feat: Mejorar la configuración y seguridad de Koji

Este commit introduce varias mejoras en los roles de Ansible para Koji: - **Rol koji_hub:** - Se reemplazó `lineinfile` con una plantilla completa para `hub.conf` para mejorar la legibilidad y mantenibilidad. - Se aseguró la instalación del paquete `python3-koji-hub-plugins` para soportar el plugin `echo`. - Se eliminó una tarea `blockinfile` redundante que duplicaba la configuración de la base de datos en `hub.conf`. - Se rehabilitó el plugin `echo` en `hub.conf` después de asegurar su disponibilidad. - **Rol postgresql:** - Se modificó la configuración de `pg_hba.conf` para iterar correctamente sobre todos los hosts en el grupo `kojihub`, asegurando que todas las instancias del hub puedan conectarse a la base de datos. - **Rol dist_git:** - Se implementó el etiquetado persistente de contextos SELinux para los directorios de `dist-git` usando `semanage fcontext` y `restorecon`, asegurando que los contextos persistan tras reetiquetados del sistema de archivos. - **Rol common:** - Se mejoró la seguridad en la generación de claves GPG usando un archivo temporal para el script por lotes, el cual se elimina de forma segura después de la generación de la clave. - **Configuración Global:** - Se introdujo la variable `koji_source_script_path` en `vars/default.yaml` para centralizar la ruta del script `mxos-get-sources.bash`, eliminando rutas hardcodeadas en `kojid_allowed_scms` y las tareas de `kojid`. - **Documentación:** - Se actualizó `docs/instalación.rst` para reflejar los cambios en la configuración de Dist-Git, plugins y variables.
2025-11-22 11:48:06 -06:00 · 2025-11-22 11:48:06 -06:00 · f14c01da0b
commit f14c01da0b
parent 39aeb2d6b6
25 changed files with 731 additions and 123 deletions
--- a/roles/common/tasks/main.yaml
+++ b/roles/common/tasks/main.yaml
@ -59,38 +59,48 @@

 - name: Create GPG key batch file
  when: inventory_hostname == 'localhost'
-  ansible.builtin.copy:
-    content: |
-      %echo Generating a basic OpenPGP key
-      Key-Type: RSA
-      Key-Length: 4096
-      Subkey-Type: RSA
-      Subkey-Length: 4096
-      Name-Real: Koji Signing Key
-      Name-Email: koji@{{ koji_hub_fqdn }}
-      Expire-Date: 0
-      Passphrase: {{ gpg_key_passphrase }}
-      %commit
-      %echo done
-    dest: "{{ koji_pki_dir }}/gpg_batch"
-    mode: "0600"
-  delegate_to: localhost
-  run_once: true
+  tags: gpg
+  block:
+    - name: Create temporary GPG batch file
+      ansible.builtin.tempfile:
+        state: file
+        suffix: .gpg
+      register: gpg_batch_file

- name: Generate GPG key
-  ansible.builtin.command:
-    cmd: "gpg --batch --gen-key {{ koji_pki_dir }}/gpg_batch"
-  delegate_to: localhost
-  run_once: true
-  args:
-    creates: "{{ koji_pki_dir }}/gpg_key.pub"
+    - name: Populate GPG batch file
+      ansible.builtin.copy:
+        content: |
+          %echo Generating a basic OpenPGP key
+          Key-Type: RSA
+          Key-Length: 4096
+          Subkey-Type: RSA
+          Subkey-Length: 4096
+          Name-Real: Koji Signing Key
+          Name-Email: koji@{{ koji_hub_fqdn }}
+          Expire-Date: 0
+          Passphrase: {{ gpg_key_passphrase }}
+          %commit
+          %echo done
+        dest: "{{ gpg_batch_file.path }}"
+        mode: "0600"

- name: Export GPG public key
-  ansible.builtin.shell:
-    cmd: "gpg --armor --export 'Koji Signing Key' > {{ koji_pki_dir }}/gpg_key.pub"
-  changed_when: false
-  delegate_to: localhost
-  run_once: true
+    - name: Generate GPG key
+      ansible.builtin.command:
+        cmd: "gpg --batch --gen-key {{ gpg_batch_file.path }}"
+      args:
+        creates: "{{ koji_pki_dir }}/gpg_key.pub"
+
+    - name: Export GPG public key
+      ansible.builtin.shell:
+        cmd: "gpg --armor --export 'Koji Signing Key' > {{ koji_pki_dir }}/gpg_key.pub"
+      changed_when: false
+
+  always:
+    - name: Remove temporary GPG batch file
+      ansible.builtin.file:
+        path: "{{ gpg_batch_file.path }}"
+        state: absent
+      when: gpg_batch_file.path is defined

