Restart Apache during installation when onion service version configuration changes #5726
Conversation
There was a problem hiding this comment.
While this will work on existing installs, this may not work on clean/new installs: the tor role is run before the app role on the app server, and Apache2 is installed/configured as part of the app role. In order to resolve, we could either:
- detect if the service exists and conditionally restart the apache2 service
or, since this is likely going to be a one-time operation:
- address this issue through documentation, since admins will likely be using the documentation to guide them through this process.
|
Drat, right, I'll add a check for the presence of the Apache package. |
If the configuration of v2 and v3 services is modified, Apache needs to be restarted for the app config to reflect the changes, so that migration warnings are accurate.
rmol
changed the title
|
Better still, just notify restart in the app server playbook, where the source URL files are managed. I tested a fresh install with both v2+v3 installed, then removed v2, and everything worked as expected. |
There was a problem hiding this comment.
Thanks @rmol for the changes, went through the test plan and confirm the banner disappeared on a simple page refresh.
It looks like you are also covering the downgrade to v2 scenarios which aren't strictly required, but fine to merge since this logic will soon be purged .
| when: v2_onion_services | ||
|
|
||
| - name: Remove source v2 onion service info if not enabled | ||
| file: | ||
| path: /var/lib/securedrop/source_v2_url | ||
| state: absent | ||
| notify: |
| @@ -23,12 +23,16 @@ | |||
| mode: "0644" | |||
| content: | | |||
| {{ v2_onion_url_lookup_result.stdout|default('') }} | |||
| notify: | |||
There was a problem hiding this comment.
Making a note to remove this logic as part of #5731 as is it outside of the tor hidden service role
Status
Ready for review
Description of Changes
Fixes #5715.
If the configuration of v2 and v3 services is modified, Apache needs to be restarted for the app config to reflect the changes, so that migration warnings are accurate.
Testing
developsecuredrop-admin sdconfigor editingsite-specificsecuredrop-admin installgit checkout -b fix-5715 origin/fix-5715Deployment
No special considerations.
Checklist
If you made changes to the server application code:
make lint) and tests (make test) pass in the development containerIf you made non-trivial code changes:
Choose one of the following: