From 4cd45b96983d3466794de7b258e60d1ec9cc3d1a Mon Sep 17 00:00:00 2001 From: Aaron Gibson Date: Wed, 17 Jun 2026 16:17:33 +0200 Subject: [PATCH 1/7] add fastpath instance for reuploading reports --- .../reuploaderfastpath.prod.ooni.io/vars.yml | 6 ++ tf/environments/prod/main.tf | 77 +++++++++++++++++++ 2 files changed, 83 insertions(+) create mode 100644 ansible/host_vars/reuploaderfastpath.prod.ooni.io/vars.yml diff --git a/ansible/host_vars/reuploaderfastpath.prod.ooni.io/vars.yml b/ansible/host_vars/reuploaderfastpath.prod.ooni.io/vars.yml new file mode 100644 index 00000000..f1507236 --- /dev/null +++ b/ansible/host_vars/reuploaderfastpath.prod.ooni.io/vars.yml @@ -0,0 +1,6 @@ +s3_ooni_open_data_access_key: "{{ lookup('amazon.aws.aws_ssm', '/oonidevops/secrets/s3_ooni_open_data_access_key', profile='oonidevops_user_prod') }}" +clickhouse_url: "clickhouse://write:{{ lookup('amazon.aws.aws_ssm', '/oonidevops/secrets/clickhouse_write_password', profile='oonidevops_user_prod') }}@data1.htz-fsn.prod.ooni.nu/ooni" +bucket_name: "ooni-data-eu-fra" +# COLLECTOR ID SHOULD BE DIFFERENT BETWEEN EACH FASTPATH INSTANCE +collector_id: "5" +env: "prod" diff --git a/tf/environments/prod/main.tf b/tf/environments/prod/main.tf index c0d56f7d..897b7baf 100644 --- a/tf/environments/prod/main.tf +++ b/tf/environments/prod/main.tf @@ -1033,6 +1033,83 @@ resource "aws_route53_record" "fastpath2_alias" { ] } +# fastpath instance for reuploading reports to from the failed-measurements bucket +module "ooni_reuploader_fastpath" { + source = "../../modules/ec2" + + stage = local.environment + + vpc_id = module.network.vpc_id + subnet_id = module.network.vpc_subnet_public[0].id + private_subnet_cidr = module.network.vpc_subnet_private[*].cidr_block + dns_zone_ooni_io = local.dns_zone_ooni_io + + key_name = module.adm_iam_roles.oonidevops_key_name + instance_type = "t3a.small" + + name = "oonireuploaderfastpath" + ingress_rules = [{ + from_port = 22, + to_port = 22, + protocol = "tcp", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 8472, + to_port = 8472, + protocol = "tcp", + cidr_blocks = concat(module.network.vpc_subnet_private[*].cidr_block, module.network.vpc_subnet_public[*].cidr_block), + }, { + from_port = 8479, + to_port = 8479, + protocol = "tcp", + cidr_blocks = concat(module.network.vpc_subnet_private[*].cidr_block, module.network.vpc_subnet_public[*].cidr_block), + }, { + from_port = 9100, + to_port = 9100, + protocol = "tcp" + cidr_blocks = ["${module.ooni_monitoring_proxy.aws_instance_private_ip}/32"] + }, { + from_port = 9102, # For fastpath metrics + to_port = 9102, + protocol = "tcp" + cidr_blocks = ["${module.ooni_monitoring_proxy.aws_instance_private_ip}/32", "${module.ooni_monitoring_proxy.aws_instance_public_ip}/32"] + }] + + egress_rules = [{ + from_port = 0, + to_port = 0, + protocol = "-1", + cidr_blocks = ["0.0.0.0/0"], + }, { + from_port = 0, + to_port = 0, + protocol = "-1", + ipv6_cidr_blocks = ["::/0"], + }] + + sg_prefix = "oonirefp" + tg_prefix = "refp" + + disk_size = 150 + + tags = merge( + local.tags, + { Name = "ooni-tier0-reuploader-fastpath" } + ) +} + +resource "aws_route53_record" "reuploader_fastpath" { + zone_id = local.dns_zone_ooni_io + name = "reuploaderfastpath.