Secure Koji setup: add koji user, fix NFS/SELinux, use CentOS Stream 10 repos

README.rst

@@ -122,6 +122,35 @@ Para interactuar con Koji como el usuario `kojiadmin` desde el Koji Hub, normalm
 .. note::
    Koji Hub es `cs10-koji-00.mx-os`.
 
+Uso del Entorno Desplegado
+--------------------------
+
+Una vez desplegado el entorno de Koji, puedes interactuar con él de las siguientes maneras:
+
+* **Interfaz Web**: Visita https://cs10-koji-00.mx-os/koji en tu navegador para acceder a la interfaz web de Koji. Aquí puedes ver compilaciones, tareas, paquetes, etc.
+
+* **Monitorear una Compilación**: Usa el comando `koji taskinfo <task_id>` para ver el estado de una tarea específica. También puedes usar la interfaz web.
+
+* **Hacer una Compilación**: Para compilar un paquete, usa `koji build <tag> <fuente>`. Por ejemplo:
+
+  .. code-block:: bash
+
+     koji build mxos0-build git+https://git.mx-os.mx/RPMs/osci-internal-test-package#5test
+
+  O desde un SRPM local:
+
+  .. code-block:: bash
+
+     koji build mxos0-build /path/to/package.src.rpm
+
+* **Listar Tareas**: `koji list-tasks` para ver tareas activas.
+
+* **Listar Etiquetas**: `koji list-tags` para ver etiquetas disponibles.
+
+* **Ver Información de un Paquete**: `koji info <package>`.
+
+Para más comandos, consulta la documentación de Koji en https://docs.pagure.org/koji/.
+
 Firma de paquetes
 =================
 Este playbook configura Koji Hub para la firma automatizada de RPM a través de un servidor Sigul externo. Para fines de prueba,

bin/koji-rpms-test.bash

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+# Test Koji RPM build process
+# Run from project root: ./bin/koji-rpms-test.bash
+
+set -euo pipefail
+
+# Colors
+green='\033[0;32m'
+red='\033[0;31m'
+nc='\033[0m'
+
+ok() { echo -e "${green}[  OK  ]${nc} $1"; }
+fail() { echo -e "${red}[ FAIL ]${red} $1"; exit 1; }
+
+hub="cs10-koji-00.mx-os"
+tag="mxos0-build"
+
+echo "## Starting Koji build from git..."
+echo "Building osci-internal-test-package (a simple test package for Koji) from https://git.mx-os.mx/RPMs/osci-internal-test-package#5test"
+build_output=$(ssh root@"$hub" "su - kojiadmin -c 'koji build $tag git+https://git.mx-os.mx/RPMs/osci-internal-test-package#5test'" 2>&1)
+if echo "$build_output" | grep -q "Created task:"; then
+    task_id=$(echo "$build_output" | grep "Created task:" | sed 's/.*Created task: \([0-9]*\).*/\1/')
+    ok "Build started, task ID: $task_id"
+else
+    fail "Failed to start build: $build_output"
+fi
+
+echo "## Checking build task..."
+task_info=$(ssh root@"$hub" "su - kojiadmin -c 'koji taskinfo $task_id'" 2>/dev/null)
+if echo "$task_info" | grep -q "State: free\|State: open\|State: closed"; then
+    ok "Build task is active (started successfully)"
+else
+    fail "Build task not found or failed to start"
+fi
+
+echo ""
+echo "Koji RPM build test passed!"

