Skip to content

Commit 7c94740

Browse files
hellaishellais
committed
Merge branch 'plpsql-improve'
* plpsql-improve: fix some issues with the playbook Reset iptables rules back to how they were Remote empty space invert order of commands Remove etckeeper commands allow openvpn connections Get rid of another ugly hack for user_group_id Get rid of ugly hack for getting user id Remove unneeded mia-ps line Replace variables Use default interpreter Improve OpenVPN setup Flesh out basic openvpn based proxy use role based tag to indicate active or standby hosts Use native user module to get user and group IDs
2 parents 8f6d6e4 + d2b7e0a commit 7c94740

File tree

12 files changed

+113
-46
lines changed

12 files changed

+113
-46
lines changed

‎ansible/inventory

+12-6
Original file line numberDiff line numberDiff line change
@@ -48,12 +48,6 @@ ams-jupyter.ooni.nu
4848
ams-wcth2.ooni.nu
4949
ams-wcth3.ooni.nu
5050

51-
[probe_services]
52-
mia-ps2.ooni.nu
53-
hkg-ps.ooni.nu
54-
ams-ps.ooni.nu
55-
ams-ps2.ooni.nu
56-
5751
########################################################################
5852
# PSK (pre-shared key) tags
5953

@@ -173,9 +167,21 @@ mia-ps2.ooni.nu
173167
ams-ps2.ooni.nu
174168
mia-ps2.ooni.nu
175169

170+
[db_active]
171+
hkgmetadb.infra.ooni.io
172+
173+
[db_standby]
174+
amsmetadb.ooni.nu
175+
176176
[have_netdata]
177177
fastpath.ooni.nu
178178

179+
[probe_services]
180+
mia-ps2.ooni.nu
181+
hkg-ps.ooni.nu
182+
ams-ps.ooni.nu
183+
ams-ps2.ooni.nu
184+
179185
########################################################################
180186
# TO DELETE.
181187
# Stopped VMs that should be deleted from GH and DNS after some grace period:

‎ansible/roles/airflow/tasks/af-psql.yml

+3-6
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,8 @@
1111
group: "afpsql"
1212
comment: "afpsql for Pipeline"
1313
state: present
14-
- name: get the user ids
15-
shell: >
16-
egrep "^afpsql:" /etc/passwd | awk -F: '{ print $3":"$4 }'
17-
changed_when: false
18-
register: user_group_id
14+
register: afpsql_user
15+
1916
- name: airflow postgres tmp directory
2017
file: dest=/srv/tmp/af-psql state=directory owner=afpsql group=afpsql mode=0750
2118
- name: airflow postgres /data directory
@@ -34,7 +31,7 @@
3431
PGDATA: /srv/af-psql
3532
POSTGRES_USER: airflow
3633
POSTGRES_PASSWORD: "{{ airflow_postgres_password }}"
37-
user: "{{ user_group_id.stdout }}"
34+
user: "{{ afpsql_user.uid }}:{{ afpsql_user.group }}"
3835
stop_signal: SIGINT # Fast shutdown. Default SIGTERM waits for all the sessions to terminate.
3936
stop_timeout: 60 # default is 10
4037
restart_policy: unless-stopped

‎ansible/roles/airflow/tasks/af-redis.yml

+2-7
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,7 @@
77
group: "afredis"
88
comment: "afredis for Pipeline"
99
state: present
10-
11-
- name: get the user ids
12-
shell: >
13-
egrep "^afredis:" /etc/passwd | awk -F: '{ print $3":"$4 }'
14-
changed_when: false
15-
register: user_group_id
10+
register: afredis_user
1611

1712
- name: redis .../etc directory
1813
file: dest=/srv/etc/af-redis state=directory owner=root group=root mode=0755
@@ -31,5 +26,5 @@
3126
- /srv/etc/af-redis:/usr/local/etc:ro
3227
- /srv/af-redis:/data:rw
3328
command: /usr/local/etc/redis.conf
34-
user: "{{ user_group_id.stdout }}"
29+
user: "{{ afredis_user.uid }}:{{ afredis_user.group }}"
3530
restart_policy: unless-stopped

‎ansible/roles/plpsql/handlers/main.yml

+4
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,8 @@
33
command: docker restart pl-psql # XXX: is `stop_timeout` respected?
44
- name: reload pl-psql
55
command: docker exec -it pl-psql pg_ctl reload -D /srv/pl-psql
6+
- name: restart openvpn
7+
service:
8+
name: openvpn
9+
state: restarted
610
...

‎ansible/roles/plpsql/meta/main.yml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
dependencies:
3+
- libhandlers
4+
...

