Secure Koji setup: add koji user, fix NFS/SELinux, use CentOS Stream 10 repos
This commit is contained in:
parent
8b9fd80a0d
commit
1f301725db
GPG key ID:
AB2A9F49384FE324
21 changed files with 654 additions and 129 deletions
29
README.rst
29
README.rst
|
|
@ -122,6 +122,35 @@ Para interactuar con Koji como el usuario `kojiadmin` desde el Koji Hub, normalm
|
|||
.. note::
|
||||
Koji Hub es `cs10-koji-00.mx-os`.
|
||||
|
||||
Uso del Entorno Desplegado
|
||||
--------------------------
|
||||
|
||||
Una vez desplegado el entorno de Koji, puedes interactuar con él de las siguientes maneras:
|
||||
|
||||
* **Interfaz Web**: Visita https://cs10-koji-00.mx-os/koji en tu navegador para acceder a la interfaz web de Koji. Aquí puedes ver compilaciones, tareas, paquetes, etc.
|
||||
|
||||
* **Monitorear una Compilación**: Usa el comando `koji taskinfo <task_id>` para ver el estado de una tarea específica. También puedes usar la interfaz web.
|
||||
|
||||
* **Hacer una Compilación**: Para compilar un paquete, usa `koji build <tag> <fuente>`. Por ejemplo:
|
||||
|
||||
.. code-block:: bash
|
||||
|
||||
koji build mxos0-build git+https://git.mx-os.mx/RPMs/osci-internal-test-package#5test
|
||||
|
||||
O desde un SRPM local:
|
||||
|
||||
.. code-block:: bash
|
||||
|
||||
koji build mxos0-build /path/to/package.src.rpm
|
||||
|
||||
* **Listar Tareas**: `koji list-tasks` para ver tareas activas.
|
||||
|
||||
* **Listar Etiquetas**: `koji list-tags` para ver etiquetas disponibles.
|
||||
|
||||
* **Ver Información de un Paquete**: `koji info <package>`.
|
||||
|
||||
Para más comandos, consulta la documentación de Koji en https://docs.pagure.org/koji/.
|
||||
|
||||
Firma de paquetes
|
||||
=================
|
||||
Este playbook configura Koji Hub para la firma automatizada de RPM a través de un servidor Sigul externo. Para fines de prueba,
|
||||
|
|
|
|||
38
bin/koji-rpms-test.bash
Executable file
38
bin/koji-rpms-test.bash
Executable file
|
|
@ -0,0 +1,38 @@
|
|||
#!/bin/bash
|
||||
|
||||
# Test Koji RPM build process
|
||||
# Run from project root: ./bin/koji-rpms-test.bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# Colors
|
||||
green='\033[0;32m'
|
||||
red='\033[0;31m'
|
||||
nc='\033[0m'
|
||||
|
||||
ok() { echo -e "${green}[ OK ]${nc} $1"; }
|
||||
fail() { echo -e "${red}[ FAIL ]${red} $1"; exit 1; }
|
||||
|
||||
hub="cs10-koji-00.mx-os"
|
||||
tag="mxos0-build"
|
||||
|
||||
echo "## Starting Koji build from git..."
|
||||
echo "Building osci-internal-test-package (a simple test package for Koji) from https://git.mx-os.mx/RPMs/osci-internal-test-package#5test"
|
||||
build_output=$(ssh root@"$hub" "su - kojiadmin -c 'koji build $tag git+https://git.mx-os.mx/RPMs/osci-internal-test-package#5test'" 2>&1)
|
||||
if echo "$build_output" | grep -q "Created task:"; then
|
||||
task_id=$(echo "$build_output" | grep "Created task:" | sed 's/.*Created task: \([0-9]*\).*/\1/')
|
||||
ok "Build started, task ID: $task_id"
|
||||
else
|
||||
fail "Failed to start build: $build_output"
|
||||
fi
|
||||
|
||||
echo "## Checking build task..."
|
||||
task_info=$(ssh root@"$hub" "su - kojiadmin -c 'koji taskinfo $task_id'" 2>/dev/null)
|
||||
if echo "$task_info" | grep -q "State: free\|State: open\|State: closed"; then
|
||||
ok "Build task is active (started successfully)"
|
||||
else
|
||||
fail "Build task not found or failed to start"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Koji RPM build test passed!"
|
||||
93
bin/koji-servers.bash
Executable file
93
bin/koji-servers.bash
Executable file
|
|
@ -0,0 +1,93 @@
|
|||
#!/usr/bin/bash
|
||||
# Script to create/destroy 4 CentOS Stream 10 Koji development servers
|
||||
# Usage: ./koji-servers.bash create|destroy
|
||||
|
||||
set -e
|
||||
|
||||
BASE_VM="cs10"
|
||||
SERVERS=("cs10-koji-00.mx-os" "cs10-koji-01.mx-os" "cs10-koji-02.mx-os" "cs10-koji-03.mx-os")
|
||||
POOL_PATH="/var/lib/libvirt/images/fast"
|
||||
SSH_KEYS=(
|
||||
"root:file:$HOME/.ssh/id_ed25519.pub"
|
||||
"renich:file:$HOME/.ssh/id_ed25519.pub"
|
||||
"alex:file:$HOME/Clients/xpc/ssh/alex.pub"
|
||||
"guillermo:file:$HOME/Clients/xpc/ssh/guillermo.pub"
|
||||
)
|
||||
|
||||
|
||||
|
||||
create_servers() {
|
||||
echo "Creating 4 Koji development servers..."
