We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
spurious testinfra failures when servers have non-default hostnames
## Description

If a production instance is configured with hostnames other than the recommended `app` and `mon`, `securedrop-admin verify` will report spurious testinfra failures.

First noticed in <https://github.com/freedomofpress/securedrop/issues/6127#issuecomment-938342242>.

## Steps to Reproduce

1. `securedrop-admin sdconfig` with non-default hostnames, e.g. those provisioned by `molecule create -s libvirt-prod-focal`:
    ```yaml
    app_hostname: app-prod
    monitor_hostname: mon-prod
    ```
2. `securedrop-admin install`
3. `securedrop-admin setup -t`
4. `securedrop-admin verify`

## Expected Behavior

All testinfra tests pass.

## Actual Behavior

Hostname-dependent testinfra tests fail, including:

* `app/test_ossec_agent.py::test_hosts_files`
* `mon/test_ossec_server.py::test_ossec_connectivity`
* `mon/test_ossec_server.py::test_hosts_files`
* `mon/test_postfix.py::test_postfix_generic_maps`

## Comments

_Originally posted by @zenmonkeykstop in <https://github.com/freedomofpress/securedrop/issues/6103#issuecomment-946018659>:_

> testinfra tests take their expected values from a bunch of variables in a yaml file, with some of said values (like server IPs) in prod runs being overridden from the `install_files/ansible-base/group_vars/all/site-specific` file created by `./securedrop-admin sdconfig`. Looks like the server hostnames are *not* being overridden. So if they're not named according to the reccos in the docs I'd expect to see this error. Would be an easy fix to override them too methinks - check `molecule/testinfra/conftest.py`.

https://github.com/freedomofpress/securedrop/blob/2882d1ea39175bd98c302000bb506e9b88a18a1f/molecule/testinfra/conftest.py#L49-L50

