d747df8d0479c004357edfc4cd7825ce7e1c83141e1e0838715c diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml index bd728c14..f35613cc 100644 --- a/ansible/roles/test_helpers/tasks/main.yml +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -29,6 +29,17 @@ mode: '0600' become: true +- name: Get checksum of downloaded file + ansible.builtin.stat: + path: "/tmp/test-helpers.tar.gz" + checksum_algorithm: sha256 + register: file_stat + +- name: Verify checksum + ansible.builtin.fail: + msg: "Checksum failed! Expected: {{checksum}} but got: {{file_stat.stat.checksum}}" + when: file_stat.stat.checksum != checksum + - name: Create test helpers temp dir ansible.builtin.file: path: "/tmp/test-helpers" From 335152ad70c5d6031127116f4ace8f65ee4b5c74 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Tue, 11 Aug 2026 15:56:03 +0200 Subject: [PATCH 19/29] Add test helpers machines; build th from scratch since we don't have binaries --- ansible/inventory | 2 + ansible/roles/test_helpers/defaults/main.yml | 11 +- ansible/roles/test_helpers/tasks/main.yml | 83 ++++++----- tf/environments/prod/main.tf | 136 +++++++++++++++++++ 4 files changed, 194 insertions(+), 38 deletions(-) diff --git a/ansible/inventory b/ansible/inventory index 8fec5c71..5008d568 100644 --- a/ansible/inventory +++ b/ansible/inventory @@ -50,6 +50,8 @@ fastpath.dev.ooni.io fastpath.prod.ooni.io json.th.dev.ooni.io echo.th.dev.ooni.io +json.th.prod.ooni.io +echo.th.prod.ooni.io fastpath2.prod.ooni.io reuploaderfastpath.prod.ooni.io anonc.dev.ooni.io diff --git a/ansible/roles/test_helpers/defaults/main.yml b/ansible/roles/test_helpers/defaults/main.yml index a431bc19..f85d5bac 100644 --- a/ansible/roles/test_helpers/defaults/main.yml +++ b/ansible/roles/test_helpers/defaults/main.yml @@ -1,3 +1,8 @@ -test_helpers_url: https://github.com/ooni/test-helpers/releases/download/0.1.0-1ac1/test-helpers@0.1.0-1ac1.tar.gz -# remember to remove the "sha256:" prefix from github -checksum: 9a7387050412d747df8d0479c004357edfc4cd7825ce7e1c83141e1e0838715c +# TODO(test-helpers-source-build): the test helpers moved into the +# test-helpers crate of https://github.com/ooni/ooniprobe-rs and there is no +# release workflow producing precompiled binaries for it yet. Until that +# workflow exists we build from source below. Once precompiled binaries are +# published again, switch this role back to downloading+checksumming a +# release tarball (see git history of this file for the previous approach). +test_helpers_repo: https://github.com/ooni/ooniprobe-rs.git +test_helpers_version: main diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml index f35613cc..335e4e05 100644 --- a/ansible/roles/test_helpers/tasks/main.yml +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -22,41 +22,60 @@ become: yes # Install test helpers -- name: Donwload binaries for test helpers - ansible.builtin.get_url: - url: "{{test_helpers_url}}" - dest: "/tmp/test-helpers.tar.gz" - mode: '0600' +# +# TODO(test-helpers-source-build): building from source here until +# ooni/ooniprobe-rs has a release workflow that publishes precompiled +# test-helpers binaries. Switch back to downloading+checksumming a release +# tarball once that exists (see git history of this role for the previous +# get_url/checksum-based approach). + +- name: Install build dependencies + ansible.builtin.apt: + name: + - git + - curl + - build-essential + - pkg-config + - libssl-dev + state: present + update_cache: yes become: true -- name: Get checksum of downloaded file +- name: Check if rustup toolchain is already installed ansible.builtin.stat: - path: "/tmp/test-helpers.tar.gz" - checksum_algorithm: sha256 - register: file_stat + path: /usr/local/cargo/bin/cargo + register: cargo_installed -- name: Verify checksum - ansible.builtin.fail: - msg: "Checksum failed! Expected: {{checksum}} but got: {{file_stat.stat.checksum}}" - when: file_stat.stat.checksum != checksum +- name: Install rustup toolchain + ansible.builtin.shell: | + curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal + environment: + RUSTUP_HOME: /usr/local/rustup + CARGO_HOME: /usr/local/cargo + when: not cargo_installed.stat.exists + become: true -- name: Create test helpers temp dir - ansible.builtin.file: - path: "/tmp/test-helpers" - state: directory - mode: "0700" - become: yes +- name: Clone ooniprobe-rs repo + ansible.builtin.git: + repo: "{{ test_helpers_repo }}" + dest: "/tmp/ooniprobe-rs" + version: "{{ test_helpers_version }}" + force: yes + become: true -- name: Extract tar content - ansible.builtin.unarchive: - src: "/tmp/test-helpers.tar.gz" - dest: "/tmp/test-helpers" - remote_src: yes - become: yes +- name: Build the test-helpers crate in release mode + ansible.builtin.command: /usr/local/cargo/bin/cargo build --release --package test-helpers + args: + chdir: "/tmp/ooniprobe-rs" + environment: + RUSTUP_HOME: /usr/local/rustup + CARGO_HOME: /usr/local/cargo + PATH: "/usr/local/cargo/bin:{{ ansible_env.PATH }}" + become: true - name: Make jsonth accessible system wide ansible.builtin.copy: - src: "/tmp/test-helpers/jsonth" + src: "/tmp/ooniprobe-rs/target/release/jsonth" dest: "/usr/local/bin/" mode: '0755' remote_src: yes @@ -64,21 +83,15 @@ - name: Make echo accessible system wide ansible.builtin.copy: - src: "/tmp/test-helpers/echo" + src: "/tmp/ooniprobe-rs/target/release/echo" dest: "/usr/local/bin/" mode: '0755' remote_src: yes become: yes -- name: Clean up temporary files - ansible.builtin.file: - path: "/tmp/test-helpers" - state: absent - become: yes - -- name: Remove downloaded tarball +- name: Clean up build directory ansible.builtin.file: - path: "/tmp/test-helpers.tar.gz" + path: "/tmp/ooniprobe-rs" state: absent become: yes diff --git a/tf/environments/prod/main.tf b/tf/environments/prod/main.tf index 3aa8c3c5..147f99ed 100644 --- a/tf/environments/prod/main.tf +++ b/tf/environments/prod/main.tf @@ -1033,6 +1033,142 @@ module "fastpath_builder" { codepipeline_bucket = aws_s3_bucket.ooniapi_codepipeline_bucket.bucket } + +#### Test Helpers Machines + +module "ooni_test_helpers_json" { + source = "../../modules/ec2" + + stage = local.environment + + vpc_id = module.network.vpc_id + subnet_id = module.network.vpc_subnet_public[0].id + private_subnet_cidr = module.network.vpc_subnet_private[*].cidr_block + dns_zone_ooni_io = local.dns_zone_ooni_io + + key_name = module.adm_iam_roles.oonidevops_key_name + instance_type = "t3.micro" + + name = "oonijsonth" + ingress_rules = [{ + from_port = 22, + to_port = 22, + protocol = "tcp", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 80, # jsonth + to_port = 80, + protocol = "tcp", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 9100, # Prometheus monitoring + to_port = 9100, + protocol = "tcp" + cidr_blocks = ["${module.ooni_monitoring_proxy.aws_instance_private_ip}/32"] + }] + + egress_rules = [{ + from_port = 0, + to_port = 0, + protocol = "-1", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 0, + to_port = 0, + protocol = "-1", + ipv6_cidr_blocks = ["::/0"], + }] + + sg_prefix = "oonijsonth" + tg_prefix = "tshp" + + disk_size = 20 + + tags = merge( + local.tags, + { Name = "ooni-tier0-jsonth" } + ) +} + +# Echo test helper, requires a dedicated machine bc it's a tcp server, +# not an HTTP server. It's impossible to reroute using nginx +module "ooni_test_helpers_echo" { + source = "../../modules/ec2" + + stage = local.environment + + vpc_id = module.network.vpc_id + subnet_id = module.network.vpc_subnet_public[0].id + private_subnet_cidr = module.network.vpc_subnet_private[*].cidr_block + dns_zone_ooni_io = local.dns_zone_ooni_io + + key_name = module.adm_iam_roles.oonidevops_key_name + instance_type = "t3.micro" + + name = "ooniechoth" + ingress_rules = [{ + from_port = 22, + to_port = 22, + protocol = "tcp", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 80, # echo + to_port = 80, + protocol = "tcp", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 9100, # Prometheus monitoring + to_port = 9100, + protocol = "tcp" + cidr_blocks = ["${module.ooni_monitoring_proxy.aws_instance_private_ip}/32"] + }] + + egress_rules = [{ + from_port = 0, + to_port = 0, + protocol = "-1", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 0, + to_port = 0, + protocol = "-1", + ipv6_cidr_blocks = ["::/0"], + }] + + sg_prefix = "ooniechoth" + tg_prefix = "echo" + + disk_size = 20 + + tags = merge( + local.tags, + { Name = "ooni-tier0-echoth" } + ) +} + +resource "aws_route53_record" "testhelpers_json_alias" { + zone_id = local.dns_zone_ooni_io + name = "json.th.${local.environment}.ooni.io" + type = "CNAME" + ttl = 300 + + records = [ + module.ooni_test_helpers_json.aws_instance_public_dns + ] +} + +resource "aws_route53_record" "testhelpers_echo_alias" { + zone_id = local.dns_zone_ooni_io + name = "echo.th.${local.environment}.ooni.io" + type = "CNAME" + ttl = 300 + + records = [ + module.ooni_test_helpers_echo.aws_instance_public_dns + ] +} + + module "reuploader_builder" { source = "../../modules/ooni_docker_build" trigger_tag = "" From 61c8f79393c328d292db977c4f3fd45238ae9054 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Tue, 11 Aug 2026 16:56:03 +0200 Subject: [PATCH 20/29] Fix edge case where service won't be properly restarted if a new version is copied --- .../templates/nginx-prometheus.j2 | 2 +- ansible/roles/test_helpers/tasks/main.yml | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/ansible/roles/prometheus_node_exporter/templates/nginx-prometheus.j2 b/ansible/roles/prometheus_node_exporter/templates/nginx-prometheus.j2 index a0019f86..6fb7c5ca 100644 --- a/ansible/roles/prometheus_node_exporter/templates/nginx-prometheus.j2 +++ b/ansible/roles/prometheus_node_exporter/templates/nginx-prometheus.j2 @@ -2,7 +2,7 @@ server { {% if use_https %} - listen {{https_port}} ssl http2; + listen 443 ssl http2; server_name {{ inventory_hostname }}; include /etc/nginx/ssl_intermediate.conf; diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml index 335e4e05..217946b6 100644 --- a/ansible/roles/test_helpers/tasks/main.yml +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -73,6 +73,9 @@ PATH: "/usr/local/cargo/bin:{{ ansible_env.PATH }}" become: true +# Both binaries are built as part of the