From bf4676281a5834bdadabf57b71ce3c0b6884a659d8b5391e4d6f3c7d4b75d158 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9nich=20Bon=20=C4=86iri=C4=87?=
 <renich@woralelandia.com>
Date: Tue, 16 Jun 2026 12:06:30 -0600
Subject: [PATCH] fix(web): enable SSL client certificate authentication for
 koji-web login
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add Apache configuration block in roles/koji_hub/tasks/main.yaml to require SSL client certificate authentication for /koji/login inside kojiweb.conf.

- Fixes the koji.AuthError: could not verify client: None error during Koji Web login.

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>

Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
---
 roles/koji_hub/tasks/main.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/roles/koji_hub/tasks/main.yaml b/roles/koji_hub/tasks/main.yaml
index 3a44b8a..394d46f 100644
--- a/roles/koji_hub/tasks/main.yaml
+++ b/roles/koji_hub/tasks/main.yaml
@@ -169,6 +169,18 @@
       </Location>
   notify: Restart httpd
 
+- name: Enable SSL for Koji Web
+  ansible.builtin.blockinfile:
+    path: "{{ koji_remote_kojiweb_httpd_conf_path }}"
+    marker: "# {mark} ANSIBLE MANAGED BLOCK SSL LOGIN"
+    block: |
+      <Location /koji/login>
+              SSLVerifyClient require
+              SSLVerifyDepth  10
+              SSLOptions +StdEnvVars
+      </Location>
+  notify: Restart httpd
+
 - name: Template Koji Hub and Web configs
   ansible.builtin.template:
     src: "{{ item.src }}"