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `molecule/testinfra/conftest.py`
Content:
```
1 """
2 Configuration for TestInfra test suite for SecureDrop.
3 Handles importing host-specific test vars, so test functions
4 can be reused across multiple hosts, with varied targets.
5 
6 Vars should be placed in `testinfra/vars/<hostname>.yml`.
7 """
8 
9 import io
10 import os
11 import yaml
12 from typing import Any, Dict
13 
14 import testutils
15 
16 
17 # The config tests target staging by default.
18 target_host = os.environ.get('SECUREDROP_TESTINFRA_TARGET_HOST', 'staging')
19 
20 
21 def securedrop_import_testinfra_vars(hostname, with_header=False):
22     """
23     Import vars from a YAML file to populate tests with host-specific
24     values used in checks. For instance, the SecureDrop docroot will
25     be under /vagrant in development, but /var/www/securedrop in staging.
26 
27     Vars must be stored in `testinfra/vars/<hostname>.yml`.
28     """
29     filepath = os.path.join(os.path.dirname(__file__), "vars", hostname+".yml")
30     with io.open(filepath, 'r') as f:
31         hostvars = yaml.safe_load(f)
32 
33     hostvars['securedrop_venv_site_packages'] = hostvars["securedrop_venv_site_packages"].format("3.8")  # noqa: E501
34     hostvars['python_version'] = "3.8"
35     hostvars['apparmor_enforce_actual'] = hostvars['apparmor_enforce']['focal']
36 
37     # If the tests are run against a production environment, check local config
38     # and override as necessary.
39     prod_filepath = os.path.join(os.path.dirname(__file__),
40                                  "../../install_files/ansible-base/group_vars/all/site-specific")
41     if os.path.isfile(prod_filepath):
42         with io.open(prod_filepath, 'r') as f:
43             prodvars = yaml.safe_load(f)
44 
45         def _prod_override(vars_key, prod_key):
46             if prod_key in prodvars:
47                 hostvars[vars_key] = prodvars[prod_key]
48 
49         _prod_override('app_ip', 'app_ip')
50         _prod_override('mon_ip', 'monitor_ip')
51         _prod_override('sasl_domain', 'sasl_domain')
52         _prod_override('sasl_username', 'sasl_username')
53         _prod_override('sasl_password', 'sasl_password')
54         _prod_override('daily_reboot_time', 'daily_reboot_time')
55 
56         # Check repo targeting, and update vars
57         repo_filepath = os.path.join(os.path.dirname(__file__),
58                                  "../../install_files/ansible-base/roles/install-fpf-repo/defaults/main.yml")  # noqa: E501
59         if os.path.isfile(repo_filepath):
60             with io.open(repo_filepath, 'r') as f:
61                 repovars = yaml.safe_load(f)
62                 if 'apt_repo_url' in repovars:
63                     hostvars['fpf_apt_repo_url'] = repovars['apt_repo_url']
64 
65     if with_header:
66         hostvars = dict(securedrop_test_vars=hostvars)
67 
68     return hostvars
69 
70 
71 class TestVars(dict):
72     managed_attrs = {}  # type: Dict[str, Any]
73 
74     def __init__(self, initial: Dict[str, Any]) -> None:
75         self.securedrop_target_distribution = os.environ.get("SECUREDROP_TARGET_DISTRIBUTION")
76         self.managed_attrs.update(initial)
77 
78     def __getattr__(self, name: str) -> Any:
79         """
80         If the requested attribute names a dict in managed_attrs and that
81         contains a key with the name of the target distribution,
82         e.g. "focal", return that. Otherwise return the entire item
83         under the requested name.
84         """
85         try:
86             attr = self.managed_attrs[name]
87             if isinstance(attr, dict) and self.securedrop_target_distribution in attr:
88                 return attr[self.securedrop_target_distribution]
89             return attr
90         except KeyError:
91             raise AttributeError(name)
92 
93     def __str__(self) -> str:
94         return str(self.managed_attrs)
95 
96 
97 testutils.securedrop_test_vars = TestVars(securedrop_import_testinfra_vars(target_host))
98
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/molecule/testinfra/conftest.py b/molecule/testinfra/conftest.py
--- a/molecule/testinfra/conftest.py
+++ b/molecule/testinfra/conftest.py
@@ -47,7 +47,9 @@
                 hostvars[vars_key] = prodvars[prod_key]
 
         _prod_override('app_ip', 'app_ip')
+        _prod_override('app_hostname', 'app_hostname')
         _prod_override('mon_ip', 'monitor_ip')
+        _prod_override('monitor_hostname', 'monitor_hostname')
         _prod_override('sasl_domain', 'sasl_domain')
         _prod_override('sasl_username', 'sasl_username')
         _prod_override('sasl_password', 'sasl_password')