workspace build above and copied to +# every host regardless of which helper it runs, but only one systemd unit +# ({{helper}}.service) is actually installed per host (see below). - name: Make jsonth accessible system wide ansible.builtin.copy: src: "/tmp/ooniprobe-rs/target/release/jsonth" @@ -80,6 +83,7 @@ mode: '0755' remote_src: yes become: yes + register: jsonth_binary - name: Make echo accessible system wide ansible.builtin.copy: @@ -88,6 +92,7 @@ mode: '0755' remote_src: yes become: yes + register: echo_binary - name: Clean up build directory ansible.builtin.file: @@ -117,3 +122,14 @@ name: "{{helper}}.service" state: started enabled: yes + +# Only the helper actually deployed on this host (the one matching {{helper}}) +# has a unit above; restart it here if its own binary changed, so a source +# rebuild actually takes effect and not just on unit-file changes. +- name: Restart helper if its binary changed + tags: test-helpers + ansible.builtin.systemd_service: + name: "{{ helper }}.service" + state: restarted + become: yes + when: (helper == 'jsonth' and jsonth_binary.changed) or (helper == 'echo' and echo_binary.changed) From 824a2bf573ba65f0acb935d33656d617ea24e87e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Wed, 12 Aug 2026 10:44:14 +0200 Subject: [PATCH 21/29] Point oonimeasurements to the temp branch --- tf/environments/dev/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf index b6978b19..7189f4f0 100644 --- a/tf/environments/dev/main.tf +++ b/tf/environments/dev/main.tf @@ -1398,7 +1398,7 @@ module "testlists_builder" { service_name = "testlists" repo = "ooni/backend" - branch_name = "master" + branch_name = "fix_1238_testlists_worktree" environment = local.environment buildspec_path = "ooniapi/services/testlists/buildspec.yml" trigger_path = "ooniapi/services/testlists/**" From 7d85944fbd713958709774bf7c53cdc228a2a100 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Wed, 12 Aug 2026 11:54:39 +0200 Subject: [PATCH 22/29] remove test helpers from dev env; point ooniprobe to dev branch --- tf/environments/dev/main.tf | 138 +----------------------------------- 1 file changed, 1 insertion(+), 137 deletions(-) diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf index 7189f4f0..305df23a 100644 --- a/tf/environments/dev/main.tf +++ b/tf/environments/dev/main.tf @@ -563,7 +563,7 @@ module "ooniapi_ooniprobe_deployer" { service_name = "ooniprobe" repo = "ooni/backend" - branch_name = "add_ooniprobe_private_api" + branch_name = "1237-check-in-to-th" environment = local.environment trigger_path = "ooniapi/services/ooniprobe/**" buildspec_path = "ooniapi/services/ooniprobe/buildspec.yml" @@ -940,142 +940,6 @@ module "fastpath_builder" { codepipeline_bucket = aws_s3_bucket.ooniapi_codepipeline_bucket.bucket } - -#### Test Helpers Machines - -module "ooni_test_helpers_json" { - source = "../../modules/ec2" - - stage = local.environment - - vpc_id = module.network.vpc_id - subnet_id = module.network.vpc_subnet_public[0].id - private_subnet_cidr = module.network.vpc_subnet_private[*].cidr_block - dns_zone_ooni_io = local.dns_zone_ooni_io - - key_name = module.adm_iam_roles.oonidevops_key_name - instance_type = "t3.micro" - - name = "oonijsonth" - ingress_rules = [{ - from_port = 22, - to_port = 22, - protocol = "tcp", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 80, # jsonth - to_port = 80, - protocol = "tcp", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 9100, # Prometheus monitoring - to_port = 9100, - protocol = "tcp" - cidr_blocks = ["${module.ooni_monitoring_proxy.aws_instance_private_ip}/32"] - }] - - egress_rules = [{ - from_port = 0, - to_port = 0, - protocol = "-1", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 0, - to_port = 0, - protocol = "-1", - ipv6_cidr_blocks = ["::/0"], - }] - - sg_prefix = "oonijsonth" - tg_prefix = "tshp" - - disk_size = 20 - - tags = merge( - local.tags, - { Name = "ooni-tier0-jsonth" } - ) -} - -# Echo test helper, requires a dedicated machine bc it's a tcp server, -# not an HTTP server. It's impossible to reroute using nginx -module "ooni_test_helpers_echo" { - source = "../../modules/ec2" - - stage = local.environment - - vpc_id = module.network.vpc_id - subnet_id = module.network.vpc_subnet_public[0].id - private_subnet_cidr = module.network.vpc_subnet_private[*].cidr_block - dns_zone_ooni_io = local.dns_zone_ooni_io - - key_name = module.adm_iam_roles.oonidevops_key_name - instance_type = "t3.micro" - - name = "ooniechoth" - ingress_rules = [{ - from_port = 22, - to_port = 22, - protocol = "tcp", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 80, # echo - to_port = 80, - protocol = "tcp", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 9100, # Prometheus monitoring - to_port = 9100, - protocol = "tcp" - cidr_blocks = ["${module.ooni_monitoring_proxy.aws_instance_private_ip}/32"] - }] - - egress_rules = [{ - from_port = 0, - to_port = 0, - protocol = "-1", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 0, - to_port = 0, - protocol = "-1", - ipv6_cidr_blocks = ["::/0"], - }] - - sg_prefix = "ooniechoth" - tg_prefix = "echo" - - disk_size = 20 - - tags = merge( - local.tags, - { Name = "ooni-tier0-echoth" } - ) -} - -resource "aws_route53_record" "testhelpers_json_alias" { - zone_id = local.dns_zone_ooni_io - name = "json.th.