|
||||
for SERVER in "${SERVERS[@]}"; do
|
||||
if virsh -c qemu:///system dominfo "$SERVER" &>/dev/null; then
|
||||
echo "VM $SERVER already exists, skipping."
|
||||
continue
|
||||
fi
|
||||
|
||||
DISK_PATH="$POOL_PATH/${SERVER}.qcow2"
|
||||
rm -f "$DISK_PATH"
|
||||
echo "Cloning $SERVER..."
|
||||
if ! virt-clone --connect=qemu:///system --original "$BASE_VM" --name "$SERVER" --file "$DISK_PATH"; then
|
||||
echo "Cloning failed for $SERVER, skipping."
|
||||
continue
|
||||
fi
|
||||
done
|
||||
|
||||
for SERVER in "${SERVERS[@]}"; do
|
||||
(
|
||||
DISK_PATH="$POOL_PATH/${SERVER}.qcow2"
|
||||
echo "Resizing disk for $SERVER..."
|
||||
if ! qemu-img create -f qcow2 "${DISK_PATH}.new" 100G; then
|
||||
echo "qemu-img create failed for $SERVER, skipping resize."
|
||||
elif ! virt-resize --expand /dev/sda4 "$DISK_PATH" "${DISK_PATH}.new"; then
|
||||
echo "virt-resize failed for $SERVER, skipping."
|
||||
rm -f "${DISK_PATH}.new"
|
||||
else
|
||||
if mv "${DISK_PATH}.new" "$DISK_PATH"; then
|
||||
echo "Resize completed for $SERVER."
|
||||
else
|
||||
echo "mv failed for $SERVER."
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "Starting $SERVER..."
|
||||
if virsh -c qemu:///system start "$SERVER"; then
|
||||
echo "$SERVER started successfully."
|
||||
else
|
||||
echo "Failed to start $SERVER."
|
||||
fi
|
||||
) &
|
||||
done
|
||||
wait
|
||||
echo "All servers created and started."
|
||||
}
|
||||
|
||||
destroy_servers() {
|
||||
echo "Destroying 4 Koji development servers..."
|
||||
for SERVER in "${SERVERS[@]}"; do
|
||||
(
|
||||
if virsh -c qemu:///system dominfo "$SERVER" &>/dev/null; then
|
||||
echo "Destroying $SERVER..."
|
||||
virsh -c qemu:///system destroy "$SERVER" || true
|
||||
virsh -c qemu:///system undefine "$SERVER" --nvram --tpm --remove-all-storage || true
|
||||
else
|
||||
echo "VM $SERVER does not exist, skipping."
|
||||
fi
|
||||
) &
|
||||
done
|
||||
wait
|
||||
echo "All servers destroyed."
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
create)
|
||||
create_servers
|
||||
;;
|
||||
destroy)
|
||||
destroy_servers
|
||||
;;
|
||||
*)
|
||||
echo "Usage: $0 {create|destroy}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
104
bin/koji-test.bash
Executable file
104
bin/koji-test.bash
Executable file
|
|
@ -0,0 +1,104 @@
|
|||
#!/bin/bash
|
||||
|
||||
# Test script for Koji dev environment
|
||||
# Run from project root: ./bin/koji-test.bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# Colors
|
||||
green='\033[0;32m'
|
||||
red='\033[0;31m'
|
||||
nc='\033[0m'
|
||||
|
||||
ok() { echo -e "${green}[ OK ]${nc} $1"; }
|
||||
fail() { echo -e "${red}[ FAIL ]${nc} $1"; exit 1; }
|
||||
|
||||
# Hosts
|
||||
hub="cs10-koji-00.mx-os"
|
||||
db="cs10-koji-01.mx-os"
|
||||
nfs="cs10-koji-02.mx-os"
|
||||
builder="cs10-koji-03.mx-os"
|
||||
|
||||
echo "## Checking VMs are running..."
|
||||
for vm in "$hub" "$db" "$nfs" "$builder"; do
|
||||
if virsh -c qemu:///system dominfo "$vm" &>/dev/null; then
|
||||
ok "VM $vm is running"
|
||||
else
|
||||
fail "VM $vm is not running"
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "## Pinging hosts..."
|
||||
for host in "$hub" "$db" "$nfs" "$builder"; do
|
||||
if ping -c 1 "$host" &>/dev/null; then
|
||||
ok "Host $host is reachable"
|
||||
else
|
||||
fail "Host $host is not reachable"
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "## Checking SSH connectivity..."
