main.yml

---
#
# Onionprobe Ansible role configuration
#
# Copyright (C) 2024 The Tor Project, Inc.
# SPDX-License-Identifier: AGPL-3.0-or-later
#

# Onionprobe installation mode: controls how it's installed.
#
# Available options:
#
# 'distro'    : installs Onionprobe from a package, if available in the distro;
#               this will be a system-wide installation, meaning that all users
#               in the system with shell access will be able to run Onionprobe.
#
#               Requirements:
#
#               * The 'onionprobe' package must be available through the system's
#                 package manager.
#
# 'pip'       : installs Onionprobe and it's dependencies using pip.
#               this won't be a system-wide installation in the sense that other
#               users with shell access won't have access to Onionprobe, since
#               it's installed in a restricted virtualenv.
#
#               Requirements (automatically handled on Debian-like systems):
#
#               * Pip.
#
#               * Virtualenv.
#
# 'repository': installs the needed dependencies and clone the Onionprobe repository.
#
#               Any users in the system may read (and sometimes execute) most of the
#               files in this working copy; in general no credentials are stored in
#               this folder; while some files are protected with restrictive file
#               permissions, others cannot otherwise they cannot be shared with
#               containers in the standalone operation more described below.
#
#               In general this should be safe, as Onionprobe by default does
#               not need any credentials to be stored on it's configuration
#               files.
#
#               * Dependencies must be available in the distribution.
#
onionprobe_installation: repository

# Onionprobe operation mode: specifies how it should run.
#
# Available options:
#
# 'manual'    : do not manage the way Onionprobe runs: this is left to the operator
#               to configure elsewhere.
#
# 'single'    : runs just the Onionprobe service, and nothing else.
#
#               Requirements:
#
#               * Systemd must be available in the system, and is used to
#                 manage the service.
#
# 'standalone': runs the full standalone monitoring monitoring node:
#               https://onionservices.torproject.org/apps/web/onionprobe/standalone/
#
#               Requirements:
#
#               * Variable 'onionprobe_installation' must be set to
#                 'repository', as the package usually don't ship the needed
#                 container configuration.
#
#               * Docker Compose or Podman Compose must be installed and
#                 configured.
#
#               * Systemd must be available in the system, as it's used to
#                 manage the service.
#
onionprobe_operation: standalone

# Onionprobe Project name
#
# This is mainly used as an identifier to configure and distinguish services.
onionprobe_project_name: onionprobe

# Onionprobe virtualenv
#
# Sets virtualenv location used by the 'pip' installation method.
onionprobe_virtualenv: "{{ onionprobe_path }}/venv"

# Repository version
#
# Ensure Onionprobe's repository version is set to a specific version.
#
# Allowed values are specified at
# https://docs.ansible.com/ansible/latest/collections/ansible/builtin/git_module.html
#
# Having it set to 'HEAD' may not be alwayes considered a good practice:
# https://ansible.readthedocs.io/projects/lint/rules/latest/
#
#onionprobe_repository_version: 1.2.0
onionprobe_repository_version: HEAD

#
# User, group and folders
#
# In most situations, {{ onionprobe_home }} can also be set to the same value
# as {{ onionprobe_path }}, but note that this can lead to a git clone error
# when running as root, due to Ansible using `onionprobe_path` as a base for
# temporary files (and Git refuses to clone into non-empty folders).
#
# So, to be in the safe side, {{{ onionspray_home }} and {{ onionprobe_path }}
# defaults to different folders.
#

onionprobe_user    : onionprobe
onionprobe_group   : onionprobe
onionprobe_uid     : 2000
onionprobe_gid     : 2000
onionprobe_home    : "/home/{{ onionprobe_user }}"
onionprobe_path    : "/var/lib/{{ onionprobe_user }}"

#
# Repository location
#
# Defaults to the upstream Onionprobe repository, but can be overriden to
# point to a fork.
#
onionprobe_repo: https://gitlab.torproject.org/tpo/onion-services/onionprobe.git

#
# Service
#

# Service name
onionprobe_service: onionprobe

# Whether to automatically enable the service
#
# Systemd might not be available in some testing environments, where makes
# sense to keep the service disabled.
onionprobe_enable_service: true

# Daemon options not specified in the Onionprobe configuration
#
# This setting is ignored by the standalone operation mode
onionprobe_daemon_opts: ''

# Onionprobe configuration folder
#
# When empty, the configuration path is computed depending on the installation
# mode:
#
#  'distro'    : config path is set to /etc/onionprobe
#  'pip'       : config path is set to {{ onionprobe_virtualenv }}/share/onionprobe/configs
#  'repository': config path is set to configs, and is relative to the {{ onionprobe_path }}
#
# Examples:
#
#   onionprobe_config_path: '{{ onionprobe_path }}'
#   onionprobe_config_path: '{{ onionprobe_path }}/configs'
#   onionprobe_config_path: '{{ onionprobe_path }}/contrib/configs'
#
onionprobe_config_path: ''

