refactor(ansible): Estandariza nombres de roles y actualiza Koji
Se estandarizan los nombres de los directorios de roles, cambiando guiones por guiones bajos. Se añaden nuevos scripts para limpieza y callbacks en Koji Hub. Además, se actualizan las configuraciones de Kojid, Kojira y PostgreSQL, incluyendo la instalación de paquetes, ajustes de mock y la gestión de variables.
This commit is contained in:
parent
08c38d3d56
commit
39aeb2d6b6
GPG key ID:
AB2A9F49384FE324
91 changed files with 1037 additions and 957 deletions
|
|
@ -1,288 +0,0 @@
|
|||
---
|
||||
- name: Install Koji Hub, Web, httpd, and crypto packages
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- koji-hub
|
||||
- koji-web
|
||||
- httpd
|
||||
- mod_ssl
|
||||
- mod_wsgi
|
||||
- python3-cryptography
|
||||
- nmap-ncat
|
||||
- postgresql
|
||||
- policycoreutils-python-utils
|
||||
- koji-utils
|
||||
- createrepo_c
|
||||
- tree
|
||||
state: present
|
||||
|
||||
- name: Create directories for certs and client configs
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: apache
|
||||
group: apache
|
||||
mode: "0700"
|
||||
loop:
|
||||
- "{{ koji_top_dir }}/certs"
|
||||
- "{{ koji_top_dir }}/clients"
|
||||
- "{{ koji_top_dir }}/packages"
|
||||
- "{{ koji_top_dir }}/repos"
|
||||
- "{{ koji_top_dir }}/work"
|
||||
- "{{ koji_top_dir }}/scratch"
|
||||
- "{{ koji_top_dir }}/repos-dist"
|
||||
|
||||
|
||||
|
||||
- name: Ensure admin user '{{ koji_admin_user }}' exists
|
||||
ansible.builtin.user:
|
||||
name: "{{ koji_admin_user }}"
|
||||
state: present
|
||||
create_home: true
|
||||
|
||||
- name: Add kojiadmin to wheel group for sudo access
|
||||
ansible.builtin.user:
|
||||
name: "{{ koji_admin_user }}"
|
||||
groups: wheel
|
||||
append: true
|
||||
state: present
|
||||
|
||||
- name: Ensure wheel group has NOPASSWD sudo access
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/sudoers
|
||||
regexp: '^# %wheel\s+ALL=\(ALL\)\s+NOPASSWD:\s+ALL$'
|
||||
line: '%wheel ALL=(ALL) NOPASSWD: ALL'
|
||||
validate: 'visudo -cf %s'
|
||||
state: present
|
||||
|
||||
- name: Ensure .koji directory exists for '{{ koji_admin_user }}'
|
||||
ansible.builtin.file:
|
||||
path: "{{ admin_user_koji_dir }}"
|
||||
state: directory
|
||||
mode: "{{ koji_client_dir_mode }}"
|
||||
|
||||
- name: Configure Koji client for admin user
|
||||
ansible.builtin.template:
|
||||
src: koji.conf.j2
|
||||
dest: "{{ admin_user_koji_dir }}/config"
|
||||
mode: "{{ koji_client_file_mode }}"
|
||||
|
||||
- name: Copy client certificates for '{{ koji_admin_user }}'
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ admin_user_koji_dir }}/{{ item.dest }}"
|
||||
mode: "{{ koji_client_file_mode }}"
|
||||
loop:
|
||||
- src: "{{ koji_pki_dir }}/kojiadmin.pem"
|
||||
dest: client.pem
|
||||
- src: "{{ koji_pki_dir }}/kojiadmin.key"
|
||||
dest: client.key
|
||||
- src: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt"
|
||||
dest: clientca.crt
|
||||
- src: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt"
|
||||
dest: serverca.crt
|
||||
|
||||
- name: Create Koji PKI directory on the hub
|
||||
ansible.builtin.file:
|
||||
path: "{{ koji_remote_pki_dir }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
|
||||
- name: Copy Koji certificates to the hub
|
||||
ansible.builtin.copy:
|
||||