bin/koji-servers.bash

@@ -0,0 +1,93 @@
+#!/usr/bin/bash
+# Script to create/destroy 4 CentOS Stream 10 Koji development servers
+# Usage: ./koji-servers.bash create|destroy
+
+set -e
+
+BASE_VM="cs10"
+SERVERS=("cs10-koji-00.mx-os" "cs10-koji-01.mx-os" "cs10-koji-02.mx-os" "cs10-koji-03.mx-os")
+POOL_PATH="/var/lib/libvirt/images/fast"
+SSH_KEYS=(
+  "root:file:$HOME/.ssh/id_ed25519.pub"
+  "renich:file:$HOME/.ssh/id_ed25519.pub"
+  "alex:file:$HOME/Clients/xpc/ssh/alex.pub"
+  "guillermo:file:$HOME/Clients/xpc/ssh/guillermo.pub"
+)
+
+
+
+create_servers() {
+  echo "Creating 4 Koji development servers..."
+  for SERVER in "${SERVERS[@]}"; do
+    if virsh -c qemu:///system dominfo "$SERVER" &>/dev/null; then
+      echo "VM $SERVER already exists, skipping."
+      continue
+    fi
+
+    DISK_PATH="$POOL_PATH/${SERVER}.qcow2"
+    rm -f "$DISK_PATH"
+    echo "Cloning $SERVER..."
+    if ! virt-clone --connect=qemu:///system --original "$BASE_VM" --name "$SERVER" --file "$DISK_PATH"; then
+      echo "Cloning failed for $SERVER, skipping."
+      continue
+    fi
+  done
+
+  for SERVER in "${SERVERS[@]}"; do
+    (
+      DISK_PATH="$POOL_PATH/${SERVER}.qcow2"
+      echo "Resizing disk for $SERVER..."
+      if ! qemu-img create -f qcow2 "${DISK_PATH}.new" 100G; then
+        echo "qemu-img create failed for $SERVER, skipping resize."
+      elif ! virt-resize --expand /dev/sda4 "$DISK_PATH" "${DISK_PATH}.new"; then
+        echo "virt-resize failed for $SERVER, skipping."
+        rm -f "${DISK_PATH}.new"
+      else
+        if mv "${DISK_PATH}.new" "$DISK_PATH"; then
+          echo "Resize completed for $SERVER."
+        else
+          echo "mv failed for $SERVER."
+        fi
+      fi
+
+      echo "Starting $SERVER..."
+      if virsh -c qemu:///system start "$SERVER"; then
+        echo "$SERVER started successfully."
+      else
+        echo "Failed to start $SERVER."
+      fi
+    ) &
+  done
+  wait
+  echo "All servers created and started."
+}
+
+destroy_servers() {
+  echo "Destroying 4 Koji development servers..."
+  for SERVER in "${SERVERS[@]}"; do
+    (
+      if virsh -c qemu:///system dominfo "$SERVER" &>/dev/null; then
+        echo "Destroying $SERVER..."
+        virsh -c qemu:///system destroy "$SERVER" || true
+        virsh -c qemu:///system undefine "$SERVER" --nvram --tpm --remove-all-storage || true
+      else
+        echo "VM $SERVER does not exist, skipping."
+      fi
+    ) &
+  done
+  wait
+  echo "All servers destroyed."
+}
+
+case "$1" in
+  create)
+    create_servers
+    ;;
+  destroy)
+    destroy_servers
+    ;;
+  *)
+    echo "Usage: $0 {create|destroy}"
+    exit 1
+    ;;
+esac

