Usage of Molecule and Ansible for development

We use Ansible heavily in SecureDrop project. Except the actual installation process, we use Molecule along with ansible for the other steps. All the available molecule scenarios can be found at ./molecule/ directory.

• builder-xenial
• builder-focal
• testinfra
• vagrant-packager
• fetch-tor-packages
• libvirt-staging-xenial
• libvirt-staging-focal
• qubes-staging-focal
• qubes-staging-xenial
• upgrade
• virtualbox-staging-xenial

Builder Xenial and builder Focal

These 2 scenarios build the debian packages for the SecureDrop server code and related packages. For the following, we will examine the builder-focal scenario.

Let us dig into the files in the scenario.

ansible-override-vars.yml

The file contains two variables which are used in conditions to mark that we are building for Focal. These are used inside of the actual package building roles.

aptpreferences.conf

Apt file

create.yml

This creates all the containers defined in the molecule.yml file.

destroy.yml

Destroys the containers created in the create step

Dockerfile

Dockerfile for the builder container image, this needs to pushed to the container repository

image_hash

Hash of the container image

Makefile

The make file

molecule.yml

Main file which defines all configurations, from where to find the Ansible roles, and what all steps should be takes for this scenario.

playbook.yml

After the containers are running, this runs the various roles to build the actual packages. It also does the initial package testing. Check the various roles in "Build SecureDrop application Debian package from local repository." task to find which package gets build via which container.

push.sh

To push the container image.