MxOS/ansible-koji
SHA256
Watch
6
0
Fork
You've already forked ansible-koji
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix(web): disable TLS 1.3 to support SSL client cert renegotiation without PHA

Browse source 
- Set SSLProtocol to disable TLS 1.3 in ssl.conf on Apache, enabling standard TLS 1.2 client certificate renegotiation.

- Revert the temporary global SSLVerifyClient/Depth optional configuration at VirtualHost level.

- Save DB connection to kojihub.context.cnx in sign spooler.

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>

Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
This commit is contained in:
Rénich Bon Ćirić 2026-06-16 12:15:03 -06:00
commit 08882ba0fe
Signed by: renich
GPG key ID: AB2A9F49384FE324
3 changed files with 2 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
roles/koji_hub/files/koji-sign-spooler
View file

@ -125,7 +125,7 @@ def process_queue():
kojihub.db.setDBopts(**db_opts) kojihub.db.setDBopts(**db_opts)
try: try:
kojihub.db.connect() kojihub.context.cnx = kojihub.db.connect()
except Exception as e: except Exception as e:
logger.error(f"Failed to connect to Koji Hub DB: {e}") logger.error(f"Failed to connect to Koji Hub DB: {e}")
return return

3
roles/koji_hub/tasks/main.yaml
View file

@ -155,8 +155,7 @@
- { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateFile", line: "SSLCertificateFile {{ koji_hub_cert_path }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateFile", line: "SSLCertificateFile {{ koji_hub_cert_path }}" }
- { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateKeyFile", line: "SSLCertificateKeyFile {{ koji_hub_key_path }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateKeyFile", line: "SSLCertificateKeyFile {{ koji_hub_key_path }}" }
- { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLCACertificateFile", line: "SSLCACertificateFile {{ koji_remote_ca_trust_path }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLCACertificateFile", line: "SSLCACertificateFile {{ koji_remote_ca_trust_path }}" }
- { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyClient", line: "SSLVerifyClient {{ koji_hub_ssl_verify_client }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLProtocol", line: "SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.3" }
- { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyDepth", line: "SSLVerifyDepth 10" }
notify: Restart httpd notify: Restart httpd
- name: Enable SSL for Koji Hub - name: Enable SSL for Koji Hub

5
vars/default.yaml
View file

@ -102,11 +102,6 @@ kojid_mock_root: /var/lib/mock/mxos0-build-x86_64
# HTTPD/Web Paths # HTTPD/Web Paths
koji_hub_httpd_ssl_config_file: /etc/httpd/conf.d/ssl.conf koji_hub_httpd_ssl_config_file: /etc/httpd/conf.d/ssl.conf
# WARNING: Set to "require" in production for security. "optional" is used in
# development/staging to avoid TLS 1.3 Post-Handshake Authentication (PHA)
# browser errors (like "Cannot perform Post-Handshake Authentication") when
# logging in to Koji Web (which enforces client certificate validation).
koji_hub_ssl_verify_client: optional
koji_cleanup_script_path: /usr/local/bin/koji_cleanup.sh koji_cleanup_script_path: /usr/local/bin/koji_cleanup.sh
koji_cleanup_service_path: /etc/systemd/system/koji-cleanup.service koji_cleanup_service_path: /etc/systemd/system/koji-cleanup.service
koji_cleanup_timer_path: /etc/systemd/system/koji-cleanup.timer koji_cleanup_timer_path: /etc/systemd/system/koji-cleanup.timer