V2 warning still showing even with only v3 enabled service

[kushaldas]

Description

This instance had both v2 and v3 onion services enabled. It was showing the red banner asking to Complete the v3 onion Services setup ... banner. After disabling v2 and keeping only v3 service, and it is still showing the same banner.

Steps to Reproduce

• prod vm with both v2+v3 running
• disable v2 via ./securedrop-admin sdconfig and then ./securedrop-admin install

Expected Behavior

• The journalist interface should not show any banner

Actual Behavior

• The journalist interface is still showing the banner
• /var/lib/securedrop has source_v3_url file, no v2 file there.

Comments

Suggestions to fix, any other relevant information.

[emkll]

Thanks @kushaldas I did manage to reproduce this. However, after restarting Apache or rebooting the application server, I no longer observe the banner. The app config is populated once the application starts with Apache, and prior to the webserver restarting, the old value for V2_ONION_ENABLED is in the configuration.

Can you try accessing the journalist interface again on the app server (after reboot) to ensure that it resolves? If so, we could consider adding a task to the playbooks to restart Apache after completing a v2->v3 migration

[zenmonkeykstop]

Replicated while QAing by:

• installing v2+v3
• updating to v3-only

The message still shows, but restarting apache with ssh app sudo systemctl restart apache2 clears it.

As per @emkll, this can probably be most easily resolved by adding an apache restart in the install playbook after those files are changed, or - even easier - noting in the docs that the message will persist until the next nightly reboot and can be removed by restarting apache as above.