Updated restore playbook to validate tor config after v2 removal

[zenmonkeykstop]

Status

Ready for review / Work in progress

Description of Changes

Fixes #5892.

• replaces disable_v2.py with an awk one-liner that catches the case when HTTPS is enabled on a source v2 interface
• adds a check that verifies that the tor config is valid and has no v2 service definitions.

Testing

v2+v3 (v2nv3.tar.gz) and v3 (v3.tar.gz) backup files are required.

v2+v3

From this branch, against a prod system (VM or hardware):

• perform a backup with the command ./securedrop-admin --force restore install_files/ansible-base/v2nv3.tar.gz
  • Verify that the backup completes successfully
  • Verify that the tasks in cleanup_v2.yml run successfully after the Reload Apache service task
  • Verify that the app server /etc/tor/torrc file contains no v2 services (view with ssh app cat /etc/tor/torrc)

v2+v3 with HTTPS

(Note: if you don't have a HTTPS backup, fake it! simply untar the v2+v3 backup, add an extra line in etc/tor/torrc in the v2 source block with the contents HiddenServicePort 443 127.0.0.1:443, and recreate the tarball! For extra points, add it in the v3 source definition as well.)
From this branch, against a prod system (VM or hardware):

• perform a backup with the command ./securedrop-admin --force restore install_files/ansible-base/v2nv3https.tar.gz
  • Verify that the backup completes successfully
  • Verify that the tasks in cleanup_v2.yml run successfully after the Reload Apache service task
  • Verify that the app server /etc/tor/torrc file contains no v2 services (view with ssh app cat /etc/tor/torrc)
  • If HTTPS was enabled in the backup for v3, verify that it is still enabled in the server /etc/tor/torrc

v3-only

From this branch, against a prod system (VM or hardware):

• perform a backup with the command ./securedrop-admin --force restore install_files/ansible-base/v3-only.tar.gz
  • Verify that the backup completes successfully
  • Verify that the tasks in cleanup_v2.yml do not run after the Reload Apache service task

Deployment

Deployed with GUI or manual update on workstation.

Checklist

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

Choose one of the following:

• I have opened a PR in the docs repo for these changes, or will do so later
• I would appreciate help with the documentation
• These changes do not require documentation

[lgtm-com]

This pull request fixes 5 alerts when merging 2c37173 into 8d5430d - view on LGTM.com

fixed alerts:

• 5 for Variable defined multiple times

[rmol]

The awk torrc cleanup is a nice reduction, but I think it needs a tweak or some post-processing, as it's leaving an empty HiddenServiceDir line at the end of the file. The tor --verify-config check passes, as Tor ignores that line, but it's debris.

Testing

v2+v3 (v2nv3.tar.gz) and v3 (v3.tar.gz) backup files are required.

v2+v3

From this branch, against a prod system (VM or hardware):

• perform a restore with the command ./securedrop-admin --force restore install_files/ansible-base/v2nv3.tar.gz
  • Verify that the restore completes successfully
  • Verify that the tasks in cleanup_v2.yml run successfully after the Reload Apache service task
  • Verify that the app server /etc/tor/torrc file contains no v2 services (view with ssh app cat /etc/tor/torrc)

⚠️ After the v2 cleanup, torrc contains an extra line at the end containing just HiddenServiceDir.

v2+v3 with HTTPS

(Note: if you don't have a HTTPS backup, fake it! simply untar the v2+v3 backup, add an extra line in etc/tor/torrc in the v2 source block with the contents HiddenServicePort 443 127.0.0.1:443, and recreate the tarball! For extra points, add it in the v3 source definition as well.)
From this branch, against a prod system (VM or hardware):

• perform a restore with the command ./securedrop-admin --force restore install_files/ansible-base/v2nv3https.tar.gz
  • Verify that the restore completes successfully
  • Verify that the tasks in cleanup_v2.yml run successfully after the Reload Apache service task
  • Verify that the app server /etc/tor/torrc file contains no v2 services (view with ssh app cat /etc/tor/torrc)
  • If HTTPS was enabled in the backup for v3, verify that it is still enabled in the server /etc/tor/torrc

⚠️ After the v2 cleanup, torrc contains an extra line at the end containing just HiddenServiceDir.

v3-only

From this branch, against a prod system (VM or hardware):

• perform a backup with the command ./securedrop-admin --force restore install_files/ansible-base/v3-only.tar.gz
  • Verify that the backup completes successfully
  • Verify that the tasks in cleanup_v2.yml do not run after the Reload Apache service task

[lgtm-com]

This pull request fixes 5 alerts when merging c8b432f into 8d5430d - view on LGTM.com

fixed alerts:

• 5 for Variable defined multiple times

[zenmonkeykstop]

@rmol a fix has been added. Take another look?

[rmol]

The sed addition worked.

v2+v3

From this branch, against a prod system (VM or hardware):

• perform a restore with the command ./securedrop-admin --force restore install_files/ansible-base/v2nv3.tar.gz
  • Verify that the restore completes successfully
  • Verify that the tasks in cleanup_v2.yml run successfully after the Reload Apache service task
  • Verify that the app server /etc/tor/torrc file contains no v2 services (view with ssh app cat /etc/tor/torrc)

v2+v3 with HTTPS

(Note: if you don't have a HTTPS backup, fake it! simply untar the v2+v3 backup, add an extra line in etc/tor/torrc in the v2 source block with the contents HiddenServicePort 443 127.0.0.1:443, and recreate the tarball! For extra points, add it in the v3 source definition as well.)
From this branch, against a prod system (VM or hardware):

• perform a backup with the command ./securedrop-admin --force restore install_files/ansible-base/v2nv3https.tar.gz
  • Verify that the backup completes successfully
  • Verify that the tasks in cleanup_v2.yml run successfully after the Reload Apache service task
  • Verify that the app server /etc/tor/torrc file contains no v2 services (view with ssh app cat /etc/tor/torrc)
  • If HTTPS was enabled in the backup for v3, verify that it is still enabled in the server /etc/tor/torrc

v3-only

From this branch, against a prod system (VM or hardware):

• perform a backup with the command ./securedrop-admin --force restore install_files/ansible-base/v3-only.tar.gz
  • Verify that the backup completes successfully
  • Verify that the tasks in cleanup_v2.yml do not run after the Reload Apache service task