{"action":"created","comment":{"url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/comments/35596846","id":35596846,"diff_hunk":"@@ -187,3 +214,50 @@ Vagrant.configure(\"2\") do |config|\n     end\n   end\n end\n+\n+\n+# Get .onion URL for connecting to instances over Tor.\n+# The Ansible playbooks fetch these values back to the\n+# Admin Workstation (localhost) so they can be manually\n+# added to the inventory file. Possible values for filename\n+# are \"app-ssh-aths\" and \"mon-ssh-aths\".\n+def find_ssh_aths(filename)\n+  require 'find'\n+  repo_root = File.expand_path(File.dirname(__FILE__))\n+  ansible_dir = File.join(repo_root, \"install_files\", \"ansible-base\")\n+\n+  Find.find(ansible_dir) do |path|","path":"Vagrantfile","position":103,"original_position":103,"commit_id":"305a126d02536a881886376b485a277c71372f77","original_commit_id":"305a126d02536a881886376b485a277c71372f77","user":{"login":"conorsch","id":657862,"avatar_url":"https://avatars.githubusercontent.com/u/657862?v=3","gravatar_id":"","url":"https://api.github.com/users/conorsch","html_url":"https://github.com/conorsch","followers_url":"https://api.github.com/users/conorsch/followers","following_url":"https://api.github.com/users/conorsch/following{/other_user}","gists_url":"https://api.github.com/users/conorsch/gists{/gist_id}","starred_url":"https://api.github.com/users/conorsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/conorsch/subscriptions","organizations_url":"https://api.github.com/users/conorsch/orgs","repos_url":"https://api.github.com/users/conorsch/repos","events_url":"https://api.github.com/users/conorsch/events{/privacy}","received_events_url":"https://api.github.com/users/conorsch/received_events","type":"User","site_admin":false},"body":"@garrettr You're right, I'll patch.","created_at":"2015-07-27T22:48:41Z","updated_at":"2015-07-27T22:48:41Z","html_url":"https://github.com/freedomofpress/securedrop/pull/1070#discussion_r35596846","pull_request_url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1070","_links":{"self":{"href":"https://api.github.com/repos/freedomofpress/securedrop/pulls/comments/35596846"},"html":{"href":"https://github.com/freedomofpress/securedrop/pull/1070#discussion_r35596846"},"pull_request":{"href":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1070"}}},"pull_request":{"url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1070","id":39296789,"html_url":"https://github.com/freedomofpress/securedrop/pull/1070","diff_url":"https://github.com/freedomofpress/securedrop/pull/1070.diff","patch_url":"https://github.com/freedomofpress/securedrop/pull/1070.patch","issue_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1070","number":1070,"state":"open","locked":false,"title":"Adds serverspec tests for prod hosts","user":{"login":"conorsch","id":657862,"avatar_url":"https://avatars.githubusercontent.com/u/657862?v=3","gravatar_id":"","url":"https://api.github.com/users/conorsch","html_url":"https://github.com/conorsch","followers_url":"https://api.github.com/users/conorsch/followers","following_url":"https://api.github.com/users/conorsch/following{/other_user}","gists_url":"https://api.github.com/users/conorsch/gists{/gist_id}","starred_url":"https://api.github.com/users/conorsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/conorsch/subscriptions","organizations_url":"https://api.github.com/users/conorsch/orgs","repos_url":"https://api.github.com/users/conorsch/repos","events_url":"https://api.github.com/users/conorsch/events{/privacy}","received_events_url":"https://api.github.com/users/conorsch/received_events","type":"User","site_admin":false},"body":"Introducing Serverspec tests for the `app-prod` and `mon-prod` VMs. The addition of the `/prod/` hosts to the test suite required a significant reorganization to the host-based spectests added in #1055, moving to a mostly role-based organization for the spectests. There are exceptions; the tests currently reflect the organization of the Ansible playbooks, and have a similar use of dynamic variables. \r\n\r\n## Major changes\r\n### `SECUREDROP_` prefix for env vars\r\nAll SecureDrop-related environment variables are now prefixed with `SECUREDROP_`. You may need to update the following in your local environment:\r\n\r\n * `DEVELOPMENT_SKIP_TAGS` -> `SECUREDROP_DEVELOPMENT_SKIP_TAGS`\r\n * `STAGING_SKIP_TAGS` -> `SECUREDROP_STAGING_SKIP_TAGS`\r\n * `PROD_SKIP_TAGS` -> `SECUREDROP_PROD_SKIP_TAGS`\r\n\r\n### SSH over Tor\r\nThe `vagrant ssh` command can now connect to `/prod/` instances over Tor. Prior to connecting over SSH, you'll still need to add the ATHS values to your torrc file and reload tor, then `export SECUREDROP_TOR_OVER_SSH=1` to tell Vagrant to use Tor. It will read the `app-ssh-aths` and `mon-ssh-aths` files on disk and use those to generate the SSH config. An example terminal session showing how this env var is configured has been added to `docs/develop.md`.