Repository: freedomofpress/securedrop

Issue:
spurious testinfra failures when servers have non-default hostnames
## Description

If a production instance is configured with hostnames other than the recommended `app` and `mon`, `securedrop-admin verify` will report spurious testinfra failures.

First noticed in <https://github.com/freedomofpress/securedrop/issues/6127#issuecomment-938342242>.

## Steps to Reproduce

1. `securedrop-admin sdconfig` with non-default hostnames, e.g. those provisioned by `molecule create -s libvirt-prod-focal`:
    ```yaml
    app_hostname: app-prod
    monitor_hostname: mon-prod
    ```
2. `securedrop-admin install`
3. `securedrop-admin setup -t`
4. `securedrop-admin verify`

## Expected Behavior

All testinfra tests pass.

## Actual Behavior

Hostname-dependent testinfra tests fail, including:

* `app/test_ossec_agent.py::test_hosts_files`
* `mon/test_ossec_server.py::test_ossec_connectivity`
* `mon/test_ossec_server.py::test_hosts_files`
* `mon/test_postfix.py::test_postfix_generic_maps`

## Comments

_Originally posted by @zenmonkeykstop in <https://github.com/freedomofpress/securedrop/issues/6103#issuecomment-946018659>:_

> testinfra tests take their expected values from a bunch of variables in a yaml file, with some of said values (like server IPs) in prod runs being overridden from the `install_files/ansible-base/group_vars/all/site-specific` file created by `./securedrop-admin sdconfig`. Looks like the server hostnames are *not* being overridden. So if they're not named according to the reccos in the docs I'd expect to see this error. Would be an easy fix to override them too methinks - check `molecule/testinfra/conftest.py`.

https://github.com/freedomofpress/securedrop/blob/2882d1ea39175bd98c302000bb506e9b88a18a1f/molecule/testinfra/conftest.py#L49-L50


Discussion:
It's turns out it's not enough to do—

```patch
--- a/molecule/testinfra/conftest.py
+++ b/molecule/testinfra/conftest.py
@@ -47,7 +47,9 @@ def securedrop_import_testinfra_vars(hostname, with_header=False):
                 hostvars[vars_key] = prodvars[prod_key]
 
         _prod_override('app_ip', 'app_ip')
+        _prod_override('app_hostname', 'app_hostname')
         _prod_override('mon_ip', 'monitor_ip')
+        _prod_override('mon_hostname', 'monitor_hostname')
         _prod_override('sasl_domain', 'sasl_domain')
         _prod_override('sasl_username', 'sasl_username')
         _prod_override('sasl_password', 'sasl_password')
```

—because then remote Ansible runs (i.e., `securedrop-admin verify`) will fail trying to connect to the servers by their `{app,monitor}_hostname`s, for which there are no aliases in `~/.ssh/config`.  That is, `securedrop-admin tailsconfig` _always_ aliases the servers as `app` and `mon`, whatever their configured hostnames.  That seems proper for connection aliases, so we'll have to find a cleverer way of overriding or injecting the configured hostnames here.

Resolving patch:
diff --git a/molecule/testinfra/conftest.py b/molecule/testinfra/conftest.py
--- a/molecule/testinfra/conftest.py
+++ b/molecule/testinfra/conftest.py
@@ -47,7 +47,9 @@ def _prod_override(vars_key, prod_key):
                 hostvars[vars_key] = prodvars[prod_key]
 
         _prod_override('app_ip', 'app_ip')
+        _prod_override('app_hostname', 'app_hostname')
         _prod_override('mon_ip', 'monitor_ip')
+        _prod_override('monitor_hostname', 'monitor_hostname')
         _prod_override('sasl_domain', 'sasl_domain')
         _prod_override('sasl_username', 'sasl_username')
         _prod_override('sasl_password', 'sasl_password')


Test patch: