Install nginx without sub-role

.github/workflows/check_ansible.yml

@@ -58,41 +58,41 @@ jobs:
       #- name: Setup tmate session
       #  uses: mxschmitt/action-tmate@v3
 
-      - uses: actions/github-script@v6
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const commentTitle = "Ansible Run Output";
-            const ansiblePlaybookOutput = `${{ steps.playbook.outputs.ansible_playbook}}`;
-            const parts = ansiblePlaybookOutput.split(/PLAY RECAP \*+/);
-            const ansiblePlaybookRecap = parts.length > 1 ? parts[1].trim() : '';
+      #- uses: actions/github-script@v9
+      #  with:
+      #    github-token: ${{ secrets.GITHUB_TOKEN }}
+      #    script: |
+      #      const commentTitle = "Ansible Run Output";
+      #      const ansiblePlaybookOutput = `${{ steps.playbook.outputs.ansible_playbook}}`;
+      #      const parts = ansiblePlaybookOutput.split(/PLAY RECAP \*+/);
+      #      const ansiblePlaybookRecap = parts.length > 1 ? parts[1].trim() : '';
 
-            const commentBody = `
-            #### Ansible Playbook Recap 🔍
+      #      const commentBody = `
+      #      #### Ansible Playbook Recap 🔍
 
-            \`\`\`\n
-            ${ansiblePlaybookRecap}
-            \`\`\`
+      #      \`\`\`\n
+      #      ${ansiblePlaybookRecap}
+      #      \`\`\`
 
-            #### Ansible playbook output 📖\`${{ steps.playbook.outcome }}\`
+      #      #### Ansible playbook output 📖\`${{ steps.playbook.outcome }}\`
 
-            <details><summary>Show Execution</summary>
+      #      <details><summary>Show Execution</summary>
 
-            \`\`\`\n
-            ${ansiblePlaybookOutput}
-            \`\`\`
+      #      \`\`\`\n
+      #      ${ansiblePlaybookOutput}
+      #      \`\`\`
 
-            </details>
+      #      </details>
 
-            |                   |                                    |
-            |-------------------|------------------------------------|
-            | Pusher            | @${{ github.actor }}               |
-            | Action            |  ${{ github.event_name }}          |
-            | Working Directory |  ${{ env.tf_actions_working_dir }} |
-            | Workflow          |  ${{ github.workflow }}            |
-            | Last updated      |  ${(new Date()).toUTCString()}     |
-            `;
+      #      |                   |                                    |
+      #      |-------------------|------------------------------------|
+      #      | Pusher            | @${{ github.actor }}               |
+      #      | Action            |  ${{ github.event_name }}          |
+      #      | Working Directory |  ${{ env.tf_actions_working_dir }} |
+      #      | Workflow          |  ${{ github.workflow }}            |
+      #      | Last updated      |  ${(new Date()).toUTCString()}     |
+      #      `;
 
-            // Call the script to write the comment
-            const script = require('./scripts/ghactions/comment-on-pr.js');
-            await script({github, context, core, commentTitle, commentBody});
+      #      // Call the script to write the comment
+      #      const script = require('./scripts/ghactions/comment-on-pr.js');
+      #      await script({github, context, core, commentTitle, commentBody});

ansible/README.md

@@ -191,6 +191,41 @@ When deploying files or updating files already existing on the hosts it can be u
 This helps track down how files on the host were modified and why.
 :::
 