\r\n\r\n### `snapci` machine in Vagrantfile\r\nThe new `snapci` VM models the Snap CI test nodes. Significantly, this box is based on CentOS 6.6, rather than Ubuntu LTS. This machine can be used for debugging the Snap playbooks. A corresponding `snapci` Ansible role is used to configure this machine both locally and as part of the Snap prod test stage.\r\n\r\n### `Prod_Clean` stage in Snap CI\r\nDue to the addition of SSH connectivity over Tor, it's now possible to run the serverspec tests against the prod hosts. Accordingly a new stage in Snap CI has been created for just this purpose. See `snap_ci/prod_clean.sh` for a detailed look. In a nutshell, the stage creates prod machines in DigitalOcean, provisions them (with more restrictive iptables rules), then runs the serverspec tests against them over Tor. As with the staging hosts, the grsecurity tasks and tests are skipped in Snap, but can be run locally.\r\n\r\n### Related PRs\r\n* #1002 (introduction of serverspec tests)\r\n* #1055 (expansion of serverspec tests)","created_at":"2015-07-06T18:33:08Z","updated_at":"2015-07-27T22:48:41Z","closed_at":null,"merged_at":null,"merge_commit_sha":"420f195666099d9430b54cc5f697d2c585a8fa52","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1070/commits","review_comments_url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1070/comments","review_comment_url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/comments{/number}","comments_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1070/comments","statuses_url":"https://api.github.com/repos/freedomofpress/securedrop/statuses/305a126d02536a881886376b485a277c71372f77","head":{"label":"conorsch:snapci-serverspec-prod-tests","ref":"snapci-serverspec-prod-tests","sha":"305a126d02536a881886376b485a277c71372f77","user":{"login":"conorsch","id":657862,"avatar_url":"https://avatars.githubusercontent.com/u/657862?v=3","gravatar_id":"","url":"https://api.github.com/users/conorsch","html_url":"https://github.com/conorsch","followers_url":"https://api.github.com/users/conorsch/followers","following_url":"https://api.github.com/users/conorsch/following{/other_user}","gists_url":"https://api.github.com/users/conorsch/gists{/gist_id}","starred_url":"https://api.github.com/users/conorsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/conorsch/subscriptions","organizations_url":"https://api.github.com/users/conorsch/orgs","repos_url":"https://api.github.com/users/conorsch/repos","events_url":"https://api.github.com/users/conorsch/events{/privacy}","received_events_url":"https://api.github.com/users/conorsch/received_events","type":"User","site_admin":false},"repo":{"id":32643414,"name":"securedrop","full_name":"conorsch/securedrop","owner":{"login":"conorsch","id":657862,"avatar_url":"https://avatars.githubusercontent.com/u/657862?v=3","gravatar_id":"","url":"https://api.github.com/users/conorsch","html_url":"https://github.com/conorsch","followers_url":"https://api.github.com/users/conorsch/followers","following_url":"https://api.github.com/users/conorsch/following{/other_user}","gists_url":"https://api.github.com/users/conorsch/gists{/gist_id}","starred_url":"https://api.github.com/users/conorsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/conorsch/subscriptions","organizations_url":"https://api.github.com/users/conorsch/orgs","repos_url":"https://api.github.com/users/conorsch/repos","events_url":"https://api.github.com/users/conorsch/events{/privacy}","received_events_url":"https://api.github.com/users/conorsch/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/conorsch/securedrop","description":"GitHub repository for the SecureDrop whistleblower platform. Do not submit tips