From f6a353d507c870b9148ad2168e3a8b4a0b226090adcc37ee9c7ff9c7c92f8f73 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9nich=20Bon=20=C4=86iri=C4=87?=
 <renich@woralelandia.com>
Date: Sat, 21 Feb 2026 14:18:33 -0600
Subject: [PATCH] =?UTF-8?q?fix(koji):=20Corregir=20configuraci=C3=B3n=20SS?=
 =?UTF-8?q?L=20y=20seguridad=20del=20Hub?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Cambiar URLs de HTTP a HTTPS en koji.conf.j2 para consistencia SSL
- Agregar WebCert en web.conf.j2 para autenticación proxy SSL
- Generar y desplegar certificado kojiweb.pem
- Configurar MaxConnectionsPerChild=100 en httpd para prevenir fugas de memoria

Co-authored-by: Assistant <renich+assistant@evalinux.com>
---
 roles/koji_hub/tasks/main.yaml        | 10 ++++++++++
 roles/koji_hub/templates/koji.conf.j2 |  4 ++--
 roles/koji_hub/templates/web.conf.j2  |  1 +
 vars/default.yaml                     |  4 ++++
 4 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/roles/koji_hub/tasks/main.yaml b/roles/koji_hub/tasks/main.yaml
index a2433a4..13af634 100644
--- a/roles/koji_hub/tasks/main.yaml
+++ b/roles/koji_hub/tasks/main.yaml
@@ -125,6 +125,7 @@
     - { src: "kojihub.pem", dest: "/etc/pki/koji/kojihub.pem", mode: "0644", group: "apache" }
     - { src: "kojiadmin.pem", dest: "{{ koji_admin_cert_path }}", mode: "0644" }
     - { src: "kojira.pem", dest: "/etc/pki/koji/kojira.pem", mode: "0640", group: "kojira" }
+    - { src: "kojiweb.pem", dest: "/etc/pki/koji/kojiweb.pem", mode: "0640", group: "apache" }
 
 - name: Update CA trust store
   ansible.builtin.command: update-ca-trust
@@ -195,6 +196,15 @@
     - httpd_use_nfs
   notify: Restart httpd
 
+- name: Configure httpd MaxConnectionsPerChild to prevent memory leaks
+  ansible.builtin.lineinfile:
+    path: /etc/httpd/conf/httpd.conf
+    regexp: '^#?\s*MaxConnectionsPerChild\s+\d+'
+    line: 'MaxConnectionsPerChild 100'
+    state: present
+    backup: true
+  notify: Restart httpd
+
 - name: Start and enable httpd
   ansible.builtin.service:
     name: httpd
diff --git a/roles/koji_hub/templates/koji.conf.j2 b/roles/koji_hub/templates/koji.conf.j2
index a601b70..1ffec6f 100644
--- a/roles/koji_hub/templates/koji.conf.j2
+++ b/roles/koji_hub/templates/koji.conf.j2
@@ -1,7 +1,7 @@
 [koji]
 server = https://{{ koji_hub_fqdn }}/kojihub
-weburl = http://{{ koji_hub_fqdn }}/koji
-topurl = http://{{ koji_hub_fqdn }}/kojifiles
+weburl = https://{{ koji_hub_fqdn }}/koji
+topurl = https://{{ koji_hub_fqdn }}/kojifiles
 topdir = {{ koji_top_dir }}
 cert = ~/.koji/client.pem
 key = /home/{{ koji_admin_user }}/.koji/client.key
diff --git a/roles/koji_hub/templates/web.conf.j2 b/roles/koji_hub/templates/web.conf.j2
index 1a2e0ca..7aaa8ae 100644
--- a/roles/koji_hub/templates/web.conf.j2
+++ b/roles/koji_hub/templates/web.conf.j2
@@ -3,6 +3,7 @@ SiteName = MxOS koji
 KojiHubURL = https://{{ koji_hub_fqdn }}/kojihub
 KojiFilesURL = https://{{ koji_hub_fqdn }}/kojifiles
 WebAuthType = ssl
+WebCert = /etc/pki/koji/kojiweb.pem
 LoginTimeout = 72
 Secret = {{ web_secret }}
 LibPath = /usr/share/koji-web/lib
diff --git a/vars/default.yaml b/vars/default.yaml
index 3bda171..7f9e5bb 100644
--- a/vars/default.yaml
+++ b/vars/default.yaml
@@ -76,6 +76,10 @@ common_koji_certs_to_generate:
     cn: "{{ koji_dist_git_fqdn }}"
     is_user: false
     is_server: true
+  - name: kojiweb
+    cn: "{{ koji_hub_fqdn }}"
+    is_user: false
+    is_server: true
 
 # File Permissions
 koji_pki_dir_mode: "0755"