<commit_before>---
- hosts: [ 'mon', 'app', 'mon-prod', 'app-prod' ]

  vars_files:
    - group_vars/securedrop.yml
    - prod-specific.yml

  roles:
    - install_fpf_repo
    - common

  sudo: yes


- hosts: [ 'mon', 'mon-prod' ]

  vars_files:
    - group_vars/securedrop.yml
    - host_vars/mon.yml
    - prod-specific.yml

  roles:
    - { role: validate, tags: [ 'validate' ] }
    - common-mon
    - ossec_server

  sudo: yes

- hosts: [ 'app', 'app-prod' ]

  vars_files:
   - group_vars/securedrop.yml
   - host_vars/app.yml
   - prod-specific.yml

  vars:

  roles:
    - { role: validate, tags: [ 'validate' ] }
    - common-app
    - ossec_agent
    - app

  sudo: yes


  # If the OSSEC authd iptables rule exemptions are in place remove them and
  # restart OSSEC. For the ossec agent the exemptions are removed as part of
  # the authd role, in order to allow all agents to connect to the ossec server
  # before killing authd and removing the ossec rules. This is a separate role for
  # the ossec server. The order of events does matter: the monitor server authd
  # service needs to be listening and reachable, then agent needs to connect to
  # ossec server, agent needs to restart, then ossec server exemptions can be
  # removed and the ossec server process can restart.
- hosts: [ 'mon', 'mon-prod' ]

  vars_files:
    - group_vars/securedrop.yml
    - host_vars/mon.yml
    - prod-specific.yml

  roles:
    - remove_authd_exemptions

  sudo: yes

  # This section will put the ssh and iptables rules in place
  # It will then add any staging exemptions required
  # at the end of each host section is when the handlers are run.
  # So iptables will not be reloaded until the exemptions are applied
  # for production the last task is apply iptables. This will break their
  # connection. After that point the admin will to proxy traffic over tor.
- hosts: [ 'app', 'app-prod' ]

  vars_files:
    - group_vars/securedrop.yml
    - host_vars/app.yml
    - prod-specific.yml

  roles:
    - restrict_direct_access_app
    - { role: backup, tags: [ 'backup' ] }

  sudo: yes

- hosts: [ 'mon', 'mon-prod' ]

  vars_files:
    - group_vars/securedrop.yml
    - host_vars/mon.yml
    - prod-specific.yml

  roles:
    - restrict_direct_access_mon

  sudo: yes

- hosts: [ 'app', 'mon', 'app-prod', 'mon-prod' ]

  roles:
    - reboot

  sudo: yes<commit_msg>adds tags to role inclusions in production playbook<commit_after>---
- hosts: [ 'mon', 'app', 'mon-prod', 'app-prod' ]

  vars_files:
    - group_vars/securedrop.yml
    - prod-specific.yml

  roles:
    - { role: install_fpf_repo, tags: fpf_repo }
    - { role: common, tags: common }

  sudo: yes


- hosts: [ 'mon', 'mon-prod' ]

  vars_files:
    - group_vars/securedrop.yml
    - host_vars/mon.yml
    - prod-specific.yml

  roles:
    - { role: validate, tags: validate }
    - { role: common-mon, tags: 'tor' }
    - { role: ossec_server, tags: ['ossec', 'ossec_server'] }

  sudo: yes

- hosts: [ 'app', 'app-prod' ]

  vars_files:
   - group_vars/securedrop.yml
   - host_vars/app.yml
   - prod-specific.yml

  vars:

  roles:
    - { role: validate, tags: validate }
    - { role: common-app, tags: ['common-app', 'tor'] }
    - { role: ossec_agent, tags: [ 'ossec', 'ossec_agent' ] }
    - { role: app, tags: app }

  sudo: yes


  # If the OSSEC authd iptables rule exemptions are in place remove them and
  # restart OSSEC. For the ossec agent the exemptions are removed as part of
  # the authd role, in order to allow all agents to connect to the ossec server
  # before killing authd and removing the ossec rules. This is a separate role for
  # the ossec server. The order of events does matter: the monitor server authd
  # service needs to be listening and reachable, then agent needs to connect to
  # ossec server, agent needs to restart, then ossec server exemptions can be
  # removed and the ossec server process can restart.
- hosts: [ 'mon', 'mon-prod' ]

  vars_files:
    - group_vars/securedrop.yml
    - host_vars/mon.yml
    - prod-specific.yml

  roles:
    - { role: remove_authd_exemptions, tags: ['ossec', 'ossec_server', 'remove_authd_exemptions' ] }

  sudo: yes

  # This section will put the ssh and iptables rules in place
  # It will then add any staging exemptions required
  # at the end of each host section is when the handlers are run.
  # So iptables will not be reloaded until the exemptions are applied
  # for production the last task is apply iptables. This will break their
  # connection. After that point the admin will to proxy traffic over tor.
- hosts: [ 'app', 'app-prod' ]

  vars_files:
    - group_vars/securedrop.yml
    - host_vars/app.yml
    - prod-specific.yml

  roles:
    - { role: restrict_direct_access_app, tags: [ 'common', 'restrict_direct_access', 'restrict_direct_access_app' ] }
    - { role: backup, tags: backup }

  sudo: yes

- hosts: [ 'mon', 'mon-prod' ]

  vars_files:
    - group_vars/securedrop.yml
    - host_vars/mon.yml
    - prod-specific.yml

  roles:
    - { role: restrict_direct_access_mon, tags: [ 'common', 'restrict_direct_access', 'restrict_direct_access_mon' ] }

  sudo: yes

- hosts: [ 'app', 'mon', 'app-prod', 'mon-prod' ]

  roles:
    - { role: reboot, tags: reboot }

  sudo: yes
{'fraction_non_alphanumeric': 0.10659319779593388, 'fraction_numerical': 0.0, 'mean_word_length': 2.8144927536231883, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3740260', 'n_tokens_mistral': 1844, 'n_tokens_neox': 1727, 'n_words': 572}