kojid

ansible/playbooks/role-rocky-kojid.yml

@@ -0,0 +1,72 @@
+---
+# Stands up an ipsilon instance for simple SSO
+- name: Configure koji hub and web server
+  hosts: kojihub
+  become: true
+  vars_files:
+  - vars/vaults/encpass.yml
+  - vars/kojid.yml
+
+  # This is to try to avoid the handler issue in pre/post tasks
+  handlers:
+    - import_tasks: handlers/main.yml
+
+  pre_tasks:
+    - name: Check if ansible cannot be run here
+      stat:
+        path: /etc/no-ansible
+      register: no_ansible
+
+    - name: Verify if we can run ansible
+      assert:
+        that:
+          - "not no_ansible.stat.exists"
+        success_msg: "We are able to run on this node"
+        fail_msg: "/etc/no-ansible exists - skipping run on this node"
+
+    # EPEL and PowerTools are required for ipsilon to function
+    # I also couldn't find an ansible built-in to do this
+    - name: Enable the PowerTools repository
+      ini_file:
+        dest: /etc/yum.repos.d/CentOS-Linux-PowerTools.repo
+        section: powertools
+        option: enabled
+        value: 1
+        owner: root
+        group: root
+        mode: '0644'
+
+    # The CentOS extras repos has epel-release provided
+    - name: Enable the EPEL repository
+      yum:
+        name: epel-release
+        state: present
+      tags:
+        - packages
+
+    - name: Install rocky-tools copr
+      yum_repository:
+        name: copr:copr.fedorainfracloud.org:nalika:rockylinux-tool
+        description: Copr repo for rockylinux-tools owned by nalika
+        file: copr_repos
+        baseurl: https://download.copr.fedorainfracloud.org/results/nalika/rockylinux-tools/epel-8-$basearch/
+        gpgcheck: true
+        gpgkey: https://download.copr.fedorainfracloud.org/results/nalika/rockylinux-tools/pubkey.gpg
+        enabled: true
+
+  # Right now, we are not sure how or where we'll get our certificates. So we
+  # are presenting a choice by setting a variable, koji_internal_ca. There is a
+  # change that we will have to do internal certs for mqtt anyway.
+  # TODO: We need an MQTT role and pre_tasks for the keytabs for this role
+  roles:
+    - role: rockylinux.kojid
+      state: present
+
+  post_tasks:
+    - name: Touching run file that ansible has ran here
+      file:
+        path: /var/log/ansible.run
+        state: touch
+        mode: '0644'
+        owner: root
+        group: root

ansible/playbooks/vars/kojid.yml

@@ -0,0 +1,15 @@
+---
+# vars for kojid
+
+kojid_vendor: Rocky
+kojid_packager: infrastructure@rockylinux.org
+kojid_distribution: Rocky
+# These three should probably be specified by special vars
+# kojid_web_url: https://koji.rockylinux.org/koji
+# kojid_hub_url: https://koji.rockylinux.org/kojihub
+# kojid_files_url: https://koji.rockylinux.org/kojifiles
+
+kojid_ca_bundle: /etc/pki/tls/certs/ca-bundle.crt
+kojid_keytab: /etc/kojid.keytab
+kojid_smtp_host: smtp.rockylinux.org
+kojid_allowed_scm: "git.centos.org:/* git.rockylinux.org:/*"

ansible/roles/requirements.yml

@@ -16,6 +16,9 @@ roles:
   - name: rockylinux.kojihub
     src: https://github.com/rocky-linux/ansible-role-kojihub
     version: main
+  - name: rockylinux.kojid
+    src: https://github.com/rocky-linux/ansible-role-kojid
+    version: main
   - name: rockylinux.rabbitmq
     src: https://github.com/rocky-linux/ansible-role-rabbitmq
     version: main