From de7ec8d165c82cee5ec5d5bb2d5b6c03a429531d4f6d94bd38bc1d43da28d56c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9nich=20Bon=20=C4=86iri=C4=87?= Date: Tue, 16 Jun 2026 12:22:19 -0600 Subject: [PATCH] fix(web): fix proxy authentication DN format and server CA option in web.conf MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Use loop-specific owner/group variables for copying certificates in roles/koji_hub/tasks/main.yaml so group: apache is actually applied. - Update roles/koji_hub/templates/hub.conf.j2 to specify both slash-separated and RFC 2253 comma-separated formats in ProxyDNs. - Update roles/koji_hub/templates/web.conf.j2 to use KojiHubCA instead of serverca for the web config block. Co-developed-by: Gemini AI Signed-off-by: Rénich Bon Ćirić --- roles/koji_hub/tasks/main.yaml | 4 ++-- roles/koji_hub/templates/hub.conf.j2 | 2 +- roles/koji_hub/templates/web.conf.j2 | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/koji_hub/tasks/main.yaml b/roles/koji_hub/tasks/main.yaml index 99e5282..6ec6ab7 100644 --- a/roles/koji_hub/tasks/main.yaml +++ b/roles/koji_hub/tasks/main.yaml @@ -115,8 +115,8 @@ ansible.builtin.copy: src: "{{ koji_pki_dir }}/{{ item.src }}" dest: "{{ item.dest }}" - owner: root - group: root + owner: "{{ item.owner | default('root') }}" + group: "{{ item.group | default('root') }}" mode: "{{ item.mode }}" loop: - { src: "{{ koji_ca_name }}_cert.crt", dest: "{{ koji_remote_ca_trust_path }}", mode: "0644" } diff --git a/roles/koji_hub/templates/hub.conf.j2 b/roles/koji_hub/templates/hub.conf.j2 index c48cbc6..832f1aa 100644 --- a/roles/koji_hub/templates/hub.conf.j2 +++ b/roles/koji_hub/templates/hub.conf.j2 @@ -25,7 +25,7 @@ AllowedSCMs = {{ koji_allowed_scms | default('git.mx-os.mx:/RPMs/*.git:*:use_com DNUsernameComponent = CN # ProxyDNs is used to allow a specific user (usually the web interface) to act as others # This should match the DN of the 'kojiweb' certificate -ProxyDNs = /C={{ koji_cert_country }}/ST={{ koji_cert_state }}/L={{ koji_cert_locality }}/O={{ koji_cert_organization }}/CN={{ koji_hub_fqdn }} +ProxyDNs = /C={{ koji_cert_country }}/ST={{ koji_cert_state }}/L={{ koji_cert_locality }}/O={{ koji_cert_organization }}/CN={{ koji_hub_fqdn }} | CN={{ koji_hub_fqdn }},O={{ koji_cert_organization }},L={{ koji_cert_locality }},ST={{ koji_cert_state }},C={{ koji_cert_country }} ## Other options ## LoginCreatesUser = On diff --git a/roles/koji_hub/templates/web.conf.j2 b/roles/koji_hub/templates/web.conf.j2 index 1f889e7..23a9617 100644 --- a/roles/koji_hub/templates/web.conf.j2 +++ b/roles/koji_hub/templates/web.conf.j2 @@ -8,5 +8,5 @@ WebCert = /etc/pki/koji/kojiweb.pem LoginTimeout = 72 Secret = {{ web_secret }} LibPath = /usr/share/koji-web/lib -serverca = {{ koji_remote_ca_trust_path }} +KojiHubCA = {{ koji_remote_ca_trust_path }} LiteralFooter = True