 - name: Set hostname
  ansible.builtin.hostname:
@ -119,10 +129,21 @@
        state: absent
      loop: "{{ groups['all'] }}"

+    - name: Scan SSH keys
+      ansible.builtin.command: ssh-keyscan -t rsa {{ item }}
+      loop: "{{ groups['all'] }}"
+      register: scanned_keys
+      delegate_to: localhost
+      run_once: true
+      changed_when: false
+      until: scanned_keys.rc == 0
+      retries: 3
+      delay: 2
+
    - name: "Add current host keys"
      ansible.builtin.known_hosts:
        path: "~/.ssh/known_hosts"
-        name: "{{ item }}"
-        key: "{{ lookup('pipe', 'ssh-keyscan -t rsa ' + item) }}"
+        name: "{{ item.item }}"
+        key: "{{ item.stdout }}"
        state: present
-      loop: "{{ groups['all'] }}"
+      loop: "{{ scanned_keys.results }}"
--- a/roles/dist_git/defaults/main.yaml
+++ b/roles/dist_git/defaults/main.yaml
@ -0,0 +1,8 @@
+---
+dist_git_base_dir: /var/lib/dist-git
+dist_git_repos_dir: "{{ dist_git_base_dir }}/git"
+dist_git_cache_dir: "{{ dist_git_base_dir }}/cache"
+dist_git_user: git
+dist_git_group: git
+dist_git_httpd_conf_path: /etc/httpd/conf.d/dist-git.conf
+dist_git_fqdn: "{{ inventory_hostname }}"
--- a/roles/dist_git/handlers/main.yaml
+++ b/roles/dist_git/handlers/main.yaml
@ -0,0 +1,9 @@
+---
+- name: Restart httpd
+  ansible.builtin.service:
+    name: httpd
+    state: restarted
+
+- name: Reload systemd daemon
+  ansible.builtin.systemd:
+    daemon_reload: true
--- a/roles/dist_git/tasks/main.yaml
+++ b/roles/dist_git/tasks/main.yaml
@ -0,0 +1,125 @@
+---
+- name: Install Git and HTTPD
+  ansible.builtin.dnf:
+    name:
+      - git
+      - git-daemon
+      - httpd
+      - mod_ssl
+      - policycoreutils-python-utils
+      - firewalld
+      - rpm-build
+      - rpmdevtools
+      - wget
+    state: present
+
+- name: Create dist-git group
+  ansible.builtin.group:
+    name: "{{ dist_git_group }}"
+    state: present
+
+- name: Create dist-git user
+  ansible.builtin.user:
+    name: "{{ dist_git_user }}"
+    group: "{{ dist_git_group }}"
+    home: "{{ dist_git_base_dir }}"
+    create_home: true
+    shell: /bin/bash
+    state: present
+
+- name: Create dist-git directory structure
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ dist_git_user }}"
+    group: "{{ dist_git_group }}"
+    mode: "0755"
+  loop:
+    - "{{ dist_git_base_dir }}"
+    - "{{ dist_git_repos_dir }}"
+    - "{{ dist_git_repos_dir }}/RPMs"
+    - "{{ dist_git_cache_dir }}"
+
+- name: Configure git safe.directory system-wide
+  ansible.builtin.command: git config --system --add safe.directory "*"
+  changed_when: false
+
+- name: Set SELinux boolean for HTTPD CGI support
+  ansible.builtin.command: setsebool -P httpd_enable_cgi 1
+  changed_when: false
+
+- name: Set SELinux context for dist-git directories (persistent)
+  ansible.builtin.command: semanage fcontext -a -t httpd_sys_content_t "{{ dist_git_base_dir }}(/.*)?"
+  changed_when: false
+
+- name: Apply SELinux context for dist-git directories
+  ansible.builtin.command: restorecon -R -v {{ dist_git_base_dir }}
+  changed_when: false
+
+- name: Create PKI directory for Dist-Git
+  ansible.builtin.file:
+    path: /etc/pki/dist-git
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Copy Dist-Git certificates
+  ansible.builtin.copy:
+    src: "{{ koji_pki_dir }}/{{ item.src }}"
+    dest: "/etc/pki/dist-git/{{ item.dest }}"
+    mode: "{{ item.mode }}"
+  loop:
+    - { src: "dist-git.crt", dest: "dist-git.crt", mode: "0644" }
+    - { src: "dist-git.key", dest: "dist-git.key", mode: "0600" }
+  notify: Restart httpd
+
+- name: Configure HTTPD for dist-git
+  ansible.builtin.template:
+    src: dist-git.conf.j2
+    dest: "{{ dist_git_httpd_conf_path }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart httpd
+
+- name: Ensure firewalld is running
+  ansible.builtin.service:
+    name: firewalld
+    state: started
+    enabled: true
+
+- name: Allow HTTP/HTTPS service in firewall
+  ansible.builtin.firewalld:
+    service: "{{ item }}"
+    permanent: true
+    state: enabled
+    immediate: true
+  loop:
+    - http
+    - https
+
+- name: Ensure HTTPD is enabled and started
+  ansible.builtin.service:
+    name: httpd
+    state: started