bin/koji-test.bash

@@ -0,0 +1,104 @@
+#!/bin/bash
+
+# Test script for Koji dev environment
+# Run from project root: ./bin/koji-test.bash
+
+set -euo pipefail
+
+# Colors
+green='\033[0;32m'
+red='\033[0;31m'
+nc='\033[0m'
+
+ok() { echo -e "${green}[  OK  ]${nc} $1"; }
+fail() { echo -e "${red}[ FAIL ]${nc} $1"; exit 1; }
+
+# Hosts
+hub="cs10-koji-00.mx-os"
+db="cs10-koji-01.mx-os"
+nfs="cs10-koji-02.mx-os"
+builder="cs10-koji-03.mx-os"
+
+echo "## Checking VMs are running..."
+for vm in "$hub" "$db" "$nfs" "$builder"; do
+    if virsh -c qemu:///system dominfo "$vm" &>/dev/null; then
+        ok "VM $vm is running"
+    else
+        fail "VM $vm is not running"
+    fi
+done
+
+echo ""
+echo "## Pinging hosts..."
+for host in "$hub" "$db" "$nfs" "$builder"; do
+    if ping -c 1 "$host" &>/dev/null; then
+        ok "Host $host is reachable"
+    else
+        fail "Host $host is not reachable"
+    fi
+done
+
+echo ""
+echo "## Checking SSH connectivity..."
+for host in "$hub" "$db" "$nfs" "$builder"; do
+    if ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no root@"$host" "echo 'SSH OK'" &>/dev/null; then
+        ok "SSH to $host works"
+    else
+        fail "SSH to $host failed"
+    fi
+done
+
+echo ""
+echo "## Checking services..."
+# Hub: httpd, kojira
+if ssh root@"$hub" "systemctl is-active httpd" &>/dev/null; then
+    ok "httpd on hub is active"
+else
+    fail "httpd on hub is not active"
+fi
+
+if ssh root@"$hub" "systemctl is-active kojira" &>/dev/null; then
+    ok "kojira on hub is active"
+else
+    fail "kojira on hub is not active"
+fi
+
+# DB: postgresql
+if ssh root@"$db" "systemctl is-active postgresql" &>/dev/null; then
+    ok "postgresql on db is active"
+else
+    fail "postgresql on db is not active"
+fi
+
+# NFS: nfs-server
+if ssh root@"$nfs" "systemctl is-active nfs-server" &>/dev/null; then
+    ok "nfs-server on nfs is active"
+else
+    fail "nfs-server on nfs is not active"
+fi
+
+# Builder: kojid
+if ssh root@"$builder" "systemctl is-active kojid" &>/dev/null; then
+    ok "kojid on builder is active"
+else
+    fail "kojid on builder is not active"
+fi
+
+echo ""
+echo "## Testing Koji connectivity..."
+if ssh root@"$hub" "su - kojiadmin -c 'koji moshimoshi'" &>/dev/null; then
+    ok "Koji 'moshimoshi' command works"
+else
+    fail "Koji 'moshimoshi' command failed"
+fi
+
+echo ""
+echo "## Checking Koji web interface..."
+if curl -k -s -L "https://$hub/koji" | grep -q "Koji"; then
+    ok "Koji web interface is accessible"
+else
+    fail "Koji web interface is not accessible"
+fi
+
+echo ""
+echo "Koji dev environment test passed!"

docs/instalación.rst

@@ -136,13 +136,6 @@ Fase 5: Configuración de Kojid (Constructor) y Kojira (Administrador de Repos)
 
 Estos componentes manejan los procesos de compilación reales y la gestión de repositorios.
 
-#. Configura Kojid (en cada host constructor):
-
-   * Instala `koji-builder`, `rpm-build`, `rpmdevtools` y `mock`.
-   * Edita `/etc/kojid/kojid.conf` para que apunte a la URL del servidor XML-RPC de Koji Hub.
-   * Especifica el certificado de cliente del componente `kojid` y el certificado de la CA de Koji.
-   * Agrega los usuarios que necesitan compilar paquetes (p. ej., `kojiadmin`) al grupo `mock`.
-
 #.  Configura Kojira (en el hub o en un host dedicado):
 
     * Instala `koji-utils`.

docs/koji

@@ -0,0 +1 @@
+Subproject commit 0db0d21d8ae52df10884af7b3ede5de052a92739000000000000000000000000

opentofu/cs10-base.tf

@@ -1,85 +1,140 @@
-resource "libvirt_volume" "cs10-base-system" {
+resource "libvirt_volume" "cs10-base" {
-  count          = var.guest_count
+  count  = var.guest_count
-  name           = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}-system.qcow2"
+  name   = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}-system.qcow2"
-  base_volume_id = libvirt_volume.cs10-base.id
+  pool   = var.pool_name
-  pool           = var.pool_name
+  format = "qcow2"
-  size           = var.disk_size
+  create = {
+    content = {
+      url = "file://${var.base_image_path}"
+    }
+  }
+}
+
+resource "libvirt_cloudinit_disk" "cs10-cloudinit" {
+  count = var.guest_count
+  name  = "${var.guest_base_name}-${format("%02d", count.index)}-cloudinit.iso"
+
+  user_data = templatefile("templates/cloudinit.cfg.tftpl", {
+    root_password = var.root_password
+    hostname      = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
+  })
+
+  meta_data = yamlencode({
+    instance-id    = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
+    local-hostname = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
+  })
 }
 
 resource "libvirt_domain" "cs10-base" {
-  count      = var.guest_count
+  count     = var.guest_count
-  name       = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
+  name      = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
-  memory     = var.guest_memory
+  memory    = var.guest_memory
-  vcpu       = var.guest_vcpu
+  unit      = "MiB"
-  qemu_agent = true
+  vcpu      = var.guest_vcpu
-  autostart  = true
+  running   = true
-  firmware   = "/usr/share/edk2/ovmf/OVMF_CODE_4M.qcow2"
+  autostart = true
+  type      = "kvm"
 
