Rénich Bon Ćirić
60a6827c3c
- Define koji_hub_ssl_verify_client in vars/default.yaml with a warning comment. - Update roles/koji_hub/tasks/main.yaml to use the new variable. - Helps document why it is optional in dev/staging (avoid TLS 1.3 PHA) and require in production. Co-developed-by: Gemini AI <renich+gemini@woralelandia.com> Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
114 lines
3.7 KiB
YAML
114 lines
3.7 KiB
YAML
---
|
|
# General Koji Settings
|
|
koji_build_tag: mxos0
|
|
koji_hub_fqdn: cs10-koji-00.mx-os
|
|
koji_admin_user: kojiadmin
|
|
koji_url: "https://{{ koji_hub_fqdn }}/koji"
|
|
koji_profile: koji
|
|
|
|
# Host FQDNs
|
|
kojid_fqdn: cs10-koji-03.mx-os
|
|
koji_db_host: cs10-koji-01.mx-os
|
|
koji_nfs_host: cs10-koji-02.mx-os
|
|
koji_dist_git_fqdn: cs10-koji-04.mx-os
|
|
sigul_server: http://localhost:8080/sigul
|
|
|
|
# Paths & Directories
|
|
koji_top_dir: /mnt/koji
|
|
koji_pki_dir: "{{ playbook_dir }}/certs"
|
|
kojid_work_dir: /var/lib/kojid
|
|
koji_remote_pki_dir: /etc/pki/koji
|
|
koji_hub_config_dir: /etc/koji-hub/hub.conf.d
|
|
koji_hub_koji_web_config_dir: /etc/kojiweb
|
|
koji_hub_koji_client_config_file: /etc/koji.conf.d/ansible-settings.conf
|
|
koji_remote_kojira_conf_path: /etc/kojira/kojira.conf
|
|
koji_remote_kojihub_httpd_conf_path: /etc/httpd/conf.d/kojihub.conf
|
|
koji_remote_kojiweb_httpd_conf_path: /etc/httpd/conf.d/kojiweb.conf
|
|
koji_hub_admin_user_home: "/home/{{ koji_admin_user }}"
|
|
koji_hub_admin_user_koji_dir: "{{ koji_hub_admin_user_home }}/.koji"
|
|
koji_source_script_path: /usr/local/bin/mxos-get-sources.bash
|
|
|
|
# Certificate Paths (Remote)
|
|
koji_hub_cert_path: /etc/pki/koji/kojihub.crt
|
|
koji_hub_key_path: /etc/pki/koji/kojihub.key
|
|
koji_admin_cert_path: /etc/pki/koji/kojiadmin.pem
|
|
koji_admin_key_path: /etc/pki/koji/kojiadmin.key
|
|
kojid_crt_path: /etc/pki/koji/kojid.crt
|
|
kojid_key_path: /etc/pki/koji/kojid.key
|
|
kojid_pem_path: /etc/pki/koji/kojid.pem
|
|
kojira_pem_path: /etc/pki/koji/kojira.pem
|
|
koji_remote_ca_trust_path: /etc/pki/ca-trust/source/anchors/koji_ca.crt
|
|
|
|
# Certificate Settings
|
|
koji_ca_name: "koji_ca"
|
|
koji_cert_expiration_days: 3650 # 10 years
|
|
koji_cert_key_size: 4096
|
|
koji_cert_country: "MX"
|
|
koji_cert_state: "Mexico"
|
|
koji_cert_locality: "Mexico City"
|
|
koji_cert_organization: "MxOS"
|
|
koji_cert_organizational_unit: "Infraestructura"
|
|
|
|
# Certificate Generation List
|
|
common_koji_certs_to_generate:
|
|
- name: kojihub
|
|
cn: "{{ koji_hub_fqdn }}"
|
|
is_user: false
|
|
is_server: true
|
|
- name: kojiweb
|
|
cn: "{{ koji_hub_fqdn }}"
|
|
is_user: false
|
|
is_server: true
|
|
- name: kojira
|
|
cn: kojira
|
|
is_user: false
|
|
- name: kojid
|
|
cn: "{{ kojid_fqdn }}"
|
|
is_user: false
|
|
- name: kojiadmin
|
|
cn: kojiadmin
|
|
is_user: true
|
|
- name: postgresql
|
|
cn: "{{ koji_db_host }}"
|
|
is_user: false
|
|
is_server: true
|
|
- name: dist-git
|
|
cn: "{{ koji_dist_git_fqdn }}"
|
|
is_user: false
|
|
is_server: true
|
|
- name: kojiweb
|
|
cn: "{{ koji_hub_fqdn }}"
|
|
is_user: false
|
|
is_server: true
|
|
|
|
# File Permissions
|
|
koji_pki_dir_mode: "0755"
|
|
koji_pki_file_mode: "0644"
|
|
koji_pki_private_key_mode: "0600"
|
|
koji_client_dir_mode: "0700"
|
|
koji_client_file_mode: "0600"
|
|
|
|
# Kojid Specific Settings
|
|
kojid_max_jobs: 10
|
|
kojid_mock_user: kojibuilder
|
|
kojid_vendor: Fundación MxOS
|
|
kojid_packager: Koji
|
|
kojid_distribution: MxOS
|
|
kojid_allowed_scms: "{{ koji_dist_git_fqdn }}:/RPMs/*:false git.mx-os.mx:*:true:{{ koji_source_script_path }} github.com:/*:false"
|
|
kojid_smtp_host: mail.mx-os.mx
|
|
kojid_smtp_user: kojid@cs10-koji-03.mx-os
|
|
kojid_from_addr: Koji Build System <kojid@cs10-koji-03.mx-os>
|
|
kojid_mock_root: /var/lib/mock/mxos0-build-x86_64
|
|
|
|
# HTTPD/Web Paths
|
|
koji_hub_httpd_ssl_config_file: /etc/httpd/conf.d/ssl.conf
|
|
# WARNING: Set to "require" in production for security. "optional" is used in
|
|
# development/staging to avoid TLS 1.3 Post-Handshake Authentication (PHA)
|
|
# browser errors (like "Cannot perform Post-Handshake Authentication") when
|
|
# logging in to Koji Web (which enforces client certificate validation).
|
|
koji_hub_ssl_verify_client: optional
|
|
koji_cleanup_script_path: /usr/local/bin/koji_cleanup.sh
|
|
koji_cleanup_service_path: /etc/systemd/system/koji-cleanup.service
|
|
koji_cleanup_timer_path: /etc/systemd/system/koji-cleanup.timer
|
|
koji_callbacks_script_path: /usr/local/bin/koji_callbacks.py
|
|
koji_callbacks_config_path: /etc/koji-hub/hub.conf.d/callbacks.conf
|