refactor(ansible): Estandariza nombres de roles y actualiza Koji

Se estandarizan los nombres de los directorios de roles, cambiando guiones por guiones bajos.

Se añaden nuevos scripts para limpieza y callbacks en Koji Hub. Además, se actualizan las configuraciones de Kojid, Kojira y PostgreSQL, incluyendo la instalación de paquetes, ajustes de mock y la gestión de variables.

roles/common/defaults/main.yaml

@@ -6,7 +6,7 @@
 
 # List of certificates to generate.
 # is_user: true will generate a .p12 file for browser import.
-koji_certs_to_generate:
+common_koji_certs_to_generate:
   - name: kojihub
     cn: "{{ koji_hub_fqdn }}" # Server certs must use the FQDN for the CN
     is_user: false

roles/common/tasks/generate_single_cert.yaml

@@ -18,6 +18,7 @@
 - name: Create temporary OpenSSL config for signing
   ansible.builtin.copy:
     dest: "{{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf"
+    mode: "0644"
     content: |
       [v3_ca]
       basicConstraints = CA:FALSE
@@ -30,11 +31,11 @@
       subjectAltName = @alt_names
       [alt_names]
       DNS.1 = {{ cert.cn }}
-      {% for san in cert.sans|default([]) %}
+      {% for san in cert.sans | default([]) %}
       DNS.{{ loop.index + 1 }} = {{ san }}
       {% endfor %}
 
-- name: "Sign certificate for {{ cert.name }} with our CA"
+- name: "Sign certificate with our CA"
   ansible.builtin.shell:
     cmd: >
       openssl x509 -req
@@ -55,8 +56,6 @@
     path: "{{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf"
     state: absent
 
-
-
 - name: "Generate PKCS12 bundle for user {{ cert.name }}"
   community.crypto.openssl_pkcs12:
     action: export
@@ -72,4 +71,4 @@
 - name: "Create PEM file for {{ cert.name }}"
   ansible.builtin.shell:
     cmd: "cat {{ koji_pki_dir }}/{{ cert.name }}.crt {{ koji_pki_dir }}/{{ cert.name }}.key > {{ koji_pki_dir }}/{{ cert.name }}.pem"
-    creates: "{{ koji_pki_dir }}/{{ cert.name }}.pem"
+    creates: "{{ koji_pki_dir }}/{{ cert.name }}.pem"

roles/common/tests/test.yaml

@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: MIT-0
 ---
-- hosts: localhost
+- name: Test common role
+  hosts: localhost
   remote_user: root
   roles:
-    - roles/common
+    - common

roles/common/vars/main.yaml

@@ -1,3 +1,3 @@
 ---
-common_ca_key_path: "{{ common_koji_pki_dir }}/{{ common_ca_name }}_cert.key"
-common_ca_cert_path: "{{ common_koji_pki_dir }}/{{ common_ca_name }}_cert.crt"
+common_ca_key_path: "{{ koji_pki_dir }}/{{ common_ca_name }}_cert.key"
+common_ca_cert_path: "{{ koji_pki_dir }}/{{ common_ca_name }}_cert.crt"

roles/koji-hub/defaults/main.yaml

@@ -1,9 +0,0 @@
----
-koji_hub_plugin_dir: /usr/lib/koji-hub/plugins
-koji_hub_config_dir: /etc/koji-hub/hub.conf.d
-koji_web_config_dir: /etc/kojiweb/
-httpd_ssl_config_file: /etc/httpd/conf.d/ssl.conf
-koji_hub_httpd_config_file: /etc/httpd/conf.d/kojihub.conf
-koji_client_config_file: /etc/koji.conf.d/main.conf
-admin_user_home: "/home/{{ koji_admin_user }}"
-admin_user_koji_dir: "{{ admin_user_home }}/.koji"

roles/koji-hub/meta/main.yaml

@@ -1,36 +0,0 @@
----
-#SPDX-License-Identifier: MIT-0
-galaxy_info:
-  author: your name
-  description: your role description
-  company: your company (optional)
-
-  # If the issue tracker for your role is not on github, uncomment the
-  # next line and provide a value
-  # issue_tracker_url: http://example.com/issue/tracker
-
-  # Choose a valid license ID from https://spdx.org - some suggested licenses:
-  # - BSD-3-Clause (default)
-  # - MIT
-  # - GPL-2.0-or-later
-  # - GPL-3.0-only
-  # - Apache-2.0
-  # - CC-BY-4.0
-  license: license (GPL-2.0-or-later, MIT, etc)
-
-  min_ansible_version: 2.1
-
-  # If this a Container Enabled role, provide the minimum Ansible Container version.
-  # min_ansible_container_version:
-
-  galaxy_tags: []
-    # List tags for your role here, one per line. A tag is a keyword that describes
-    # and categorizes the role. Users find roles by searching for tags. Be sure to
-    # remove the '[]' above, if you add tags to this list.
-    #
-    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
-    #       Maximum 20 tags per role.
-
-dependencies: []
-  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
-  # if you add dependencies to this list.

