roles/koji-web: Deploy the Koji Web UI
The *koji-web* role installs and configures the Koji Web GUI front-end for Koji. It requires Apache and mod_wsgi. A client certificate is required for authentication to the hub, and must be placed in the host-specific subdirectory of `certs/koji`.jenkins-master
parent
6341d972f6
commit
da4ec1612c
|
|
@ -0,0 +1,11 @@
|
||||||
|
koji_uid: 998
|
||||||
|
koji_gid: 996
|
||||||
|
koji_home: /var/lib/koji
|
||||||
|
kojihub_host: "{{ ansible_fqdn }}"
|
||||||
|
kojihub_url: https://{{ kojihub_host }}/kojihub
|
||||||
|
kojiweb_hostname: "{{ kojihub_host }}"
|
||||||
|
kojiweb_url: https://{{ kojiweb_hostname }}/koji
|
||||||
|
kojifiles_host: "{{ kojihub_host }}"
|
||||||
|
kojifiles_url: http://{{ kojifiles_host }}/kojifiles
|
||||||
|
kojiweb_secret: >
|
||||||
|
{{ lookup("password", "passwords/kojiweb_secret/" + inventory_hostname) }}
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
- name: update ca trust
|
||||||
|
command: update-ca-trust
|
||||||
|
|
@ -0,0 +1,64 @@
|
||||||
|
- name: ensure packages are installed
|
||||||
|
package:
|
||||||
|
name={{ koji_web_packages|join(',') }}
|
||||||
|
state=present
|
||||||
|
tags:
|
||||||
|
- install
|
||||||
|
notify: restart httpd
|
||||||
|
- meta: flush_handlers
|
||||||
|
|
||||||
|
- name: ensure koji group exists
|
||||||
|
group:
|
||||||
|
name=koji
|
||||||
|
gid={{ koji_gid }}
|
||||||
|
state=present
|
||||||
|
- name: ensure koji user exists
|
||||||
|
user:
|
||||||
|
name=koji
|
||||||
|
home={{ koji_home }}
|
||||||
|
createhome=no
|
||||||
|
group=koji
|
||||||
|
uid={{ koji_uid }}
|
||||||
|
state=present
|
||||||
|
|
||||||
|
- name: ensure koji web certificate is installed
|
||||||
|
copy:
|
||||||
|
src={{ item }}
|
||||||
|
dest=/etc/kojiweb/{{ item|basename }}
|
||||||
|
mode=0440
|
||||||
|
owner=root
|
||||||
|
group=koji
|
||||||
|
with_fileglob:
|
||||||
|
- certs/koji/{{ inventory_hostname }}/kojiweb.pem
|
||||||
|
- name: ensure koji web ca certificates are installed
|
||||||
|
copy:
|
||||||
|
src={{ item }}
|
||||||
|
dest=/etc/kojiweb/{{ item|basename }}
|
||||||
|
mode=0644
|
||||||
|
with_fileglob:
|
||||||
|
- certs/koji/{{ inventory_hostname }}/*.crt
|
||||||
|
- name: ensure koji hub server ca certificate is trusted
|
||||||
|
copy:
|
||||||
|
src={{ item }}
|
||||||
|
dest=/etc/pki/ca-trust/source/anchors/koji-hub.crt
|
||||||
|
mode=0644
|
||||||
|
with_fileglob:
|
||||||
|
- certs/koji/{{ inventory_hostname }}/kojihubca.crt
|
||||||
|
notify: update ca trust
|
||||||
|
- name: ensure koji web is configured
|
||||||
|
template:
|
||||||
|
src=web.conf.j2
|
||||||
|
dest=/etc/kojiweb/web.conf
|
||||||
|
mode=0644
|
||||||
|
notify: reload httpd
|
||||||
|
|
||||||
|
- name: ensure apache is configured to serve koji web
|
||||||
|
template:
|
||||||
|
src=kojiweb.httpd.conf.j2
|
||||||
|
dest=/etc/httpd/conf.d/kojiweb.conf
|
||||||
|
notify: reload httpd
|
||||||
|
- name: ensure apache is allowed to make network connections
|
||||||
|
seboolean:
|
||||||
|
name=httpd_can_network_connect
|
||||||
|
persistent=yes
|
||||||
|
state=yes
|
||||||
|
|
@ -0,0 +1,72 @@
|
||||||
|
<VirtualHost _default_:443>
|
||||||
|
Include conf.d/ssl.include
|
||||||
|
|
||||||
|
SSLCertificateFile {{ apache_ssl_certificate }}
|
||||||
|
SSLCertificateKeyFile {{ apache_ssl_certificate_key }}
|
||||||
|
SSLCertificateChainFile {{ apache_ssl_certificate }}
|
||||||
|
SSLCACertificateFile {{ apache_ssl_ca_certificate }}
|
||||||
|
|
||||||
|
RewriteEngine On
|
||||||
|
RewriteRule ^/?$ /koji/ [R=301,L]
|
||||||
|
</VirtualHost>
|
||||||
|
|
||||||
|
RewriteEngine On
|
||||||
|
RewriteCond %{HTTPS} !on