{"golden_diff": "diff --git a/molecule/testinfra/conftest.py b/molecule/testinfra/conftest.py\n--- a/molecule/testinfra/conftest.py\n+++ b/molecule/testinfra/conftest.py\n@@ -47,7 +47,9 @@\n                 hostvars[vars_key] = prodvars[prod_key]\n \n         _prod_override('app_ip', 'app_ip')\n+        _prod_override('app_hostname', 'app_hostname')\n         _prod_override('mon_ip', 'monitor_ip')\n+        _prod_override('monitor_hostname', 'monitor_hostname')\n         _prod_override('sasl_domain', 'sasl_domain')\n         _prod_override('sasl_username', 'sasl_username')\n         _prod_override('sasl_password', 'sasl_password')\n", "issue": "spurious testinfra failures when servers have non-default hostnames\n## Description\r\n\r\nIf a production instance is configured with hostnames other than the recommended `app` and `mon`, `securedrop-admin verify` will report spurious testinfra failures.\r\n\r\nFirst noticed in <https://github.com/freedomofpress/securedrop/issues/6127#issuecomment-938342242>.\r\n\r\n## Steps to Reproduce\r\n\r\n1. `securedrop-admin sdconfig` with non-default hostnames, e.g. those provisioned by `molecule create -s libvirt-prod-focal`:\r\n    ```yaml\r\n    app_hostname: app-prod\r\n    monitor_hostname: mon-prod\r\n    ```\r\n2. `securedrop-admin install`\r\n3. `securedrop-admin setup -t`\r\n4. `securedrop-admin verify`\r\n\r\n## Expected Behavior\r\n\r\nAll testinfra tests pass.\r\n\r\n## Actual Behavior\r\n\r\nHostname-dependent testinfra tests fail, including:\r\n\r\n* `app/test_ossec_agent.py::test_hosts_files`\r\n* `mon/test_ossec_server.py::test_ossec_connectivity`\r\n* `mon/test_ossec_server.py::test_hosts_files`\r\n* `mon/test_postfix.py::test_postfix_generic_maps`\r\n\r\n## Comments\r\n\r\n_Originally posted by @zenmonkeykstop in <https://github.com/freedomofpress/securedrop/issues/6103#issuecomment-946018659>:_\r\n\r\n> testinfra tests take their expected values from a bunch of variables in a yaml file, with some of said values (like server IPs) in prod runs being overridden from the `install_files/ansible-base/group_vars/all/site-specific` file created by `./securedrop-admin sdconfig`. Looks like the server hostnames are *not* being overridden. So if they're not named according to the reccos in the docs I'd expect to see this error. Would be an easy fix to override them too methinks - check `molecule/testinfra/conftest.py`.\r\n\r\nhttps://github.com/freedomofpress/securedrop/blob/2882d1ea39175bd98c302000bb506e9b88a18a1f/molecule/testinfra/conftest.py#L49-L50\n", "before_files": [{"content": "\"\"\"\nConfiguration for TestInfra test suite for SecureDrop.\nHandles importing host-specific test vars, so test functions\ncan be reused across multiple hosts, with varied targets.\n\nVars should be placed in `testinfra/vars/<hostname>.yml`.\n\"\"\"\n\nimport io\nimport os\nimport yaml\nfrom typing import Any, Dict\n\nimport testutils\n\n\n# The config tests target staging by default.\ntarget_host = os.environ.get('SECUREDROP_TESTINFRA_TARGET_HOST', 'staging')\n\n\ndef securedrop_import_testinfra_vars(hostname, with_header=False):\n    \"\"\"\n    Import vars from a YAML file to populate tests with host-specific\n    values used in checks. For instance, the SecureDrop docroot will\n    be under /vagrant in development, but /var/www/securedrop in staging.\n\n    Vars must be stored in `testinfra/vars/<hostname>.yml`.\n    \"\"\"\n    filepath = os.path.join(os.path.dirname(__file__), \"vars\", hostname+\".yml\")\n    with io.open(filepath, 'r') as f:\n        hostvars = yaml.safe_load(f)\n\n    hostvars['securedrop_venv_site_packages'] = hostvars[\"securedrop_venv_site_packages\"].format(\"3.8\")  # noqa: E501\n    hostvars['python_version'] = \"3.8\"\n    hostvars['apparmor_enforce_actual'] = hostvars['apparmor_enforce']['focal']\n\n    # If the tests are run against a production environment, check local config\n    # and override as necessary.\n    prod_filepath = os.path.join(os.path.dirname(__file__),\n                                 \"../../install_files/ansible-base/group_vars/all/site-specific\")\n    if os.path.isfile(prod_filepath):\n        with io.open(prod_filepath, 'r') as f:\n            prodvars = yaml.safe_load(f)\n\n        def _prod_override(vars_key, prod_key):\n            if prod_key in prodvars:\n                hostvars[vars_key] = prodvars[prod_key]\n\n        _prod_override('app_ip', 'app_ip')\n        _prod_override('mon_ip', 'monitor_ip')\n        _prod_override('sasl_domain', 'sasl_domain')\n        _prod_override('sasl_username', 'sasl_username')\n        _prod_override('sasl_password', 'sasl_password')\n        _prod_override('daily_reboot_time', 'daily_reboot_time')\n\n        # Check repo targeting, and update vars\n        repo_filepath = os.path.join(os.path.dirname(__file__),\n                                 \"../../install_files/ansible-base/roles/install-fpf-repo/defaults/main.yml\")  # noqa: E501\n        if os.path.isfile(repo_filepath):\n            with io.open(repo_filepath, 'r') as f:\n                repovars = yaml.safe_load(f)\n                if 'apt_repo_url' in repovars:\n                    hostvars['fpf_apt_repo_url'] = repovars['apt_repo_url']\n\n    if with_header:\n        hostvars = dict(securedrop_test_vars=hostvars)\n\n    return hostvars\n\n\nclass TestVars(dict):\n    managed_attrs = {}  # type: Dict[str, Any]\n\n    def __init__(self, initial: Dict[str, Any]) -> None:\n        self.securedrop_target_distribution = os.environ.get(\"SECUREDROP_TARGET_DISTRIBUTION\")\n        self.managed_attrs.update(initial)\n\n    def __getattr__(self, name: str) -> Any:\n        \"\"\"\n        If the requested attribute names a dict in managed_attrs and that\n        contains a key with the name of the target distribution,\n        e.g. \"focal\", return that. Otherwise return the entire item\n        under the requested name.