roles/koji-hub/templates/99-local-policies.conf.j2

@@ -1,2 +0,0 @@
-[hub-policy:admin]
-user = {{ koji_admin_user }}

roles/koji-hub/templates/koji_bootstrap.sh.j2

@@ -1,40 +0,0 @@
-#!/bin/bash
-set -e
-
-KOJI_CMD="sudo -u kojiadmin koji --config=/home/kojiadmin/.koji/config"
-
-# Clean up previous attempts to ensure a clean slate
-$KOJI_CMD remove-target "{{ koji_build_tag }}-build" || echo "Target {{ koji_build_tag }}-build did not exist"
-$KOJI_CMD remove-tag "{{ koji_build_tag }}-build" || echo "Tag {{ koji_build_tag }}-build did not exist"
-$KOJI_CMD remove-tag "{{ koji_build_tag }}" || echo "Tag {{ koji_build_tag }} did not exist"
-
-# Tags
-$KOJI_CMD add-tag "{{ koji_build_tag }}" || echo "Tag {{ koji_build_tag }} already exists"
-$KOJI_CMD add-tag --parent "{{ koji_build_tag }}" --arches "x86_64" "{{ koji_build_tag }}-build" || echo "Tag {{ koji_build_tag }}-build already exists"
-
-# Target
-$KOJI_CMD add-target "{{ koji_build_tag }}-build" "{{ koji_build_tag }}-build" || echo "Target {{ koji_build_tag }}-build already exists"
-
-# External Repos
-$KOJI_CMD remove-external-repo "centos-stream-10-baseos" || echo "External repo centos-stream-10-baseos not found"
-$KOJI_CMD remove-external-repo "centos-stream-10-appstream" || echo "External repo centos-stream-10-appstream not found"
-$KOJI_CMD add-external-repo -t "{{ koji_build_tag }}-build" "centos-stream-10-baseos" "http://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/" || echo "External repo centos-stream-10-baseos already exists"
-$KOJI_CMD add-external-repo -t "{{ koji_build_tag }}-build" "centos-stream-10-appstream" "http://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/" || echo "External repo centos-stream-10-appstream already exists"
-
-# Groups
-$KOJI_CMD add-group "{{ koji_build_tag }}-build" "build" || echo "Group build already exists"
-$KOJI_CMD add-group-pkg "{{ koji_build_tag }}-build" "build" "build-sys" || echo "Package build-sys already in group build"
-$KOJI_CMD add-group-pkg "{{ koji_build_tag }}-build" "build" "python3-dnf" || echo "Package python3-dnf already in group build"
-$KOJI_CMD add-group-pkg "{{ koji_build_tag }}-build" "build" "python3-dnf-plugins-core" || echo "Package python3-dnf-plugins-core already in group build"
-
-# Hosts
-{% for host in groups['kojibuilders'] %}
-$KOJI_CMD add-host "{{ host }}" x86_64 || echo "Host {{ host }} already exists"
-$KOJI_CMD add-host-to-channel "{{ host }}" createrepo || echo "Host {{ host }} already in channel createrepo"
-$KOJI_CMD edit-host --capacity={{ kojid_max_jobs }} "{{ host }}" || echo "Could not edit host {{ host }}"
-{% endfor %}
-
-# Repo
-$KOJI_CMD add-user kojira || echo "User kojira already exists"
-$KOJI_CMD grant-permission repo kojira || echo "Permission repo already granted to kojira"
-$KOJI_CMD regen-repo --nowait "{{ koji_build_tag }}-build"

roles/koji-hub/tests/test.yaml

@@ -1,6 +0,0 @@
-#SPDX-License-Identifier: MIT-0
----
-- hosts: localhost
-  remote_user: root
-  roles:
-    - roles/koji-hub

roles/koji-hub/vars/main.yaml

@@ -1,3 +0,0 @@
-#SPDX-License-Identifier: MIT-0
----
-# vars file for roles/koji-hub

roles/koji_bootstrap/tasks/main.yaml

@@ -0,0 +1,125 @@
+---
+- name: Add kojira user
+  ansible.builtin.command: "sudo -u {{ koji_admin_user }} koji --config={{ koji_hub_admin_user_koji_dir }}/config add-user kojira"
+  register: koji_bootstrap_add_user_result
+  changed_when: "'User added' in koji_bootstrap_add_user_result.stdout"
+  failed_when: "koji_bootstrap_add_user_result.rc != 0 and 'already exists' not in koji_bootstrap_add_user_result.stderr"
+
+- name: Grant repo permission to kojira user
+  ansible.builtin.command: >
+    sudo -u {{ koji_admin_user }} koji
+    --config={{ koji_hub_admin_user_koji_dir }}/config
+    grant-permission repo kojira
+  register: koji_bootstrap_grant_permission_result
+  changed_when: "'Permission granted' in koji_bootstrap_grant_permission_result.stdout"
+  failed_when: "koji_bootstrap_grant_permission_result.rc != 0 and 'already has permission' not in koji_bootstrap_grant_permission_result.stderr"
+
+- name: Create main build tag
+  ansible.builtin.command: >
+    sudo -u {{ koji_admin_user }} koji
+    --config={{ koji_hub_admin_user_koji_dir }}/config
+    add-tag --arches x86_64 {{ koji_build_tag }}
+  register: koji_bootstrap_add_tag_result
+  changed_when: "'Tag created' in koji_bootstrap_add_tag_result.stdout"
+  failed_when: "koji_bootstrap_add_tag_result.rc != 0 and 'already exists' not in koji_bootstrap_add_tag_result.stderr"
+
+- name: Create x86_64 build tag
+  ansible.builtin.command: >
+    sudo -u {{ koji_admin_user }} koji
+    --config={{ koji_hub_admin_user_koji_dir }}/config
+    add-tag --parent {{ koji_build_tag }} --arches x86_64 {{ koji_build_tag }}-build
+  register: koji_bootstrap_add_arch_tag_result
+  changed_when: "'Tag created' in koji_bootstrap_add_arch_tag_result.stdout"
+  failed_when: "koji_bootstrap_add_arch_tag_result.rc != 0 and 'already exists' not in koji_bootstrap_add_arch_tag_result.stderr"
+
+- name: Enable automatic build NVR bumping
+  ansible.builtin.command: >
+    sudo -u {{ koji_admin_user }} koji
+    --config={{ koji_hub_admin_user_koji_dir }}/config
+    edit-tag --extra autorelease=1 {{ koji_build_tag }}-build
+  register: koji_bootstrap_edit_tag_result
+  changed_when: "'Tag updated' in koji_bootstrap_edit_tag_result.stdout"
+  failed_when: "koji_bootstrap_edit_tag_result.rc != 0 and 'tag not found' not in koji_bootstrap_edit_tag_result.stderr"
+
+- name: Create build target
+  ansible.builtin.command: >
+    sudo -u {{ koji_admin_user }} koji
+    --config={{ koji_hub_admin_user_koji_dir }}/config
+    add-target {{ koji_build_tag }} {{ koji_build_tag }}-build
+  register: koji_bootstrap_add_target_result
+  changed_when: "'Target created' in koji_bootstrap_add_target_result.stdout"
+  failed_when: "koji_bootstrap_add_target_result.rc != 0 and 'already exists' not in koji_bootstrap_add_target_result.stderr"
+
+- name: Add CentOS Stream 10 BaseOS external repository
+  ansible.builtin.command: >
+    sudo -u {{ koji_admin_user }} koji
+    --config={{ koji_hub_admin_user_koji_dir }}/config
+    add-external-repo -t {{ koji_build_tag }}-build centos-stream-10-baseos
+    https://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/
+  register: koji_bootstrap_add_baseos_repo_result
+  changed_when: "'External repository created' in koji_bootstrap_add_baseos_repo_result.stdout"
+  failed_when: "koji_bootstrap_add_baseos_repo_result.rc != 0 and 'already exists' not in koji_bootstrap_add_baseos_repo_result.stderr"
+
+- name: Add CentOS Stream 10 AppStream external repository
+  ansible.builtin.command: >
+    sudo -u {{ koji_admin_user }} koji
+    --config={{ koji_hub_admin_user_koji_dir }}/config
+    add-external-repo -t {{ koji_build_tag }}-build centos-stream-10-appstream
+    https://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/
+  register: koji_bootstrap_add_appstream_repo_result
+  changed_when: "'External repository created' in koji_bootstrap_add_appstream_repo_result.stdout"
+  failed_when: "koji_bootstrap_add_appstream_repo_result.rc != 0 and 'already exists' not in koji_bootstrap_add_appstream_repo_result.stderr"
+
+- name: Add CentOS Stream 10 EPEL external repository
+  ansible.builtin.command: >
+    sudo -u {{ koji_admin_user }} koji
+    --config={{ koji_hub_admin_user_koji_dir }}/config
+    add-external-repo -t {{ koji_build_tag }}-build centos-stream-10-epel
+    https://mirror.facebook.net/fedora/epel/10/Everything/x86_64/
+  register: koji_bootstrap_add_appstream_repo_result
+  changed_when: "'External repository created' in koji_bootstrap_add_appstream_repo_result.stdout"
+  failed_when: "koji_bootstrap_add_appstream_repo_result.rc != 0 and 'already exists' not in koji_bootstrap_add_appstream_repo_result.stderr"
+
+- name: Add Koji builder hosts
+  ansible.builtin.command: >
+    sudo -u {{ koji_admin_user }} koji
+    --config={{ koji_hub_admin_user_koji_dir }}/config
+    add-host {{ item }} x86_64
+  loop: "{{ groups['kojibuilders'] }}"
+  register: koji_bootstrap_add_host_result
+  changed_when: "'Host added' in koji_bootstrap_add_host_result.stdout"
+  failed_when: "koji_bootstrap_add_host_result.rc != 0 and 'is already in the database' not in koji_bootstrap_add_host_result.stderr"
+
+- name: Add Koji builder hosts to createrepo channel
+  ansible.builtin.command: >
+    sudo -u {{ koji_admin_user }} koji
+    --config={{ koji_hub_admin_user_koji_dir }}/config
+    add-host-to-channel {{ item }} createrepo
+  loop: "{{ groups['kojibuilders'] }}"
+  register: koji_bootstrap_add_host_to_channel_result
+  changed_when: "'Host added to channel' in koji_bootstrap_add_host_to_channel_result.stdout"
+  failed_when: "koji_bootstrap_add_host_to_channel_result.rc != 0 and 'is already subscribed' not in koji_bootstrap_add_host_to_channel_result.stderr"
+
+- name: Set Koji builder host capacity
+  ansible.builtin.command: >
+    sudo -u {{ koji_admin_user }} koji
+    --config={{ koji_hub_admin_user_koji_dir }}/config
+    edit-host --capacity={{ kojid_max_jobs }} {{ item }}
+  loop: "{{ groups['kojibuilders'] }}"
+  changed_when: true
+
+- name: Regenerate repo
+  ansible.builtin.command: >
+    sudo -u {{ koji_admin_user }} koji
+    --config={{ koji_hub_admin_user_koji_dir }}/config
+    regen-repo {{ koji_build_tag }}
+  changed_when: false
+
+- name: Create builder user
+  ansible.builtin.command: >
+    sudo -u {{ koji_admin_user }} koji
+    --config={{ koji_hub_admin_user_koji_dir }}/config
+    add-user builder
+  register: koji_bootstrap_add_builder_user_result
+  changed_when: "'User added' in koji_bootstrap_add_builder_user_result.stdout"
+  failed_when: "koji_bootstrap_add_builder_user_result.rc != 0 and 'already exists' not in koji_bootstrap_add_builder_user_result.stderr"