src: "{{ koji_pki_dir }}/{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "{{ item.mode }}"
|
||||
loop:
|
||||
- { src: "{{ koji_ca_name }}_cert.crt", dest: "{{ koji_remote_ca_trust_path }}", mode: "0644" }
|
||||
- { src: "kojihub.crt", dest: "{{ koji_hub_cert_path }}", mode: "0644", group: "apache" }
|
||||
- { src: "kojihub.key", dest: "{{ koji_hub_key_path }}", mode: "0640", group: "apache" }
|
||||
- { src: "kojihub.pem", dest: "/etc/pki/koji/kojihub.pem", mode: "0644", group: "apache" }
|
||||
- { src: "kojiadmin.pem", dest: "{{ koji_admin_cert_path }}", mode: "0644" }
|
||||
|
||||
- name: Update CA trust store
|
||||
ansible.builtin.shell: update-ca-trust
|
||||
changed_when: true
|
||||
|
||||
- name: Flush handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
- name: Configure httpd for Koji
|
||||
ansible.builtin.lineinfile:
|
||||
path: "{{ item.path }}"
|
||||
regexp: "{{ item.regexp }}"
|
||||
line: "{{ item.line }}"
|
||||
backup: true
|
||||
loop:
|
||||
- { path: "{{ httpd_ssl_config_file }}", regexp: "^SSLCertificateFile", line: "SSLCertificateFile {{ koji_hub_cert_path }}" }
|
||||
- { path: "{{ httpd_ssl_config_file }}", regexp: "^SSLCertificateKeyFile", line: "SSLCertificateKeyFile {{ koji_hub_key_path }}" }
|
||||
- { path: "{{ httpd_ssl_config_file }}", regexp: "^#?SSLCACertificateFile", line: "SSLCACertificateFile {{ koji_remote_ca_trust_path }}" }
|
||||
notify: Restart httpd
|
||||
|
||||
- name: Enable SSL for Koji Hub
|
||||
ansible.builtin.blockinfile:
|
||||
path: "{{ koji_hub_httpd_config_file }}"
|
||||
marker: "# {mark} ANSIBLE MANAGED BLOCK"
|
||||
block: |
|
||||
<Location /kojihub/ssllogin>
|
||||
SSLVerifyClient require
|
||||
SSLVerifyDepth 10
|
||||
SSLOptions +StdEnvVars
|
||||
</Location>
|
||||
notify: Restart httpd
|
||||
|
||||
- name: Template Koji Hub and Web configs
|
||||
ansible.builtin.template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
group: apache
|
||||
mode: "0640"
|
||||
loop:
|
||||
- { src: "00-main.conf.j2", dest: "{{ koji_hub_config_dir }}/00-main.conf" }
|
||||
- { src: "db.conf.j2", dest: "{{ koji_hub_config_dir }}/db.conf" }
|
||||
- { src: "admin.conf.j2", dest: "{{ koji_hub_config_dir }}/admin.conf" }
|
||||
- { src: "web.conf.j2", dest: "{{ koji_web_config_dir }}/web.conf" }
|
||||
- { src: "policies.conf.j2", dest: "{{ koji_hub_config_dir }}/policies.conf" }
|
||||
- { src: "99-local-policies.conf.j2", dest: "{{ koji_hub_config_dir }}/99-local-policies.conf" }
|
||||
notify: Restart httpd
|
||||
|
||||
- name: Set SELinux booleans for Apache
|
||||
ansible.posix.seboolean:
|
||||
name: "{{ item }}"
|
||||
state: true
|
||||
persistent: true
|
||||
loop:
|
||||
- httpd_can_network_connect_db
|
||||
- httpd_can_network_connect
|
||||
- allow_httpd_anon_write
|
||||
- httpd_use_nfs
|
||||
|
||||
- name: Start and enable httpd
|
||||
ansible.builtin.service:
|
||||
name: httpd
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
- name: Open firewall for http/https
|
||||
ansible.posix.firewalld:
|
||||
service: "{{ item }}"
|
||||
permanent: true
|
||||
state: enabled
|
||||
loop: ["http", "https"]
|
||||
notify: Reload firewalld
|
||||
|
||||
- name: Set SELinux context for Koji topdir
|
||||
ansible.builtin.command: semanage fcontext -a -t httpd_sys_rw_content_t "/mnt/koji(/.*)?"