+    enabled: true
+
+- name: Deploy custom git-daemon systemd service
+  ansible.builtin.template:
+    src: git-daemon.service.j2
+    dest: /etc/systemd/system/git-daemon.service
+    owner: root
+    group: root
+    mode: '0644'
+  notify: Reload systemd daemon
+
+- name: Reload systemd daemon to recognize new git-daemon service file
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Ensure git-daemon.service is enabled and started
+  ansible.builtin.systemd_service:
+    name: git-daemon.service
+    state: started
+    enabled: true
--- a/roles/dist_git/templates/dist-git.conf.j2
+++ b/roles/dist_git/templates/dist-git.conf.j2
@ -0,0 +1,40 @@
+<VirtualHost *:80>
+    ServerName {{ dist_git_fqdn }}
+    DocumentRoot {{ dist_git_base_dir }}
+
+    # Redirect all HTTP traffic to HTTPS
+    RewriteEngine On
+    RewriteCond %{HTTPS} off
+    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
+</VirtualHost>
+
+<VirtualHost *:443>
+    ServerName {{ dist_git_fqdn }}
+    DocumentRoot {{ dist_git_base_dir }}
+
+    SSLEngine on
+    SSLCertificateFile /etc/pki/dist-git/dist-git.crt
+    SSLCertificateKeyFile /etc/pki/dist-git/dist-git.key
+
+    # Git Smart HTTP for RPMs
+    # Maps /RPMs/pkg.git to {{ dist_git_repos_dir }}/RPMs/pkg.git
+    SetEnvIf Request_URI "^/RPMs/" GIT_PROJECT_ROOT={{ dist_git_repos_dir }}/RPMs
+    SetEnv GIT_HTTP_EXPORT_ALL
+    ScriptAlias /RPMs/ /usr/libexec/git-core/git-http-backend/
+
+    <Directory "/usr/libexec/git-core">
+        Options +ExecCGI
+        Require all granted
+    </Directory>
+
+    <Directory "{{ dist_git_repos_dir }}">
+        Require all granted
+    </Directory>
+
+    # Lookaside Cache
+    Alias /sources {{ dist_git_cache_dir }}
+    <Directory "{{ dist_git_cache_dir }}">
+        Options +Indexes
+        Require all granted
+    </Directory>
+</VirtualHost>
--- a/roles/dist_git/templates/git-daemon.service.j2
+++ b/roles/dist_git/templates/git-daemon.service.j2
@ -0,0 +1,13 @@
+[Unit]
+Description=Fast, unauthenticated GIT access
+Documentation=man:git-daemon(1)
+
+[Service]
+Type=simple
+ExecStart=/usr/libexec/git-core/git-daemon --base-path={{ dist_git_base_dir }}/git --export-all --listen=0.0.0.0 --port=9418
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+User={{ dist_git_user }}
+Group={{ dist_git_group }}
+
+[Install]
+WantedBy=multi-user.target
--- a/roles/koji_bootstrap/tasks/add_host.yaml
+++ b/roles/koji_bootstrap/tasks/add_host.yaml
@ -0,0 +1,20 @@
+---
+- name: Add Koji builder host {{ item }}
+  block:
+    - name: Try to add Koji builder host
+      ansible.builtin.command: >
+        sudo -u {{ koji_admin_user }} koji
+        --config={{ koji_hub_admin_user_koji_dir }}/config
+        add-host {{ item }} x86_64
+      register: koji_add_host_result
+      changed_when: "'Host added' in koji_add_host_result.stdout"
+      failed_when: "'is already in the database' not in koji_add_host_result.stderr and koji_add_host_result.rc != 0"
+  rescue:
+    - name: Convert user to host in DB if it exists as user
+      ansible.builtin.command: >
+        sudo -u postgres psql {{ koji_db_name }} -c
+        "UPDATE users SET usertype = 1 WHERE name = '{{ item }}' AND usertype = 0;"
+      when:
+        - "'already exists and it is not a host' in koji_add_host_result.stderr"
+      changed_when: true
+      delegate_to: "{{ koji_db_host }}"
--- a/roles/koji_bootstrap/tasks/main.yaml
+++ b/roles/koji_bootstrap/tasks/main.yaml
@ -76,19 +76,43 @@
    --config={{ koji_hub_admin_user_koji_dir }}/config
    add-external-repo -t {{ koji_build_tag }}-build centos-stream-10-epel
    https://mirror.facebook.net/fedora/epel/10/Everything/x86_64/
-  register: koji_bootstrap_add_appstream_repo_result
-  changed_when: "'External repository created' in koji_bootstrap_add_appstream_repo_result.stdout"
-  failed_when: "koji_bootstrap_add_appstream_repo_result.rc != 0 and 'already exists' not in koji_bootstrap_add_appstream_repo_result.stderr"
+  register: koji_bootstrap_add_epel_repo_result
+  changed_when: "'External repository created' in koji_bootstrap_add_epel_repo_result.stdout"
+  failed_when: "koji_bootstrap_add_epel_repo_result.rc != 0 and 'already exists' not in koji_bootstrap_add_epel_repo_result.stderr"