roles/koji_hub/defaults/main.yaml

@@ -0,0 +1,7 @@
+---
+koji_hub_plugin_dir: /usr/lib/koji_hub/plugins
+koji_hub_config_dir: /etc/koji_hub/hub.conf.d
+koji_hub_koji_web_config_dir: /etc/kojiweb/
+koji_hub_httpd_ssl_config_file: /etc/httpd/conf.d/ssl.conf
+koji_hub_httpd_config_file: /etc/httpd/conf.d/kojihub.conf
+koji_hub_koji_client_config_file: /etc/koji.conf.d/main.conf

roles/koji_hub/files/koji-cleanup.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Koji Cleanup Service
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/koji_cleanup.sh

roles/koji_hub/files/koji-cleanup.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Run Koji Cleanup Service weekly
+
+[Timer]
+OnCalendar=weekly
+Persistent=true
+
+[Install]
+WantedBy=timers.target

roles/koji_hub/handlers/main.yaml

@@ -1,4 +1,4 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
 - name: Restart httpd
   ansible.builtin.service:

roles/koji_hub/meta/main.yaml

@@ -1,9 +1,9 @@
 ---
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 galaxy_info:
-  author: your name
-  description: your role description
-  company: your company (optional)
+  author: MxOS
+  description: Koji Hub role
+  company: MxOS
 
   # If the issue tracker for your role is not on github, uncomment the
   # next line and provide a value
@@ -16,9 +16,9 @@ galaxy_info:
   # - GPL-3.0-only
   # - Apache-2.0
   # - CC-BY-4.0
-  license: license (GPL-2.0-or-later, MIT, etc)
+  license: MIT
 
-  min_ansible_version: 2.1
+  min_ansible_version: "2.1"
 
   # If this a Container Enabled role, provide the minimum Ansible Container version.
   # min_ansible_container_version:

roles/koji_hub/tasks/main.yaml

@@ -32,9 +32,7 @@
     - "{{ koji_top_dir }}/scratch"
     - "{{ koji_top_dir }}/repos-dist"
 
-
-
-- name: Ensure admin user '{{ koji_admin_user }}' exists
+- name: Ensure admin user exists
   ansible.builtin.user:
     name: "{{ koji_admin_user }}"
     state: present
@@ -47,6 +45,8 @@
     append: true
     state: present
 
+# This is for demonstration purposes only. In a production environment,
+# it is recommended to configure sudo access with a more restrictive policy.
 - name: Ensure wheel group has NOPASSWD sudo access
   ansible.builtin.lineinfile:
     path: /etc/sudoers
@@ -57,20 +57,26 @@
 
 - name: Ensure .koji directory exists for '{{ koji_admin_user }}'
   ansible.builtin.file:
-    path: "{{ admin_user_koji_dir }}"
+    path: "{{ koji_hub_admin_user_koji_dir }}"
     state: directory
+    owner: "{{ koji_admin_user }}"
+    group: "{{ koji_admin_user }}"
     mode: "{{ koji_client_dir_mode }}"
 
 - name: Configure Koji client for admin user
   ansible.builtin.template:
     src: koji.conf.j2
-    dest: "{{ admin_user_koji_dir }}/config"
+    dest: "{{ koji_hub_admin_user_koji_dir }}/config"
+    owner: "{{ koji_admin_user }}"
+    group: "{{ koji_admin_user }}"
     mode: "{{ koji_client_file_mode }}"
 
