Swap tor apt repo to point to our mirror

This addresses issue #2106 - mitigate side-effects from a tor package
breaking securedrop instances in the field.

The actual logic that creates our mirror is in source control in another repo.

install_files/ansible-base/group_vars/all/securedrop

@@ -35,3 +35,5 @@ apparmor_profiles:
 
 # Installing the securedrop-app-code.deb package
 securedrop_app_code_deb: "securedrop-app-code-{{ securedrop_app_code_version }}-amd64" # do not enter .deb extension
+
+tor_apt_repo_url: http://tor-apt.ops.freedom.press

install_files/ansible-base/roles/common/templates/security.list

@@ -3,4 +3,4 @@ deb-src http://security.ubuntu.com/ubuntu trusty-security main
 deb http://security.ubuntu.com/ubuntu trusty-security universe
 deb-src http://security.ubuntu.com/ubuntu trusty-security universe
 deb [arch=amd64] {{ apt_repo_url }} trusty main
-deb http://deb.torproject.org/torproject.org trusty main
+deb {{ tor_apt_repo_url }} trusty main

install_files/ansible-base/roles/tor-hidden-services/tasks/install_tor.yml

@@ -9,7 +9,8 @@
 
 - name: Setup Tor apt repo.
   apt_repository:
-    repo: deb http://deb.torproject.org/torproject.org {{ ansible_lsb.codename }} main
+    filename: deb_torproject_org_torproject_org
+    repo: deb {{ tor_apt_repo_url }} {{ ansible_lsb.codename }} main
     state: present
   register: add_tor_apt_repo
   tags:

install_files/securedrop-app-code/DEBIAN/postinst

@@ -55,6 +55,13 @@ case "$1" in
       rm /tmp/securedrop_custom_logo.png
     fi
 
+    # Repoint tor repositories to FPF mirror
+    for file in "sources.list.d/deb_torproject_org_torproject_org.list" "security.list"
+    do
+        if [ -f "/etc/apt/$file" ]; then
+            sed -i 's/deb.torproject.org\/torproject.org/tor-apt.ops.freedom.press/g' "/etc/apt/$file"
+        fi
+    done
     ;;
 
     abort-upgrade|abort-remove|abort-deconfigure)