fix(web): fix proxy authentication DN format and server CA option in web.conf

- Use loop-specific owner/group variables for copying certificates in roles/koji_hub/tasks/main.yaml so group: apache is actually applied.

- Update roles/koji_hub/templates/hub.conf.j2 to specify both slash-separated and RFC 2253 comma-separated formats in ProxyDNs.

- Update roles/koji_hub/templates/web.conf.j2 to use KojiHubCA instead of serverca for the web config block.

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>

Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>

roles/koji_hub/tasks/main.yaml

@@ -115,8 +115,8 @@
   ansible.builtin.copy:
     src: "{{ koji_pki_dir }}/{{ item.src }}"
     dest: "{{ item.dest }}"
-    owner: root
-    group: root
+    owner: "{{ item.owner | default('root') }}"
+    group: "{{ item.group | default('root') }}"
     mode: "{{ item.mode }}"
   loop:
     - { src: "{{ koji_ca_name }}_cert.crt", dest: "{{ koji_remote_ca_trust_path }}", mode: "0644" }

roles/koji_hub/templates/hub.conf.j2

@@ -25,7 +25,7 @@ AllowedSCMs = {{ koji_allowed_scms | default('git.mx-os.mx:/RPMs/*.git:*:use_com
 DNUsernameComponent = CN
 # ProxyDNs is used to allow a specific user (usually the web interface) to act as others
 # This should match the DN of the 'kojiweb' certificate
-ProxyDNs = /C={{ koji_cert_country }}/ST={{ koji_cert_state }}/L={{ koji_cert_locality }}/O={{ koji_cert_organization }}/CN={{ koji_hub_fqdn }}
+ProxyDNs = /C={{ koji_cert_country }}/ST={{ koji_cert_state }}/L={{ koji_cert_locality }}/O={{ koji_cert_organization }}/CN={{ koji_hub_fqdn }} | CN={{ koji_hub_fqdn }},O={{ koji_cert_organization }},L={{ koji_cert_locality }},ST={{ koji_cert_state }},C={{ koji_cert_country }}
 
 ##  Other options  ##
 LoginCreatesUser = On

roles/koji_hub/templates/web.conf.j2

@@ -8,5 +8,5 @@ WebCert = /etc/pki/koji/kojiweb.pem
 LoginTimeout = 72
 Secret = {{ web_secret }}
 LibPath = /usr/share/koji-web/lib
-serverca = {{ koji_remote_ca_trust_path }}
+KojiHubCA = {{ koji_remote_ca_trust_path }}
 LiteralFooter = True