 - name: Copy client certificates for '{{ koji_admin_user }}'
   ansible.builtin.copy:
     src: "{{ item.src }}"
-    dest: "{{ admin_user_koji_dir }}/{{ item.dest }}"
+    dest: "{{ koji_hub_admin_user_koji_dir }}/{{ item.dest }}"
+    owner: "{{ koji_admin_user }}"
+    group: "{{ koji_admin_user }}"
     mode: "{{ koji_client_file_mode }}"
   loop:
     - src: "{{ koji_pki_dir }}/kojiadmin.pem"
@@ -105,12 +111,23 @@
     - { src: "kojiadmin.pem", dest: "{{ koji_admin_cert_path }}", mode: "0644" }
 
 - name: Update CA trust store
-  ansible.builtin.shell: update-ca-trust
-  changed_when: true
+  ansible.builtin.command: update-ca-trust
+  changed_when: false
 
 - name: Flush handlers
   ansible.builtin.meta: flush_handlers
 
+- name: Create Koji Hub and Web config directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop:
+    - "{{ koji_hub_config_dir }}"
+    - "{{ koji_hub_koji_web_config_dir }}"
+
 - name: Configure httpd for Koji
   ansible.builtin.lineinfile:
     path: "{{ item.path }}"
@@ -118,9 +135,9 @@
     line: "{{ item.line }}"
     backup: true
   loop:
-    - { path: "{{ httpd_ssl_config_file }}", regexp: "^SSLCertificateFile", line: "SSLCertificateFile {{ koji_hub_cert_path }}" }
-    - { path: "{{ httpd_ssl_config_file }}", regexp: "^SSLCertificateKeyFile", line: "SSLCertificateKeyFile {{ koji_hub_key_path }}" }
-    - { path: "{{ httpd_ssl_config_file }}", regexp: "^#?SSLCACertificateFile", line: "SSLCACertificateFile {{ koji_remote_ca_trust_path }}" }
+    - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateFile", line: "SSLCertificateFile {{ koji_hub_cert_path }}" }
+    - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateKeyFile", line: "SSLCertificateKeyFile {{ koji_hub_key_path }}" }
+    - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLCACertificateFile", line: "SSLCACertificateFile {{ koji_remote_ca_trust_path }}" }
   notify: Restart httpd
 
 - name: Enable SSL for Koji Hub
@@ -145,11 +162,20 @@
     - { src: "00-main.conf.j2", dest: "{{ koji_hub_config_dir }}/00-main.conf" }
     - { src: "db.conf.j2", dest: "{{ koji_hub_config_dir }}/db.conf" }
     - { src: "admin.conf.j2", dest: "{{ koji_hub_config_dir }}/admin.conf" }
-    - { src: "web.conf.j2", dest: "{{ koji_web_config_dir }}/web.conf" }
+    - { src: "web.conf.j2", dest: "{{ koji_hub_koji_web_config_dir }}/web.conf" }
     - { src: "policies.conf.j2", dest: "{{ koji_hub_config_dir }}/policies.conf" }
     - { src: "99-local-policies.conf.j2", dest: "{{ koji_hub_config_dir }}/99-local-policies.conf" }
   notify: Restart httpd
 
+- name: Configure Koji Hub database connection
+  ansible.builtin.blockinfile:
+    path: /etc/koji-hub/hub.conf
+    block: |
+      DBHost = {{ koji_db_host }}
+      DBPass = {{ koji_db_password }}
+    marker: "# {mark} ANSIBLE MANAGED BLOCK FOR DB CONNECTION"
+  notify: Restart httpd
+
 - name: Set SELinux booleans for Apache
   ansible.posix.seboolean:
     name: "{{ item }}"
@@ -160,6 +186,7 @@
     - httpd_can_network_connect
     - allow_httpd_anon_write
     - httpd_use_nfs
+  notify: Restart httpd
 
 - name: Start and enable httpd
   ansible.builtin.service:
@@ -177,9 +204,11 @@
 
 - name: Set SELinux context for Koji topdir
   ansible.builtin.command: semanage fcontext -a -t httpd_sys_rw_content_t "/mnt/koji(/.*)?"
+  changed_when: false
 
 - name: Apply SELinux context
   ansible.builtin.command: restorecon -r -v /mnt/koji
+  changed_when: false
 
 - name: Add database host to /etc/hosts
   ansible.builtin.lineinfile:
@@ -201,30 +230,15 @@
     port: 5432
     timeout: 120
 
-- name: Check if Koji DB schema is loaded
-  ansible.builtin.shell:
-    cmd: psql -h {{ koji_db_host }} -U {{ koji_db_user }} -d {{ koji_db_name }} -c "SELECT 'users'::regclass;"
-  register: schema_check
-  failed_when: false
-  changed_when: false
-  environment:
-    PGPASSWORD: "{{ koji_db_password }}"
-
-- name: Load Koji DB Schema
-  ansible.builtin.shell:
-    cmd: psql -h {{ koji_db_host }} -U {{ koji_db_user }} -d {{ koji_db_name }} -f /usr/share/koji/schema.sql
-  when: schema_check.rc != 0
-  environment:
-    PGPASSWORD: "{{ koji_db_password }}"
-
 - name: Check if Koji DB schema is loaded
   community.postgresql.postgresql_query:
     login_db: "{{ koji_db_name }}"
-    query: "SELECT 'users'::regclass;"
+    query: "SELECT EXISTS (SELECT FROM information_schema.tables WHERE table_schema = 'public' AND table_name = 'users');"
     login_host: "{{ koji_db_host }}"
     login_user: "{{ koji_db_user }}"
     login_password: "{{ koji_db_password }}"
-  register: schema_check
+  register: koji_hub_schema_check
+  changed_when: false
 
 - name: Load Koji DB Schema
   community.postgresql.postgresql_script:
@@ -233,7 +247,7 @@
     login_host: "{{ koji_db_host }}"
     login_user: "{{ koji_db_user }}"
     login_password: "{{ koji_db_password }}"
-  when: schema_check.failed
+  when: not koji_hub_schema_check.query_result[0].exists
 
 - name: Create kojiadmin user in database
   community.postgresql.postgresql_query:
@@ -246,43 +260,64 @@
 - name: Configure Koji client via ansible-settings.conf
   ansible.builtin.template:
     src: koji.conf.j2
-    dest: "{{ koji_client_config_file }}"
+    dest: "{{ koji_hub_koji_client_config_file }}"
     group: apache
     mode: "0644"
 
 - name: Grant admin privileges to kojiadmin user
   community.postgresql.postgresql_query:
     login_db: "{{ koji_db_name }}"
-    query: "INSERT INTO user_perms (user_id, perm_id, creator_id) VALUES ((SELECT id FROM users WHERE name = '{{ koji_admin_user }}'), (SELECT id FROM permissions WHERE name = 'admin'), (SELECT id FROM users WHERE name = '{{ koji_admin_user }}')) ON CONFLICT DO NOTHING"
+    query: >
+      INSERT INTO user_perms (user_id, perm_id, creator_id)
+      VALUES (
+        (SELECT id FROM users WHERE name = '{{ koji_admin_user }}'),
+        (SELECT id FROM permissions WHERE name = 'admin'),
+        (SELECT id FROM users WHERE name = '{{ koji_admin_user }}')
+      ) ON CONFLICT DO NOTHING
     login_host: "{{ koji_db_host }}"
     login_user: "{{ koji_db_user }}"
     login_password: "{{ koji_db_password }}"
 