\n        \"\"\"\n        try:\n            attr = self.managed_attrs[name]\n            if isinstance(attr, dict) and self.securedrop_target_distribution in attr:\n                return attr[self.securedrop_target_distribution]\n            return attr\n        except KeyError:\n            raise AttributeError(name)\n\n    def __str__(self) -> str:\n        return str(self.managed_attrs)\n\n\ntestutils.securedrop_test_vars = TestVars(securedrop_import_testinfra_vars(target_host))\n", "path": "molecule/testinfra/conftest.py"}], "after_files": [{"content": "\"\"\"\nConfiguration for TestInfra test suite for SecureDrop.\nHandles importing host-specific test vars, so test functions\ncan be reused across multiple hosts, with varied targets.\n\nVars should be placed in `testinfra/vars/<hostname>.yml`.\n\"\"\"\n\nimport io\nimport os\nimport yaml\nfrom typing import Any, Dict\n\nimport testutils\n\n\n# The config tests target staging by default.\ntarget_host = os.environ.get('SECUREDROP_TESTINFRA_TARGET_HOST', 'staging')\n\n\ndef securedrop_import_testinfra_vars(hostname, with_header=False):\n    \"\"\"\n    Import vars from a YAML file to populate tests with host-specific\n    values used in checks. For instance, the SecureDrop docroot will\n    be under /vagrant in development, but /var/www/securedrop in staging.\n\n    Vars must be stored in `testinfra/vars/<hostname>.yml`.\n    \"\"\"\n    filepath = os.path.join(os.path.dirname(__file__), \"vars\", hostname+\".yml\")\n    with io.open(filepath, 'r') as f:\n        hostvars = yaml.safe_load(f)\n\n    hostvars['securedrop_venv_site_packages'] = hostvars[\"securedrop_venv_site_packages\"].format(\"3.8\")  # noqa: E501\n    hostvars['python_version'] = \"3.8\"\n    hostvars['apparmor_enforce_actual'] = hostvars['apparmor_enforce']['focal']\n\n    # If the tests are run against a production environment, check local config\n    # and override as necessary.\n    prod_filepath = os.path.join(os.path.dirname(__file__),\n                                 \"../../install_files/ansible-base/group_vars/all/site-specific\")\n    if os.path.isfile(prod_filepath):\n        with io.open(prod_filepath, 'r') as f:\n            prodvars = yaml.safe_load(f)\n\n        def _prod_override(vars_key, prod_key):\n            if prod_key in prodvars:\n                hostvars[vars_key] = prodvars[prod_key]\n\n        _prod_override('app_ip', 'app_ip')\n        _prod_override('app_hostname', 'app_hostname')\n        _prod_override('mon_ip', 'monitor_ip')\n        _prod_override('monitor_hostname', 'monitor_hostname')\n        _prod_override('sasl_domain', 'sasl_domain')\n        _prod_override('sasl_username', 'sasl_username')\n        _prod_override('sasl_password', 'sasl_password')\n        _prod_override('daily_reboot_time', 'daily_reboot_time')\n\n        # Check repo targeting, and update vars\n        repo_filepath = os.path.join(os.path.dirname(__file__),\n                                 \"../../install_files/ansible-base/roles/install-fpf-repo/defaults/main.yml\")  # noqa: E501\n        if os.path.isfile(repo_filepath):\n            with io.open(repo_filepath, 'r') as f:\n                repovars = yaml.safe_load(f)\n                if 'apt_repo_url' in repovars:\n                    hostvars['fpf_apt_repo_url'] = repovars['apt_repo_url']\n\n    if with_header:\n        hostvars = dict(securedrop_test_vars=hostvars)\n\n    return hostvars\n\n\nclass TestVars(dict):\n    managed_attrs = {}  # type: Dict[str, Any]\n\n    def __init__(self, initial: Dict[str, Any]) -> None:\n        self.securedrop_target_distribution = os.environ.get(\"SECUREDROP_TARGET_DISTRIBUTION\")\n        self.managed_attrs.update(initial)\n\n    def __getattr__(self, name: str) -> Any:\n        \"\"\"\n        If the requested attribute names a dict in managed_attrs and that\n        contains a key with the name of the target distribution,\n        e.g. \"focal\", return that. Otherwise return the entire item\n        under the requested name.\n        \"\"\"\n        try:\n            attr = self.managed_attrs[name]\n            if isinstance(attr, dict) and self.securedrop_target_distribution in attr:\n                return attr[self.securedrop_target_distribution]\n            return attr\n        except KeyError:\n            raise AttributeError(name)\n\n    def __str__(self) -> str:\n        return str(self.managed_attrs)\n\n\ntestutils.securedrop_test_vars = TestVars(securedrop_import_testinfra_vars(target_host))\n", "path": "molecule/testinfra/conftest.py"}]}