+#### Tagging convention
+
+Tasks are tagged along two independent axes, so that `--tags`/`--skip-tags` can be used to run (or skip) a
+meaningful slice of a playbook without guessing what else might be silently pulled in or left out:
+
+* **Component tag** — matches the role name (`nginx`, `dehydrated`, `nftables`, `prometheus_node_exporter`,
+  `docker`, `ooniapi_gateway`, ...). Selects everything belonging to that role.
+* **Phase tag** — a small, fixed vocabulary describing *what kind* of operation the task performs, independent of
+  which role it lives in:
+
+  | Tag          | Meaning                                                                                                             |
+  |--------------|----------------------------------------------------------------------------------------------------------------------|
+  | `packages`   | apt/package installs — slow, safe to skip when nothing package-level changed                                      |
+  | `config`     | template/config file rendering — fast, safe to run often                                                           |
+  | `certs`      | dehydrated cert issuance/renewal — rate-limited by Let's Encrypt, must be independently skippable (e.g. before DNS is cut over to a new host) |
+  | `network`    | nftables rules and docker network setup                                                                            |
+  | `service`    | service enable/start/restart/reload operations                                                                     |
+  | `monitoring` | prometheus/node_exporter wiring and health checks                                                                  |
+  | `secrets`    | sudoers rules and deploy-credential/password setup                                                                 |
+
+  Most tasks should carry exactly one component tag and one phase tag.
+
+  Examples:
+  ```
+  ./play -i inventory deploy-monitoring-proxy.yml -l monitoringproxy.prod.ooni.io --tags config
+  ./play -i inventory deploy-ooni-backend.yml -l backend-hel.ooni.org --skip-tags certs
+  ./play -i inventory deploy-clickhouse-proxy.yml -l clickhouseproxy.prod.ooni.io --tags monitoring
+  ```
+
+:::note
+This taxonomy is applied incrementally as roles are touched, not retrofitted across the whole codebase in one go
+— currently `nginx`, `dehydrated`, and `prometheus_node_exporter` follow it. Don't assume every task elsewhere
+already does.
+:::
+
 ### Platform specific known bugs
 
 On macOS you might run into this issue: https://github.com/ansible/ansible/issues/76322

ansible/deploy-clickhouse-proxy.yml

@@ -6,9 +6,10 @@
   become: true
   roles:
     - role: bootstrap
+    - role: nginx
     - role: dehydrated
-      vars: 
-        ssl_domains: 
+      vars:
+        ssl_domains:
           - "{{ inventory_hostname }}"
         tls_cert_dir: /var/lib/dehydrated/certs
     - role: clickhouse_proxy

ansible/deploy-monitoring-proxy.yml

@@ -6,13 +6,13 @@
   become: true
   roles:
     - role: bootstrap
+    - role: nginx
+      tags: nginx
     - role: dehydrated
       vars:
         ssl_domains:
           - "{{ inventory_hostname }}"
         tls_cert_dir: /var/lib/dehydrated/certs
-    - role: nginx
-      tags: nginx
     - role: monitoring_proxy
       vars:
         monitoring_proxy_public_fqdn: "{{ inventory_hostname }}"

ansible/deploy-notebook.yml

@@ -9,4 +9,6 @@
     ssl_domains:
       - "{{ inventory_hostname }}"
   roles:
+    - nginx
+    - dehydrated
     - notebook

ansible/deploy-ooni-backend.yml

@@ -8,6 +8,7 @@
         admin_group_name: adm
     - role: base-backend
     - role: nftables
+    - role: nginx
     - role: dehydrated
       tags: dehydrated
       expand: yes

ansible/deploy-wc-test-helper.yml

@@ -0,0 +1,14 @@
+---
+- name: Deploy test helpers
+  hosts:
+    - wc.th.dev.ooni.io
+  become: true
+  vars:
+    ssl_domains:
+      - "{{ inventory_hostname }}"
+    nginx_install_method: official_repo
+  roles:
+    - role: bootstrap
+    - role: nginx
+    - role: dehydrated
+    - role: prometheus_node_exporter

ansible/inventory

@@ -35,6 +35,9 @@ ams-ps.ooni.nu
 #mia-echoth.ooni.nu
 #mia-httpth.ooni.nu
 
+[do_fra]
+wc.th.dev.ooni.io
+
 [aws-proxy]
 clickhouseproxy.dev.ooni.io
 clickhouseproxy.prod.ooni.io

ansible/roles/bootstrap/handlers/main.yml

@@ -9,7 +9,7 @@
     state: restarted
 
 - name: Test systemd-resolved
-  ansible.builtin.shell: resolvectl query go.dnscheck.tools --cache=no
+  ansible.builtin.shell: resolvectl query dnscheck.tools --cache=no
 
 - name: Restart systemd-journald
   ansible.builtin.systemd_service:

ansible/roles/bootstrap/tasks/main.yml

@@ -26,6 +26,7 @@
       - git
       - htop
       - iotop
+      - locales
       - lsof
       - lvm2
       - man-db
@@ -44,6 +45,24 @@
     update_cache: yes
     install_recommends: no
 