here!","fork":true,"url":"https://api.github.com/repos/conorsch/securedrop","forks_url":"https://api.github.com/repos/conorsch/securedrop/forks","keys_url":"https://api.github.com/repos/conorsch/securedrop/keys{/key_id}","collaborators_url":"https://api.github.com/repos/conorsch/securedrop/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/conorsch/securedrop/teams","hooks_url":"https://api.github.com/repos/conorsch/securedrop/hooks","issue_events_url":"https://api.github.com/repos/conorsch/securedrop/issues/events{/number}","events_url":"https://api.github.com/repos/conorsch/securedrop/events","assignees_url":"https://api.github.com/repos/conorsch/securedrop/assignees{/user}","branches_url":"https://api.github.com/repos/conorsch/securedrop/branches{/branch}","tags_url":"https://api.github.com/repos/conorsch/securedrop/tags","blobs_url":"https://api.github.com/repos/conorsch/securedrop/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/conorsch/securedrop/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/conorsch/securedrop/git/refs{/sha}","trees_url":"https://api.github.com/repos/conorsch/securedrop/git/trees{/sha}","statuses_url":"https://api.github.com/repos/conorsch/securedrop/statuses/{sha}","languages_url":"https://api.github.com/repos/conorsch/securedrop/languages","stargazers_url":"https://api.github.com/repos/conorsch/securedrop/stargazers","contributors_url":"https://api.github.com/repos/conorsch/securedrop/contributors","subscribers_url":"https://api.github.com/repos/conorsch/securedrop/subscribers","subscription_url":"https://api.github.com/repos/conorsch/securedrop/subscription","commits_url":"https://api.github.com/repos/conorsch/securedrop/commits{/sha}","git_commits_url":"https://api.github.com/repos/conorsch/securedrop/git/commits{/sha}","comments_url":"https://api.github.com/repos/conorsch/securedrop/comments{/number}","issue_comment_url":"https://api.github.com/repos/conorsch/securedrop/issues/comments{/number}","contents_url":"https://api.github.com/repos/conorsch/securedrop/contents/{+path}","compare_url":"https://api.github.com/repos/conorsch/securedrop/compare/{base}...{head}","merges_url":"https://api.github.com/repos/conorsch/securedrop/merges","archive_url":"https://api.github.com/repos/conorsch/securedrop/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/conorsch/securedrop/downloads","issues_url":"https://api.github.com/repos/conorsch/securedrop/issues{/number}","pulls_url":"https://api.github.com/repos/conorsch/securedrop/pulls{/number}","milestones_url":"https://api.github.com/repos/conorsch/securedrop/milestones{/number}","notifications_url":"https://api.github.com/repos/conorsch/securedrop/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/conorsch/securedrop/labels{/name}","releases_url":"https://api.github.com/repos/conorsch/securedrop/releases{/id}","created_at":"2015-03-21T17:59:44Z","updated_at":"2015-03-21T17:59:46Z","pushed_at":"2015-07-25T01:30:51Z","git_url":"git://github.com/conorsch/securedrop.git","ssh_url":"git@github.com:conorsch/securedrop.git","clone_url":"https://github.com/conorsch/securedrop.git","svn_url":"https://github.com/conorsch/securedrop","homepage":"https://freedom.press/securedrop","size":30520,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"develop"}},"base":{"label":"freedomofpress:develop","ref":"develop","sha":"a6c907c1c29de923f54423d1ee953447b1f3c8c4","user":{"login":"freedomofpress","id":5388147,"avatar_url":"https://avatars.githubusercontent.com/u/5388147?v=3","gravatar_id":"","url":"https://api.github.com/users/freedomofpress","html_url":"https://github.com/freedomofpress","followers_url":"https://api.github.com/users/freedomofpress/followers","following_url":"https://api.github.com/users/freedomofpress/following{/other_user}","gists_url":"https://api.github.com/users/freedomofpress/gists{/gist_id}","starred_url":"https://api.github.com/users/freedomofpress/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/freedomofpress/subscriptions","organizations_url":"https://api.github.com/users/freedomofpress/orgs","repos_url":"https://api.github.com/users/freedomofpress/repos","events_url":"https://api.github.com/users/freedomofpress/events{/privacy}","received_events_url":"https://api.github.com/users/freedomofpress/received_events","type":"Organization","site_admin":false},"repo":{"id":3156820,"name":"securedrop","full_name":"freedomofpress/securedrop","owner":{"login":"freedomofpress","id":5388147,"avatar_url":"https://avatars.githubusercontent.com/u/5388147?v=3","gravatar_id":"","url":"https://api.github.com/users/freedomofpress","html_url":"https://github.com/freedomofpress","followers_url":"https://api.github.com/users/freedomofpress/followers","following_url":"https://api.github.com/users/freedomofpress/following{/other_user}","gists_url":"https://api.github.com/users/freedomofpress/gists{/gist_id}","starred_url":"https://api.github.com/users/freedomofpress/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/freedomofpress/subscriptions","organizations_url":"https://api.github.com/users/freedomofpress/orgs","repos_url":"https://api.github.com/users/freedomofpress/repos","events_url":"https://api.github.com/users/freedomofpress/events{/privacy}","received_events_url":"https://api.github.com/users/freedomofpress/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/freedomofpress/securedrop","description":"GitHub