-  cpu {
+   os = {
+     type            = "hvm"
+     arch            = "x86_64"
+     machine         = "q35"
+     firmware        = "efi"
+     loader_path     = "/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2"
+     loader_readonly = true
+     loader_secure   = true
+     loader_type     = "pflash"
+     nvram = {
+       path     = "/var/lib/libvirt/qemu/nvram/${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}_VARS.qcow2"
+       template = "/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2"
+       format   = "qcow2"
+     }
+     boot_devices = ["hd"]
+   }
+
+  cpu = {
     mode = "host-passthrough"
   }
 
-  cloudinit = libvirt_cloudinit_disk.cs10-cloudinit.id
+  features = {
-
+    acpi = true
-  network_interface {
+    apic = true
-    network_name   = "default"
-    wait_for_lease = true
   }
 
-  disk {
+  devices = {
-    volume_id = libvirt_volume.cs10-base-system[count.index].id
+    disks = [
-  }
+      {
-
+        source = {
-  console {
+          file = libvirt_volume.cs10-base[count.index].path
-    type        = "pty"
+        }
-    target_type = "serial"
+        target = { dev = "vda" }
-    target_port = "0"
+        bus    = "virtio"
-  }
+      },
-
+      {
-  console {
+        source = {
-    type        = "pty"
+          file = libvirt_cloudinit_disk.cs10-cloudinit[count.index].path
-    target_type = "virtio"
+        }
-    target_port = "1"
+        target   = { dev = "sda" }
-  }
+        bus      = "sata"
-
+        readonly = true
-  graphics {
+      }
-    type        = "spice"
-    listen_type = "address"
-    autoport    = true
-  }
-
-  video {
-    type = "virtio"
-  }
-
-  provisioner "file" {
-    source      = "scripts"
-    destination = "/tmp"
-
-    connection {
-      type    = "ssh"
-      host    = self.name
-      timeout = "1m"
-    }
-  }
-
-  provisioner "remote-exec" {
-    inline = [
-      "bash /tmp/scripts/set-hostname.bash ${self.name}",
-      "bash /tmp/scripts/dnf-fastest_mirrors.bash",
-      "bash /tmp/scripts/install-tools.bash",
-      "bash /tmp/scripts/upgrade.bash"
     ]
 
-    connection {
+    interfaces = [
-      type    = "ssh"
+      {
-      user    = "root"
+        type  = "network"
-      host    = self.name
+        model = "virtio"
-      timeout = "5m"
+        source = {
+          network = "default"
+        }
+      }
+    ]
+
+    consoles = [
+      {
+        type        = "pty"
+        target_type = "serial"
+        target_port = "0"
+      },
+      {
+        type        = "pty"
+        target_type = "virtio"
+        target_port = "1"
+      }
+    ]
+
+    rngs = [
+      {
+        model = "virtio"
+        device = "/dev/urandom"
+      }
+    ]
+
+    serials = [
+      {
+        type        = "pty"
+        target_port = "0"
+        target_type = "isa-serial"
+      }
+    ]
+
+    tpms = [
+      {
+        model = "tpm-crb"
+        backend_type    = "emulator"
+        backend_version = "2.0"
+      }
+    ]
+
+    graphics = {
+      spice = {
+        autoport = "yes"
+        listen   = "127.0.0.1"
+      }
+    }
+
+    video = {
+      type = "virtio"
     }
   }
-
-  xml {
-    xslt = file("xslt/ide-to-sata.xslt")
-  }
 }

