mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
2f533eb279
group_vars/all/README.md forbids role-specific configuration in that directory, and 19_tor.yml held five variables no role but svc-net-tor ever read. They now live where the README points: the values an operator may override in meta/services.yml, where the inventory's applications block is deep-merged on top, and the derived ones in vars/main.yml.
The exception is the egress virtual range, which moves the other way into 08_networks.yml. It is not a property of the role but a claim on shared address space, and 0f6728a4c1 records what a collision costs: tor's upstream default 10.192.0.0/10 swallowed the docker pool at 10.208.0.0/12, and every connection to a container address came back as 'errno 104 Connection reset by peer'. The two numbers that must not overlap now sit one line apart.
The onion's HTTP forward becomes a declaration rather than a derivation. lookup('tor_ports') walks group_names and collects what those roles declare under ports.onion; port 80 belongs to svc-prx-openresty, which a node acquires through sys-stk-front-proxy and which therefore appears in no dependency list an inventory carries. A node provisioned with --include svc-net-tor published an onion forwarding SSH and nothing else, leaving every app it serves unreachable - measured as ERR_SOCKS_CONNECTION_FAILED in the CI instructions replay. The new role-local tor_extra_ports lookup composes the flagged forwards with the derived ones and collapses a port named twice, since torrc writes one HiddenServicePort line per entry.
Not moved: tor_ports stays in plugins/lookup because tor_reachable imports from it and three database roles use that; and the flags sit outside ports.onion because every key there mirrors a port the role declares under ports.local, which neither sshd nor the front proxy is.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
67 lines
3.3 KiB
YAML
67 lines
3.3 KiB
YAML
---
|
|
# General
|
|
application_id: "svc-net-tor"
|
|
|
|
TOR_IMAGE: "{{ lookup('config', application_id, 'services.tor.image') }}"
|
|
TOR_VERSION: "{{ lookup('config', application_id, 'services.tor.version') }}"
|
|
TOR_CONTAINER: "{{ lookup('config', application_id, 'services.tor.name') }}"
|
|
|
|
TOR_NODE_ONION: "{{ lookup('config', application_id, 'services.tor.node', '') }}"
|
|
TOR_USE_ENTRY_GUARDS: "{{ lookup('config', application_id, 'services.tor.use_entry_guards') | bool }}"
|
|
TOR_FLAVOR: "{{ lookup('config', application_id, 'services.tor.flavor') }}"
|
|
TOR_ONION_SSH_ENABLED: "{{ lookup('config', application_id, 'services.tor.forwards.ssh') | bool }}"
|
|
TOR_ONION_HTTP_ENABLED: "{{ lookup('config', application_id, 'services.tor.forwards.http') | bool }}"
|
|
TOR_ONION_EXTRA_PORTS: "{{ lookup('tor_extra_ports') }}"
|
|
TOR_EGRESS_ROUTER_ENABLED: "{{ lookup('config', application_id, 'services.tor.egress.enabled') | bool }}"
|
|
TOR_EGRESS_VIRTUAL_NET_IPV4: "{{ NETWORK_TOR_VIRTUAL_CIDR }}"
|
|
TOR_TRANS_PORT: "{{ lookup('config', application_id, 'services.tor.ports.local.trans') }}"
|
|
TOR_DNS_PORT: "{{ lookup('config', application_id, 'services.tor.ports.local.dns') }}"
|
|
TOR_SOCKS_PORT: "{{ lookup('config', application_id, 'services.tor.ports.local.socks') }}"
|
|
TOR_DNSMASQ_PORT: "{{ NETWORK_DNS_PORT }}"
|
|
TOR_DNSMASQ_CONF: "/etc/dnsmasq.d/tor-onion.conf"
|
|
|
|
TOR_EGRESS_GUARDED_PORTS:
|
|
- port: "{{ TOR_TRANS_PORT }}"
|
|
protocol: tcp
|
|
admitted: containers
|
|
- port: "{{ TOR_DNS_PORT }}"
|
|
protocol: tcp
|
|
admitted: containers
|
|
- port: "{{ TOR_DNS_PORT }}"
|
|
protocol: udp
|
|
admitted: containers
|
|
- port: "{{ TOR_SOCKS_PORT }}"
|
|
protocol: tcp
|
|
admitted: internal
|
|
- port: "{{ TOR_DNSMASQ_PORT }}"
|
|
protocol: tcp
|
|
admitted: internal
|
|
- port: "{{ TOR_DNSMASQ_PORT }}"
|
|
protocol: udp
|
|
admitted: internal
|
|
TOR_EGRESS_CLIENT_CIDRS: "{{ lookup('tor_egress_clients') }}"
|
|
TOR_DNSMASQ_DROPIN: "/etc/systemd/system/dnsmasq.service.d/infinito-restart.conf"
|
|
# nocheck: host-local-fact meta/services.yml pins this role to the manager, so the fact describes the node the hidden service forwards on
|
|
TOR_CONTAINER_DNS_HOST: "{{ ansible_facts['docker0']['ipv4']['address'] | default('', true) }}"
|
|
# nocheck: host-local-fact meta/services.yml pins this role to the manager, so the fact describes the node the hidden service forwards on
|
|
TOR_HS_BACKEND_HOST: "{{ ansible_facts['default_ipv4']['address'] if DEPLOYMENT_MODE == 'swarm' else (TOR_CONTAINER_DNS_HOST | ternary(TOR_CONTAINER_DNS_HOST, '127.0.0.1'))
|
|
}}"
|
|
|
|
TOR_DATA_DIR: "{{ [ DIR_VAR_LIB, application_id, 'data' ] | path_join }}"
|
|
TOR_CONFIG_DIR: "{{ [ DIR_VAR_LIB, application_id, 'config' ] | path_join }}"
|
|
TOR_TORRC_HOST: "{{ [ TOR_CONFIG_DIR, 'torrc' ] | path_join }}"
|
|
TOR_HS_DIR: "{{ [ TOR_DATA_DIR, 'infinito', 'node' ] | path_join }}"
|
|
|
|
TOR_HS_SRC_DIR: "{{ lookup('path_absolute', '.onion-identity', 'hs') }}"
|
|
|
|
TOR_INSTANCE_DIR: "{{ lookup('container', application_id, 'directories.instance') }}"
|
|
TOR_ENTRYPOINT_HOST: "{{ [ TOR_INSTANCE_DIR, 'entrypoint.sh' ] | path_join }}"
|
|
TOR_HEALTHCHECK_HOST: "{{ [ TOR_INSTANCE_DIR, 'healthcheck.sh' ] | path_join }}"
|
|
TOR_ENTRYPOINT_PATH: "/usr/local/bin/tor-entrypoint.sh"
|
|
TOR_HEALTHCHECK_PATH: "/usr/local/bin/tor-healthcheck.sh"
|
|
TOR_RESTART_REQUIRED: >-
|
|
{{ (_tor_hs_keys is changed)
|
|
or (_tor_torrc is changed)
|
|
or (_tor_entrypoint is changed)
|
|
or (_tor_healthcheck is changed) }}
|