repository for the SecureDrop whistleblower platform. Do not submit tips here!","fork":false,"url":"https://api.github.com/repos/freedomofpress/securedrop","forks_url":"https://api.github.com/repos/freedomofpress/securedrop/forks","keys_url":"https://api.github.com/repos/freedomofpress/securedrop/keys{/key_id}","collaborators_url":"https://api.github.com/repos/freedomofpress/securedrop/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/freedomofpress/securedrop/teams","hooks_url":"https://api.github.com/repos/freedomofpress/securedrop/hooks","issue_events_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/events{/number}","events_url":"https://api.github.com/repos/freedomofpress/securedrop/events","assignees_url":"https://api.github.com/repos/freedomofpress/securedrop/assignees{/user}","branches_url":"https://api.github.com/repos/freedomofpress/securedrop/branches{/branch}","tags_url":"https://api.github.com/repos/freedomofpress/securedrop/tags","blobs_url":"https://api.github.com/repos/freedomofpress/securedrop/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/freedomofpress/securedrop/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/freedomofpress/securedrop/git/refs{/sha}","trees_url":"https://api.github.com/repos/freedomofpress/securedrop/git/trees{/sha}","statuses_url":"https://api.github.com/repos/freedomofpress/securedrop/statuses/{sha}","languages_url":"https://api.github.com/repos/freedomofpress/securedrop/languages","stargazers_url":"https://api.github.com/repos/freedomofpress/securedrop/stargazers","contributors_url":"https://api.github.com/repos/freedomofpress/securedrop/contributors","subscribers_url":"https://api.github.com/repos/freedomofpress/securedrop/subscribers","subscription_url":"https://api.github.com/repos/freedomofpress/securedrop/subscription","commits_url":"https://api.github.com/repos/freedomofpress/securedrop/commits{/sha}","git_commits_url":"https://api.github.com/repos/freedomofpress/securedrop/git/commits{/sha}","comments_url":"https://api.github.com/repos/freedomofpress/securedrop/comments{/number}","issue_comment_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/comments{/number}","contents_url":"https://api.github.com/repos/freedomofpress/securedrop/contents/{+path}","compare_url":"https://api.github.com/repos/freedomofpress/securedrop/compare/{base}...{head}","merges_url":"https://api.github.com/repos/freedomofpress/securedrop/merges","archive_url":"https://api.github.com/repos/freedomofpress/securedrop/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/freedomofpress/securedrop/downloads","issues_url":"https://api.github.com/repos/freedomofpress/securedrop/issues{/number}","pulls_url":"https://api.github.com/repos/freedomofpress/securedrop/pulls{/number}","milestones_url":"https://api.github.com/repos/freedomofpress/securedrop/milestones{/number}","notifications_url":"https://api.github.com/repos/freedomofpress/securedrop/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/freedomofpress/securedrop/labels{/name}","releases_url":"https://api.github.com/repos/freedomofpress/securedrop/releases{/id}","created_at":"2012-01-11T19:57:55Z","updated_at":"2015-07-27T09:34:05Z","pushed_at":"2015-07-27T21:23:30Z","git_url":"git://github.com/freedomofpress/securedrop.git","ssh_url":"git@github.com:freedomofpress/securedrop.git","clone_url":"https://github.com/freedomofpress/securedrop.git","svn_url":"https://github.com/freedomofpress/securedrop","homepage":"https://freedom.press/securedrop","size":41699,"stargazers_count":1491,"watchers_count":1491,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":237,"mirror_url":null,"open_issues_count":164,"forks":237,"open_issues":164,"watchers":1491,"default_branch":"develop"}},"_links":{"self":{"href":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1070"},"html":{"href":"https://github.com/freedomofpress/securedrop/pull/1070"},"issue":{"href":"https://api.github.com/repos/freedomofpress/securedrop/issues/1070"},"comments":{"href":"https://api.github.com/repos/freedomofpress/securedrop/issues/1070/comments"},"review_comments":{"href":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1070/comments"},"review_comment":{"href":"https://api.github.com/repos/freedomofpress/securedrop/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1070/commits"},"statuses":{"href":"https://api.github.com/repos/freedomofpress/securedrop/statuses/305a126d02536a881886376b485a277c71372f77"}}}}