An Ansible role that automates the deployment and management of Tor relays with security features like offline master keys and Prometheus monitoring.
ansible-relayor is an Ansible role that automates the deployment, configuration, and management of Tor relay servers. It solves the problem of manual, error-prone relay setup by handling key generation, instance creation, security hardening, and monitoring integration. The role ensures relays are secure and maintainable with features like offline master keys and automated renewals.
Tor relay operators and network administrators who want to deploy and manage Tor relays at scale using infrastructure-as-code practices. It's particularly useful for those running multiple relays or requiring robust security and monitoring.
Developers choose ansible-relayor because it significantly reduces the operational complexity of running Tor relays while enforcing security best practices like key isolation and automated renewals. Its built-in Prometheus integration and support for both exit and non-exit relays make it a comprehensive solution compared to manual setups or simpler scripts.
An Ansible Role for Tor Relay Operators
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Generates and manages Ed25519 master keys on the Ansible control host, never exposing them to relays, enhancing security against server compromises as highlighted in the README's security considerations.
Creates multiple Tor instances per server with distinct system users, automatically utilizing IPv6 if available, reducing manual setup errors and supporting compartmentalization.
Auto-generates Prometheus scrape configurations, nginx reverse proxy setups, and alert rules for comprehensive relay monitoring when enabled, simplifying observability for operators.
Simplifies exit relay configuration with automatic deployment of Tor exit notice pages via DirPort and support for custom exit policies, easing compliance and user communication.
Does not handle reducing instance counts or changing ORPorts after initial deployment, as noted in the README, potentially leaving orphaned instances that require manual cleanup.
Prometheus integration only generates configs; users must separately install and configure nginx, blackbox exporter, and Prometheus server, adding setup complexity and external dependencies.
Keeping Tor software updated is out of scope, forcing operators to rely on OS-level auto-updates or implement separate processes, increasing operational burden and security risks.