#
# Onionprobe configuration file relative to {{ onionprobe_config_path }}
#
# Do not leave this empty.
#
onionprobe_config: 'tor.yaml'

# Path for a configuration file to be copied to the remote host
#
# This file should be stored in the Ansible configuration folder/repository,
# and it's copied to the remote host.
#
# Leaving this empty means that no configuration file will be copied to
# the remote host, but {{ onionprobe_config }} can still be used to
# point to an existing file in the remote host.
onionprobe_config_src: ''

# Path where a config generation script is stored
#
# When empty, the configuration path is computed depending on the installation
# mode:
#
#  'distro'    : config path is set to /usr/share/onionprobe/examples
#  'pip'       : config path is set to {{ onionprobe_virtualenv }}/share/onionprobe/examples
#  'repository': config path is set to {{ onionprobe_path }}/packages
#
# Examples:
#
#   onionprobe_config_script_path: '/usr/share/onionprobe/examples'
#   onionprobe_config_script_path: '{{ onionprobe_path }}/packages'
#   onionprobe_config_script_path: '{{ onionprobe_path }}/contrib/configs'
#   onionprobe_config_script_path: '{{ onionprobe_virtualenv }}/share/onionprobe/examples
#
onionprobe_config_script_path: ''

# Path for a config generation script to be copied to the remote host
#
# This script should be stored in the Ansible configuration folder/repository,
# and it's copied to the remote host.
#
# Leaving this empty disables the config generation script (for the single operation
# mode) or uses the default one (for the standalone mode).
onionprobe_config_script_src : ''

#
# Standalone monitor mode options
#

# The container runtime to use
#
# Note that this role won't manage the container runtime installation.
# That needs to be done elsewhere.
#
onionprobe_container_runtime: 'docker'

# Config script parameters
#
# Allow passing parameters to the config generation script.
#
# Example:
#
#   onionprobe_config_script_params: >
#     --loop --wait 3600
#     --config_template /srv/onionprobe/configs/tor.yaml
#     --config_overrides rounds=20 descriptor_max_retries=20
#     descriptor_timeout=120 http_connect_timeout=120
#     http_connect_max_retries=6 http_read_timeout=120
#
# For the standalone operation mode, it's recommended to set "--wait" and
# "rounds=" params, so the configuration container stops periodically, ensuring
# that whenever it restarts a fresh configuration is picked.
#
# The --output-folder option don't need to be set, as Ansible will automatically
# configure it in sync with {{ onionprobe_config_path }}.
#
# When using options such as --config_template in the standalone mode, note
# that the Onionprobe path inside the container will be different from
# {{ onionprobe_path }}. Usually, the Onionprobe path inside the container will be
# /srv/shared.
onionprobe_config_script_params: ''

# Prometheus options as documented at
# https://prometheus.io/docs/prometheus/latest/command-line/prometheus/
onionprobe_prometheus_web_external_url: 'http://localhost:9090'

# Alertmanager options as documented at
# https://prometheus.io/docs/alerting/latest/configuration/
onionprobe_alertmanager_template                : alertmanager/alertmanager.yml.j2
onionprobe_smtp_smarthost                       : mail.example.org:587
onionprobe_smtp_email                           : changeme@example.org
onionprobe_smtp_username                        : changeme
onionprobe_smtp_auth_password                   : changeme
onionprobe_altermanager_default_recipient_email : changeme@example.org

# Sets the Alertmanager group ownership for the standalone monitor mode
#
# This depends on the UID and GID used by the Alertmanager container service:
# https://github.com/prometheus/alertmanager/blob/main/Dockerfile
#
# It may or may not match the default nobody/nogroup from your operating system.
#
# The default may for for most cases, so only customize these variables if you're
# having issues with the alertmanager container.
onionprobe_alertmanager_group: nogroup

# Grafana configuration
onionprobe_grafana_database_password: unsafe-password-please-change

# Grafana options as documented at
# https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/
onionprobe_grafana_smtp_enabled         : false
onionprobe_grafana_smtp_host            : localhost:25
onionprobe_grafana_smtp_user            : ''
onionprobe_grafana_stmp_password        : ''
onionprobe_grafana_smtp_starttls_policy : ''
onionprobe_grafana_server_domain        : ''
onionprobe_grafana_server_root_url      : ''
onionprobe_grafana_plugins_enable_alpha : false