Secure Koji setup: add koji user, fix NFS/SELinux, use CentOS Stream 10 repos

roles/koji-hub/tasks/main.yaml

@@ -2,18 +2,18 @@
 - name: Install Koji Hub, Web, httpd, and crypto packages
   ansible.builtin.dnf:
     name:
-      - httpd
       - koji-hub
       - koji-web
+      - httpd
       - mod_ssl
       - mod_wsgi
-      - nmap-ncat
-      - policycoreutils-python-utils
-      - postgresql
       - python3-cryptography
-      - rpmdevtools
-      - rpmlint
-      - koji-hub-plugins
+      - nmap-ncat
+      - postgresql
+      - policycoreutils-python-utils
+      - koji-utils
+      - createrepo_c
+      - tree
     state: present
 
 - name: Create directories for certs and client configs
@@ -175,6 +175,12 @@
   loop: ["http", "https"]
   notify: Reload firewalld
 
+- name: Set SELinux context for Koji topdir
+  ansible.builtin.command: semanage fcontext -a -t httpd_sys_rw_content_t "/mnt/koji(/.*)?"
+
+- name: Apply SELinux context
+  ansible.builtin.command: restorecon -r -v /mnt/koji
+
 - name: Add database host to /etc/hosts
   ansible.builtin.lineinfile:
     path: /etc/hosts
@@ -182,6 +188,13 @@
     regexp: ".*{{ koji_db_host }}"
     state: present
 
+- name: Add hub host to /etc/hosts
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    line: "{{ ansible_default_ipv4.address }} {{ koji_hub_fqdn }}"
+    regexp: ".*{{ koji_hub_fqdn }}"
+    state: present
+
 - name: Wait for database to be available
   ansible.builtin.wait_for:
     host: "{{ koji_db_host }}"