- name: Add Koji builder hosts
+- name: Download repomd.xml from CentOS Stream 10 build repo
+  ansible.builtin.get_url:
+    url: https://kojihub.stream.centos.org/kojifiles/repos/c10s-build/latest/x86_64/repodata/repomd.xml
+    dest: /tmp/c10s-repomd.xml
+
+- name: Extract comps.xml path
+  ansible.builtin.shell: grep 'comps.xml"' /tmp/c10s-repomd.xml | head -n 1 | sed -e 's/.*href="//' -e 's/".*//'
+  register: comps_path
+  changed_when: false
+
+- name: Download comps.xml
+  ansible.builtin.get_url:
+    url: "https://kojihub.stream.centos.org/kojifiles/repos/c10s-build/latest/x86_64/{{ comps_path.stdout }}"
+    dest: /tmp/c10s-comps.xml
+
+- name: Import comps groups
  ansible.builtin.command: >
    sudo -u {{ koji_admin_user }} koji
    --config={{ koji_hub_admin_user_koji_dir }}/config
-    add-host {{ item }} x86_64
+    import-comps /tmp/c10s-comps.xml {{ koji_build_tag }}-build
+  register: koji_bootstrap_import_comps_result
+  changed_when: "'Groups imported' in koji_bootstrap_import_comps_result.stdout"
+
+- name: Add Koji builder hosts
+  ansible.builtin.include_tasks: add_host.yaml
  loop: "{{ groups['kojibuilders'] }}"
-  register: koji_bootstrap_add_host_result
-  changed_when: "'Host added' in koji_bootstrap_add_host_result.stdout"
-  failed_when: "koji_bootstrap_add_host_result.rc != 0 and 'is already in the database' not in koji_bootstrap_add_host_result.stderr"
+
+- name: Restart httpd on kojihub to apply Koji changes
+  ansible.builtin.service:
+    name: httpd
+    state: restarted
+  delegate_to: "{{ groups['kojihub'][0] }}"
+  run_once: true