-- name: Ensure correct ownership of kojiadmin config
-  ansible.builtin.file:
-    path: "{{ admin_user_koji_dir }}"
-    owner: "{{ koji_admin_user }}"
-    group: "{{ koji_admin_user }}"
-    recurse: true
+- name: Template Koji callback script
+  ansible.builtin.template:
+    src: koji_callbacks.py.j2
+    dest: "{{ koji_callbacks_script_path }}"
+    mode: "0755"
 
-- name: Add Koji builder hosts
-  ansible.builtin.shell:
-    cmd: "sudo -u kojiadmin koji --config={{ admin_user_koji_dir }}/config add-host {{ item }} x86_64"
-  loop: "{{ groups['kojibuilders'] }}"
-  register: add_host_result
-  failed_when: "add_host_result.rc != 0 and 'already in the database' not in add_host_result.stderr"
-  changed_when: "add_host_result.rc == 0"
+- name: Configure Koji callbacks
+  ansible.builtin.template:
+    src: callbacks.conf.j2
+    dest: "{{ koji_callbacks_config_path }}"
+    mode: "0640"
+  notify: Restart httpd
 
-- name: Add Koji builder hosts to createrepo channel
-  ansible.builtin.shell:
-    cmd: "sudo -u kojiadmin koji --config={{ admin_user_koji_dir }}/config add-host-to-channel {{ item }} createrepo"
-  loop: "{{ groups['kojibuilders'] }}"
-  register: add_channel_result
-  failed_when: "add_channel_result.rc != 0 and 'already in the database' not in add_channel_result.stderr and 'already subscribed to the createrepo channel' not in add_channel_result.stderr"
-  changed_when: "add_channel_result.rc == 0"
+- name: Template Koji cleanup script
+  ansible.builtin.template:
+    src: koji_cleanup.sh.j2
+    dest: "{{ koji_cleanup_script_path }}"
+    mode: "0755"
 
-- name: Set Koji builder host capacity
-  ansible.builtin.shell:
-    cmd: "sudo -u kojiadmin koji --config={{ admin_user_koji_dir }}/config edit-host --capacity={{ kojid_max_jobs }} {{ item }}"
-  loop: "{{ groups['kojibuilders'] }}"
-  changed_when: true
+- name: Create systemd service for Koji cleanup
+  ansible.builtin.copy:
+    src: koji-cleanup.service
+    dest: "{{ koji_cleanup_service_path }}"
+    mode: "0644"
+
+- name: Create systemd timer for Koji cleanup
+  ansible.builtin.copy:
+    src: koji-cleanup.timer
+    dest: "{{ koji_cleanup_timer_path }}"
+    mode: "0644"
+
+- name: Enable and start Koji cleanup timer
+  ansible.builtin.systemd:
+    name: koji-cleanup.timer
+    state: started
+    enabled: true
+    daemon_reload: true
+
+- name: Enable and start Koji DB sweeper timer
+  ansible.builtin.service:
+    name: koji-sweep-db.timer
+    state: started
+    enabled: true

roles/koji_hub/templates/99-local-policies.conf.j2

@@ -0,0 +1,8 @@
+[hub-policy:admin]
+user = {{ koji_admin_user }}
+
+[task:newRepo]
+channel = repo
+
+[task:build_rpm]
+user = builder

roles/koji_hub/templates/callbacks.conf.j2

@@ -0,0 +1,3 @@
+[hub]
+CallbackFile = /usr/local/bin/koji_callbacks.py
+CallbackRegex = .*

roles/koji_hub/templates/koji_callbacks.py.j2

@@ -0,0 +1,18 @@
+#!/usr/bin/python3
+import os
+import sys
+import json
+
+def main():
+    log_file = "/var/log/koji_callbacks.log"
+    with open(log_file, "a") as f:
+        f.write("Callback triggered:\n")
+        f.write(f"  Type: {os.environ.get('KOJI_TYPE')}\n")
+        f.write(f"  Table: {os.environ.get('KOJI_TABLE')}\n")
+        f.write(f"  ID: {os.environ.get('KOJI_ID')}\n")
+        f.write(f"  Attrs: {os.environ.get('KOJI_ATTRS')}\n")
+        f.write("\n")
+
+if __name__ == "__main__":
+    main()
+

roles/koji_hub/templates/koji_cleanup.sh.j2

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+# Koji cleanup script
+# This script cleans up old build roots and work directories on the Koji hub.
+
+set -euo pipefail
+
+# --- Configuration ---
+KOJI_TOP_DIR="{{ koji_top_dir }}"
+KOJI_ADMIN_USER="{{ koji_admin_user }}"
+ADMIN_USER_KOJI_DIR="{{ koji_hub_admin_user_koji_dir }}"
+
+# --- Main Script ---
+
+echo "$(date): Starting Koji cleanup..."
+
+# Clean up old build roots
+# koji-gc --cleanup-buildroots --debug
+
+# Clean up old work directories
+# find "$KOJI_TOP_DIR/work" -maxdepth 1 -type d -mtime +7 -exec rm -rf {} \;
+
+# Example: Remove old scratch builds (older than 30 days)
+# koji --config="$ADMIN_USER_KOJI_DIR/config" list-builds --state=FAILED --state=CANCELED --state=DELETED --mine --after-completion="$(date -d '30 days ago' +%Y-%m-%d)" | awk '{print $1}' | xargs -r -L 1 koji --config="$ADMIN_USER_KOJI_DIR/config" remove-build --nowait
+
+echo "$(date): Koji cleanup finished."

roles/koji_hub/tests/test.yaml

@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: MIT-0
+---
+- name: Test koji_hub role
+  hosts: localhost
+  remote_user: root
+  roles:
+    - koji_hub

roles/koji_hub/vars/main.yaml

@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: MIT-0
+---
+# vars file for roles/koji_hub

roles/kojid/defaults/main.yaml

@@ -1,2 +1,5 @@
 ---
-kojid_work_dir: /var/lib/kojid
+kojid_work_dir: /var/lib/kojid
+kojid_allowed_scms: git.mx-os.mx:/RPMs/*
+kojid_use_host_resolv: true
+kojid_max_jobs: 50

roles/kojid/files/mxos0-build-x86_64.cfg

@@ -1,5 +1,10 @@
+config_opts['root'] = '{{ kojid_mock_root }}'
 config_opts['releasever'] = '10'
 config_opts['rpmbuild_networking'] = True
+config_opts['use_bootstrap'] = False
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['chroot_setup_cmd'] = 'install rpm-build rpmdevtools rpmlint'
 config_opts['yum.conf'] = """
 [main]
 gpgcheck=1
@@ -8,6 +13,7 @@ keepcache=1
 reposdir=/dev/null
 retries=20
 strict=1
+sslverify=0
 
