Provide a downloadable DNF repo configuration file at
http://cs10-repo.mx-os/mxos.repo that points to our CentOS Stream 10
BaseOS structured layout (binary, debug, and source packages).
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Add fallback to official CentOS Stream lookaside cache in SCM get-sources script
- Update documentation to reflect CentOS-style structured repositories on cs10-repo
- Update project journal with progress and decisions
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
Remove the centered max-width #wrap layout on desktop viewport widths
and clear default #innerwrap margins to allow Koji Web tables to utilize
the full screen width, preventing layout cramming.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Update Caddy tasks and templates to serve from /srv/www/repo.
- Update Koji Hub export script to target /srv/www/repo/.
- Redeploy Caddy config via Ansible.
- Update ADR-05 and package compilation documentation.
- Log progress in the project journal.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Provision cs10-repo.mx-os VM with 500 GB system disk using OpenTofu.
- Create and apply Ansible role to install and configure Caddy to serve /srv/repo/.
- Update Koji Hub export script to rsync signed binary RPMs to the repo server and trigger createrepo_c.
- Record ADR-05 detailing this design decision and update package compilation guide.
- Log progress in the project journal.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Record ADR-05 detailing the topological sorting and cyclic group resolution.
- Update package compilation guide with instructions for running the bootstrap daemon and the Forgejo package exporter.
- Log agent progress in the project journal.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
Add configurations to playbooks and templates for local repository mirroring.
This exports and mounts the CentOS Stream 10 local mirror directory (/srv/nfs/cs10),
deploys the Apache configuration serving it from the Hub, and parameters the Koji
external repository bootstrap tasks to synchronize target URLs with local mirrors.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Configurar GnuPG con gnupg-pkcs11-scd y libsiguldry_pkcs11.so para el usuario root.
- Importar clave pública de firma de Siguldry al llavero GPG de root automáticamente.
- Modificar el spooler para usar rpmsign con la macro _gpg_name en lugar de Sequoia (_openpgp_sign).
- Remover el argumento keyword no soportado 'sigkey' de add_rpm_sig().
- Definir variables de entorno SIGULDRY_SOCKET y CREDENTIALS_DIRECTORY en el servicio systemd del spooler.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Use loop-specific owner/group variables for copying certificates in roles/koji_hub/tasks/main.yaml so group: apache is actually applied.
- Update roles/koji_hub/templates/hub.conf.j2 to specify both slash-separated and RFC 2253 comma-separated formats in ProxyDNs.
- Update roles/koji_hub/templates/web.conf.j2 to use KojiHubCA instead of serverca for the web config block.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Add install-ca and remove-ca targets to GNUmakefile.
- Allows local installation/removal of certs/koji_ca_cert.crt into the system CA trust anchors.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Set SSLProtocol to disable TLS 1.3 in ssl.conf on Apache, enabling standard TLS 1.2 client certificate renegotiation.
- Revert the temporary global SSLVerifyClient/Depth optional configuration at VirtualHost level.
- Save DB connection to kojihub.context.cnx in sign spooler.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Define koji_hub_ssl_verify_client in vars/default.yaml with a warning comment.
- Update roles/koji_hub/tasks/main.yaml to use the new variable.
- Helps document why it is optional in dev/staging (avoid TLS 1.3 PHA) and require in production.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Add SSLVerifyClient optional and SSLVerifyDepth 10 to the loop configuring ssl.conf in roles/koji_hub/tasks/main.yaml.
- This forces the client certificate request to happen during the initial TLS handshake, bypassing TLS 1.3 Post-Handshake Authentication (PHA) failures.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Add Apache configuration block in roles/koji_hub/tasks/main.yaml to require SSL client certificate authentication for /koji/login inside kojiweb.conf.
- Fixes the koji.AuthError: could not verify client: None error during Koji Web login.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
* Se agrega white-space: nowrap a las pestañas del menú de navegación para asegurar que textos con múltiples palabras como \"Build Targets\" se mantengan en una sola línea.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Remove wrap max-width to allow the content to use 100% width on ultra-wide screens.
- Clean up duplicate and old CSS blocks from the tasks file.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Set #wrap background to transparent and remove its box shadow to prevent the header and nav from looking boxed and cut off.
- Convert tables to self-contained visual cards with white backgrounds, border-radii, and shadows.
- Enlarge body font size to 16px, table text to 15px, and nav/search elements to improve readability.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Scope table responsiveness (display: block) strictly within the mobile media query. This restores table widths back to 100% on desktop layout.
- Refine table styles by differentiating layout tables (table.data-list, table.list) from vertical key-value information tables (table th), giving them a clean layout with right-aligned headers and Slate 100 background.
- Increase page font-size base, padding, and add a drop-shadowed white container wrapper for a modern, clean visual presentation.
- Theme h4 table headers with Slate 900 and a 4px Emerald border accent to override Koji's default blue.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Add a task to check and inject the viewport meta tag inside Koji's Cheetah header template.
