Secure Koji setup: add koji user, fix NFS/SELinux, use CentOS Stream 10 repos

roles/kojid/tasks/main.yaml

@@ -7,13 +7,12 @@
       - rpm-build
       - rpmdevtools
       - mock
-      - centos-stream-repos
-      - koji-builder-plugins
+      - policycoreutils-python-utils
     state: present
 
 - name: Create kojid work directory
   ansible.builtin.file:
-    path: "{{ kojid_work_dir }}"
+    path: /var/lib/kojid
     state: directory
     owner: root
     group: root
@@ -67,10 +66,9 @@
     - {src: "kojid.key", dest: "{{ kojid_key_path }}", mode: "0600"}
 
 - name: "Concatenate certificate and key into a PEM file"
-  ansible.builtin.copy:
-    content: "{{ lookup('file', kojid_crt_path) }}\n{{ lookup('file', kojid_key_path) }}"
-    dest: "{{ kojid_pem_path }}"
-    mode: "0600"
+  ansible.builtin.shell: cat "{{ kojid_crt_path }}" "{{ kojid_key_path }}" > "{{ kojid_pem_path }}"
+  args:
+    creates: "{{ kojid_pem_path }}"
 
 - name: Set ownership and permissions on kojid.pem
   ansible.builtin.file:
@@ -79,6 +77,13 @@
     group: root
     mode: "0600"
 
+- name: Add hub host to /etc/hosts
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    line: "{{ hostvars[groups['kojihub'][0]].ansible_default_ipv4.address }} {{ koji_hub_fqdn }}"
+    regexp: ".*{{ koji_hub_fqdn }}"
+    state: present
+
 - name: Update CA trust
   ansible.builtin.command: update-ca-trust