${local.environment}.ooni.io" - type = "CNAME" - ttl = 300 - - records = [ - module.ooni_test_helpers_json.aws_instance_public_dns - ] -} - -resource "aws_route53_record" "testhelpers_echo_alias" { - zone_id = local.dns_zone_ooni_io - name = "echo.th.${local.environment}.ooni.io" - type = "CNAME" - ttl = 300 - - records = [ - module.ooni_test_helpers_echo.aws_instance_public_dns - ] -} - - #### OONI Run service module "ooniapi_oonirun_deployer" { From 41a344cb67209fa56355b55f5c6fad03aacfbfac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Wed, 12 Aug 2026 12:55:05 +0200 Subject: [PATCH 23/29] Pull binaries from ooniprobe-rs repo --- ansible/deploy-echo-test-helper.yml | 3 +- ansible/roles/test_helpers/defaults/main.yml | 10 +-- ansible/roles/test_helpers/handlers/main.yml | 4 +- ansible/roles/test_helpers/tasks/main.yml | 86 ++----------------- .../{echo.service => echoth.service} | 2 +- ansible/roles/test_helpers/vars/main.yml | 10 ++- 6 files changed, 22 insertions(+), 93 deletions(-) rename ansible/roles/test_helpers/templates/{echo.service => echoth.service} (89%) diff --git a/ansible/deploy-echo-test-helper.yml b/ansible/deploy-echo-test-helper.yml index fe6434a1..2f3965ae 100644 --- a/ansible/deploy-echo-test-helper.yml +++ b/ansible/deploy-echo-test-helper.yml @@ -17,5 +17,6 @@ http_port: 8080 # if we leave port 80, it's taken by nginx - role: test_helpers vars: - helper: echo + helper: echoth + test_helpers_binary_source: echo port: 80 diff --git a/ansible/roles/test_helpers/defaults/main.yml b/ansible/roles/test_helpers/defaults/main.yml index f85d5bac..ea3d89cd 100644 --- a/ansible/roles/test_helpers/defaults/main.yml +++ b/ansible/roles/test_helpers/defaults/main.yml @@ -1,8 +1,2 @@ -# TODO(test-helpers-source-build): the test helpers moved into the -# test-helpers crate of https://github.com/ooni/ooniprobe-rs and there is no -# release workflow producing precompiled binaries for it yet. Until that -# workflow exists we build from source below. Once precompiled binaries are -# published again, switch this role back to downloading+checksumming a -# release tarball (see git history of this file for the previous approach). -test_helpers_repo: https://github.com/ooni/ooniprobe-rs.git -test_helpers_version: main +test_helpers_version: v0.1.6-beta +test_helpers_base_url: "https://github.com/ooni/ooniprobe-rs/releases/download/{{ test_helpers_version }}" diff --git a/ansible/roles/test_helpers/handlers/main.yml b/ansible/roles/test_helpers/handlers/main.yml index 30593401..a5505f71 100644 --- a/ansible/roles/test_helpers/handlers/main.yml +++ b/ansible/roles/test_helpers/handlers/main.yml @@ -1,7 +1,7 @@ -- name: restart echo +- name: restart echoth tags: test-helpers ansible.builtin.systemd_service: - name: echo + name: echoth state: restarted - name: restart jsonth diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml index 217946b6..21d67991 100644 --- a/ansible/roles/test_helpers/tasks/main.yml +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -22,83 +22,14 @@ become: yes # Install test helpers -# -# TODO(test-helpers-source-build): building from source here until -# ooni/ooniprobe-rs has a release workflow that publishes precompiled -# test-helpers binaries. Switch back to downloading+checksumming a release -# tarball once that exists (see git history of this role for the previous -# get_url/checksum-based approach). - -- name: Install build dependencies - ansible.builtin.apt: - name: - - git - - curl - - build-essential - - pkg-config - - libssl-dev - state: present - update_cache: yes - become: true - -- name: Check if rustup toolchain is already installed - ansible.builtin.stat: - path: /usr/local/cargo/bin/cargo - register: cargo_installed - -- name: Install rustup toolchain - ansible.builtin.shell: | - curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal - environment: - RUSTUP_HOME: /usr/local/rustup - CARGO_HOME: /usr/local/cargo - when: not cargo_installed.stat.exists - become: true - -- name: Clone ooniprobe-rs repo - ansible.builtin.git: - repo: "{{ test_helpers_repo }}" - dest: "/tmp/ooniprobe-rs" - version: "{{ test_helpers_version }}" - force: yes - become: true - -- name: Build the test-helpers crate in release mode - ansible.builtin.command: /usr/local/cargo/bin/cargo build --release --package test-helpers - args: - chdir: "/tmp/ooniprobe-rs" - environment: - RUSTUP_HOME: /usr/local/rustup - CARGO_HOME: /usr/local/cargo - PATH: "/usr/local/cargo/bin:{{ ansible_env.PATH }}" - become: true - -# Both binaries are built as part of the workspace build above and copied to -# every host regardless of which helper it runs, but only one systemd unit -# ({{helper}}.service) is actually installed per host (see below). -- name: Make jsonth accessible system wide - ansible.builtin.copy: - src: "/tmp/ooniprobe-rs/target/release/jsonth" - dest: "/usr/local/bin/" - mode: '0755' - remote_src: yes - become: yes - register: jsonth_binary - -- name: Make echo accessible system wide - ansible.builtin.copy: - src: "/tmp/ooniprobe-rs/target/release/echo" - dest: "/usr/local/bin/" +- name: Download the {{ helper }} test helper binary + ansible.builtin.get_url: + url: "{{ test_helpers_base_url }}/{{ test_helpers_binary_source }}" + dest: "/usr/local/bin/{{ helper }}" mode: '0755' - remote_src: yes - become: yes - register: echo_binary - -- name: Clean up build directory - ansible.builtin.file: - path: "/tmp/ooniprobe-rs" - state: absent + force: yes become: yes + register: helper_binary # Create systemd units @@ -123,13 +54,10 @@ state: started enabled: yes -# Only the helper actually deployed on this host (the one matching {{helper}}) -# has a unit above; restart it here if its own binary changed, so a source -# rebuild actually takes effect and not just on unit-file changes. - name: Restart helper if its binary changed tags: test-helpers ansible.builtin.systemd_service: name: "{{ helper }}.service" state: restarted become: yes - when: (helper == 'jsonth' and jsonth_binary.changed) or (helper == 'echo' and echo_binary.changed) + when: helper_binary.changed diff --git a/ansible/roles/test_helpers/templates/echo.service b/ansible/roles/test_helpers/templates/echoth.service similarity index 89% rename from ansible/roles/test_helpers/templates/echo.service rename to ansible/roles/test_helpers/templates/echoth.service index 996e6aa1..2c0b9f57 100644 --- a/ansible/roles/test_helpers/templates/echo.service +++ b/ansible/roles/test_helpers/templates/echoth.service @@ -6,7 +6,7 @@ StartLimitBurst=3 [Service] Type=simple -ExecStart=/usr/local/bin/echo --port {{port}} +ExecStart=/usr/local/bin/echoth --port {{port}} Restart=on-failure RestartSec=5 User=testhelpers diff --git a/ansible/roles/test_helpers/vars/main.yml b/ansible/roles/test_helpers/vars/main.yml index 671bb91e..abb5927b 100644 --- a/ansible/roles/test_helpers/vars/main.yml +++ b/ansible/roles/test_helpers/vars/main.yml @@ -1,4 +1,10 @@ -# choices: jsonth, echo +# choices: jsonth, echoth helper: "jsonth" -port: "80" \ No newline at end of file +port: "80" + +# Name of the released binary asset to download for this helper. Defaults to +# the helper name. +# The echo test helper's release asset is published as "echo" +# but we rename it locallly to avoid shadowing the `echo` command +test_helpers_binary_source: "{{ helper }}" From abf93a299577405480ca933b90a70120c2f9ab76 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Thu, 13 Aug 2026 12:30:52 +0200 Subject: [PATCH 24/29] Get monitoring ip by digging it --- ansible/roles/test_helpers/defaults/main.yml | 3 + ansible/roles/test_helpers/tasks/main.yml | 17 ++- tf/environments/prod/main.tf | 137 +++---------------- 3 files changed, 36 insertions(+), 121 deletions(-) diff --git a/ansible/roles/test_helpers/defaults/main.yml b/ansible/roles/test_helpers/defaults/main.yml index ea3d89cd..5c1e9ae1 100644 --- a/ansible/roles/test_helpers/defaults/main.yml +++ b/ansible/roles/test_helpers/defaults/main.yml @@ -1,2 +1,5 @@ test_helpers_version: v0.1.6-beta test_helpers_base_url: "https://github.com/ooni/ooniprobe-rs/releases/download/{{ test_helpers_version }}" + +# monitoring server IP +monitoring_server_ip: "{{ lookup('dig', 'monitoring.ooni.org') }}" diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml index 21d67991..4a8f8ea2 100644 --- a/ansible/roles/test_helpers/tasks/main.yml +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -1,14 +1,25 @@ --- -# For prometheus scrape requests -- name: Allow traffic on port 9100 +# For prometheus scrape requests. +- name: Allow traffic on port 9100 from the monitoring host only become: true tags: prometheus-proxy blockinfile: path: /etc/ooni/nftables/tcp/9100.nft create: yes block: | - add rule inet filter input tcp dport 9100 counter accept comment "node exporter" + add rule inet filter input ip saddr {{ monitoring_server_ip }} tcp dport 9100 counter accept comment "node exporter" + notify: + - reload nftables + +- name: Allow traffic on the {{ helper }} test helper port + become: true + tags: test-helpers + blockinfile: + path: "/etc/ooni/nftables/tcp/{{ port }}.nft" + create: yes + block: | + add rule inet filter input tcp dport {{ port }} counter accept comment "{{ helper }} test helper" notify: - reload nftables diff --git a/tf/environments/prod/main.tf b/tf/environments/prod/main.tf index 147f99ed..46c32791 100644 --- a/tf/environments/prod/main.tf +++ b/tf/environments/prod/main.tf @@ -1035,137 +1035,38 @@ module "fastpath_builder" { #### Test Helpers Machines +# module "ooni_test_helpers_json" { - source = "../../modules/ec2" - - stage = local.environment - - vpc_id = module.network.vpc_id - subnet_id = module.network.vpc_subnet_public[0].id - private_subnet_cidr = module.network.vpc_subnet_private[*].cidr_block - dns_zone_ooni_io = local.dns_zone_ooni_io + source = "../../modules/ooni_th_binary_droplet" - key_name = module.adm_iam_roles.oonidevops_key_name - instance_type = "t3.micro" - - name = "oonijsonth" - ingress_rules = [{ - from_port = 22, - to_port = 22, - protocol = "tcp", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 80, # jsonth - to_port = 80, - protocol = "tcp", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 9100, # Prometheus monitoring - to_port = 9100, - protocol = "tcp" - cidr_blocks = ["${module.ooni_monitoring_proxy.aws_instance_private_ip}/32"] - }] + stage = local.environment + name = "oonijsonth" + hostname = "json.th" - egress_rules = [{ - from_port = 0, - to_port = 0, - protocol = "-1", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 0, - to_port = 0, - protocol = "-1", - ipv6_cidr_blocks = ["::/0"], - }] - - sg_prefix = "oonijsonth" - tg_prefix = "tshp" - - disk_size = 20 + ssh_keys = [ + "3d:81:99:17:b5:d1:20:a5:fe:2b:14:96:67:93:d6:34", + "f6:4b:8b:e2:0e:d2:97:c5:45:5c:07:a6:fe:54:60:0e" + ] - tags = merge( - local.tags, - { Name = "ooni-tier0-jsonth" } - ) + dns_zone_ooni_io = local.dns_zone_ooni_io } -# Echo test helper, requires a dedicated machine bc it's a tcp server, +# Echo test helper requires a dedicated machine bc it's a tcp server, # not an HTTP server. It's impossible to reroute using nginx module "ooni_test_helpers_echo" { - source = "../../modules/ec2" + source = "../../modules/ooni_th_binary_droplet" - stage = local.environment - - vpc_id = module.network.vpc_id - subnet_id = module.network.vpc_subnet_public[0].id - private_subnet_cidr = module.network.vpc_subnet_private[*].cidr_block - dns_zone_ooni_io = local.dns_zone_ooni_io + stage = local.environment + name = "ooniechoth" + hostname = "echo.th" - key_name = module.adm_iam_roles.oonidevops_key_name - instance_type = "t3.micro" - - name = "ooniechoth" - ingress_rules = [{ - from_port = 22, - to_port = 22, - protocol = "tcp", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 80, # echo - to_port = 80, - protocol = "tcp", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 9100, # Prometheus monitoring - to_port = 9100, - protocol = "tcp" - cidr_blocks = ["${module.ooni_monitoring_proxy.aws_instance_private_ip}/32"] - }] - - egress_rules = [{ - from_port = 0, - to_port = 0, - protocol = "-1", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 0, - to_port = 0, - protocol = "-1", - ipv6_cidr_blocks = ["::/0"], - }] - - sg_prefix = "ooniechoth" - tg_prefix = "echo" - - disk_size = 20 - - tags = merge( - local.tags, - { Name = "ooni-tier0-echoth" } - ) -} - -resource "aws_route53_record" "testhelpers_json_alias" { - zone_id = local.dns_zone_ooni_io - name = "json.th.${local.environment}.ooni.io" - type = "CNAME" - ttl = 300 - - records = [ - module.ooni_test_helpers_json.aws_instance_public_dns + ssh_keys = [ + "3d:81:99:17:b5:d1:20:a5:fe:2b:14:96:67:93:d6:34", + "f6:4b:8b:e2:0e:d2:97:c5:45:5c:07:a6:fe:54:60:0e" ] -} -resource "aws_route53_record" "testhelpers_echo_alias" { - zone_id = local.dns_zone_ooni_io - name = "echo.th.${local.environment}.ooni.io" - type = "CNAME" - ttl = 300 - - records = [ - module.ooni_test_helpers_echo.aws_instance_public_dns - ] + dns_zone_ooni_io = local.dns_zone_ooni_io } From cd7d168da44a4b40e5c99ef7c7e53eeb41d914cb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Fri, 14 Aug 2026 10:42:52 +0200 Subject: [PATCH 25/29] Add oonidevops ssh key to digitalocean hosts --- tf/environments/prod/main.tf | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/tf/environments/prod/main.tf b/tf/environments/prod/main.tf index 46c32791..801ee5f9 100644 --- a/tf/environments/prod/main.tf +++ b/tf/environments/prod/main.tf @@ -1037,6 +1037,14 @@ module "fastpath_builder" { #### Test Helpers Machines # +# Registers the same oonidevops keypair used for the EC2 instances (see +# module.adm_iam_roles) as a DigitalOcean account key, so it can be installed +# on droplets via their ssh_keys argument too. +resource "digitalocean_ssh_key" "oonidevops" { + name = "oonidevops" + public_key = jsondecode(data.aws_secretsmanager_secret_version.deploy_key.secret_string)["public_key"] +} + module "ooni_test_helpers_json" { source = "../../modules/ooni_th_binary_droplet" @@ -1044,10 +1052,7 @@ module "ooni_test_helpers_json" { name = "oonijsonth" hostname = "json.th" - ssh_keys = [ - "3d:81:99:17:b5:d1:20:a5:fe:2b:14:96:67:93:d6:34", - "f6:4b:8b:e2:0e:d2:97:c5:45:5c:07:a6:fe:54:60:0e" - ] + ssh_keys = [digitalocean_ssh_key.oonidevops.fingerprint] dns_zone_ooni_io = local.dns_zone_ooni_io } @@ -1061,10 +1066,7 @@ module "ooni_test_helpers_echo" { name = "ooniechoth" hostname = "echo.th" - ssh_keys = [ - "3d:81:99:17:b5:d1:20:a5:fe:2b:14:96:67:93:d6:34", - "f6:4b:8b:e2:0e:d2:97:c5:45:5c:07:a6:fe:54:60:0e" - ] + ssh_keys = [digitalocean_ssh_key.oonidevops.fingerprint] dns_zone_ooni_io = local.dns_zone_ooni_io } From b8b458b1f9a67f6f5e508619727fd766c99e59ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Fri, 14 Aug 2026 12:14:28 +0200 Subject: [PATCH 26/29] Fix small issues on playbooks for debian --- ansible/requirements/ansible-galaxy.yml | 2 +- ansible/roles/ssh_users/tasks/main.yml | 4 ++-- ansible/roles/test_helpers/handlers/main.yml | 12 ------------ ansible/roles/test_helpers/tasks/main.yml | 7 ++++--- 4 files changed, 7 insertions(+), 18 deletions(-) diff --git