 - name: Add Koji builder hosts to createrepo channel
  ansible.builtin.command: >
--- a/roles/koji_hub/tasks/main.yaml
+++ b/roles/koji_hub/tasks/main.yaml
@ -14,6 +14,7 @@
      - koji-utils
      - createrepo_c
      - tree
+      - python3-koji-hub-plugins
    state: present

 - name: Create directories for certs and client configs
@ -32,6 +33,20 @@
    - "{{ koji_top_dir }}/scratch"
    - "{{ koji_top_dir }}/repos-dist"

+- name: Create kojira group
+  ansible.builtin.group:
+    name: kojira
+    state: present
+
+- name: Create kojira system user
+  ansible.builtin.user:
+    name: kojira
+    group: kojira
+    home: /var/lib/kojira
+    shell: /sbin/nologin
+    system: true
+    state: present
+
 - name: Ensure admin user exists
  ansible.builtin.user:
    name: "{{ koji_admin_user }}"
@ -109,6 +124,7 @@
    - { src: "kojihub.key", dest: "{{ koji_hub_key_path }}", mode: "0640", group: "apache" }
    - { src: "kojihub.pem", dest: "/etc/pki/koji/kojihub.pem", mode: "0644", group: "apache" }
    - { src: "kojiadmin.pem", dest: "{{ koji_admin_cert_path }}", mode: "0644" }
+    - { src: "kojira.pem", dest: "/etc/pki/koji/kojira.pem", mode: "0640", group: "kojira" }

 - name: Update CA trust store
  ansible.builtin.command: update-ca-trust
@ -167,15 +183,6 @@
    - { src: "99-local-policies.conf.j2", dest: "{{ koji_hub_config_dir }}/99-local-policies.conf" }
  notify: Restart httpd

- name: Configure Koji Hub database connection
-  ansible.builtin.blockinfile:
-    path: /etc/koji-hub/hub.conf
-    block: |
-      DBHost = {{ koji_db_host }}
-      DBPass = {{ koji_db_password }}
-    marker: "# {mark} ANSIBLE MANAGED BLOCK FOR DB CONNECTION"
-  notify: Restart httpd
-
 - name: Set SELinux booleans for Apache
  ansible.posix.seboolean:
    name: "{{ item }}"
@ -278,6 +285,15 @@
    login_user: "{{ koji_db_user }}"
    login_password: "{{ koji_db_password }}"

+- name: Configure Koji Hub Main Options (hub.conf)
+  ansible.builtin.template:
+    src: hub.conf.j2
+    dest: /etc/koji-hub/hub.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart httpd
+
 - name: Template Koji callback script
  ansible.builtin.template:
    src: koji_callbacks.py.j2
--- a/roles/koji_hub/templates/hub.conf.j2
+++ b/roles/koji_hub/templates/hub.conf.j2
@ -1,25 +1,63 @@
-# Koji Hub Configuration
 [hub]
-# Main directory for Koji data (packages, repos, etc.)
+
+## ConfigParser style config file, similar to ini files
+## https://docs.python.org/library/configparser.html
+
+##  Basic options  ##
+DBName = {{ koji_db_name }}
+DBUser = {{ koji_db_user }}
+DBHost = {{ koji_db_host }}
+DBPass = {{ koji_db_password }}
 KojiDir = {{ koji_top_dir }}

-# Authentication methods. 'ssl' is primary for clients, 'password' for web UI.
-AuthMethods = ssl, password
+##  Auth-related options  ##
+# CheckClientIP = True

-# Automatically create a user account on first successful SSL login.
+##  Kerberos authentication options  ##
+# ProxyPrincipals = koji/kojiweb@EXAMPLE.COM
+# HostPrincipalFormat = compile/%s@EXAMPLE.COM
+# AllowedKrbRealms = *
+# DisableURLSessions = False
+
+##  SSL client certificate auth configuration  ##
+# The client username is the common name of the subject of their client certificate
+DNUsernameComponent = CN
+# ProxyDNs is used to allow a specific user (usually the web interface) to act as others
+# This should match the DN of the 'kojiweb' certificate
+ProxyDNs = /C={{ koji_cert_country }}/ST={{ koji_cert_state }}/L={{ koji_cert_locality }}/O={{ koji_cert_organization }}/CN={{ koji_hub_fqdn }}
+
+##  Other options  ##
 LoginCreatesUser = On
+KojiWebURL = {{ koji_url }}
+EmailDomain = {{ koji_email_domain | default('mx-os.mx') }}
+NotifyOnSuccess = False
+NotifyOnFailure = False
+DisableNotifications = False