|
||||
for host in "$hub" "$db" "$nfs" "$builder"; do
|
||||
if ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no root@"$host" "echo 'SSH OK'" &>/dev/null; then
|
||||
ok "SSH to $host works"
|
||||
else
|
||||
fail "SSH to $host failed"
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "## Checking services..."
|
||||
# Hub: httpd, kojira
|
||||
if ssh root@"$hub" "systemctl is-active httpd" &>/dev/null; then
|
||||
ok "httpd on hub is active"
|
||||
else
|
||||
fail "httpd on hub is not active"
|
||||
fi
|
||||
|
||||
if ssh root@"$hub" "systemctl is-active kojira" &>/dev/null; then
|
||||
ok "kojira on hub is active"
|
||||
else
|
||||
fail "kojira on hub is not active"
|
||||
fi
|
||||
|
||||
# DB: postgresql
|
||||
if ssh root@"$db" "systemctl is-active postgresql" &>/dev/null; then
|
||||
ok "postgresql on db is active"
|
||||
else
|
||||
fail "postgresql on db is not active"
|
||||
fi
|
||||
|
||||
# NFS: nfs-server
|
||||
if ssh root@"$nfs" "systemctl is-active nfs-server" &>/dev/null; then
|
||||
ok "nfs-server on nfs is active"
|
||||
else
|
||||
fail "nfs-server on nfs is not active"
|
||||
fi
|
||||
|
||||
# Builder: kojid
|
||||
if ssh root@"$builder" "systemctl is-active kojid" &>/dev/null; then
|
||||
ok "kojid on builder is active"
|
||||
else
|
||||
fail "kojid on builder is not active"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "## Testing Koji connectivity..."
|
||||
if ssh root@"$hub" "su - kojiadmin -c 'koji moshimoshi'" &>/dev/null; then
|
||||
ok "Koji 'moshimoshi' command works"
|
||||
else
|
||||
fail "Koji 'moshimoshi' command failed"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "## Checking Koji web interface..."
|
||||
if curl -k -s -L "https://$hub/koji" | grep -q "Koji"; then
|
||||
ok "Koji web interface is accessible"
|
||||
else
|
||||
fail "Koji web interface is not accessible"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Koji dev environment test passed!"
|
||||
|
|
@ -136,13 +136,6 @@ Fase 5: Configuración de Kojid (Constructor) y Kojira (Administrador de Repos)
|
|||
|
||||
Estos componentes manejan los procesos de compilación reales y la gestión de repositorios.
|
||||
|
||||
#. Configura Kojid (en cada host constructor):
|
||||
|
||||
* Instala `koji-builder`, `rpm-build`, `rpmdevtools` y `mock`.
|
||||
* Edita `/etc/kojid/kojid.conf` para que apunte a la URL del servidor XML-RPC de Koji Hub.
|
||||
* Especifica el certificado de cliente del componente `kojid` y el certificado de la CA de Koji.
|
||||
* Agrega los usuarios que necesitan compilar paquetes (p. ej., `kojiadmin`) al grupo `mock`.
|
||||
|
||||
#. Configura Kojira (en el hub o en un host dedicado):
|
||||
|
||||
* Instala `koji-utils`.
|
||||
1
docs/koji
Submodule
1
docs/koji
Submodule
|
|
@ -0,0 +1 @@
|
|||
Subproject commit 0db0d21d8ae52df10884af7b3ede5de052a92739000000000000000000000000
|
||||
|
|
@ -1,85 +1,140 @@
|
|||
resource "libvirt_volume" "cs10-base-system" {
|
||||
resource "libvirt_volume" "cs10-base" {
|
||||
count = var.guest_count
|
||||
name = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}-system.qcow2"
|
||||
base_volume_id = libvirt_volume.cs10-base.id
|
||||
pool = var.pool_name
|
||||
size = var.disk_size
|
||||
format = "qcow2"
|
||||
create = {
|
||||
content = {
|
||||
url = "file://${var.base_image_path}"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "libvirt_cloudinit_disk" "cs10-cloudinit" {
|
||||
count = var.guest_count
|
||||
name = "${var.guest_base_name}-${format("%02d", count.index)}-cloudinit.iso"
|
||||
|
||||
user_data = templatefile("templates/cloudinit.cfg.tftpl", {
|
||||
root_password = var.root_password
|
||||
hostname = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
|
||||
})
|
||||
|
||||
meta_data = yamlencode({
|
||||
instance-id = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
|
||||
local-hostname = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
|
||||
})
|
||||
}
|
||||
|
||||
resource "libvirt_domain" "cs10-base" {
|
||||
count = var.guest_count
|
||||
name = "${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}"
|
||||