+- name: Generate en_US.UTF-8 locale
+  community.general.locale_gen:
+    name: en_US.UTF-8
+    state: present
+
+- name: Set system locale
+  ansible.builtin.lineinfile:
+    path: /etc/default/locale
+    create: yes
+    regexp: "^{{ item.key }}="
+    line: "{{ item.key }}={{ item.value }}"
+    owner: root
+    group: root
+    mode: "0644"
+  loop:
+    - { key: "LANG", value: "en_US.UTF-8" }
+    - { key: "LC_ALL", value: "en_US.UTF-8" }
+
 - name: Set timezone
   community.general.timezone:
     name: Etc/UTC

ansible/roles/dehydrated/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
 - name: Installs packages
-  tags: dehydrated
+  tags: [dehydrated, packages]
   apt:
     install_recommends: false
     cache_valid_time: 86400
@@ -23,7 +23,7 @@
 #      HOOK="/etc/dehydrated/hook.sh"
 
 - name: Add ACME dedicated sites-enabled file
-  tags: dehydrated
+  tags: [dehydrated, certs]
   ansible.builtin.template:
     src: templates/letsencrypt-http
     # the server block matches all SSL FQDNs and must be
@@ -33,7 +33,7 @@
     owner: root
 
 - name: Add canary file to ensure /.well-known/acme-challenge is reachable by let's encrypt
-  tags: dehydrated
+  tags: [dehydrated, certs]
   ansible.builtin.copy:
     content: |
       Generated by ansible using ansible/roles/dehydrated/tasks/main.yml.
@@ -44,39 +44,39 @@
     owner: root
 
 - name: reload nftables service
-  tags: dehydrated
+  tags: [dehydrated, network]
   shell: systemctl reload nftables.service
 
 - name: Configure domains {{ ssl_domains }}
   # https://github.com/dehydrated-io/dehydrated/blob/master/docs/domains_txt.md
-  tags: dehydrated
+  tags: [dehydrated, certs]
   template:
     src: templates/domains.txt.j2
     dest: /etc/dehydrated/domains.txt
 
 - name: Register account if needed
-  tags: dehydrated
+  tags: [dehydrated, certs]
   ansible.builtin.shell:
     cmd: "test -d /var/lib/dehydrated/accounts || dehydrated --register --accept-terms"
 
 - name: Install dehydrated.service
-  tags: dehydrated
+  tags: [dehydrated, certs]
   template:
     src: templates/dehydrated.service
     dest: /etc/systemd/system/dehydrated.service
     mode: 0644
     owner: root
 
 - name: Install dehydrated.timer
-  tags: dehydrated
+  tags: [dehydrated, certs]
   template:
     src: templates/dehydrated.timer
     dest: /etc/systemd/system/dehydrated.timer
     mode: 0644
     owner: root
 
 - name: Ensure timer runs
-  tags: dehydrated
+  tags: [dehydrated, certs]
   systemd:
     name: dehydrated.timer
     state: started

ansible/roles/nginx/defaults/main.yml

@@ -1 +1,10 @@
 nginx_user: nginx
+
+# "nginxinc_role" (default, unchanged): install via the nginxinc.nginx galaxy
+# role, as today.
+# "official_repo": install directly from nginx.org's own apt repo, following
+# https://nginx.org/en/linux_packages.html#Debian, with a pinned signing-key
+# fingerprint check. Opt in per-playbook; the nginxinc_role default is left
+# alone for existing callers since switching apt repos changes what nginx
+# package/version they get on their next run.
+nginx_install_method: nginxinc_role

ansible/roles/nginx/files/ssl_modern.conf

@@ -1,4 +1,4 @@
 # Oldest compatible clients: Firefox 27, Chrome 30, IE 11 on Windows 7, Edge, Opera 17, Safari 9, Android 5.0, and Java 8
-ssl_protocols TLSv1.2;
+ssl_protocols TLSv1.2 TLSv1.3;
 ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
 # NB: technically, it does not require ssl_dhparam as it has no DHE, only ECDHE.