-# Header used by Apache/mod_proxy to forward the original client IP.
-ProxyUserHeader = X-Forwarded-For
+##  Resource limits  ##
+# RLIMIT_AS =
+# RLIMIT_CORE =
+# RLIMIT_CPU =
+# RLIMIT_DATA =
+# RLIMIT_FSIZE =
+# RLIMIT_MEMLOCK =
+# RLIMIT_NOFILE =
+# RLIMIT_NPROC =
+# RLIMIT_OFILE =
+# RLIMIT_RSS =
+# RLIMIT_STACK =

-# Message to display in the client when the hub is offline.
-ServerOfflineMessage = The Koji build system is currently offline for maintenance.
+## MemoryWarnThreshold = 5000
+## MaxRequestLength = 4194304

-# How long builder should wait for host-init to finish (seconds)
-HostInitTimeout = 120
+## Extended features
+# EnableMaven = False
+# EnableWin = False

-Plugins = sigul_sign
+## Koji hub plugins
+PluginPath = /usr/lib/koji-hub-plugins
+Plugins = echo

-[sigul]
-# Sigul server URL (replace with actual Sigul server address)
-SigulServer = {{ sigul_server }}
+## Debugging
+KojiDebug = On
+LogLevel = INFO
--- a/roles/kojid/defaults/main.yaml
+++ b/roles/kojid/defaults/main.yaml
@ -1,5 +1,10 @@
 ---
-kojid_work_dir: /var/lib/kojid
 kojid_allowed_scms: git.mx-os.mx:/RPMs/*
-kojid_use_host_resolv: true
+kojid_allowed_scms_use_config: true
+kojid_allowed_scms_use_policy: false
+kojid_log_level: INFO
 kojid_max_jobs: 50
+kojid_mock_user: kojibuilder
+kojid_use_createrepo_c: true
+kojid_use_host_resolv: true
+kojid_work_dir: /var/lib/kojid
--- a/roles/kojid/files/mxos-get-sources.bash
+++ b/roles/kojid/files/mxos-get-sources.bash
@ -0,0 +1,41 @@
+#!/usr/bin/bash
+set -ex
+
+SURL="https://cs10-koji-04.mx-os/sources"
+PKGNAME=$(basename "$PWD")
+
+if [ ! -f "sources" ]; then
+    echo "No sources file found."
+    exit 0
+fi
+
+while read -r alg filename_part eq hash; do
+    # Format: SHA512 (filename) = hash
+    # filename_part is "(filename)"
+    filename="${filename_part:1:-1}" 
+    
+    if [ -f "$filename" ]; then
+        echo "File $filename already exists, skipping."
+        continue
+    fi
+
+    # Construct URL based on MxOS layout: SURL/PKGNAME/FILENAME/HASH/FILENAME
+    # Note: PKGNAME might need to be passed or detected. 
+    # Usually in Koji execution, PWD is the SCM root, so basename PWD should work if directory matches package name.
+    # However, Koji often clones into 'ed' or similar.
+    
+    # Using the layout found: sources/ed/ed-1.20.tar.lz/HASH/
+    # Assuming the file is INSIDE that hash directory.
+    
+    # Check if there's a trailing slash in SURL, remove it if so.
+    SURL=${SURL%/}
+    
+    url="$SURL/$PKGNAME/$filename/$hash/$filename"
+    
+    echo "Downloading $filename from $url"
+    curl -L --fail --retry 5 -o "$filename" "$url"
+    
+    # Verify hash (optional but good)
+    echo "$hash  $filename" | sha512sum -c -
+
+done < sources
--- a/roles/kojid/tasks/main.yaml
+++ b/roles/kojid/tasks/main.yaml
@ -44,12 +44,7 @@
    group: mock
    mode: "2775"

- name: Copy mock configuration file
-  ansible.builtin.copy:
-    src: mxos0-build-x86_64.cfg
-    dest: /etc/mock/mxos0-build-x86_64.cfg
-    mode: "0644"
-  notify: restart kojid
+

 - name: Configure kojid
  ansible.builtin.template:
@ -104,6 +99,22 @@
    regexp: ".*{{ koji_hub_fqdn }}"
    state: present