|
||||
|
||||
- name: Apply SELinux context
|
||||
ansible.builtin.command: restorecon -r -v /mnt/koji
|
||||
|
||||
- name: Add database host to /etc/hosts
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/hosts
|
||||
line: "{{ hostvars[groups['kojidb'][0]].ansible_default_ipv4.address }} {{ koji_db_host }}"
|
||||
regexp: ".*{{ koji_db_host }}"
|
||||
state: present
|
||||
|
||||
- name: Add hub host to /etc/hosts
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/hosts
|
||||
line: "{{ ansible_default_ipv4.address }} {{ koji_hub_fqdn }}"
|
||||
regexp: ".*{{ koji_hub_fqdn }}"
|
||||
state: present
|
||||
|
||||
- name: Wait for database to be available
|
||||
ansible.builtin.wait_for:
|
||||
host: "{{ koji_db_host }}"
|
||||
port: 5432
|
||||
timeout: 120
|
||||
|
||||
- name: Check if Koji DB schema is loaded
|
||||
ansible.builtin.shell:
|
||||
cmd: psql -h {{ koji_db_host }} -U {{ koji_db_user }} -d {{ koji_db_name }} -c "SELECT 'users'::regclass;"
|
||||
register: schema_check
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
environment:
|
||||
PGPASSWORD: "{{ koji_db_password }}"
|
||||
|
||||
- name: Load Koji DB Schema
|
||||
ansible.builtin.shell:
|
||||
cmd: psql -h {{ koji_db_host }} -U {{ koji_db_user }} -d {{ koji_db_name }} -f /usr/share/koji/schema.sql
|
||||
when: schema_check.rc != 0
|
||||
environment:
|
||||
PGPASSWORD: "{{ koji_db_password }}"
|
||||
|
||||
- name: Check if Koji DB schema is loaded
|
||||
community.postgresql.postgresql_query:
|
||||
login_db: "{{ koji_db_name }}"
|
||||
query: "SELECT 'users'::regclass;"
|
||||
login_host: "{{ koji_db_host }}"
|
||||
login_user: "{{ koji_db_user }}"
|
||||
login_password: "{{ koji_db_password }}"
|
||||
register: schema_check
|
||||
|
||||
- name: Load Koji DB Schema
|
||||
community.postgresql.postgresql_script:
|
||||
db: "{{ koji_db_name }}"
|
||||
path: /usr/share/koji/schema.sql
|
||||
login_host: "{{ koji_db_host }}"
|
||||
login_user: "{{ koji_db_user }}"
|
||||
login_password: "{{ koji_db_password }}"
|
||||
when: schema_check.failed
|
||||
|
||||
- name: Create kojiadmin user in database
|
||||
community.postgresql.postgresql_query:
|
||||
login_db: "{{ koji_db_name }}"
|
||||
query: "INSERT INTO users (name, status, usertype) VALUES ('{{ koji_admin_user }}', 0, 0) ON CONFLICT DO NOTHING"
|
||||
login_host: "{{ koji_db_host }}"
|
||||
login_user: "{{ koji_db_user }}"
|
||||
login_password: "{{ koji_db_password }}"
|
||||
|
||||
- name: Configure Koji client via ansible-settings.conf
|
||||
ansible.builtin.template:
|
||||
src: koji.conf.j2
|
||||
dest: "{{ koji_client_config_file }}"
|
||||
group: apache
|
||||
mode: "0644"
|
||||
|
||||
- name: Grant admin privileges to kojiadmin user
|
||||
community.postgresql.postgresql_query:
|
||||
login_db: "{{ koji_db_name }}"
|
||||
query: "INSERT INTO user_perms (user_id, perm_id, creator_id) VALUES ((SELECT id FROM users WHERE name = '{{ koji_admin_user }}'), (SELECT id FROM permissions WHERE name = 'admin'), (SELECT id FROM users WHERE name = '{{ koji_admin_user }}')) ON CONFLICT DO NOTHING"
|
||||
login_host: "{{ koji_db_host }}"
|
||||
login_user: "{{ koji_db_user }}"
|
||||
login_password: "{{ koji_db_password }}"
|
||||
|
||||
- name: Ensure correct ownership of kojiadmin config
|
||||
ansible.builtin.file:
|
||||
path: "{{ admin_user_koji_dir }}"
|
||||
owner: "{{ koji_admin_user }}"
|
||||
group: "{{ koji_admin_user }}"
|
||||
recurse: true
|
||||
|
||||
- name: Add Koji builder hosts
|
||||
ansible.builtin.shell:
|
||||
cmd: "sudo -u kojiadmin koji --config={{ admin_user_koji_dir }}/config add-host {{ item }} x86_64"
|
||||
loop: "{{ groups['kojibuilders'] }}"
|
||||
register: add_host_result
|
||||
failed_when: "add_host_result.rc != 0 and 'already in the database' not in add_host_result.stderr"
|
||||
changed_when: "add_host_result.rc == 0"
|
||||
|
||||
- name: Add Koji builder hosts to createrepo channel
|
||||
ansible.builtin.shell:
|
||||
cmd: "sudo -u kojiadmin koji --config={{ admin_user_koji_dir }}/config add-host-to-channel {{ item }} createrepo"
|
||||
loop: "{{ groups['kojibuilders'] }}"
|
||||
register: add_channel_result
|
||||
failed_when: "add_channel_result.rc != 0 and 'already in the database' not in add_channel_result.stderr and 'already subscribed to the createrepo channel' not in add_channel_result.stderr"
|
||||
changed_when: "add_channel_result.rc == 0"
|
||||
|
||||
- name: Set Koji builder host capacity
|
||||
ansible.builtin.shell:
|
||||
cmd: "sudo -u kojiadmin koji --config={{ admin_user_koji_dir }}/config edit-host --capacity={{ kojid_max_jobs }} {{ item }}"
|
||||
loop: "{{ groups['kojibuilders'] }}"
|
||||
changed_when: true
|
||||
Loading…
Reference in a new issue