memory = var.guest_memory
|
||||
unit = "MiB"
|
||||
vcpu = var.guest_vcpu
|
||||
qemu_agent = true
|
||||
running = true
|
||||
autostart = true
|
||||
firmware = "/usr/share/edk2/ovmf/OVMF_CODE_4M.qcow2"
|
||||
type = "kvm"
|
||||
|
||||
cpu {
|
||||
os = {
|
||||
type = "hvm"
|
||||
arch = "x86_64"
|
||||
machine = "q35"
|
||||
firmware = "efi"
|
||||
loader_path = "/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2"
|
||||
loader_readonly = true
|
||||
loader_secure = true
|
||||
loader_type = "pflash"
|
||||
nvram = {
|
||||
path = "/var/lib/libvirt/qemu/nvram/${var.guest_base_name}-${format("%02d", count.index)}.${var.domain}_VARS.qcow2"
|
||||
template = "/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2"
|
||||
format = "qcow2"
|
||||
}
|
||||
boot_devices = ["hd"]
|
||||
}
|
||||
|
||||
cpu = {
|
||||
mode = "host-passthrough"
|
||||
}
|
||||
|
||||
cloudinit = libvirt_cloudinit_disk.cs10-cloudinit.id
|
||||
|
||||
network_interface {
|
||||
network_name = "default"
|
||||
wait_for_lease = true
|
||||
features = {
|
||||
acpi = true
|
||||
apic = true
|
||||
}
|
||||
|
||||
disk {
|
||||
volume_id = libvirt_volume.cs10-base-system[count.index].id
|
||||
devices = {
|
||||
disks = [
|
||||
{
|
||||
source = {
|
||||
file = libvirt_volume.cs10-base[count.index].path
|
||||
}
|
||||
target = { dev = "vda" }
|
||||
bus = "virtio"
|
||||
},
|
||||
{
|
||||
source = {
|
||||
file = libvirt_cloudinit_disk.cs10-cloudinit[count.index].path
|
||||
}
|
||||
target = { dev = "sda" }
|
||||
bus = "sata"
|
||||
readonly = true
|
||||
}
|
||||
]
|
||||
|
||||
console {
|
||||
interfaces = [
|
||||
{
|
||||
type = "network"
|
||||
model = "virtio"
|
||||
source = {
|
||||
network = "default"
|
||||
}
|
||||
}
|
||||
]
|
||||
|
||||
consoles = [
|
||||
{
|
||||
type = "pty"
|
||||
target_type = "serial"
|
||||
target_port = "0"
|
||||
}
|
||||
|
||||
console {
|
||||
},
|
||||
{
|
||||
type = "pty"
|
||||
target_type = "virtio"
|
||||
target_port = "1"
|
||||
}
|
||||
|
||||
graphics {
|
||||
type = "spice"
|
||||
listen_type = "address"
|
||||
autoport = true
|
||||
}
|
||||
|
||||
video {
|
||||
type = "virtio"
|
||||
}
|
||||
|
||||
provisioner "file" {
|
||||
source = "scripts"
|
||||
destination = "/tmp"
|
||||
|
||||
connection {
|
||||
type = "ssh"
|
||||
host = self.name
|
||||
timeout = "1m"
|
||||
}
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"bash /tmp/scripts/set-hostname.bash ${self.name}",
|
||||
"bash /tmp/scripts/dnf-fastest_mirrors.bash",
|
||||
"bash /tmp/scripts/install-tools.bash",
|
||||
"bash /tmp/scripts/upgrade.bash"
|
||||
]
|
||||
|
||||
connection {
|
||||
type = "ssh"
|
||||
user = "root"
|
||||
host = self.name
|
||||
timeout = "5m"
|
||||
rngs = [
|
||||
{
|
||||
model = "virtio"
|
||||
device = "/dev/urandom"
|
||||
}
|
||||
]
|
||||
|
||||
serials = [
|
||||
{
|
||||
type = "pty"
|
||||
target_port = "0"
|
||||
target_type = "isa-serial"
|
||||
}
|
||||
]
|
||||
|
||||
tpms = [
|
||||
{
|
||||
model = "tpm-crb"
|
||||
backend_type = "emulator"
|
||||
backend_version = "2.0"
|
||||
}
|
||||
]
|
||||
|
||||
graphics = {
|
||||
spice = {
|
||||
autoport = "yes"
|
||||
listen = "127.0.0.1"
|
||||
}
|
||||
}
|
||||
|
||||
xml {
|
||||
xslt = file("xslt/ide-to-sata.xslt")
|
||||
video = {
|
||||
type = "virtio"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
190
opentofu/cs10.xml
Normal file
190
opentofu/cs10.xml
Normal file
|
|
@ -0,0 +1,190 @@
|
|||
<domain type='kvm'>
|
||||
<name>cs10</name>
|
||||
<uuid>dd0ce3f5-a2c0-4bc9-8b1f-e92edeaf196d</uuid>
|
||||
<metadata>
|
||||
<libosinfo:libosinfo xmlns:libosinfo="http://libosinfo.org/xmlns/libvirt/domain/1.0">
|
||||
<libosinfo:os id="http://centos.org/centos-stream/10"/>
|
||||
</libosinfo:libosinfo>
|
||||
</metadata>
|
||||
<memory unit='KiB'>8388608</memory>
|
||||
<currentMemory unit='KiB'>8388608</currentMemory>
|
||||
<vcpu placement='static'>4</vcpu>
|
||||
<os firmware='efi'>
|
||||
<type arch='x86_64' machine='pc-q35-10.1'>hvm</type>
|
||||
<firmware>
|
||||
<feature enabled='yes' name='enrolled-keys'/>
|
||||
<feature enabled='yes' name='secure-boot'/>
