Secure Koji setup: add koji user, fix NFS/SELinux, use CentOS Stream 10 repos

roles/common/tasks/main.yaml

@@ -85,10 +85,25 @@
   ansible.builtin.shell:
     cmd: "gpg --armor --export 'Koji Signing Key' > {{ koji_pki_dir }}/gpg_key.pub"
     creates: "{{ koji_pki_dir }}/gpg_key.pub"
-    changed_when: false
   delegate_to: localhost
   run_once: true
 
+- name: Set hostname
+  ansible.builtin.hostname:
+    name: "{{ inventory_hostname }}"
+  when: inventory_hostname != 'localhost'
+
+- name: Enable persistent systemd journal
+  ansible.builtin.file:
+    path: /var/log/journal
+    state: directory
+    mode: "0755"
+  when: inventory_hostname != 'localhost'
+
+- name: Flush systemd journal to disk
+  ansible.builtin.command: journalctl --flush
+  when: inventory_hostname != 'localhost'
+
 - name: "Remove existing host keys"
   ansible.builtin.shell:
     cmd: "ssh-keygen -R {{ item }}"

roles/koji-hub/tasks/main.yaml

@@ -2,18 +2,18 @@
 - name: Install Koji Hub, Web, httpd, and crypto packages
   ansible.builtin.dnf:
     name:
-      - httpd
       - koji-hub
       - koji-web
+      - httpd
       - mod_ssl
       - mod_wsgi
-      - nmap-ncat
-      - policycoreutils-python-utils
-      - postgresql
       - python3-cryptography
-      - rpmdevtools
-      - rpmlint
-      - koji-hub-plugins
+      - nmap-ncat
+      - postgresql
+      - policycoreutils-python-utils
+      - koji-utils
+      - createrepo_c
+      - tree
     state: present
 
 - name: Create directories for certs and client configs
@@ -175,6 +175,12 @@
   loop: ["http", "https"]
   notify: Reload firewalld
 
+- name: Set SELinux context for Koji topdir
+  ansible.builtin.command: semanage fcontext -a -t httpd_sys_rw_content_t "/mnt/koji(/.*)?"
+
+- name: Apply SELinux context
+  ansible.builtin.command: restorecon -r -v /mnt/koji
+
 - name: Add database host to /etc/hosts
   ansible.builtin.lineinfile:
     path: /etc/hosts
@@ -182,6 +188,13 @@
     regexp: ".*{{ koji_db_host }}"
     state: present
 
+- name: Add hub host to /etc/hosts
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    line: "{{ ansible_default_ipv4.address }} {{ koji_hub_fqdn }}"
+    regexp: ".*{{ koji_hub_fqdn }}"
+    state: present
+
 - name: Wait for database to be available
   ansible.builtin.wait_for:
     host: "{{ koji_db_host }}"

roles/koji-hub/templates/koji_bootstrap.sh.j2

@@ -16,6 +16,8 @@ $KOJI_CMD add-tag --parent "{{ koji_build_tag }}" --arches "x86_64" "{{ koji_bui
 $KOJI_CMD add-target "{{ koji_build_tag }}-build" "{{ koji_build_tag }}-build" || echo "Target {{ koji_build_tag }}-build already exists"
 
 # External Repos
+$KOJI_CMD remove-external-repo "centos-stream-10-baseos" || echo "External repo centos-stream-10-baseos not found"
+$KOJI_CMD remove-external-repo "centos-stream-10-appstream" || echo "External repo centos-stream-10-appstream not found"
 $KOJI_CMD add-external-repo -t "{{ koji_build_tag }}-build" "centos-stream-10-baseos" "http://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/" || echo "External repo centos-stream-10-baseos already exists"
 $KOJI_CMD add-external-repo -t "{{ koji_build_tag }}-build" "centos-stream-10-appstream" "http://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/" || echo "External repo centos-stream-10-appstream already exists"
 

roles/kojid/tasks/main.yaml

@@ -7,13 +7,12 @@
       - rpm-build
       - rpmdevtools
       - mock
-      - centos-stream-repos
-      - koji-builder-plugins
+      - policycoreutils-python-utils
     state: present
 