a/ansible/requirements/ansible-galaxy.yml b/ansible/requirements/ansible-galaxy.yml index e31076d3..5172cbec 100644 --- a/ansible/requirements/ansible-galaxy.yml +++ b/ansible/requirements/ansible-galaxy.yml @@ -1,6 +1,6 @@ roles: - src: nginxinc.nginx - version: 0.24.3 + version: 0.26.0 - src: geerlingguy.certbot version: 5.2.0 - src: https://github.com/idealista/clickhouse_role diff --git a/ansible/roles/ssh_users/tasks/main.yml b/ansible/roles/ssh_users/tasks/main.yml index 3615a9ba..14a5bd6e 100644 --- a/ansible/roles/ssh_users/tasks/main.yml +++ b/ansible/roles/ssh_users/tasks/main.yml @@ -85,8 +85,8 @@ path: /etc/sudoers.d/adm state: absent -- name: reload sshd +- name: reload ssh tags: ssh_users ansible.builtin.systemd_service: - name: sshd + name: ssh state: reloaded diff --git a/ansible/roles/test_helpers/handlers/main.yml b/ansible/roles/test_helpers/handlers/main.yml index a5505f71..1d820eff 100644 --- a/ansible/roles/test_helpers/handlers/main.yml +++ b/ansible/roles/test_helpers/handlers/main.yml @@ -1,15 +1,3 @@ -- name: restart echoth - tags: test-helpers - ansible.builtin.systemd_service: - name: echoth - state: restarted - -- name: restart jsonth - tags: test-helpers - ansible.builtin.systemd_service: - name: jsonth - state: restarted - - name: reload nftables tags: nftables ansible.builtin.systemd_service: diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml index 4a8f8ea2..bec319cc 100644 --- a/ansible/roles/test_helpers/tasks/main.yml +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -51,12 +51,13 @@ dest: /etc/systemd/system/{{helper}}.service mode: '0755' owner: root - notify: - - "restart {{helper}}" + register: helper_unit - name: reload systemd tags: test-helpers - shell: systemctl daemon-reload + ansible.builtin.systemd_service: + daemon_reload: yes + when: helper_unit.changed - name: Start helper tags: test-helpers From a40258fd576a5ff2b16368ec0e74e1714213263b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Fri, 14 Aug 2026 12:15:20 +0200 Subject: [PATCH 27/29] Add simpler test helper module --- tf/modules/ooni_th_binary_droplet/main.tf | 31 +++++++++++++++++ tf/modules/ooni_th_binary_droplet/outputs.tf | 7 ++++ .../ooni_th_binary_droplet/variables.tf | 33 +++++++++++++++++++ 3 files changed, 71 insertions(+) create mode 100644 tf/modules/ooni_th_binary_droplet/main.tf create mode 100644 tf/modules/ooni_th_binary_droplet/outputs.tf create mode 100644 tf/modules/ooni_th_binary_droplet/variables.tf diff --git a/tf/modules/ooni_th_binary_droplet/main.tf b/tf/modules/ooni_th_binary_droplet/main.tf new file mode 100644 index 00000000..f0d3c1f6 --- /dev/null +++ b/tf/modules/ooni_th_binary_droplet/main.tf @@ -0,0 +1,31 @@ +terraform { + required_providers { + digitalocean = { + source = "digitalocean/digitalocean" + version = "~> 2.0" + } + } +} + +resource "digitalocean_droplet" "ooni_th" { + image = "debian-13-x64" + name = "${var.name}-${var.stage}" + region = var.instance_location + size = var.instance_size + ipv6 = true + ssh_keys = var.ssh_keys + + lifecycle { + create_before_destroy = true + ignore_changes = all + } +} + +resource "aws_route53_record" "ooni_th" { + zone_id = var.dns_zone_ooni_io + name = "${var.hostname}.${var.stage}.ooni.io" + type = "A" + ttl = 60 + + records = [digitalocean_droplet.ooni_th.ipv4_address] +} diff --git a/tf/modules/ooni_th_binary_droplet/outputs.tf b/tf/modules/ooni_th_binary_droplet/outputs.tf new file mode 100644 index 00000000..e091c016 --- /dev/null +++ b/tf/modules/ooni_th_binary_droplet/outputs.tf @@ -0,0 +1,7 @@ +output "droplet_ipv4_address" { + value = digitalocean_droplet.ooni_th.ipv4_address +} + +output "fqdn" { + value = aws_route53_record.ooni_th.fqdn +} diff --git a/tf/modules/ooni_th_binary_droplet/variables.tf b/tf/modules/ooni_th_binary_droplet/variables.tf new file mode 100644 index 00000000..b257b344 --- /dev/null +++ b/tf/modules/ooni_th_binary_droplet/variables.tf @@ -0,0 +1,33 @@ +variable "stage" { + type = string +} + +variable "name" { + description = "Name of the droplet (will be suffixed with -)" + type = string +} + +variable "hostname" { + description = "DNS label for the helper, e.g. \"json.th\" or \"echo.th\". The record is created as ..ooni.io" + type = string +} + +variable "instance_location" { + type = string + default = "fra1" +} + +variable "instance_size" { + type = string + default = "s-1vcpu-1gb" +} + +variable "ssh_keys" { + description = "Fingerprints of the DigitalOcean account SSH keys to grant root access to" + type = list(string) +} + +variable "dns_zone_ooni_io" { + description = "id of the DNS zone for ooni_io" + type = string +} From f88a07f25103de1d9aff1c884afe9734afcca4b0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Fri, 14 Aug 2026 12:16:17 +0200 Subject: [PATCH 28/29] Fix test helper restart --- ansible/roles/test_helpers/tasks/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml index bec319cc..3b463873 100644 --- a/ansible/roles/test_helpers/tasks/main.yml +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -66,10 +66,10 @@ state: started enabled: yes -- name: Restart helper if its binary changed +- name: Restart helper if its binary or unit file changed tags: test-helpers ansible.builtin.systemd_service: name: "{{ helper }}.service" state: restarted become: yes - when: helper_binary.changed + when: helper_binary.changed or helper_unit.changed From 01214d646adffb1b9108930a1cb21bbc9363bd17 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20D=C3=ADaz?