|
||||
</firmware>
|
||||
<loader readonly='yes' secure='yes' type='pflash' format='qcow2'>/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2</loader>
|
||||
<nvram template='/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2' templateFormat='qcow2' format='qcow2'>/var/lib/libvirt/qemu/nvram/cs10_VARS.qcow2</nvram>
|
||||
<boot dev='hd'/>
|
||||
</os>
|
||||
<features>
|
||||
<acpi/>
|
||||
<apic/>
|
||||
<vmport state='off'/>
|
||||
<smm state='on'/>
|
||||
</features>
|
||||
<cpu mode='host-passthrough' check='none' migratable='on'/>
|
||||
<clock offset='utc'>
|
||||
<timer name='rtc' tickpolicy='catchup'/>
|
||||
<timer name='pit' tickpolicy='delay'/>
|
||||
<timer name='hpet' present='no'/>
|
||||
</clock>
|
||||
<on_poweroff>destroy</on_poweroff>
|
||||
<on_reboot>restart</on_reboot>
|
||||
<on_crash>destroy</on_crash>
|
||||
<pm>
|
||||
<suspend-to-mem enabled='no'/>
|
||||
<suspend-to-disk enabled='no'/>
|
||||
</pm>
|
||||
<devices>
|
||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
||||
<disk type='file' device='disk'>
|
||||
<driver name='qemu' type='qcow2'/>
|
||||
<source file='/home/renich/VirtualMachines/cs10.qcow2'/>
|
||||
<target dev='vda' bus='virtio'/>
|
||||
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
|
||||
</disk>
|
||||
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
|
||||
<address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/>
|
||||
</controller>
|
||||
<controller type='pci' index='0' model='pcie-root'/>
|
||||
<controller type='pci' index='1' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='1' port='0x10'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
|
||||
</controller>
|
||||
<controller type='pci' index='2' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='2' port='0x11'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
|
||||
</controller>
|
||||
<controller type='pci' index='3' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='3' port='0x12'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
|
||||
</controller>
|
||||
<controller type='pci' index='4' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='4' port='0x13'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
|
||||
</controller>
|
||||
<controller type='pci' index='5' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='5' port='0x14'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
|
||||
</controller>
|
||||
<controller type='pci' index='6' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='6' port='0x15'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
|
||||
</controller>
|
||||
<controller type='pci' index='7' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='7' port='0x16'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
|
||||
</controller>
|
||||
<controller type='pci' index='8' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='8' port='0x17'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x7'/>
|
||||
</controller>
|
||||
<controller type='pci' index='9' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='9' port='0x18'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0' multifunction='on'/>
|
||||
</controller>
|
||||
<controller type='pci' index='10' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='10' port='0x19'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x1'/>
|
||||
</controller>
|
||||
<controller type='pci' index='11' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='11' port='0x1a'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x2'/>
|
||||
</controller>
|
||||
<controller type='pci' index='12' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='12' port='0x1b'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x3'/>
|
||||
</controller>
|
||||
<controller type='pci' index='13' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='13' port='0x1c'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x4'/>
|
||||
</controller>
|
||||
<controller type='pci' index='14' model='pcie-root-port'>
|
||||
<model name='pcie-root-port'/>
|
||||
<target chassis='14' port='0x1d'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x5'/>