+- name: Copy source fetching wrapper script
+  ansible.builtin.copy:
+    src: mxos-get-sources.bash
+    dest: "{{ koji_source_script_path }}"
+    mode: "0755"
+    owner: root
+    group: root
+
+- name: Configure MxOS Mock config
+  ansible.builtin.template:
+    src: mxos0-build-x86_64.cfg.j2
+    dest: /etc/mock/mxos0-build-x86_64.cfg
+    mode: "0644"
+    owner: root
+    group: mock
+
 - name: Update CA trust
  ansible.builtin.command: update-ca-trust
  changed_when: false
--- a/roles/kojid/templates/kojid.conf.j2
+++ b/roles/kojid/templates/kojid.conf.j2
@ -33,3 +33,9 @@ from_addr = {{ kojid_from_addr }}
 ; certs
 cert = {{ kojid_pem_path }}
 serverca = {{ koji_remote_ca_trust_path }}
+
+; repos
+use_createrepo_c = {{ kojid_use_createrepo_c }}
+
+; logs
+log_level = {{ kojid_log_level }}
--- a/roles/kojid/templates/mxos0-build-x86_64.cfg.j2
+++ b/roles/kojid/templates/mxos0-build-x86_64.cfg.j2
@ -4,7 +4,7 @@ config_opts['rpmbuild_networking'] = True
 config_opts['use_bootstrap'] = False
 config_opts['target_arch'] = 'x86_64'
 config_opts['legal_host_arches'] = ('x86_64',)
-config_opts['chroot_setup_cmd'] = 'install rpm-build rpmdevtools rpmlint'
+config_opts['chroot_setup_cmd'] = 'install rpm-build rpmdevtools rpmlint make'
 config_opts['yum.conf'] = """
 [main]
 gpgcheck=1
@ -37,3 +37,13 @@ baseurl=https://dl.fedoraproject.org/pub/epel/10/Everything/x86_64/
 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-epel-10
 enabled=1
 """
+
+# Bind mount the MxOS source fetching wrapper
+config_opts['plugin_conf']['bind_mount_enable'] = True
+if 'bind_mount_opts' in config_opts['plugin_conf']:
+    if 'dirs' in config_opts['plugin_conf']['bind_mount_opts']:
+        config_opts['plugin_conf']['bind_mount_opts']['dirs'].append(('/usr/local/bin/mxos-get-sources.bash', '/usr/local/bin/mxos-get-sources.bash'))
+    else:
+        config_opts['plugin_conf']['bind_mount_opts']['dirs'] = [('/usr/local/bin/mxos-get-sources.bash', '/usr/local/bin/mxos-get-sources.bash')]
+else:
+    config_opts['plugin_conf']['bind_mount_opts'] = {'dirs': [('/usr/local/bin/mxos-get-sources.bash', '/usr/local/bin/mxos-get-sources.bash')]}
--- a/roles/postgresql/tasks/main.yaml
+++ b/roles/postgresql/tasks/main.yaml
@ -67,9 +67,10 @@
    contype: hostssl
    databases: "{{ koji_db_name }}"
    users: "{{ koji_db_user }}"
-    address: "{{ hostvars[groups['kojihub'][0]].ansible_default_ipv4.address }}/32"
+    address: "{{ hostvars[item].ansible_default_ipv4.address }}/32"
    method: scram-sha-256
    backup: true
+  loop: "{{ groups['kojihub'] }}"
  notify: Restart postgresql

 - name: Configure pg_hba.conf to allow IPv6 connection from the Koji hub
@ -78,10 +79,11 @@
    contype: hostssl
    databases: "{{ koji_db_name }}"
    users: "{{ koji_db_user }}"
-    address: "{{ hostvars[groups['kojihub'][0]].ansible_default_ipv6.address }}/128"
+    address: "{{ hostvars[item].ansible_default_ipv6.address }}/128"
    method: scram-sha-256
    backup: true
-  when: hostvars[groups['kojihub'][0]].ansible_default_ipv6.address is defined
+  loop: "{{ groups['kojihub'] }}"
+  when: hostvars[item].ansible_default_ipv6.address is defined
  notify: Restart postgresql

 - name: Configure pg_hba.conf for local postgres user trust authentication