MxOS/ansible-koji
SHA256
Watch
6
0
Fork
You've already forked ansible-koji
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
ansible-koji/.agents/journal/entries/2026-06-16-renich-agent-44789154.md
Rénich Bon Ćirić b7c28ade88
 refactor: change repository path to /srv/www/repo for SELinux compliance 
- Update Caddy tasks and templates to serve from /srv/www/repo.
- Update Koji Hub export script to target /srv/www/repo/.
- Redeploy Caddy config via Ansible.
- Update ADR-05 and package compilation documentation.
- Log progress in the project journal.

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
2026-06-16 16:52:29 -06:00

4.4 KiB
Raw Blame History

Journal: 2026-06-16 (agent-44789154)

==============================

  • [2026-06-16 12:06:23] [agent-44789154] [PRB,DEC,GOT] [prev:5e1354db7c0d7d755c9dfcb9adf6b36a5b7591b466794a514f08e2095ffa78b3] [hash:bf32795c050c4e4334423e30c4ca2a4405f2df2817ceb72c79e8dbb8ad1821a2] Fixed Koji login error (could not verify client: None) by configuring SSLVerifyClient require for /koji/login in kojiweb.conf via Ansible.
  • [2026-06-16 12:08:40] [agent-44789154] [PRB,DEC,GOT] [prev:bf32795c050c4e4334423e30c4ca2a4405f2df2817ceb72c79e8dbb8ad1821a2] [hash:4647fb9e2a341bbff2b0baaf381f076bc3cb29fad6410947469ee57758352b39] Configured SSLVerifyClient optional at VirtualHost level to prevent TLS 1.3 Post-Handshake Authentication (PHA) failures during Koji Web login.
  • [2026-06-16 12:15:09] [agent-44789154] [PRB,DEC,GOT] [prev:4647fb9e2a341bbff2b0baaf381f076bc3cb29fad6410947469ee57758352b39] [hash:1caa695467849353193c7b3c607e3366846d09215ad35f228ba13ae92b44bc29] Disabled TLS 1.3 in Apache to fallback to TLS 1.2, allowing client certificate renegotiation for Koji CLI and daemons (which don't support TLS 1.3 PHA).
  • [2026-06-16 12:17:57] [agent-44789154] [DEC,GOT] [prev:1caa695467849353193c7b3c607e3366846d09215ad35f228ba13ae92b44bc29] [hash:2b7c155f428fc5cca979da324cf854f251a1b26ad91a1f1899cc87501dd54ee7] Added install-ca and remove-ca targets in GNUmakefile to manage local system trust of Koji CA certificate.
  • [2026-06-16 12:22:27] [agent-44789154] [PRB,DEC,GOT] [prev:2b7c155f428fc5cca979da324cf854f251a1b26ad91a1f1899cc87501dd54ee7] [hash:3745d45c850df4f6bc9e839a6b4a25d482ebf271b22da0dcf599810e4b3139c0] Fixed Koji Web client cert auth: set group permissions to apache, changed web.conf key to KojiHubCA, and updated ProxyDNs to support RFC 2253 DN format.
  • [2026-06-16 13:48:49] [agent-44789154] [GOT,DEC] [prev:3745d45c850df4f6bc9e839a6b4a25d482ebf271b22da0dcf599810e4b3139c0] [hash:dad7e97152b063fccb93c95a10b0d3f44b5547cbacb85839c1f57243f603b4bd] Configured local CentOS Stream 10 repository mirroring in playbooks and group variables, establishing Apache host configs on the Hub, NFS mount points, and automated tag URL updates.
  • [2026-06-16 14:47:34] [agent-44789154] [GOT] [prev:dad7e97152b063fccb93c95a10b0d3f44b5547cbacb85839c1f57243f603b4bd] [hash:ff115eb6b7066ffdc4e19a3915954026304bb29e4dcde38f08a98e1dcd66a216] Imported all 4579 package repositories from the Forgejo RPMs organization into the Koji mxos0 build tag.
  • [2026-06-16 15:34:06] [agent-44789154] [GOT,DEC] [prev:ff115eb6b7066ffdc4e19a3915954026304bb29e4dcde38f08a98e1dcd66a216] [hash:267e20bbe8860aa24ba9857f43a7e57fdfe3316d66b0b0fd2373a4f66377d8ea] DEC: Reverted mergerepo_c wrapper and restored correct BaseOS (5) / AppStream (10) priorities on mxos0-build tag. GOT: Cleaned Ansible playbooks, added noarch to builder cs10-koji-03.mx-os arches, successfully triggered and checked rust-siguldry package compilation, created docs/compilación_de_paquetes.rst.
  • [2026-06-16 15:47:09] [agent-44789154] [GOT,DEC] [prev:267e20bbe8860aa24ba9857f43a7e57fdfe3316d66b0b0fd2373a4f66377d8ea] [hash:ba5dc0fe3c77a6f0299c27e3ba1c16c2233d6464e87f9685b77df1f9d61dd298] Calculated topological bootstrap order for all 480 BaseOS packages using DNF API inside a CentOS Stream 10 container. Updated bootstrap-baseos.py on Koji Hub to build packages in this order and started it in the background. Deployed export-koji-to-forgejo.py to sync signed RPMs to the Forgejo Package Registry. Created ADR-05 and updated compilación_de_paquetes.rst.
  • [2026-06-16 16:10:24] [agent-44789154] [GOT,DEC] [prev:ba5dc0fe3c77a6f0299c27e3ba1c16c2233d6464e87f9685b77df1f9d61dd298] [hash:dae096cb37d89f9ef09ef6ac6ad2f2ea981108412ca44b1fc9cd525611f1fee7] DEC: Decided to use a dedicated 500 GB VM serving via Caddy on port 80 as our package repository server instead of Forgejo Package Registry. GOT: Provisioned cs10-repo.mx-os using OpenTofu, configured Caddy via Ansible role, deployed export-koji-to-repo.py on Koji Hub to automatically rsync RPMs and run createrepo_c, and documented the design change in ADR-05 and compilación_de_paquetes.rst.
  • [2026-06-16 16:52:24] [agent-44789154] [DEC,GOT] [prev:dae096cb37d89f9ef09ef6ac6ad2f2ea981108412ca44b1fc9cd525611f1fee7] [hash:b831bf88d615907d7514b2aa6e03025a5d027053791a430be25b58286ca1a7d0] DEC: Updated repository path to /srv/www/repo/ to align with SELinux predefined web content contexts. GOT: Reconfigured caddy Ansible role, updated export-koji-to-repo.py, redeployed, and cleaned up the old /srv/repo directory.