Secure Koji setup: add koji user, fix NFS/SELinux, use CentOS Stream 10 repos
This commit is contained in:
parent
8b9fd80a0d
commit
1f301725db
GPG key ID:
AB2A9F49384FE324
21 changed files with 654 additions and 129 deletions
|
|
@ -1,85 +1,140 @@
|
|||
resource "libvirt_volume" "cs10-base-system" {
|
||||
count = var.guest_count
|
||||
name = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}-system.qcow2"
|
||||
base_volume_id = libvirt_volume.cs10-base.id
|
||||
pool = var.pool_name
|
||||
size = var.disk_size
|
||||
resource "libvirt_volume" "cs10-base" {
|
||||
count = var.guest_count
|
||||
name = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}-system.qcow2"
|
||||
pool = var.pool_name
|
||||
format = "qcow2"
|
||||
create = {
|
||||
content = {
|
||||
url = "file://${var.base_image_path}"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "libvirt_cloudinit_disk" "cs10-cloudinit" {
|
||||
count = var.guest_count
|
||||
name = "${var.guest_base_name}-${format("%02d", count.index)}-cloudinit.iso"
|
||||
|
||||
user_data = templatefile("templates/cloudinit.cfg.tftpl", {
|
||||
root_password = var.root_password
|
||||
hostname = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
|
||||
})
|
||||
|
||||
meta_data = yamlencode({
|
||||
instance-id = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
|
||||
local-hostname = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
|
||||
})
|
||||
}
|
||||
|
||||
resource "libvirt_domain" "cs10-base" {
|
||||
count = var.guest_count
|
||||
name = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
|
||||
memory = var.guest_memory
|
||||
vcpu = var.guest_vcpu
|
||||
qemu_agent = true
|
||||
autostart = true
|
||||
firmware = "/usr/share/edk2/ovmf/OVMF_CODE_4M.qcow2"
|
||||
count = var.guest_count
|
||||
name = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
|
||||
memory = var.guest_memory
|
||||
unit = "MiB"
|
||||
vcpu = var.guest_vcpu
|
||||
running = true
|
||||
autostart = true
|
||||
type = "kvm"
|
||||
|
||||
cpu {
|
||||
os = {
|
||||
type = "hvm"
|
||||
arch = "x86_64"
|
||||
machine = "q35"
|
||||
firmware = "efi"
|
||||
loader_path = "/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2"
|
||||
loader_readonly = true
|
||||
loader_secure = true
|
||||
loader_type = "pflash"
|
||||
nvram = {
|
||||
path = "/var/lib/libvirt/qemu/nvram/${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}_VARS.qcow2"
|
||||
template = "/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2"
|
||||
format = "qcow2"
|
||||
}
|
||||
boot_devices = ["hd"]
|
||||
}
|
||||
|
||||
cpu = {
|
||||
mode = "host-passthrough"
|
||||
}
|
||||
|
||||
cloudinit = libvirt_cloudinit_disk.cs10-cloudinit.id
|
||||
|
||||
network_interface {
|
||||
network_name = "default"
|
||||
wait_for_lease = true
|
||||
features = {
|
||||
acpi = true
|
||||
apic = true
|
||||
}
|
||||
|
||||
disk {
|
||||
volume_id = libvirt_volume.cs10-base-system[count.index].id
|
||||
}
|
||||
|
||||
console {
|
||||
type = "pty"
|
||||
target_type = "serial"
|
||||
target_port = "0"
|
||||
}
|
||||
|
||||
console {
|
||||
type = "pty"
|
||||
target_type = "virtio"
|
||||
target_port = "1"
|
||||
}
|
||||
|
||||
graphics {
|
||||
type = "spice"
|
||||
listen_type = "address"
|
||||
autoport = true
|
||||
}
|
||||
|
||||
video {
|
||||
type = "virtio"
|
||||
}
|
||||
|
||||
provisioner "file" {
|
||||
source = "scripts"
|
||||
destination = "/tmp"
|
||||
|
||||
connection {
|
||||
type = "ssh"
|
||||
host = self.name
|
||||
timeout = "1m"
|
||||
}
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"bash /tmp/scripts/set-hostname.bash ${self.name}",
|
||||
"bash /tmp/scripts/dnf-fastest_mirrors.bash",
|
||||
"bash /tmp/scripts/install-tools.bash",
|
||||
"bash /tmp/scripts/upgrade.bash"
|
||||
devices = {
|
||||
disks = [
|
||||
{
|
||||
source = {
|
||||
file = libvirt_volume.cs10-base[count.index].path
|
||||
}
|
||||
target = { dev = "vda" }
|
||||
bus = "virtio"
|
||||
},
|
||||
{
|
||||
source = {
|
||||
file = libvirt_cloudinit_disk.cs10-cloudinit[count.index].path
|
||||
}
|
||||
target = { dev = "sda" }
|
||||
bus = "sata"
|
||||
readonly = true
|
||||
}
|
||||
]
|
||||
|
||||
connection {
|
||||
type = "ssh"
|
||||
user = "root"
|
||||
host = self.name
|
||||
timeout = "5m"
|
||||
interfaces = [
|
||||
{
|
||||
type = "network"
|
||||
model = "virtio"
|
||||
source = {
|
||||
network = "default"
|
||||
}
|
||||
}
|
||||
]
|
||||
|
||||
consoles = [
|
||||
{
|
||||
type = "pty"
|
||||
target_type = "serial"
|
||||
target_port = "0"
|
||||
},
|
||||
{
|
||||
type = "pty"
|
||||
target_type = "virtio"
|
||||
target_port = "1"
|
||||
}
|
||||
]
|
||||
|
||||
rngs = [
|
||||
{
|
||||
model = "virtio"
|
||||
device = "/dev/urandom"
|
||||
}
|
||||
]
|
||||
|
||||
serials = [
|
||||
{
|
||||
type = "pty"
|
||||
target_port = "0"
|
||||
target_type = "isa-serial"
|
||||
}
|
||||
]
|
||||
|
||||
tpms = [
|
||||
{
|
||||
model = "tpm-crb"
|
||||
backend_type = "emulator"
|
||||
backend_version = "2.0"
|
||||
}
|
||||
]
|
||||
|
||||
graphics = {
|
||||
spice = {
|
||||
autoport = "yes"
|
||||
listen = "127.0.0.1"
|
||||
}
|
||||
}
|
||||
|
||||
video = {
|
||||
type = "virtio"
|
||||
}
|
||||
}
|
||||
|
||||
xml {
|
||||
xslt = file("xslt/ide-to-sata.xslt")
|
||||
}
|
||||
}
|
||||
|
|
|
|||
190
opentofu/cs10.xml
Normal file
190
opentofu/cs10.xml
Normal file
|
|
@ -0,0 +1,190 @@
|
|||
<domain type='kvm'>
|
||||
<name>cs10</name>
|
||||
<uuid>dd0ce3f5-a2c0-4bc9-8b1f-e92edeaf196d</uuid>
|
||||
<metadata>
|
||||
<libosinfo:libosinfo xmlns:libosinfo="http://libosinfo.org/xmlns/libvirt/domain/1.0">
|
||||
<libosinfo:os id="http://centos.org/centos-stream/10"/>
|
||||
</libosinfo:libosinfo>
|
||||
</metadata>
|
||||
<memory unit='KiB'>8388608</memory>
|
||||
<currentMemory unit='KiB'>8388608</currentMemory>
|
||||
<vcpu placement='static'>4</vcpu>
|
||||
<os firmware='efi'>
|
||||
<type arch='x86_64' machine='pc-q35-10.1'>hvm</type>
|
||||
<firmware>
|
||||
<feature enabled='yes' name='enrolled-keys'/>
|
||||
<feature enabled='yes' name='secure-boot'/>
|
||||
</firmware>
|
||||
<loader readonly='yes' secure='yes' type='pflash' format='qcow2'>/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2</loader>
|
||||
<nvram template='/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2' templateFormat='qcow2' format='qcow2'>/var/lib/libvirt/qemu/nvram/cs10_VARS.qcow2</nvram>
|
||||
<boot dev='hd'/>
|
||||
</os>
|
||||
<features>
|
||||
<acpi/>
|
||||
<apic/>
|
||||
<vmport state='off'/>
|
||||
<smm state='on'/>
|
||||
</features>
|
||||
<cpu mode='host-passthrough' check='none' migratable='on'/>
|
||||
<clock offset='utc'>
|
||||
<timer name='rtc' tickpolicy='catchup'/>
|
||||
<timer name='pit' tickpolicy='delay'/>
|
||||
<timer name='hpet' present='no'/>
|
||||
</clock>
|
||||
<on_poweroff>destroy</on_poweroff>
|
||||
<on_reboot>restart</on_reboot>
|
||||
<on_crash>destroy</on_crash>
|
||||
<pm>
|
||||
<suspend-to-mem enabled='no'/>
|
||||
<suspend-to-disk enabled='no'/>
|
||||
</pm>
|
||||
<devices>
|
||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
||||
<disk type='file' device='disk'>
|
||||
<driver name='qemu' type='qcow2'/>
|
||||
<source file='/home/renich/VirtualMachines/cs10.qcow2'/>
|
||||
<target dev='vda' bus='virtio'/>
|
||||
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
|
||||
</disk>
|
||||
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
|
||||
<address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/>
|
||||
</controller>
|
||||
<controller type='pci' index='0' model='pcie-root'/>
|
||||