- Add CSS media queries to reorganize the header and navigation bar elements vertically on narrow screens.
- Implement inline horizontal scroll on table tags to prevent viewports from expanding beyond mobile screen widths.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Correct the relative stylesheet import path to '../../koji.css' in the theme file to restore base styles and resolve the unstyled vertical navigation menu list.
- Restore the round logo layout scaled to 50px of height.
- Style the mainNav tabs menu with Slate/Emerald colors to match the theme.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Configure mxos-packages DNF repository to allow siguldry-pkcs11 package resolution.
- Verify if rsvg-convert exists on localhost to bypass become/dnf installation check when passwordless sudo is unavailable.
- Align PKCS#11 module path to /usr/lib64/pkcs11/libsiguldry_pkcs11.so in spooler and docs.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
* Conversión automática de logotipos SVG a PNG mediante librsvg2-tools en localhost
* Despliegue de los assets gráficos en el directorio de temas de Koji Web
* Creación de la hoja de estilos koji.css con overrides de color corporativo (Verde Esmeralda #10b981)
* Activación del tema mxos en web.conf de Koji Web
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
* Explicación de la carga de RPMs a través del API de Forgejo
* Configuración del repositorio local DNF
* Ejemplo de workflow en YAML para Forgejo Actions
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
* Implementación del rol de Ansible 'siguldry' para CentOS Stream 10
* Migración del plugin de firmas de Koji Hub a un spooler asíncrono
* Modificación de roles para utilizar empaquetamiento RPM nativo de siguldry-pkcs11
* Documentación de decisiones (ADRs) y roadmap en docs/technical/
* Limpieza de binarios locales pesados de PKCS#11 en Ansible
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
Modernized HCL syntax with object notation
Increased SSH timeout from 1m to 2m for first boot
Fixed script name typo: dnf-config.bash → dnf-conf.bash
Simplified VM configuration (removed rngs, serials, tpms, graphics)
Tested and working
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Cambiar URLs de HTTP a HTTPS en koji.conf.j2 para consistencia SSL
- Agregar WebCert en web.conf.j2 para autenticación proxy SSL
- Generar y desplegar certificado kojiweb.pem
- Configurar MaxConnectionsPerChild=100 en httpd para prevenir fugas de memoria
Co-authored-by: Assistant <renich+assistant@evalinux.com>
- Configurar rol dist_git como Lookaside Cache únicamente (sin git-daemon).
- Actualizar estructura de caché a 'rpms/pkg/file/algo/hash/file' compatible con upstream.
- Añadir scripts bin/sync-sources.bash y bin/sync-all-sources.bash para sincronizar fuentes desde CentOS Stream.
- Eliminar bin/import-srpm.bash obsoleto.
- Actualizar script mxos-get-sources.bash en kojid para usar la nueva estructura de URL.
- Corregir lógica de 'add-host' en koji_bootstrap para manejar reintentos limpiamente.
- Actualizar documentación (README.rst, docs/instalación.rst) reflejando los cambios.
- Correcciones menores en rutas de configuración y nombres de grupos en deploy.yaml.
Este commit introduce varias mejoras en los roles de Ansible para Koji:
- **Rol koji_hub:**
- Se reemplazó `lineinfile` con una plantilla completa para `hub.conf` para mejorar la legibilidad y mantenibilidad.
- Se aseguró la instalación del paquete `python3-koji-hub-plugins` para soportar el plugin `echo`.
- Se eliminó una tarea `blockinfile` redundante que duplicaba la configuración de la base de datos en `hub.conf`.
- Se rehabilitó el plugin `echo` en `hub.conf` después de asegurar su disponibilidad.
- **Rol postgresql:**
- Se modificó la configuración de `pg_hba.conf` para iterar correctamente sobre todos los hosts en el grupo `kojihub`, asegurando que todas las instancias del hub puedan conectarse a la base de datos.
- **Rol dist_git:**
- Se implementó el etiquetado persistente de contextos SELinux para los directorios de `dist-git` usando `semanage fcontext` y `restorecon`, asegurando que los contextos persistan tras reetiquetados del sistema de archivos.
- **Rol common:**
- Se mejoró la seguridad en la generación de claves GPG usando un archivo temporal para el script por lotes, el cual se elimina de forma segura después de la generación de la clave.
- **Configuración Global:**
- Se introdujo la variable `koji_source_script_path` en `vars/default.yaml` para centralizar la ruta del script `mxos-get-sources.bash`, eliminando rutas hardcodeadas en `kojid_allowed_scms` y las tareas de `kojid`.
- **Documentación:**
- Se actualizó `docs/instalación.rst` para reflejar los cambios en la configuración de Dist-Git, plugins y variables.
Se estandarizan los nombres de los directorios de roles, cambiando guiones por guiones bajos.
Se añaden nuevos scripts para limpieza y callbacks en Koji Hub. Además, se actualizan las configuraciones de Kojid, Kojira y PostgreSQL, incluyendo la instalación de paquetes, ajustes de mock y la gestión de variables.