opentofu/cs10.xml

@@ -0,0 +1,190 @@
+<domain type='kvm'>
+  <name>cs10</name>
+  <uuid>dd0ce3f5-a2c0-4bc9-8b1f-e92edeaf196d</uuid>
+  <metadata>
+    <libosinfo:libosinfo xmlns:libosinfo="http://libosinfo.org/xmlns/libvirt/domain/1.0">
+      <libosinfo:os id="http://centos.org/centos-stream/10"/>
+    </libosinfo:libosinfo>
+  </metadata>
+  <memory unit='KiB'>8388608</memory>
+  <currentMemory unit='KiB'>8388608</currentMemory>
+  <vcpu placement='static'>4</vcpu>
+  <os firmware='efi'>
+    <type arch='x86_64' machine='pc-q35-10.1'>hvm</type>
+    <firmware>
+      <feature enabled='yes' name='enrolled-keys'/>
+      <feature enabled='yes' name='secure-boot'/>
+    </firmware>
+    <loader readonly='yes' secure='yes' type='pflash' format='qcow2'>/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2</loader>
+    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2' templateFormat='qcow2' format='qcow2'>/var/lib/libvirt/qemu/nvram/cs10_VARS.qcow2</nvram>
+    <boot dev='hd'/>
+  </os>
+  <features>
+    <acpi/>
+    <apic/>
+    <vmport state='off'/>
+    <smm state='on'/>
+  </features>
+  <cpu mode='host-passthrough' check='none' migratable='on'/>
+  <clock offset='utc'>
+    <timer name='rtc' tickpolicy='catchup'/>
+    <timer name='pit' tickpolicy='delay'/>
+    <timer name='hpet' present='no'/>
+  </clock>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <pm>
+    <suspend-to-mem enabled='no'/>
+    <suspend-to-disk enabled='no'/>
+  </pm>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <disk type='file' device='disk'>
+      <driver name='qemu' type='qcow2'/>
+      <source file='/home/renich/VirtualMachines/cs10.qcow2'/>
+      <target dev='vda' bus='virtio'/>
+      <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
+    </disk>
+    <controller type='usb' index='0' model='qemu-xhci' ports='15'>
+      <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/>
+    </controller>
+    <controller type='pci' index='0' model='pcie-root'/>
+    <controller type='pci' index='1' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='1' port='0x10'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
+    </controller>
+    <controller type='pci' index='2' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='2' port='0x11'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
+    </controller>
+    <controller type='pci' index='3' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='3' port='0x12'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
+    </controller>
+    <controller type='pci' index='4' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='4' port='0x13'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
+    </controller>
+    <controller type='pci' index='5' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='5' port='0x14'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
+    </controller>
+    <controller type='pci' index='6' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='6' port='0x15'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
+    </controller>
+    <controller type='pci' index='7' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='7' port='0x16'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
+    </controller>
+    <controller type='pci' index='8' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='8' port='0x17'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x7'/>
+    </controller>
+    <controller type='pci' index='9' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='9' port='0x18'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0' multifunction='on'/>
+    </controller>
+    <controller type='pci' index='10' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='10' port='0x19'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x1'/>
+    </controller>
+    <controller type='pci' index='11' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='11' port='0x1a'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x2'/>
+    </controller>
+    <controller type='pci' index='12' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='12' port='0x1b'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x3'/>
+    </controller>
+    <controller type='pci' index='13' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='13' port='0x1c'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x4'/>
+    </controller>
+    <controller type='pci' index='14' model='pcie-root-port'>
+      <model name='pcie-root-port'/>
+      <target chassis='14' port='0x1d'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x5'/>
+    </controller>
+    <controller type='sata' index='0'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
+    </controller>
+    <controller type='virtio-serial' index='0'>
+      <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
+    </controller>
+    <controller type='scsi' index='0' model='virtio-scsi'>
+      <address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
+    </controller>
+    <interface type='network'>
+      <mac address='52:54:00:62:40:d9'/>
+      <source network='default'/>
+      <model type='virtio'/>
+      <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
+    </interface>
+    <serial type='pty'>
+      <target type='isa-serial' port='0'>
+        <model name='isa-serial'/>
+      </target>
+    </serial>
+    <console type='pty'>
+      <target type='serial' port='0'/>
+    </console>
+    <channel type='unix'>
+      <target type='virtio' name='org.qemu.guest_agent.0'/>
+      <address type='virtio-serial' controller='0' bus='0' port='1'/>
+    </channel>
+    <channel type='spicevmc'>
+      <target type='virtio' name='com.redhat.spice.0'/>
+      <address type='virtio-serial' controller='0' bus='0' port='2'/>
+    </channel>
+    <input type='tablet' bus='usb'>
+      <address type='usb' bus='0' port='1'/>
+    </input>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <tpm model='tpm-crb'>
+      <backend type='emulator' version='2.0'/>
+    </tpm>
+    <graphics type='spice' autoport='yes'>
+      <listen type='address'/>
+      <image compression='off'/>
+    </graphics>
+    <sound model='ich9'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x1b' function='0x0'/>
+    </sound>
+    <audio id='1' type='spice'/>
+    <video>
+      <model type='virtio' heads='1' primary='yes'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/>
+    </video>
+    <redirdev bus='usb' type='spicevmc'>
+      <address type='usb' bus='0' port='2'/>
+    </redirdev>
+    <redirdev bus='usb' type='spicevmc'>
+      <address type='usb' bus='0' port='3'/>
+    </redirdev>
+    <watchdog model='itco' action='reset'/>
+    <memballoon model='virtio'>
+      <address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
+    </memballoon>
+    <rng model='virtio'>
+      <backend model='random'>/dev/urandom</backend>
+      <address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
+    </rng>
+  </devices>
+</domain>
+