= Date: Fri, 14 Aug 2026 13:20:48 +0200 Subject: [PATCH 29/29] rename binaries; do checksum on download --- ansible/deploy-echo-test-helper.yml | 5 +++-- ansible/deploy-json-test-helper.yml | 4 +++- ansible/roles/test_helpers/defaults/main.yml | 2 +- ansible/roles/test_helpers/tasks/main.yml | 3 ++- .../templates/{echoth.service => ooechohelpd.service} | 2 +- .../templates/{jsonth.service => oojsonhelpd.service} | 2 +- ansible/roles/test_helpers/vars/main.yml | 10 ++-------- 7 files changed, 13 insertions(+), 15 deletions(-) rename ansible/roles/test_helpers/templates/{echoth.service => ooechohelpd.service} (88%) rename ansible/roles/test_helpers/templates/{jsonth.service => oojsonhelpd.service} (89%) diff --git a/ansible/deploy-echo-test-helper.yml b/ansible/deploy-echo-test-helper.yml index 2f3965ae..2e875c1e 100644 --- a/ansible/deploy-echo-test-helper.yml +++ b/ansible/deploy-echo-test-helper.yml @@ -17,6 +17,7 @@ http_port: 8080 # if we leave port 80, it's taken by nginx - role: test_helpers vars: - helper: echoth - test_helpers_binary_source: echo + helper: ooechohelpd + # sha256 of https://github.com/ooni/ooniprobe-rs/releases/download/v0.1.6/ooechohelpd + test_helpers_checksum: 10511a8b918c2244eba9e17c32f3cec9efbc5ffa51d6ad7f59fe648cd0986615 port: 80 diff --git a/ansible/deploy-json-test-helper.yml b/ansible/deploy-json-test-helper.yml index ba08b1fc..e591018d 100644 --- a/ansible/deploy-json-test-helper.yml +++ b/ansible/deploy-json-test-helper.yml @@ -17,5 +17,7 @@ http_port: 8080 # if we leave port 80, it's taken by nginx - role: test_helpers vars: - helper: jsonth + helper: oojsonhelpd + # sha256 of https://github.com/ooni/ooniprobe-rs/releases/download/v0.1.6/oojsonhelpd + test_helpers_checksum: 3d977e1418ea398f520dff3de951e36010a294dc3d1b564c961542cc3729a224 port: 80 diff --git a/ansible/roles/test_helpers/defaults/main.yml b/ansible/roles/test_helpers/defaults/main.yml index 5c1e9ae1..d3d76986 100644 --- a/ansible/roles/test_helpers/defaults/main.yml +++ b/ansible/roles/test_helpers/defaults/main.yml @@ -1,4 +1,4 @@ -test_helpers_version: v0.1.6-beta +test_helpers_version: v0.1.6 test_helpers_base_url: "https://github.com/ooni/ooniprobe-rs/releases/download/{{ test_helpers_version }}" # monitoring server IP diff --git a/ansible/roles/test_helpers/tasks/main.yml b/ansible/roles/test_helpers/tasks/main.yml index 3b463873..02b57055 100644 --- a/ansible/roles/test_helpers/tasks/main.yml +++ b/ansible/roles/test_helpers/tasks/main.yml @@ -35,8 +35,9 @@ # Install test helpers - name: Download the {{ helper }} test helper binary ansible.builtin.get_url: - url: "{{ test_helpers_base_url }}/{{ test_helpers_binary_source }}" + url: "{{ test_helpers_base_url }}/{{ helper }}" dest: "/usr/local/bin/{{ helper }}" + checksum: "sha256:{{ test_helpers_checksum }}" mode: '0755' force: yes become: yes diff --git a/ansible/roles/test_helpers/templates/echoth.service b/ansible/roles/test_helpers/templates/ooechohelpd.service similarity index 88% rename from ansible/roles/test_helpers/templates/echoth.service rename to ansible/roles/test_helpers/templates/ooechohelpd.service index 2c0b9f57..2ba60f1c 100644 --- a/ansible/roles/test_helpers/templates/echoth.service +++ b/ansible/roles/test_helpers/templates/ooechohelpd.service @@ -6,7 +6,7 @@ StartLimitBurst=3 [Service] Type=simple -ExecStart=/usr/local/bin/echoth --port {{port}} +ExecStart=/usr/local/bin/ooechohelpd --port {{port}} Restart=on-failure RestartSec=5 User=testhelpers diff --git a/ansible/roles/test_helpers/templates/jsonth.service b/ansible/roles/test_helpers/templates/oojsonhelpd.service similarity index 89% rename from ansible/roles/test_helpers/templates/jsonth.service rename to ansible/roles/test_helpers/templates/oojsonhelpd.service index 54392c17..de3c4367 100644 --- a/ansible/roles/test_helpers/templates/jsonth.service +++ b/ansible/roles/test_helpers/templates/oojsonhelpd.service @@ -6,7 +6,7 @@ StartLimitBurst=3 [Service] Type=simple -ExecStart=/usr/local/bin/jsonth --port {{port}} +ExecStart=/usr/local/bin/oojsonhelpd --port {{port}} Restart=on-failure RestartSec=5 User=testhelpers diff --git a/ansible/roles/test_helpers/vars/main.yml b/ansible/roles/test_helpers/vars/main.yml index abb5927b..3d224a6d 100644 --- a/ansible/roles/test_helpers/vars/main.yml +++ b/ansible/roles/test_helpers/vars/main.yml @@ -1,10 +1,4 @@ -# choices: jsonth, echoth -helper: "jsonth" +# choices: oojsonhelpd, ooechohelpd +helper: "oojsonhelpd" port: "80" - -# Name of the released binary asset to download for this helper. Defaults to -# the helper name. -# The echo test helper's release asset is published as "echo" -# but we rename it locallly to avoid shadowing the `echo` command -test_helpers_binary_source: "{{ helper }}"