|
||||||
|
RewriteRule /koji/.* https://{{ kojiweb_hostname }}$0 [R=301,L]
|
||||||
|
|
||||||
|
#We use wsgi by default
|
||||||
|
#Alias /koji "/usr/share/koji-web/scripts/wsgi_publisher.py"
|
||||||
|
#(configuration goes in /etc/kojiweb/web.conf)
|
||||||
|
|
||||||
|
WSGIDaemonProcess kojiweb \
|
||||||
|
user=koji \
|
||||||
|
group=koji \
|
||||||
|
display-name=%{GROUP}
|
||||||
|
WSGIScriptAlias /koji /usr/share/koji-web/scripts/wsgi_publisher.py \
|
||||||
|
process-group=koji
|
||||||
|
|
||||||
|
<Directory "/usr/share/koji-web/scripts/">
|
||||||
|
<IfVersion < 2.4>
|
||||||
|
Order allow,deny
|
||||||
|
Allow from all
|
||||||
|
</IfVersion>
|
||||||
|
<IfVersion >= 2.4>
|
||||||
|
Require all granted
|
||||||
|
</IfVersion>
|
||||||
|
</Directory>
|
||||||
|
|
||||||
|
# uncomment this to enable authentication via Kerberos
|
||||||
|
# <Location /koji/login>
|
||||||
|
# AuthType Kerberos
|
||||||
|
# AuthName "Koji Web UI"
|
||||||
|
# KrbMethodNegotiate on
|
||||||
|
# KrbMethodK5Passwd off
|
||||||
|
# KrbServiceName HTTP
|
||||||
|
# KrbAuthRealm EXAMPLE.COM
|
||||||
|
# Krb5Keytab /etc/httpd.keytab
|
||||||
|
# KrbSaveCredentials off
|
||||||
|
# Require valid-user
|
||||||
|
# ErrorDocument 401 /koji-static/errors/unauthorized.html
|
||||||
|
# </Location>
|
||||||
|
|
||||||
|
# uncomment this to enable authentication via SSL client certificates
|
||||||
|
<Location /koji/login>
|
||||||
|
SSLVerifyClient optional
|
||||||
|
SSLVerifyDepth 10
|
||||||
|
SSLOptions +StdEnvVars
|
||||||
|
ErrorDocument 401 /koji-static/errors/unauthorized.html
|
||||||
|
</Location>
|
||||||
|
|
||||||
|
Alias /koji-static/ "/usr/share/koji-web/static/"
|
||||||
|
|
||||||
|
<Directory "/usr/share/koji-web/static/">
|
||||||
|
Options None
|
||||||
|
AllowOverride None
|
||||||
|
<IfVersion < 2.4>
|
||||||
|
Order allow,deny
|
||||||
|
Allow from all
|
||||||
|
</IfVersion>
|
||||||
|
<IfVersion >= 2.4>
|
||||||
|
Require all granted
|
||||||
|
</IfVersion>
|
||||||
|
</Directory>
|
||||||
|
|
@ -0,0 +1,37 @@
|
||||||
|
{#- vim: set ft=jinja : -#}
|
||||||
|
[web]
|
||||||
|
SiteName = koji
|
||||||
|
#KojiTheme = mytheme
|
||||||
|
|
||||||
|
# Key urls
|
||||||
|
KojiHubURL = {{ kojihub_url }}
|
||||||
|
KojiFilesURL = {{ kojifiles_url }}
|
||||||
|
|
||||||
|
# Kerberos authentication options
|
||||||
|
# WebPrincipal = koji/web@EXAMPLE.COM
|
||||||
|
# WebKeytab = /etc/httpd.keytab
|
||||||
|
# WebCCache = /var/tmp/kojiweb.ccache
|
||||||
|
# The service name of the principal being used by the hub
|
||||||
|
# KrbService = host
|
||||||
|
|
||||||
|
# SSL authentication options
|
||||||
|
WebCert = /etc/kojiweb/kojiweb.pem
|
||||||
|
ClientCA = /etc/kojiweb/clientca.crt
|
||||||
|
KojiHubCA = /etc/kojiweb/kojihubca.crt
|
||||||
|
|
||||||
|
LoginTimeout = 72
|
||||||
|
|
||||||
|
# This must be changed and uncommented before deployment
|
||||||
|
Secret = {{ kojiweb_secret }}
|
||||||
|
|
||||||
|
LibPath = /usr/share/koji-web/lib
|
||||||
|
|
||||||
|
# If set to True, then the footer will be included literally.
|
||||||
|
# If False, then the footer will be included as another Kid Template.
|
||||||
|
# Defaults to True
|
||||||
|
LiteralFooter = True
|
||||||
|
|
||||||
|
# This can be a space-delimited list of the numeric IDs of users that you want
|
||||||
|
# to hide from tasks listed on the front page. You might want to, for instance,
|
||||||
|
# hide the activity of an account used for continuous integration.
|
||||||
|
#HiddenUsers = 5372 1234
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
koji_web_packages:
|
||||||
|
- koji-web
|
||||||
Loading…
Reference in New Issue