opentofu/main.tf

@@ -10,18 +10,5 @@ provider "libvirt" {
   uri = "qemu:///system"
 }
 
-resource "libvirt_cloudinit_disk" "cs10-cloudinit" {
-  name = "cs10-cloudinit.iso"
-  pool = var.pool_name
-  user_data = templatefile("templates/cloudinit.cfg.tftpl", {
-    root_password = var.root_password
-    }
-  )
-}
 
-resource "libvirt_volume" "cs10-base" {
+
-  name   = "cs10-base.qcow2"
-  pool   = var.pool_name
-  source = var.base_image_path
-  format = "qcow2"
-}

opentofu/templates/cloudinit.cfg.tftpl

@@ -1,5 +1,8 @@
 #cloud-config
 
+instance_id: ${hostname}
+local_hostname: ${hostname}
+
 # ssh
 disable_root: false
 allow_public_ssh_keys: true

opentofu/variables.tf

@@ -2,12 +2,14 @@ variable "root_password" {
   description = "Contraseña de root para las máquinas virtuales."
   type        = string
   sensitive   = true
+  default     = "Un pinche pass."
 }
 
 variable "domain" {
   description = "Dominio de red para las máquinas virtuales."
   type        = string
   sensitive   = false
+  default     = "mx-os"
 }
 
 variable "guest_count" {
@@ -19,12 +21,13 @@ variable "guest_count" {
 variable "guest_base_name" {
   description = "Nombre base para las máquinas virtuales invitadas."
   type        = string
-  default     = "cs10-base"
+  default     = "cs10-koji"
 }
 
 variable "base_image_path" {
-  description = "Ruta al archivo de la imagen base de la máquina virtual."
+  description = "Path to the base qcow2 image"
   type        = string
+  default     = "/home/renich/VirtualMachines/cs10.qcow2"
 }
 
 variable "guest_memory" {

opentofu/xslt/ide-to-sata.xslt

@@ -1,21 +0,0 @@
-<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
-  <xsl:output omit-xml-declaration="yes" indent="yes"/>
-  <xsl:strip-space elements="*"/>
-
-  <xsl:template match="node()|@*">
-    <xsl:copy>
-      <xsl:apply-templates select="node()|@*"/>
-    </xsl:copy>
-  </xsl:template>
-
-  <xsl:template match="disk[serial='cloudinit']">
-    <xsl:copy>
-      <xsl:apply-templates select="@*"/>
-      <xsl:copy-of select="driver"/>
-      <source file="{source/@file}"/>
-      <target dev="sda" bus="sata"/>
-      <xsl:copy-of select="readonly"/>
-      <address type="drive" controller="0" bus="0" target="0" unit="0"/>
-    </xsl:copy>
-  </xsl:template>
-</xsl:stylesheet>

roles/common/tasks/main.yaml

@@ -85,10 +85,25 @@
   ansible.builtin.shell:
     cmd: "gpg --armor --export 'Koji Signing Key' > {{ koji_pki_dir }}/gpg_key.pub"
     creates: "{{ koji_pki_dir }}/gpg_key.pub"
-    changed_when: false
   delegate_to: localhost
   run_once: true
 
