Skip to content

Update fastpath to support anonymous credentials #308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
LDiazN merged 6 commits into from
Jan 16, 2026
Merged

Update fastpath to support anonymous credentials #308

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e34d6b0
Update fastpath docker image to use the version supporting anonymous …
LDiazN Jan 15, 2026
4520fe1
Update fastpath docker version
LDiazN Jan 15, 2026
75a6d44
Set ooniprobe branch to anonymous credentials version
LDiazN Jan 15, 2026
b4c36a2
Add settings to deploy anonymous credentials
LDiazN Jan 15, 2026
4a9422e
Fix bad bucket config
LDiazN Jan 15, 2026
0e59525
Add read permissions to ooniprobe to the s3 manifests bucket
LDiazN Jan 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ansible/roles/fastpath/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,7 @@
- name: Ensure fastpath is running
community.docker.docker_container:
name: fastpath
image: ooni/fastpath:v0.88
image: ooni/fastpath:v0.89
state: started
user: "{{user_uid.stdout}}:{{user_gid.stdout}}"
# use network mode = host to allow traffic from fastpath to the statsd exporter without
Expand Down
24 changes: 22 additions & 2 deletions tf/environments/dev/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,6 +206,11 @@ data "aws_ssm_parameter" "prometheus_metrics_password" {
name = "/oonidevops/ooni_services/prometheus_metrics_password"
}

# Manually managed with the AWS console
data "aws_ssm_parameter" "anonc_secret_key" {
name = "/oonidevops/secrets/zkp/secret_key"
}

resource "aws_secretsmanager_secret" "oonipg_url" {
name = "oonidevops/ooni-tier0-postgres/postgresql_url"
tags = local.tags
Expand Down Expand Up @@ -468,6 +473,18 @@ resource "aws_iam_role_policy" "ooniprobe_role" {
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "${aws_s3_bucket.ooni_private_config_bucket.arn}/*"
},
{
"Sid": "",
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "${aws_s3_bucket.anoncred_manifests.arn}/*"
},
{
"Sid": "",
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "${aws_s3_bucket.anoncred_manifests.arn}/*"
}
]
}
Expand All @@ -479,7 +496,7 @@ module "ooniapi_ooniprobe_deployer" {

service_name = "ooniprobe"
repo = "ooni/backend"
branch_name = "master"
branch_name = "userauth-dep"
trigger_path = "ooniapi/services/ooniprobe/**"
buildspec_path = "ooniapi/services/ooniprobe/buildspec.yml"
codestar_connection_arn = aws_codestarconnections_connection.oonidevops.arn
Expand Down Expand Up @@ -512,6 +529,7 @@ module "ooniapi_ooniprobe" {
JWT_ENCRYPTION_KEY = data.aws_ssm_parameter.jwt_secret_legacy.arn
PROMETHEUS_METRICS_PASSWORD = data.aws_ssm_parameter.prometheus_metrics_password.arn
CLICKHOUSE_URL = data.aws_ssm_parameter.clickhouse_readonly_url.arn
ANONC_SECRET_KEY = data.aws_ssm_parameter.anonc_secret_key.arn
}

task_environment = {
Expand All @@ -520,6 +538,8 @@ module "ooniapi_ooniprobe" {
COLLECTOR_ID = 3 # use a different one in prod
CONFIG_BUCKET = aws_s3_bucket.ooni_private_config_bucket.bucket
TOR_TARGETS = "tor_targets.json"
ANONC_MANIFEST_BUCKET = aws_s3_bucket.anoncred_manifests.bucket
ANONC_MANIFEST_FILE = "manifest.json"
}

ooniapi_service_security_groups = [
Expand Down Expand Up @@ -822,7 +842,7 @@ module "fastpath_builder" {

service_name = "fastpath"
repo = "ooni/backend"
branch_name = "master"
branch_name = "userauth-dep"
buildspec_path = "fastpath/buildspec.yml"
trigger_path = "fastpath/**"
codestar_connection_arn = aws_codestarconnections_connection.oonidevops.arn
Expand Down
Loading