 - name: Create kojid work directory
   ansible.builtin.file:
-    path: "{{ kojid_work_dir }}"
+    path: /var/lib/kojid
     state: directory
     owner: root
     group: root
@@ -67,10 +66,9 @@
     - {src: "kojid.key", dest: "{{ kojid_key_path }}", mode: "0600"}
 
 - name: "Concatenate certificate and key into a PEM file"
-  ansible.builtin.copy:
-    content: "{{ lookup('file', kojid_crt_path) }}\n{{ lookup('file', kojid_key_path) }}"
-    dest: "{{ kojid_pem_path }}"
-    mode: "0600"
+  ansible.builtin.shell: cat "{{ kojid_crt_path }}" "{{ kojid_key_path }}" > "{{ kojid_pem_path }}"
+  args:
+    creates: "{{ kojid_pem_path }}"
 
 - name: Set ownership and permissions on kojid.pem
   ansible.builtin.file:
@@ -79,6 +77,13 @@
     group: root
     mode: "0600"
 
+- name: Add hub host to /etc/hosts
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    line: "{{ hostvars[groups['kojihub'][0]].ansible_default_ipv4.address }} {{ koji_hub_fqdn }}"
+    regexp: ".*{{ koji_hub_fqdn }}"
+    state: present
+
 - name: Update CA trust
   ansible.builtin.command: update-ca-trust
 

roles/kojid/templates/site-defaults.cfg.j2

@@ -1,4 +1,5 @@
 config_opts['releasever'] = '10'
+config_opts['rpmbuild_networking'] = True
 config_opts['yum.conf'] = """
 [main]
 gpgcheck=1
@@ -10,17 +11,17 @@ strict=1
 
 [baseos]
 name=CentOS Stream 10 - BaseOS
-baseurl=http://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/
+baseurl=https://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/
 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
 
 [appstream]
 name=CentOS Stream 10 - AppStream
-baseurl=http://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/
+baseurl=https://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/
 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
 
 [crb]
 name=CentOS Stream 10 - CRB
-baseurl=http://mirror.stream.centos.org/10-stream/CRB/x86_64/os/
+baseurl=https://mirror.stream.centos.org/10-stream/CRB/x86_64/os/
 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
 enabled=1
 """

roles/kojira/tasks/main.yaml

@@ -26,9 +26,13 @@
     - { src: "kojira.key", dest: "/etc/pki/koji/kojira.key", mode: "0600" }
 
 - name: "Concatenate certificate and key into a PEM file"
-  ansible.builtin.copy:
-    content: "{{ lookup('file', '/etc/pki/koji/kojira.crt') }}\n{{ lookup('file', '/etc/pki/koji/kojira.key') }}"
-    dest: "/etc/pki/koji/kojira.pem"
+  ansible.builtin.shell: cat /etc/pki/koji/kojira.crt /etc/pki/koji/kojira.key > /etc/pki/koji/kojira.pem
+  args:
+    creates: /etc/pki/koji/kojira.pem
+
+- name: Set permissions on kojira PEM file
+  ansible.builtin.file:
+    path: /etc/pki/koji/kojira.pem
     mode: "0600"
 
 - name: Start and enable kojira service

roles/nfs-client/tasks/main.yaml

@@ -25,3 +25,12 @@
     fstype: nfs
     opts: "rw,sync"
     state: mounted
+
+- name: Set SELinux context for Koji NFS mount
+  ansible.builtin.command: semanage fcontext -a -t httpd_sys_rw_content_t "{{ koji_top_dir }}(/.*)?"
+
+- name: Apply SELinux context
+  ansible.builtin.command: restorecon -r -v "{{ koji_top_dir }}"
+
+- name: Flush systemd journal to disk
+  ansible.builtin.command: journalctl --flush

roles/postgresql/tasks/main.yaml

@@ -91,6 +91,7 @@
     address: "{{ hostvars[groups['kojihub'][0]].ansible_default_ipv6.address }}/128"
     method: scram-sha-256
     backup: true
+  when: hostvars[groups['kojihub'][0]].ansible_default_ipv6.address is defined
   notify: Restart postgresql
 
 - name: Configure pg_hba.conf for local postgres user trust authentication