‎ansible/roles/plpsql/tasks/main.yml

+50-18
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,7 @@
88
group: "plpsql"
99
comment: "plpsql for Postgres"
1010
state: present
11-
12-
- name: get the user ids
13-
shell: >
14-
egrep "^plpsql:" /etc/passwd | awk -F: '{ print $3":"$4 }'
15-
changed_when: false
16-
register: user_group_id
11+
register: plpsql_user
1712

1813
- name: pipeline postgres PGDATA directory
1914
file: dest=/srv/pl-psql state=directory owner=plpsql group=plpsql mode=0700
@@ -22,32 +17,69 @@
2217
template: src=pg_hba.conf dest=/srv/pl-psql/pg_hba.conf owner=plpsql group=plpsql mode=0444
2318
notify: reload pl-psql
2419

25-
# Warning: hkgmetadb.infra.ooni.io is hardcoded here to identify the active and standby DBs
26-
# TODO: use a flag in inventory instead
27-
28-
# active host
29-
3020
- name: place config in PGDATA for active DB
3121
template: src=postgresql.active.conf dest=/srv/pl-psql/postgresql.conf owner=plpsql group=plpsql mode=0444
3222
notify: reload pl-psql
33-
when: inventory_hostname == 'hkgmetadb.infra.ooni.io'
23+
when: "'db_active' in group_names"
3424

3525
- name: drop recovery.conf from PGDATA on active DB
3626
file: name=/srv/pl-psql/recovery.conf state=absent
3727
notify: reload pl-psql
38-
when: inventory_hostname == 'hkgmetadb.infra.ooni.io'
39-
40-
# standby hosts
28+
when: "'db_active' in group_names"
4129

4230
- name: place config in PGDATA for standby DB
4331
template: src=postgresql.standby.conf dest=/srv/pl-psql/postgresql.conf owner=plpsql group=plpsql mode=0444
4432
notify: reload pl-psql
45-
when: inventory_hostname != 'hkgmetadb.infra.ooni.io'
33+
when: "'db_standby' in group_names"
4634

4735
- name: place recovery.conf to PGDATA on standby DB
4836
template: src=recovery.conf dest=/srv/pl-psql/recovery.conf owner=plpsql group=plpsql mode=0444
4937
notify: reload pl-psql
50-
when: inventory_hostname != 'hkgmetadb.infra.ooni.io'
38+
when: "'db_standby' in group_names"
39+
40+
# TODO fix this with the apt module once we update to the latest debian
41+
# apt:
42+
# name: openvpn
43+
# install_recommends: no
44+
45+
- name: install openvpn
46+
command: apt-get install --no-install-recommends -y openvpn
47+
tags: dbvpn
48+
49+
- name: openvpn create conf on standby node
50+
template: src=openvpn.standby.conf dest=/etc/openvpn/oonidbvpn.conf
51+
notify: systemctl daemon-reload
52+
when: "'db_standby' in group_names"
53+
tags: dbvpn
54+
55+
- name: openvpn create conf on active node
56+
template: src=openvpn.active.conf dest=/etc/openvpn/oonidbvpn.conf
57+
notify: systemctl daemon-reload
58+
when: "'db_active' in group_names"
59+
tags: dbvpn
60+
61+
- name: openvpn create shared secret on active node
62+
command: openvpn --genkey --secret /etc/openvpn/oonipgvpn.key
63+
args:
64+
creates: /etc/openvpn/oonipgvpn.key
65+
notify: restart openvpn
66+
when: "'db_active' in group_names"
67+
tags: dbvpn
68+
69+
- name: openvpn copy shared secret from active node
70+
slurp:
71+
src: /etc/openvpn/oonipgvpn.key
72+
register: pgvpn_secret
73+
when: "'db_active' in group_names"
74+
tags: dbvpn
75+
76+
- name: openvpn copy shared secret to standby node
77+
copy:
78+
content: "{{ pgvpn_secret }}"
79+
dest: /etc/openvpn/oonipgvpn.key
80+
notify: restart openvpn
81+
when: "'db_standby' in group_names"
82+
tags: dbvpn
5183

5284
# if `initdb` fails read `Arbitrary --user Notes` at https://hub.docker.com/_/postgres/
5385
- name: docker run pipeline postgres
@@ -86,7 +118,7 @@
86118
PUSHGATEWAY_CERT: "/srv/pl-psql_ssl/pusher/{{ inventory_hostname }}.cert"
87119
PUSHGATEWAY_KEY: "/srv/pl-psql_ssl/pusher/{{ inventory_hostname }}.key"
88120
stop_signal: SIGINT # Fast shutdown. Default SIGTERM waits for all the sessions to terminate.
89-
user: "{{ user_group_id.stdout }}"
121+
user: "{{ plpsql_user.uid }}:{{ plpsql_user.group }}"
90122
stop_timeout: 60 # default is 10
91123
restart_policy: unless-stopped
92124
...