 [baseos]
 name=CentOS Stream 10 - BaseOS
@@ -24,5 +30,10 @@ name=CentOS Stream 10 - CRB
 baseurl=https://mirror.stream.centos.org/10-stream/CRB/x86_64/os/
 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
 enabled=1
+
+[epel]
+name=Extra Packages for Enterprise Linux 10 - x86_64
+baseurl=https://dl.fedoraproject.org/pub/epel/10/Everything/x86_64/
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-epel-10
+enabled=1
 """
-config_opts['chroot_setup_cmd'] = 'install rpm-build rpmdevtools rpmlint'

roles/kojid/handlers/main.yaml

@@ -1,4 +1,3 @@
-#SPDX-License-Identifier: MIT-0
 ---
 - name: Restart kojid
   ansible.builtin.service:

roles/kojid/meta/main.yaml

@@ -1,36 +1,22 @@
 # SPDX-License-Identifier: MIT-0
 ---
 galaxy_info:
-  author: your name
-  description: your role description
-  company: your company (optional)
+  author: "Renich Bon Ciric"
+  description: "Koji builder"
+  company: "Mx-OS"
 
-  # If the issue tracker for your role is not on github, uncomment the
-  # next line and provide a value
-  # issue_tracker_url: http://example.com/issue/tracker
+  license: "GPL-2.0-or-later"
 
-  # Choose a valid license ID from https://spdx.org - some suggested licenses:
-  # - BSD-3-Clause (default)
-  # - - MIT
-  # - GPL-2.0-or-later
-  # - GPL-3.0-only
-  # - Apache-2.0
-  # - CC-BY-4.0
-  license: license (GPL-2.0-or-later, MIT, etc)
+  min_ansible_version: "2.15"
 
-  min_ansible_version: 2.1
-
-  # If this a Container Enabled role, provide the minimum Ansible Container version.
-  # min_ansible_container_version:
+  platforms:
+    - name: Fedora
+      versions:
+        - "40"
+    - name: EL
+      versions:
+        - "10"
 
   galaxy_tags: []
-    # List tags for your role here, one per line. A tag is a keyword that describes
-    # and categorizes the role. Users find roles by searching for tags. Be sure to
-    # remove the '[]' above, if you add tags to this list.
-    #
-    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
-    #       Maximum 20 tags per role.
 
 dependencies: []
-  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
-  # if you add dependencies to this list.

roles/kojid/tasks/main.yaml

@@ -1,6 +1,16 @@
 ---
 
-- name: Install Koji-Builder packages and rpm-build
+- name: Enable CodeReady Builder (CRB) repository
+  ansible.builtin.command: dnf config-manager --set-enabled crb
+  args:
+    creates: /etc/yum.repos.d/centos-stream-crb.repo
+
+- name: Install EPEL repository
+  ansible.builtin.dnf:
+    name: epel-release
+    state: present
+
+- name: Install Koji-Builder packages, rpm-build, and koji CLI
   ansible.builtin.dnf:
     name:
       - koji-builder
@@ -8,6 +18,8 @@
       - rpmdevtools
       - mock
       - policycoreutils-python-utils
+      - git
+      - koji
     state: present
 
 - name: Create kojid work directory
@@ -32,11 +44,12 @@
     group: mock
     mode: "2775"
 
-- name: Configure mock site defaults
-  ansible.builtin.template:
-    src: site-defaults.cfg.j2
-    dest: /etc/mock/site-defaults.cfg
+- name: Copy mock configuration file
+  ansible.builtin.copy:
+    src: mxos0-build-x86_64.cfg
+    dest: /etc/mock/mxos0-build-x86_64.cfg
     mode: "0644"
+  notify: restart kojid
 
 - name: Configure kojid
   ansible.builtin.template:
@@ -77,6 +90,13 @@
     group: root
     mode: "0600"
 
+- name: Configure Koji client on builder
+  ansible.builtin.template:
+    src: roles/koji_hub/templates/koji.conf.j2
+    dest: /etc/koji.conf.d/ansible-settings.conf
+    mode: "0644"
+
+
 - name: Add hub host to /etc/hosts
   ansible.builtin.lineinfile:
     path: /etc/hosts
@@ -86,16 +106,11 @@
 
 - name: Update CA trust
   ansible.builtin.command: update-ca-trust
+  changed_when: false
+  check_mode: false
 
 - name: Start and enable kojid service
   ansible.builtin.service:
     name: kojid
     state: started
     enabled: true
-
-- name: Add koji hub to /etc/hosts
-  ansible.builtin.lineinfile:
-    path: /etc/hosts
-    line: "{{ hostvars[groups['kojihub'][0]].ansible_default_ipv4.address }} {{ koji_hub_fqdn }}"
-    regexp: ".*{{ koji_hub_fqdn }}"
-    state: present

roles/kojid/tests/test.yaml

@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: MIT-0
 ---
-- hosts: localhost
+- name: Test kojid role
+  hosts: localhost
   remote_user: root
   roles:
-    - roles/kojid
+    - kojid

roles/kojira/handlers/main.yaml

@@ -1,4 +1,4 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
 - name: Restart kojira
   ansible.builtin.service:

roles/kojira/meta/main.yaml

@@ -1,36 +1,22 @@
 # SPDX-License-Identifier: MIT-0
 ---
 galaxy_info:
-  author: your name
-  description: your role description
-  company: your company (optional)
+  author: "Renich Bon Ciric"
+  description: "Koji scheduler"
+  company: "Mx-OS"
 
-  # If the issue tracker for your role is not on github, uncomment the
-  # next line and provide a value
-  # issue_tracker_url: http://example.com/issue/tracker
+  license: "GPL-2.0-or-later"
 
-  # Choose a valid license ID from https://spdx.org - some suggested licenses:
-  # - BSD-3-Clause (default)
-  # - MIT
-  # - GPL-2.0-or-later
-  # - GPL-3.0-only
-  # - Apache-2.0
-  # - CC-BY-4.0
-  license: license (GPL-2.0-or-later, MIT, etc)
+  min_ansible_version: "2.15"
 
-  min_ansible_version: 2.1
-
-  # If this a Container Enabled role, provide the minimum Ansible Container version.
-  # min_ansible_container_version:
+  platforms:
+    - name: Fedora
+      versions:
+        - "40"
+    - name: EL
+      versions:
+        - "10"
 
   galaxy_tags: []
-    # List tags for your role here, one per line. A tag is a keyword that describes
-    # and categorizes the role. Users find roles by searching for tags. Be sure to
-    # remove the '[]' above, if you add tags to this list.
-    #
-    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
-    #       Maximum 20 tags per role.
 
