MxOS/ansible-koji
SHA256
Watch
6
0
Fork
You've already forked ansible-koji
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix(web): fix proxy authentication DN format and server CA option in web.conf

Browse source 
- Use loop-specific owner/group variables for copying certificates in roles/koji_hub/tasks/main.yaml so group: apache is actually applied.

- Update roles/koji_hub/templates/hub.conf.j2 to specify both slash-separated and RFC 2253 comma-separated formats in ProxyDNs.

- Update roles/koji_hub/templates/web.conf.j2 to use KojiHubCA instead of serverca for the web config block.

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>

Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
This commit is contained in:
Rénich Bon Ćirić 2026-06-16 12:22:19 -06:00
commit de7ec8d165
Signed by: renich
GPG key ID: AB2A9F49384FE324
3 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
roles/koji_hub/tasks/main.yaml
View file

@ -115,8 +115,8 @@
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ koji_pki_dir }}/{{ item.src }}" src: "{{ koji_pki_dir }}/{{ item.src }}"
dest: "{{ item.dest }}" dest: "{{ item.dest }}"
owner: root owner: "{{ item.owner | default('root') }}"
group: root group: "{{ item.group | default('root') }}"
mode: "{{ item.mode }}" mode: "{{ item.mode }}"
loop: loop:
- { src: "{{ koji_ca_name }}_cert.crt", dest: "{{ koji_remote_ca_trust_path }}", mode: "0644" } - { src: "{{ koji_ca_name }}_cert.crt", dest: "{{ koji_remote_ca_trust_path }}", mode: "0644" }

2
roles/koji_hub/templates/hub.conf.j2
View file

@ -25,7 +25,7 @@ AllowedSCMs = {{ koji_allowed_scms | default('git.mx-os.mx:/RPMs/*.git:*:use_com
DNUsernameComponent = CN DNUsernameComponent = CN
# ProxyDNs is used to allow a specific user (usually the web interface) to act as others # ProxyDNs is used to allow a specific user (usually the web interface) to act as others
# This should match the DN of the 'kojiweb' certificate # This should match the DN of the 'kojiweb' certificate
ProxyDNs = /C={{ koji_cert_country }}/ST={{ koji_cert_state }}/L={{ koji_cert_locality }}/O={{ koji_cert_organization }}/CN={{ koji_hub_fqdn }} ProxyDNs = /C={{ koji_cert_country }}/ST={{ koji_cert_state }}/L={{ koji_cert_locality }}/O={{ koji_cert_organization }}/CN={{ koji_hub_fqdn }} | CN={{ koji_hub_fqdn }},O={{ koji_cert_organization }},L={{ koji_cert_locality }},ST={{ koji_cert_state }},C={{ koji_cert_country }}
## Other options ## ## Other options ##
LoginCreatesUser = On LoginCreatesUser = On

2
roles/koji_hub/templates/web.conf.j2
View file

@ -8,5 +8,5 @@ WebCert = /etc/pki/koji/kojiweb.pem
LoginTimeout = 72 LoginTimeout = 72
Secret = {{ web_secret }} Secret = {{ web_secret }}
LibPath = /usr/share/koji-web/lib LibPath = /usr/share/koji-web/lib
serverca = {{ koji_remote_ca_trust_path }} KojiHubCA = {{ koji_remote_ca_trust_path }}
LiteralFooter = True LiteralFooter = True