‎ansible/roles/plpsql/templates/openvpn.active.conf

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# OONI DB VPN - managed by ansible
2+
# /etc/openvpn/oonidbvpn.conf
3+
# HKG -> mia-ps-test.ooni.nu -> AMS
4+
5+
dev tun
6+
remote {{ lookup('dig', 'mia-ps-test.ooni.nu/A') }}
7+
# fallback to direct connection HKG -> AMS
8+
remote {{ lookup('dig', 'amsmetadb.ooni.nu/A') }}
9+
ifconfig 10.1.0.2 10.1.0.1
10+
secret oonipgvpn.key
11+
cipher AES-256-CBC
12+
comp-lzo
13+
verb 3
14+
keepalive 10 60
15+
ping-timer-rem
16+
persist-tun
17+
persist-key

‎ansible/roles/plpsql/templates/openvpn.standby.conf

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# OONI DB VPN - managed by ansible
2+
# /etc/openvpn/oonidbvpn.conf
3+
# HKG -> mia-ps-test.ooni.nu -> AMS
4+
# Configuration for AMS db
5+
dev tun
6+
ifconfig 10.1.0.1 10.1.0.2
7+
secret oonipgvpn.key
8+
comp-lzo
9+
cipher AES-256-CBC
10+
keepalive 10 60
11+
ping-timer-rem
12+
persist-tun
13+
persist-key

‎ansible/roles/plpsql/templates/pg_hba.conf

+1-1
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ host all all ::1/128 trust
9393
#host replication postgres ::1/128 trust
9494

9595
# NB: `ssl` is neither supported nor enforced.
96-
{% if inventory_hostname == 'hkgmetadb.infra.ooni.io' %}
96+
{% if 'db_active' in group_names %}
9797
host replication amsrepl {{ lookup('dig', 'amsmetadb.ooni.nu/A') }}/32 md5
9898
{% endif %}
9999

‎ansible/roles/plpsql/templates/postgresql.active.conf

-3
Original file line numberDiff line numberDiff line change
@@ -208,13 +208,10 @@ wal_level = replica # minimal, replica, or logical. (change requires restart)
208208
#checkpoint_warning = 30s # 0 disables
209209

210210
# - Archiving -
211-
212-
{% if inventory_hostname == 'hkgmetadb.infra.ooni.io' %}
213211
archive_mode = on
214212
archive_command = '/usr/local/bin/metadb_s3_archive "%p" "%f"'
215213
# placeholders: %p = path of file to archive
216214
# %f = file name only
217-
{% endif %}
218215
#archive_timeout = 0 # force a logfile segment switch after this
219216
# number of seconds; 0 disables
220217

‎ansible/roles/plpsql/templates/postgresql.standby.conf

+3-5
Original file line numberDiff line numberDiff line change
@@ -208,13 +208,11 @@ wal_level = replica # minimal, replica, or logical. (change requires restart)
208208
#checkpoint_warning = 30s # 0 disables
209209

210210
# - Archiving -
211-
212-
{% if inventory_hostname == 'hkgmetadb.infra.ooni.io' %}
213-
archive_mode = on
214-
archive_command = '/usr/local/bin/metadb_s3_archive "%p" "%f"'
211+
# Disable archiving because standby
212+
#archive_mode = on
213+
#archive_command = '/usr/local/bin/metadb_s3_archive "%p" "%f"'
215214
# placeholders: %p = path of file to archive
216215
# %f = file name only
217-
{% endif %}
218216
#archive_timeout = 0 # force a logfile segment switch after this
219217
# number of seconds; 0 disables
220218

‎ansible/templates/iptables.filter.part/amsmetadb.ooni.nu

+4
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,8 @@
44
-A INPUT -s {{ lookup('dig', 'ams-api.ooni.nu/A') }}/32 -p tcp -m tcp --dport 5432 -j ACCEPT
55
-A INPUT -s {{ lookup('dig', 'fastpath.ooni.nu/A') }}/32 -p tcp -m tcp --dport 5432 -j ACCEPT
66
-A INPUT -s {{ lookup('dig', 'ams-jupyter.ooni.nu/A') }}/32 -p tcp -m tcp --dport 5432 -j ACCEPT
7+
8+
# allow openvpn connections
9+
-A INPUT -s {{ lookup('dig', 'hkgmetadb.infra.ooni.io/A') }}/32 -p udp --dport 1194 -j ACCEPT
10+
-A INPUT -s {{ lookup('dig', 'mia-ps-test.ooni.nu/A') }}/32 -p udp --dport 1194 -j ACCEPT
711
{% endblock %}

0 commit comments

Comments
 (0)