 dependencies: []
-  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
-  # if you add dependencies to this list.

roles/kojira/tasks/main.yaml

@@ -1,12 +1,10 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
 - name: Install Koji Utils package (which includes kojira)
   ansible.builtin.dnf:
     name: ["koji-utils"]
     state: present
 
-
-
 - name: Configure kojira
   ansible.builtin.template:
     src: kojira.conf.j2
@@ -26,13 +24,13 @@
     - { src: "kojira.key", dest: "/etc/pki/koji/kojira.key", mode: "0600" }
 
 - name: "Concatenate certificate and key into a PEM file"
-  ansible.builtin.shell: cat /etc/pki/koji/kojira.crt /etc/pki/koji/kojira.key > /etc/pki/koji/kojira.pem
+  ansible.builtin.shell: cat /etc/pki/koji/kojira.crt /etc/pki/koji/kojira.key > {{ kojira_pem_path }}
   args:
-    creates: /etc/pki/koji/kojira.pem
+    creates: "{{ kojira_pem_path }}"
 
 - name: Set permissions on kojira PEM file
   ansible.builtin.file:
-    path: /etc/pki/koji/kojira.pem
+    path: "{{ kojira_pem_path }}"
     mode: "0600"
 
 - name: Start and enable kojira service

roles/kojira/templates/kojira.conf.j2

@@ -1,4 +1,4 @@
 [kojira]
 server = https://{{ koji_hub_fqdn }}/kojihub
-cert = {{ kojira_cert_path }}
+cert = {{ kojira_pem_path }}
 serverca = {{ koji_remote_ca_trust_path }}

roles/kojira/tests/test.yaml

@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: MIT-0
 ---
-- hosts: localhost
+- name: Test kojira role
+  hosts: localhost
   remote_user: root
   roles:
-    - roles/kojira
+    - kojira

roles/kojira/vars/main.yaml

@@ -1,4 +1,3 @@
 # SPDX-License-Identifier: MIT-0
 ---
 # vars file for roles/kojira
-

roles/nfs-client/meta/main.yaml

@@ -1,36 +0,0 @@
-#SPDX-License-Identifier: MIT-0
----
-galaxy_info:
-  author: your name
-  description: your role description
-  company: your company (optional)
-
-  # If the issue tracker for your role is not on github, uncomment the
-  # next line and provide a value
-  # issue_tracker_url: http://example.com/issue/tracker
-
-  # Choose a valid license ID from https://spdx.org - some suggested licenses:
-  # - BSD-3-Clause (default)
-  # - MIT
-  # - GPL-2.0-or-later
-  # - GPL-3.0-only
-  # - Apache-2.0
-  # - CC-BY-4.0
-  license: license (GPL-2.0-or-later, MIT, etc)
-
-  min_ansible_version: 2.1
-
-  # If this a Container Enabled role, provide the minimum Ansible Container version.
-  # min_ansible_container_version:
-
-  galaxy_tags: []
-    # List tags for your role here, one per line. A tag is a keyword that describes
-    # and categorizes the role. Users find roles by searching for tags. Be sure to
-    # remove the '[]' above, if you add tags to this list.
-    #
-    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
-    #       Maximum 20 tags per role.
-
-dependencies: []
-  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
-  # if you add dependencies to this list.

roles/nfs-client/tests/test.yaml

@@ -1,6 +0,0 @@
-#SPDX-License-Identifier: MIT-0
----
-- hosts: localhost
-  remote_user: root
-  roles:
-    - roles/nfs-client

roles/nfs-server/tests/test.yaml

@@ -1,6 +0,0 @@
-#SPDX-License-Identifier: MIT-0
----
-- hosts: localhost
-  remote_user: root
-  roles:
-    - roles/nfs-server

roles/nfs_client/defaults/main.yaml

@@ -1,3 +1,3 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
 # defaults file for roles/nfs-client

roles/nfs_client/handlers/main.yaml

@@ -1,3 +1,3 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
 # handlers file for roles/nfs-client

roles/nfs_client/meta/main.yaml

@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: MIT-0
+---
+galaxy_info:
+  author: "Renich Bon Ciric"
+  description: "NFS client"
+  company: "Mx-OS"
+
+  license: "GPL-2.0-or-later"
+
+  min_ansible_version: "2.15"
+
+  platforms:
+    - name: Fedora
+      versions:
+        - "40"
+    - name: EL
+      versions:
+        - "10"
+
+  galaxy_tags: []
+
+dependencies: []

roles/nfs_client/tasks/main.yaml

@@ -1,9 +1,13 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
 - name: Install NFS client packages
-  ansible.builtin.dnf:
-    name: nfs-utils
+  ansible.builtin.package:
+    name: "{{ item }}"
     state: present
+  loop:
+    - nfs-utils
+    - nfs4-acl-tools
+    - policycoreutils-python-utils
 
 - name: Create mount point directory
   ansible.builtin.file:
@@ -11,12 +15,12 @@
     state: directory
     mode: "0755"
 
-- name: Add kojifs0 to /etc/hosts
+- name: Add NFS server to /etc/hosts
   ansible.builtin.lineinfile:
     path: /etc/hosts
     line: "{{ hostvars[groups['kojifs'][0]].ansible_default_ipv4.address }} {{ koji_nfs_host }}"
-    create: true
     state: present
+    mode: "0644"
 
 - name: Mount the Koji NFS share
   ansible.posix.mount:
@@ -27,10 +31,16 @@
     state: mounted
 
 - name: Set SELinux context for Koji NFS mount
-  ansible.builtin.command: semanage fcontext -a -t httpd_sys_rw_content_t "{{ koji_top_dir }}(/.*)?"
+  ansible.builtin.command: semanage fcontext -a -t nfs_t "{{ koji_top_dir }}(/.*)?"
+  changed_when: false
+  check_mode: false
 
 - name: Apply SELinux context
-  ansible.builtin.command: restorecon -r -v "{{ koji_top_dir }}"
+  ansible.builtin.command: restorecon -R "{{ koji_top_dir }}"
+  changed_when: false
+  check_mode: false
 