|
||||
</controller>
|
||||
<controller type='sata' index='0'>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
|
||||
</controller>
|
||||
<controller type='virtio-serial' index='0'>
|
||||
<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
|
||||
</controller>
|
||||
<controller type='scsi' index='0' model='virtio-scsi'>
|
||||
<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
|
||||
</controller>
|
||||
<interface type='network'>
|
||||
<mac address='52:54:00:62:40:d9'/>
|
||||
<source network='default'/>
|
||||
<model type='virtio'/>
|
||||
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
|
||||
</interface>
|
||||
<serial type='pty'>
|
||||
<target type='isa-serial' port='0'>
|
||||
<model name='isa-serial'/>
|
||||
</target>
|
||||
</serial>
|
||||
<console type='pty'>
|
||||
<target type='serial' port='0'/>
|
||||
</console>
|
||||
<channel type='unix'>
|
||||
<target type='virtio' name='org.qemu.guest_agent.0'/>
|
||||
<address type='virtio-serial' controller='0' bus='0' port='1'/>
|
||||
</channel>
|
||||
<channel type='spicevmc'>
|
||||
<target type='virtio' name='com.redhat.spice.0'/>
|
||||
<address type='virtio-serial' controller='0' bus='0' port='2'/>
|
||||
</channel>
|
||||
<input type='tablet' bus='usb'>
|
||||
<address type='usb' bus='0' port='1'/>
|
||||
</input>
|
||||
<input type='mouse' bus='ps2'/>
|
||||
<input type='keyboard' bus='ps2'/>
|
||||
<tpm model='tpm-crb'>
|
||||
<backend type='emulator' version='2.0'/>
|
||||
</tpm>
|
||||
<graphics type='spice' autoport='yes'>
|
||||
<listen type='address'/>
|
||||
<image compression='off'/>
|
||||
</graphics>
|
||||
<sound model='ich9'>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x1b' function='0x0'/>
|
||||
</sound>
|
||||
<audio id='1' type='spice'/>
|
||||
<video>
|
||||
<model type='virtio' heads='1' primary='yes'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/>
|
||||
</video>
|
||||
<redirdev bus='usb' type='spicevmc'>
|
||||
<address type='usb' bus='0' port='2'/>
|
||||
</redirdev>
|
||||
<redirdev bus='usb' type='spicevmc'>
|
||||
<address type='usb' bus='0' port='3'/>
|
||||
</redirdev>
|
||||
<watchdog model='itco' action='reset'/>
|
||||
<memballoon model='virtio'>
|
||||
<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
|
||||
</memballoon>
|
||||
<rng model='virtio'>
|
||||
<backend model='random'>/dev/urandom</backend>
|
||||
<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
|
||||
</rng>
|
||||
</devices>
|
||||
</domain>
|
||||
|
||||
|
|
@ -10,18 +10,5 @@ provider "libvirt" {
|
|||
uri = "qemu:///system"
|
||||
}
|
||||
|
||||
resource "libvirt_cloudinit_disk" "cs10-cloudinit" {
|
||||
name = "cs10-cloudinit.iso"
|
||||
pool = var.pool_name
|
||||
user_data = templatefile("templates/cloudinit.cfg.tftpl", {
|
||||
root_password = var.root_password
|
||||
}
|
||||
)
|
||||
}
|
||||
|
||||
resource "libvirt_volume" "cs10-base" {
|
||||
name = "cs10-base.qcow2"
|
||||
pool = var.pool_name
|
||||
source = var.base_image_path
|
||||
format = "qcow2"
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
#cloud-config
|
||||
|
||||
instance_id: ${hostname}
|
||||
local_hostname: ${hostname}
|
||||
|
||||
# ssh
|
||||
disable_root: false
|
||||
allow_public_ssh_keys: true
|
||||
|
|
|
|||
|
|
@ -2,12 +2,14 @@ variable "root_password" {
|
|||
description = "Contraseña de root para las máquinas virtuales."
|
||||
type = string
|
||||
sensitive = true
|
||||
default = "Un pinche pass."
|
||||
}
|
||||
|
||||
variable "domain" {
|
||||
description = "Dominio de red para las máquinas virtuales."
|
||||
type = string
|
||||
sensitive = false
|
||||
default = "mx-os"
|
||||
}
|
||||
|
||||
variable "guest_count" {
|
||||
|
|
@ -19,12 +21,13 @@ variable "guest_count" {
|
|||
variable "guest_base_name" {
|
||||
description = "Nombre base para las máquinas virtuales invitadas."
|
||||
type = string
|
||||
default = "cs10-base"
|
||||
default = "cs10-koji"
|
||||
}
|
||||
|
||||
variable "base_image_path" {
|
||||
description = "Ruta al archivo de la imagen base de la máquina virtual."
