fix(koji): Corregir configuración SSL y seguridad del Hub

- Cambiar URLs de HTTP a HTTPS en koji.conf.j2 para consistencia SSL
- Agregar WebCert en web.conf.j2 para autenticación proxy SSL
- Generar y desplegar certificado kojiweb.pem
- Configurar MaxConnectionsPerChild=100 en httpd para prevenir fugas de memoria

Co-authored-by: Assistant <renich+assistant@evalinux.com>

roles/koji_hub/tasks/main.yaml

@@ -125,6 +125,7 @@
     - { src: "kojihub.pem", dest: "/etc/pki/koji/kojihub.pem", mode: "0644", group: "apache" }
     - { src: "kojiadmin.pem", dest: "{{ koji_admin_cert_path }}", mode: "0644" }
     - { src: "kojira.pem", dest: "/etc/pki/koji/kojira.pem", mode: "0640", group: "kojira" }
+    - { src: "kojiweb.pem", dest: "/etc/pki/koji/kojiweb.pem", mode: "0640", group: "apache" }
 
 - name: Update CA trust store
   ansible.builtin.command: update-ca-trust
@@ -195,6 +196,15 @@
     - httpd_use_nfs
   notify: Restart httpd
 
+- name: Configure httpd MaxConnectionsPerChild to prevent memory leaks
+  ansible.builtin.lineinfile:
+    path: /etc/httpd/conf/httpd.conf
+    regexp: '^#?\s*MaxConnectionsPerChild\s+\d+'
+    line: 'MaxConnectionsPerChild 100'
+    state: present
+    backup: true
+  notify: Restart httpd
+
 - name: Start and enable httpd
   ansible.builtin.service:
     name: httpd

roles/koji_hub/templates/koji.conf.j2

@@ -1,7 +1,7 @@
 [koji]
 server = https://{{ koji_hub_fqdn }}/kojihub
-weburl = http://{{ koji_hub_fqdn }}/koji
+weburl = https://{{ koji_hub_fqdn }}/koji
-topurl = http://{{ koji_hub_fqdn }}/kojifiles
+topurl = https://{{ koji_hub_fqdn }}/kojifiles
 topdir = {{ koji_top_dir }}
 cert = ~/.koji/client.pem
 key = /home/{{ koji_admin_user }}/.koji/client.key

roles/koji_hub/templates/web.conf.j2

@@ -3,6 +3,7 @@ SiteName = MxOS koji
 KojiHubURL = https://{{ koji_hub_fqdn }}/kojihub
 KojiFilesURL = https://{{ koji_hub_fqdn }}/kojifiles
 WebAuthType = ssl
+WebCert = /etc/pki/koji/kojiweb.pem
 LoginTimeout = 72
 Secret = {{ web_secret }}
 LibPath = /usr/share/koji-web/lib

vars/default.yaml

@@ -76,6 +76,10 @@ common_koji_certs_to_generate:
     cn: "{{ koji_dist_git_fqdn }}"
     is_user: false
     is_server: true
+  - name: kojiweb
+    cn: "{{ koji_hub_fqdn }}"
+    is_user: false
+    is_server: true
 
 # File Permissions
 koji_pki_dir_mode: "0755"