+- name: Set hostname
+  ansible.builtin.hostname:
+    name: "{{ inventory_hostname }}"
+  when: inventory_hostname != 'localhost'
+
+- name: Enable persistent systemd journal
+  ansible.builtin.file:
+    path: /var/log/journal
+    state: directory
+    mode: "0755"
+  when: inventory_hostname != 'localhost'
+
+- name: Flush systemd journal to disk
+  ansible.builtin.command: journalctl --flush
+  when: inventory_hostname != 'localhost'
+
 - name: "Remove existing host keys"
   ansible.builtin.shell:
     cmd: "ssh-keygen -R {{ item }}"

roles/koji-hub/tasks/main.yaml

@@ -2,18 +2,18 @@
 - name: Install Koji Hub, Web, httpd, and crypto packages
   ansible.builtin.dnf:
     name:
-      - httpd
       - koji-hub
       - koji-web
+      - httpd
       - mod_ssl
       - mod_wsgi
-      - nmap-ncat
-      - policycoreutils-python-utils
-      - postgresql
       - python3-cryptography
-      - rpmdevtools
+      - nmap-ncat
-      - rpmlint
+      - postgresql
-      - koji-hub-plugins
+      - policycoreutils-python-utils
+      - koji-utils
+      - createrepo_c
+      - tree
     state: present
 
 - name: Create directories for certs and client configs
@@ -175,6 +175,12 @@
   loop: ["http", "https"]
   notify: Reload firewalld
 
+- name: Set SELinux context for Koji topdir
+  ansible.builtin.command: semanage fcontext -a -t httpd_sys_rw_content_t "/mnt/koji(/.*)?"
+
+- name: Apply SELinux context
+  ansible.builtin.command: restorecon -r -v /mnt/koji
+
 - name: Add database host to /etc/hosts
   ansible.builtin.lineinfile:
     path: /etc/hosts
@@ -182,6 +188,13 @@
     regexp: ".*{{ koji_db_host }}"
     state: present
 
+- name: Add hub host to /etc/hosts
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    line: "{{ ansible_default_ipv4.address }} {{ koji_hub_fqdn }}"
+    regexp: ".*{{ koji_hub_fqdn }}"
+    state: present
+
 - name: Wait for database to be available
   ansible.builtin.wait_for:
     host: "{{ koji_db_host }}"

roles/koji-hub/templates/koji_bootstrap.sh.j2

@@ -16,6 +16,8 @@ $KOJI_CMD add-tag --parent "{{ koji_build_tag }}" --arches "x86_64" "{{ koji_bui
 $KOJI_CMD add-target "{{ koji_build_tag }}-build" "{{ koji_build_tag }}-build" || echo "Target {{ koji_build_tag }}-build already exists"
 
 # External Repos
+$KOJI_CMD remove-external-repo "centos-stream-10-baseos" || echo "External repo centos-stream-10-baseos not found"
+$KOJI_CMD remove-external-repo "centos-stream-10-appstream" || echo "External repo centos-stream-10-appstream not found"
 $KOJI_CMD add-external-repo -t "{{ koji_build_tag }}-build" "centos-stream-10-baseos" "http://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/" || echo "External repo centos-stream-10-baseos already exists"
 $KOJI_CMD add-external-repo -t "{{ koji_build_tag }}-build" "centos-stream-10-appstream" "http://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/" || echo "External repo centos-stream-10-appstream already exists"
 

roles/kojid/tasks/main.yaml

@@ -7,13 +7,12 @@
       - rpm-build
       - rpmdevtools
       - mock
-      - centos-stream-repos
+      - policycoreutils-python-utils
-      - koji-builder-plugins
     state: present
 
 - name: Create kojid work directory
   ansible.builtin.file:
-    path: "{{ kojid_work_dir }}"
+    path: /var/lib/kojid
     state: directory
     owner: root
     group: root
@@ -67,10 +66,9 @@
     - {src: "kojid.key", dest: "{{ kojid_key_path }}", mode: "0600"}
 
 - name: "Concatenate certificate and key into a PEM file"
-  ansible.builtin.copy:
+  ansible.builtin.shell: cat "{{ kojid_crt_path }}" "{{ kojid_key_path }}" > "{{ kojid_pem_path }}"
-    content: "{{ lookup('file', kojid_crt_path) }}\n{{ lookup('file', kojid_key_path) }}"
+  args:
-    dest: "{{ kojid_pem_path }}"
+    creates: "{{ kojid_pem_path }}"
-    mode: "0600"
 
 - name: Set ownership and permissions on kojid.pem
   ansible.builtin.file:
@@ -79,6 +77,13 @@
     group: root
     mode: "0600"
 
+- name: Add hub host to /etc/hosts
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    line: "{{ hostvars[groups['kojihub'][0]].ansible_default_ipv4.address }} {{ koji_hub_fqdn }}"
+    regexp: ".*{{ koji_hub_fqdn }}"
+    state: present
+
 - name: Update CA trust
   ansible.builtin.command: update-ca-trust
 

roles/kojid/templates/site-defaults.cfg.j2

@@ -1,4 +1,5 @@
 config_opts['releasever'] = '10'
+config_opts['rpmbuild_networking'] = True
 config_opts['yum.conf'] = """
 [main]
 gpgcheck=1
@@ -10,17 +11,17 @@ strict=1
 
 [baseos]
 name=CentOS Stream 10 - BaseOS
-baseurl=http://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/
+baseurl=https://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/
 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
 
 [appstream]
 name=CentOS Stream 10 - AppStream
-baseurl=http://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/
+baseurl=https://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/
 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
 
 [crb]
 name=CentOS Stream 10 - CRB
-baseurl=http://mirror.stream.centos.org/10-stream/CRB/x86_64/os/
+baseurl=https://mirror.stream.centos.org/10-stream/CRB/x86_64/os/
 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
 enabled=1
 """

roles/kojira/tasks/main.yaml

@@ -26,9 +26,13 @@
     - { src: "kojira.key", dest: "/etc/pki/koji/kojira.key", mode: "0600" }
 
 - name: "Concatenate certificate and key into a PEM file"
-  ansible.builtin.copy:
+  ansible.builtin.shell: cat /etc/pki/koji/kojira.crt /etc/pki/koji/kojira.key > /etc/pki/koji/kojira.pem
-    content: "{{ lookup('file', '/etc/pki/koji/kojira.crt') }}\n{{ lookup('file', '/etc/pki/koji/kojira.key') }}"
+  args:
-    dest: "/etc/pki/koji/kojira.pem"
+    creates: /etc/pki/koji/kojira.pem
+
+- name: Set permissions on kojira PEM file
+  ansible.builtin.file:
+    path: /etc/pki/koji/kojira.pem
     mode: "0600"
 
 - name: Start and enable kojira service

roles/nfs-client/tasks/main.yaml

@@ -25,3 +25,12 @@
     fstype: nfs
     opts: "rw,sync"
     state: mounted
+
+- name: Set SELinux context for Koji NFS mount
+  ansible.builtin.command: semanage fcontext -a -t httpd_sys_rw_content_t "{{ koji_top_dir }}(/.*)?"
+
+- name: Apply SELinux context
+  ansible.builtin.command: restorecon -r -v "{{ koji_top_dir }}"
+
+- name: Flush systemd journal to disk
+  ansible.builtin.command: journalctl --flush

roles/postgresql/tasks/main.yaml

@@ -91,6 +91,7 @@
     address: "{{ hostvars[groups['kojihub'][0]].ansible_default_ipv6.address }}/128"
     method: scram-sha-256
     backup: true
+  when: hostvars[groups['kojihub'][0]].ansible_default_ipv6.address is defined
   notify: Restart postgresql
 
 - name: Configure pg_hba.conf for local postgres user trust authentication

vars/default.yaml

@@ -15,7 +15,7 @@ sigul_server: http://localhost:8080/sigul
 # Paths & Directories
 koji_top_dir: /mnt/koji
 koji_pki_dir: "{{ playbook_dir }}/certs"
-kojid_work_dir: /mnt/koji/work
+kojid_work_dir: /var/lib/kojid
 koji_remote_pki_dir: /etc/pki/koji
 koji_hub_config_dir: /etc/koji-hub/hub.conf.d
 koji_web_config_dir: /etc/kojiweb