<controller type='pci' index='1' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='1' port='0x10'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
|
||||
</controller>
|
||||
<controller type='pci' index='2' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='2' port='0x11'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
|
||||
</controller>
|
||||
<controller type='pci' index='3' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='3' port='0x12'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
|
||||
</controller>
|
||||
<controller type='pci' index='4' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='4' port='0x13'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
|
||||
</controller>
|
||||
<controller type='pci' index='5' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='5' port='0x14'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
|
||||
</controller>
|
||||
<controller type='pci' index='6' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='6' port='0x15'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
|
||||
</controller>
|
||||
<controller type='pci' index='7' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='7' port='0x16'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
|
||||
</controller>
|
||||
<controller type='pci' index='8' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='8' port='0x17'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x7'/>
|
||||
</controller>
|
||||
<controller type='pci' index='9' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='9' port='0x18'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0' multifunction='on'/>
|
||||
</controller>
|
||||
<controller type='pci' index='10' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='10' port='0x19'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x1'/>
|
||||
</controller>
|
||||
<controller type='pci' index='11' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='11' port='0x1a'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x2'/>
|
||||
</controller>
|
||||
<controller type='pci' index='12' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='12' port='0x1b'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x3'/>
|
||||
</controller>
|
||||
<controller type='pci' index='13' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='13' port='0x1c'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x4'/>
|
||||
</controller>
|
||||
<controller type='pci' index='14' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='14' port='0x1d'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x5'/>
|
||||
</controller>
|
||||
<controller type='sata' index='0'>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
|
||||
</controller>
|
||||
<controller type='virtio-serial' index='0'>
|
||||
<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
|
||||
</controller>
|
||||
<controller type='scsi' index='0' model='virtio-scsi'>
|
||||
<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
|
||||
</controller>
|
||||
<interface type='network'>
|
||||
<mac address='52:54:00:62:40:d9'/>
|
||||
<source network='default'/>
|
||||
<model type='virtio'/>
|
||||
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
|
||||
</interface>
|
||||
<serial type='pty'>
|
||||
<target type='isa-serial' port='0'>
|
||||
<model name='isa-serial'/>
|
||||
</target>
|
||||
</serial>
|
||||
<console type='pty'>
|
||||
<target type='serial' port='0'/>
|
||||
</console>
|
||||
<channel type='unix'>
|
||||
<target type='virtio' name='org.qemu.guest_agent.0'/>
|
||||
<address type='virtio-serial' controller='0' bus='0' port='1'/>
|
||||
</channel>
|
||||
<channel type='spicevmc'>
|
||||
<target type='virtio' name='com.redhat.spice.0'/>
|
||||
<address type='virtio-serial' controller='0' bus='0' port='2'/>
|
||||
</channel>
|
||||
<input type='tablet' bus='usb'>