|
||||
description = "Path to the base qcow2 image"
|
||||
type = string
|
||||
default = "/home/renich/VirtualMachines/cs10.qcow2"
|
||||
}
|
||||
|
||||
variable "guest_memory" {
|
||||
|
|
|
|||
|
|
@ -1,21 +0,0 @@
|
|||
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
|
||||
<xsl:output omit-xml-declaration="yes" indent="yes"/>
|
||||
<xsl:strip-space elements="*"/>
|
||||
|
||||
<xsl:template match="node()|@*">
|
||||
<xsl:copy>
|
||||
<xsl:apply-templates select="node()|@*"/>
|
||||
</xsl:copy>
|
||||
</xsl:template>
|
||||
|
||||
<xsl:template match="disk[serial='cloudinit']">
|
||||
<xsl:copy>
|
||||
<xsl:apply-templates select="@*"/>
|
||||
<xsl:copy-of select="driver"/>
|
||||
<source file="{source/@file}"/>
|
||||
<target dev="sda" bus="sata"/>
|
||||
<xsl:copy-of select="readonly"/>
|
||||
<address type="drive" controller="0" bus="0" target="0" unit="0"/>
|
||||
</xsl:copy>
|
||||
</xsl:template>
|
||||
</xsl:stylesheet>
|
||||
|
|
@ -85,10 +85,25 @@
|
|||
ansible.builtin.shell:
|
||||
cmd: "gpg --armor --export 'Koji Signing Key' > {{ koji_pki_dir }}/gpg_key.pub"
|
||||
creates: "{{ koji_pki_dir }}/gpg_key.pub"
|
||||
changed_when: false
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Set hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ inventory_hostname }}"
|
||||
when: inventory_hostname != 'localhost'
|
||||
|
||||
- name: Enable persistent systemd journal
|
||||
ansible.builtin.file:
|
||||
path: /var/log/journal
|
||||
state: directory
|
||||
mode: "0755"
|
||||
when: inventory_hostname != 'localhost'
|
||||
|
||||
- name: Flush systemd journal to disk
|
||||
ansible.builtin.command: journalctl --flush
|
||||
when: inventory_hostname != 'localhost'
|
||||
|
||||
- name: "Remove existing host keys"
|
||||
ansible.builtin.shell:
|
||||
cmd: "ssh-keygen -R {{ item }}"
|
||||
|
|
|
|||
|
|
@ -2,18 +2,18 @@
|
|||
- name: Install Koji Hub, Web, httpd, and crypto packages
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- httpd
|
||||
- koji-hub
|
||||
- koji-web
|
||||
- httpd
|
||||
- mod_ssl
|
||||
- mod_wsgi
|
||||
- nmap-ncat
|
||||
- policycoreutils-python-utils
|
||||
- postgresql
|
||||
- python3-cryptography
|
||||
- rpmdevtools
|
||||
- rpmlint
|
||||
- koji-hub-plugins
|
||||
- nmap-ncat
|
||||
- postgresql
|
||||
- policycoreutils-python-utils
|
||||
- koji-utils
|
||||
- createrepo_c
|
||||
- tree
|
||||
state: present
|
||||
|
||||
- name: Create directories for certs and client configs
|
||||
|
|
@ -175,6 +175,12 @@
|
|||
loop: ["http", "https"]
|
||||
notify: Reload firewalld
|
||||
|
||||
- name: Set SELinux context for Koji topdir
|
||||
ansible.builtin.command: semanage fcontext -a -t httpd_sys_rw_content_t "/mnt/koji(/.*)?"
|
||||
|
||||
- name: Apply SELinux context
|
||||
ansible.builtin.command: restorecon -r -v /mnt/koji
|
||||
|
||||
- name: Add database host to /etc/hosts
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/hosts
|
||||
|
|
@ -182,6 +188,13 @@
|
|||
regexp: ".*{{ koji_db_host }}"
|
||||
state: present
|
||||
|
||||
- name: Add hub host to /etc/hosts
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/hosts
|
||||
line: "{{ ansible_default_ipv4.address }} {{ koji_hub_fqdn }}"
|
||||
regexp: ".*{{ koji_hub_fqdn }}"
|
||||
state: present
|
||||
|
||||
- name: Wait for database to be available
|
||||
ansible.builtin.wait_for:
|
||||
host: "{{ koji_db_host }}"
|
||||
|
|
|
|||
|
|
@ -16,6 +16,8 @@ $KOJI_CMD add-tag --parent "{{ koji_build_tag }}" --arches "x86_64" "{{ koji_bui
|
|||
$KOJI_CMD add-target "{{ koji_build_tag }}-build" "{{ koji_build_tag }}-build" || echo "Target {{ koji_build_tag }}-build already exists"
|
||||
|
||||
# External Repos
|
||||
$KOJI_CMD remove-external-repo "centos-stream-10-baseos" || echo "External repo centos-stream-10-baseos not found"
|
||||
$KOJI_CMD remove-external-repo "centos-stream-10-appstream" || echo "External repo centos-stream-10-appstream not found"
|
||||
$KOJI_CMD add-external-repo -t "{{ koji_build_tag }}-build" "centos-stream-10-baseos" "http://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/" || echo "External repo centos-stream-10-baseos already exists"
|
||||
$KOJI_CMD add-external-repo -t "{{ koji_build_tag }}-build" "centos-stream-10-appstream" "http://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/" || echo "External repo centos-stream-10-appstream already exists"
|
||||
|
||||
|
|
|
|||
|
|
@ -7,13 +7,12 @@