${local.environment}.ooni.io" + type = "CNAME" + ttl = 300 + + records = [ + module.ooni_reuploader_fastpath.aws_instance_public_dns + ] +} + + module "fastpath_builder" { source = "../../modules/ooni_docker_build" trigger_tag = "" From 38e55ae45d5974785e862a792aff62c0e5c2e1a0 Mon Sep 17 00:00:00 2001 From: Aaron Gibson Date: Wed, 17 Jun 2026 17:05:50 +0200 Subject: [PATCH 2/7] add reuploader instance to deploy-fastpath.yml --- ansible/deploy-fastpath.yml | 1 + ansible/inventory | 1 + 2 files changed, 2 insertions(+) diff --git a/ansible/deploy-fastpath.yml b/ansible/deploy-fastpath.yml index 4d3f5589..b9a8e502 100644 --- a/ansible/deploy-fastpath.yml +++ b/ansible/deploy-fastpath.yml @@ -4,6 +4,7 @@ - fastpath.dev.ooni.io - fastpath.prod.ooni.io - fastpath2.prod.ooni.io + - reuploaderfastpath.prod.ooni.io become: true roles: - role: bootstrap diff --git a/ansible/inventory b/ansible/inventory index 56fe49e2..9a878bf1 100644 --- a/ansible/inventory +++ b/ansible/inventory @@ -49,6 +49,7 @@ openvpn2.htz-fsn.prod.ooni.nu fastpath.dev.ooni.io fastpath.prod.ooni.io fastpath2.prod.ooni.io +reuploaderfastpath.prod.ooni.io anonc.dev.ooni.io jumphost.dev.ooni.io jumphost.prod.ooni.io From 9d12e2db80459a5eb768873fa8d4fda4a795af3a Mon Sep 17 00:00:00 2001 From: Aaron Gibson Date: Wed, 17 Jun 2026 17:21:58 +0200 Subject: [PATCH 3/7] add reuploader fastpath to clickhouseproxy nft rules --- tf/environments/prod/main.tf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tf/environments/prod/main.tf b/tf/environments/prod/main.tf index 897b7baf..b24faec1 100644 --- a/tf/environments/prod/main.tf +++ b/tf/environments/prod/main.tf @@ -523,6 +523,8 @@ module "ooni_clickhouse_proxy" { "${module.ooni_fastpath.aws_instance_public_ip}/32"], ["${module.ooni_fastpath2.aws_instance_private_ip}/32", "${module.ooni_fastpath2.aws_instance_public_ip}/32"], + ["${module.ooni_reuploader_fastpath.aws_instance_private_ip}/32", + "${module.ooni_reuploader_fastpath.aws_instance_public_ip}/32"], ["${module.ooniapi_testlists.aws_instance_private_ip}/32", "${module.ooniapi_testlists.aws_instance_public_ip}/32"], ), From 18e5aab6a5e5e59ea643ec55f15533b1e1051acc Mon Sep 17 00:00:00 2001 From: Aaron Gibson Date: Wed, 17 Jun 2026 17:22:52 +0200 Subject: [PATCH 4/7] use ooni_fastpath module, decrease disk size --- tf/environments/prod/main.tf | 52 +++++------------------------------- 1 file changed, 7 insertions(+), 45 deletions(-) diff --git a/tf/environments/prod/main.tf b/tf/environments/prod/main.tf index b24faec1..ca9bd6c7 100644 --- a/tf/environments/prod/main.tf +++ b/tf/environments/prod/main.tf @@ -1037,7 +1037,7 @@ resource "aws_route53_record" "fastpath2_alias" { # fastpath instance for reuploading reports to from the failed-measurements bucket module "ooni_reuploader_fastpath" { - source = "../../modules/ec2" + source = "../../modules/ooni_fastpath" stage = local.environment @@ -1049,55 +1049,17 @@ module "ooni_reuploader_fastpath" { key_name = module.adm_iam_roles.oonidevops_key_name instance_type = "t3a.small" - name = "oonireuploaderfastpath" - ingress_rules = [{ - from_port = 22, - to_port = 22, - protocol = "tcp", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 8472, - to_port = 8472, - protocol = "tcp", - cidr_blocks = concat(module.network.vpc_subnet_private[*].cidr_block, module.network.vpc_subnet_public[*].cidr_block), - }, { - from_port = 8479, - to_port = 8479, - protocol = "tcp", - cidr_blocks = concat(module.network.vpc_subnet_private[*].cidr_block, module.network.vpc_subnet_public[*].cidr_block), - }, { - from_port = 9100, - to_port = 9100, - protocol = "tcp" - cidr_blocks = ["${module.ooni_monitoring_proxy.aws_instance_private_ip}/32"] - }, { - from_port = 9102, # For fastpath metrics - to_port = 9102, - protocol = "tcp" - cidr_blocks = ["${module.ooni_monitoring_proxy.aws_instance_private_ip}/32", "${module.ooni_monitoring_proxy.aws_instance_public_ip}/32"] - }] - - egress_rules = [{ - from_port = 0, - to_port = 0, - protocol = "-1", - cidr_blocks = ["0.0.0.0/0"], - }, { - from_port = 0, - to_port = 0, - protocol = "-1", - ipv6_cidr_blocks = ["::/0"], - }] + name = "reuploaderfastpath" sg_prefix = "oonirefp" tg_prefix = "refp" - disk_size = 150 + disk_size = 20 - tags = merge( - local.tags, - { Name = "ooni-tier0-reuploader-fastpath" } - ) + monitoring_proxy_private_ip = module.ooni_monitoring_proxy.aws_instance_private_ip + monitoring_proxy_public_ip = module.ooni_monitoring_proxy.aws_instance_public_ip + + tags = local.tags } resource "aws_route53_record" "reuploader_fastpath" { From 171c8d34e12672fab1574d5ed7b268594344ed44 Mon Sep 17 00:00:00 2001 From: Aaron Gibson Date: Fri, 19 Jun 2026 12:53:58 +0200 Subject: [PATCH 5/7] add reuploader fastpath to prometheus.yml --- ansible/roles/prometheus/templates/prometheus.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/ansible/roles/prometheus/templates/prometheus.yml b/ansible/roles/prometheus/templates/prometheus.yml index 22f3bb3f..ed675d0d 100755 --- a/ansible/roles/prometheus/templates/prometheus.yml +++ b/ansible/roles/prometheus/templates/prometheus.yml @@ -346,6 +346,7 @@ scrape_configs: - fastpath.dev.ooni.io:9102 - fastpath.prod.ooni.io:9102 - fastpath2.prod.ooni.io:9102 + - reuploaderfastpath.prod.ooni.io:9102 scrape_interval: 5s scheme: https relabel_configs: # Change the host to the proxy host with relabeling From b3c1d8ba3f6ecfb5b63b2de669f8709972126aab Mon Sep 17 00:00:00 2001 From: Aaron Gibson Date: Tue, 23 Jun 2026 10:26:38 +0200 Subject: [PATCH 6/7] fix required variables fro ooni_fastpath module --- tf/environments/prod/main.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tf/environments/prod/main.tf b/tf/environments/prod/main.tf index 0d3df5cf..16adbfa8 100644 --- a/tf/environments/prod/main.tf +++ b/tf/environments/prod/main.tf @@ -983,18 +983,18 @@ module "ooni_fastpath2" { module "ooni_reuploader_fastpath" { source = "../../modules/ooni_fastpath" - stage = local.environment + name = "reuploaderfastpath" + env = local.environment vpc_id = module.network.vpc_id subnet_id = module.network.vpc_subnet_public[0].id private_subnet_cidr = module.network.vpc_subnet_private[*].cidr_block + public_subnet_cidr = module.network.vpc_subnet_public[*].cidr_block dns_zone_ooni_io = local.dns_zone_ooni_io key_name = module.adm_iam_roles.oonidevops_key_name instance_type = "t3a.small" - name = "reuploaderfastpath" - sg_prefix = "oonirefp" tg_prefix = "refp" From dd4ff6832d28ac522409598f7050f16e104b8049 Mon Sep 17 00:00:00 2001 From: Aaron Gibson Date: Tue, 23 Jun 2026 10:34:05 +0200 Subject: [PATCH 7/7] remove duplicated record, created by ooni_fastpath module --- tf/environments/prod/main.tf | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/tf/environments/prod/main.tf b/tf/environments/prod/main.tf index 16adbfa8..2fb42ce7 100644 --- a/tf/environments/prod/main.tf +++ b/tf/environments/prod/main.tf @@ -1006,18 +1006,6 @@ module "ooni_reuploader_fastpath" { tags = local.tags } -resource "aws_route53_record" "reuploader_fastpath" { - zone_id = local.dns_zone_ooni_io - name = "reuploaderfastpath.${local.environment}.ooni.io" - type = "CNAME" - ttl = 300 - - records = [ - module.ooni_reuploader_fastpath.aws_instance_public_dns - ] -} - - module "fastpath_builder" { source = "../../modules/ooni_docker_build" trigger_tag = ""