 - name: Flush systemd journal to disk
   ansible.builtin.command: journalctl --flush
+  changed_when: false
+  check_mode: false

roles/nfs_client/tests/test.yaml

@@ -0,0 +1,7 @@
+# tests file for nfs_client
+---
+- name: Test nfs_client role
+  hosts: localhost
+  remote_user: root
+  roles:
+    - nfs_client

roles/nfs_client/vars/main.yaml

@@ -1,3 +1,3 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
 # vars file for roles/nfs-client

roles/nfs_server/defaults/main.yaml

@@ -1,3 +1,3 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
 # defaults file for roles/nfs-server

roles/nfs_server/handlers/main.yaml

@@ -1,4 +1,4 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
 - name: Restart nfs-server
   ansible.builtin.service:

roles/nfs_server/meta/main.yaml

@@ -0,0 +1,22 @@
+---
+# SPDX-License-Identifier: MIT-0
+galaxy_info:
+  author: "Renich Bon Ciric"
+  description: "NFS server"
+  company: "Mx-OS"
+
+  license: "GPL-2.0-or-later"
+
+  min_ansible_version: "2.15"
+
+  platforms:
+    - name: Fedora
+      versions:
+        - "40"
+    - name: EL
+      versions:
+        - "10"
+
+  galaxy_tags: []
+
+dependencies: []

roles/nfs_server/tasks/main.yaml

@@ -1,4 +1,4 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
 - name: Install NFS server packages
   ansible.builtin.dnf:
@@ -17,9 +17,9 @@
   ansible.builtin.lineinfile:
     path: /etc/hosts
     line: "{{ hostvars[item].ansible_default_ipv4.address }} {{ item }}"
-    create: true
     state: present
-  loop: "{{ groups['koji_nodes'] }}"
+    mode: "0644"
+  loop: "{{ groups['all'] }}"
 
 - name: Configure the NFS export for all Koji nodes
   ansible.builtin.template:
@@ -29,9 +29,11 @@
     group: root
     mode: "0644"
 
+# This command does not provide a reliable way to determine if the NFS exports were changed,
+# so we run it on every execution.
 - name: Export all NFS filesystems
   ansible.builtin.command: exportfs -ra
-  changed_when: true
+  changed_when: false
 
 - name: Start and enable NFS services
   ansible.builtin.service:

roles/nfs_server/tests/test.yaml

@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: MIT-0
+---
+- name: Test nfs_server role
+  hosts: localhost
+  remote_user: root
+  roles:
+    - nfs_server

roles/nfs_server/vars/main.yaml

@@ -1,3 +1,3 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
 # vars file for roles/nfs-server

roles/postgresql/defaults/main.yaml

@@ -1,2 +1,2 @@
 ---
-koji_db_network: "192.168.122.0/24"
+postgresql_koji_db_network: 192.168.1.0/24

roles/postgresql/meta/main.yaml

@@ -1,36 +1,22 @@
 ---
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 galaxy_info:
-  author: your name
-  description: your role description
-  company: your company (optional)
+  author: "Renich Bon Ciric"
+  description: "PostgreSQL server"
+  company: "Mx-OS"
 
-  # If the issue tracker for your role is not on github, uncomment the
-  # next line and provide a value
-  # issue_tracker_url: http://example.com/issue/tracker
+  license: "GPL-2.0-or-later"
 
-  # Choose a valid license ID from https://spdx.org - some suggested licenses:
-  # - BSD-3-Clause (default)
-  # - MIT
-  # - GPL-2.0-or-later
-  # - GPL-3.0-only
-  # - Apache-2.0
-  # - CC-BY-4.0
-  license: license (GPL-2.0-or-later, MIT, etc)
+  min_ansible_version: "2.15"
 
-  min_ansible_version: 2.1
-
-  # If this a Container Enabled role, provide the minimum Ansible Container version.
-  # min_ansible_container_version:
+  platforms:
+    - name: Fedora
+      versions:
+        - "40"
+    - name: EL
+      versions:
+        - "10"
 
   galaxy_tags: []
-    # List tags for your role here, one per line. A tag is a keyword that describes
-    # and categorizes the role. Users find roles by searching for tags. Be sure to
-    # remove the '[]' above, if you add tags to this list.
-    #
-    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
-    #       Maximum 20 tags per role.
 
 dependencies: []
-  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
-  # if you add dependencies to this list.

roles/postgresql/tasks/main.yaml

@@ -1,4 +1,4 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
 - name: Install PostgreSQL packages
   ansible.builtin.dnf:
@@ -43,34 +43,24 @@
     state: started
     enabled: true
 
-- name: Configure PostgreSQL settings
-  community.postgresql.postgresql_set:
-    name: "{{ item.name }}"
-    value: "{{ item.value }}"
+- name: Configure PostgreSQL settings for SSL and listening
+  ansible.builtin.lineinfile:
+    path: /var/lib/pgsql/data/postgresql.conf
+    regexp: "^{{ item.regexp }}"
+    line: "{{ item.line }}"
+    state: present
+    backup: true
   loop:
-    - { name: 'ssl_ca_file', value: 'ca.crt' }
-    - { name: 'ssl', value: 'on' }
-    - { name: 'ssl_cert_file', value: 'server.crt' }
-    - { name: 'ssl_key_file', value: 'server.key' }
-    - { name: 'max_connections', value: '200' }
-    - { name: 'listen_addresses', value: '*' }
+    - { regexp: '#?ssl\\s*=\\s*.*', line: "ssl = on" }
+    - { regexp: '#?ssl_cert_file\\s*=\\s*.*', line: "ssl_cert_file = 'server.crt'" }
+    - { regexp: '#?ssl_key_file\\s*=\\s*.*', line: "ssl_key_file = 'server.key'" }
+    - { regexp: '#?ssl_ca_file\\s*=\\s*.*', line: "ssl_ca_file = 'ca.crt'" }
+    - { regexp: '#?listen_addresses\\s*=\\s*.*', line: "listen_addresses = '*'" }
+    - { regexp: '#?max_connections\\s*=\\s*.*', line: "max_connections = 200" }
   become: true
   become_user: postgres
   notify: Restart postgresql
 
-
-
-- name: Remove old pg_hba.conf entry for Koji hub (IPv4 network)
-  community.postgresql.postgresql_pg_hba:
-    dest: /var/lib/pgsql/data/pg_hba.conf
-    contype: hostssl
-    databases: "{{ koji_db_name }}"
-    users: "{{ koji_db_user }}"
-    address: "{{ koji_db_network }}"
-    method: scram-sha-256
-    state: absent
-  notify: Restart postgresql
-
 - name: Configure pg_hba.conf to allow connection from the Koji hub (IPv4 address)
   community.postgresql.postgresql_pg_hba:
     dest: /var/lib/pgsql/data/pg_hba.conf

roles/postgresql/tests/test.yaml

@@ -1,6 +1,7 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
-- hosts: localhost
+- name: Test postgresql role
+  hosts: localhost
   remote_user: root
   roles:
-    - roles/postgresql
+    - postgresql

roles/postgresql/vars/main.yaml

@@ -1,3 +1,3 @@
-#SPDX-License-Identifier: MIT-0
+# SPDX-License-Identifier: MIT-0
 ---
 # vars file for roles/postgresql