|
|||
- rpm-build
|
||||
- rpmdevtools
|
||||
- mock
|
||||
- centos-stream-repos
|
||||
- koji-builder-plugins
|
||||
- policycoreutils-python-utils
|
||||
state: present
|
||||
|
||||
- name: Create kojid work directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ kojid_work_dir }}"
|
||||
path: /var/lib/kojid
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
|
|
@ -67,10 +66,9 @@
|
|||
- {src: "kojid.key", dest: "{{ kojid_key_path }}", mode: "0600"}
|
||||
|
||||
- name: "Concatenate certificate and key into a PEM file"
|
||||
ansible.builtin.copy:
|
||||
content: "{{ lookup('file', kojid_crt_path) }}\n{{ lookup('file', kojid_key_path) }}"
|
||||
dest: "{{ kojid_pem_path }}"
|
||||
mode: "0600"
|
||||
ansible.builtin.shell: cat "{{ kojid_crt_path }}" "{{ kojid_key_path }}" > "{{ kojid_pem_path }}"
|
||||
args:
|
||||
creates: "{{ kojid_pem_path }}"
|
||||
|
||||
- name: Set ownership and permissions on kojid.pem
|
||||
ansible.builtin.file:
|
||||
|
|
@ -79,6 +77,13 @@
|
|||
group: root
|
||||
mode: "0600"
|
||||
|
||||
- name: Add hub host to /etc/hosts
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/hosts
|
||||
line: "{{ hostvars[groups['kojihub'][0]].ansible_default_ipv4.address }} {{ koji_hub_fqdn }}"
|
||||
regexp: ".*{{ koji_hub_fqdn }}"
|
||||
state: present
|
||||
|
||||
- name: Update CA trust
|
||||
ansible.builtin.command: update-ca-trust
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
config_opts['releasever'] = '10'
|
||||
config_opts['rpmbuild_networking'] = True
|
||||
config_opts['yum.conf'] = """
|
||||
[main]
|
||||
gpgcheck=1
|
||||
|
|
@ -10,17 +11,17 @@ strict=1
|
|||
|
||||
[baseos]
|
||||
name=CentOS Stream 10 - BaseOS
|
||||
baseurl=http://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/
|
||||
baseurl=https://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
|
||||
|
||||
[appstream]
|
||||
name=CentOS Stream 10 - AppStream
|
||||
baseurl=http://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/
|
||||
baseurl=https://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
|
||||
|
||||
[crb]
|
||||
name=CentOS Stream 10 - CRB
|
||||
baseurl=http://mirror.stream.centos.org/10-stream/CRB/x86_64/os/
|
||||
baseurl=https://mirror.stream.centos.org/10-stream/CRB/x86_64/os/
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
|
||||
enabled=1
|
||||
"""
|
||||
|
|
|
|||
|
|
@ -26,9 +26,13 @@
|
|||
- { src: "kojira.key", dest: "/etc/pki/koji/kojira.key", mode: "0600" }
|
||||
|
||||
- name: "Concatenate certificate and key into a PEM file"
|
||||
ansible.builtin.copy:
|
||||
content: "{{ lookup('file', '/etc/pki/koji/kojira.crt') }}\n{{ lookup('file', '/etc/pki/koji/kojira.key') }}"
|
||||
dest: "/etc/pki/koji/kojira.pem"
|
||||
ansible.builtin.shell: cat /etc/pki/koji/kojira.crt /etc/pki/koji/kojira.key > /etc/pki/koji/kojira.pem
|
||||
args:
|
||||
creates: /etc/pki/koji/kojira.pem
|
||||
|
||||
- name: Set permissions on kojira PEM file
|
||||
ansible.builtin.file:
|
||||
path: /etc/pki/koji/kojira.pem
|
||||
mode: "0600"
|
||||
|
||||
- name: Start and enable kojira service
|
||||
|
|
|
|||
|
|
@ -25,3 +25,12 @@
|
|||
fstype: nfs
|
||||
opts: "rw,sync"
|
||||
state: mounted
|
||||
|
||||
- name: Set SELinux context for Koji NFS mount
|
||||
ansible.builtin.command: semanage fcontext -a -t httpd_sys_rw_content_t "{{ koji_top_dir }}(/.*)?"
|
||||
|
||||
- name: Apply SELinux context
|
||||
ansible.builtin.command: restorecon -r -v "{{ koji_top_dir }}"
|
||||
|
||||
- name: Flush systemd journal to disk
|
||||
ansible.builtin.command: journalctl --flush
|
||||
|
|
|
|||
|
|
@ -91,6 +91,7 @@
|
|||
address: "{{ hostvars[groups['kojihub'][0]].ansible_default_ipv6.address }}/128"
|
||||
method: scram-sha-256
|
||||
backup: true
|
||||
when: hostvars[groups['kojihub'][0]].ansible_default_ipv6.address is defined
|
||||
notify: Restart postgresql
|
||||
|
||||
- name: Configure pg_hba.conf for local postgres user trust authentication
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ sigul_server: http://localhost:8080/sigul
|
|||
# Paths & Directories
|
||||
koji_top_dir: /mnt/koji
|
||||
koji_pki_dir: "{{ playbook_dir }}/certs"
|
||||
kojid_work_dir: /mnt/koji/work
|
||||
kojid_work_dir: /var/lib/kojid
|
||||
koji_remote_pki_dir: /etc/pki/koji
|
||||
koji_hub_config_dir: /etc/koji-hub/hub.conf.d
|
||||
koji_web_config_dir: /etc/kojiweb
|
||||
|
|
|
|||
Loading…
Reference in a new issue