|
||||
<address type='usb' bus='0' port='1'/>
|
||||
</input>
|
||||
<input type='mouse' bus='ps2'/>
|
||||
<input type='keyboard' bus='ps2'/>
|
||||
<tpm model='tpm-crb'>
|
||||
<backend type='emulator' version='2.0'/>
|
||||
</tpm>
|
||||
<graphics type='spice' autoport='yes'>
|
||||
<listen type='address'/>
|
||||
<image compression='off'/>
|
||||
</graphics>
|
||||
<sound model='ich9'>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x1b' function='0x0'/>
|
||||
</sound>
|
||||
<audio id='1' type='spice'/>
|
||||
<video>
|
||||
<model type='virtio' heads='1' primary='yes'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/>
|
||||
</video>
|
||||
<redirdev bus='usb' type='spicevmc'>
|
||||
<address type='usb' bus='0' port='2'/>
|
||||
</redirdev>
|
||||
<redirdev bus='usb' type='spicevmc'>
|
||||
<address type='usb' bus='0' port='3'/>
|
||||
</redirdev>
|
||||
<watchdog model='itco' action='reset'/>
|
||||
<memballoon model='virtio'>
|
||||
<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
|
||||
</memballoon>
|
||||
<rng model='virtio'>
|
||||
<backend model='random'>/dev/urandom</backend>
|
||||
<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
|
||||
</rng>
|
||||
</devices>
|
||||
</domain>
|
||||
|
||||
|
|
@ -10,18 +10,5 @@ provider "libvirt" {
|
|||
uri = "qemu:///system"
|
||||
}
|
||||
|
||||
resource "libvirt_cloudinit_disk" "cs10-cloudinit" {
|
||||
name = "cs10-cloudinit.iso"
|
||||
pool = var.pool_name
|
||||
user_data = templatefile("templates/cloudinit.cfg.tftpl", {
|
||||
root_password = var.root_password
|
||||
}
|
||||
)
|
||||
}
|
||||
|
||||
resource "libvirt_volume" "cs10-base" {
|
||||
name = "cs10-base.qcow2"
|
||||
pool = var.pool_name
|
||||
source = var.base_image_path
|
||||
format = "qcow2"
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
#cloud-config
|
||||
|
||||
instance_id: ${hostname}
|
||||
local_hostname: ${hostname}
|
||||
|
||||
# ssh
|
||||
disable_root: false
|
||||
allow_public_ssh_keys: true
|
||||
|
|
|
|||
|
|
@ -2,12 +2,14 @@ variable "root_password" {
|
|||
description = "Contraseña de root para las máquinas virtuales."
|
||||
type = string
|
||||
sensitive = true
|
||||
default = "Un pinche pass."
|
||||
}
|
||||
|
||||
variable "domain" {
|
||||
description = "Dominio de red para las máquinas virtuales."
|
||||
type = string
|
||||
sensitive = false
|
||||
default = "mx-os"
|
||||
}
|
||||
|
||||
variable "guest_count" {
|
||||
|
|
@ -19,12 +21,13 @@ variable "guest_count" {
|
|||
variable "guest_base_name" {
|
||||
description = "Nombre base para las máquinas virtuales invitadas."
|
||||
type = string
|
||||
default = "cs10-base"
|
||||
default = "cs10-koji"
|
||||
}
|
||||
|
||||
variable "base_image_path" {
|
||||
description = "Ruta al archivo de la imagen base de la máquina virtual."
|
||||
description = "Path to the base qcow2 image"
|
||||
type = string
|
||||
default = "/home/renich/VirtualMachines/cs10.qcow2"
|
||||
}
|
||||
|
||||
variable "guest_memory" {
|
||||
|
|
|
|||
|
|
@ -1,21 +0,0 @@
|
|||
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
|
||||
<xsl:output omit-xml-declaration="yes" indent="yes"/>
|
||||
<xsl:strip-space elements="*"/>
|
||||
|
||||
<xsl:template match="node()|@*">
|
||||
<xsl:copy>
|
||||
<xsl:apply-templates select="node()|@*"/>
|
||||
</xsl:copy>
|
||||
</xsl:template>
|
||||
|
||||
<xsl:template match="disk[serial='cloudinit']">
|
||||
<xsl:copy>
|
||||
<xsl:apply-templates select="@*"/>
|
||||
<xsl:copy-of select="driver"/>
|
||||
<source file="{source/@file}"/>
|
||||
<target dev="sda" bus="sata"/>
|
||||
<xsl:copy-of select="readonly"/>
|
||||
<address type="drive" controller="0" bus="0" target="0" unit="0"/>
|
||||
</xsl:copy>
|
||||
</xsl:template>
|
||||
</xsl:stylesheet>
|
||||
Loading…
Reference in a new issue