mirror of
https://src.koozali.org/infra/smeserver-koji.git
synced 2024-11-21 17:17:28 +01:00
removed old, unused scripts
This commit is contained in:
parent
42a061199c
commit
40d55c87d9
@ -1,53 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Copyright (C) 2019 Intel Corporation
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
|
|
||||||
set -xe
|
|
||||||
SCRIPT_DIR="$(dirname "$(realpath "$0")")"
|
|
||||||
source "$SCRIPT_DIR"/globals.sh
|
|
||||||
source "$SCRIPT_DIR"/parameters.sh
|
|
||||||
|
|
||||||
STAGING_RPM_DIR="$KOJI_DIR/work/imported-rpms"
|
|
||||||
STAGING_RPM_SRC_DIR="$STAGING_RPM_DIR/src"
|
|
||||||
STAGING_RPM_BIN_DIR="$STAGING_RPM_DIR/bin"
|
|
||||||
STAGING_RPM_DEBUG_DIR="$STAGING_RPM_DIR/debug"
|
|
||||||
|
|
||||||
import_koji_pkg() {
|
|
||||||
local src_dir="$1"
|
|
||||||
local dst_dir="$2"
|
|
||||||
local search_pattern="$3"
|
|
||||||
cp -r "$src_dir" "$dst_dir"
|
|
||||||
chown -R "$HTTPD_USER":"$HTTPD_USER" "$dst_dir"
|
|
||||||
find "$dst_dir" -name "$search_pattern" -exec koji import --link {} + > /dev/null
|
|
||||||
}
|
|
||||||
|
|
||||||
if [[ -n "$SRC_RPM_DIR" && -n "$BIN_RPM_DIR" ]]; then
|
|
||||||
ADMIN_KOJI_DIR="$(echo ~kojiadmin)/.koji"
|
|
||||||
cp -r "$ADMIN_KOJI_DIR" "$HOME/.koji"
|
|
||||||
mkdir -p "$STAGING_RPM_DIR"
|
|
||||||
chown -R "$HTTPD_USER":"$HTTPD_USER" "$STAGING_RPM_DIR"
|
|
||||||
|
|
||||||
import_koji_pkg "$SRC_RPM_DIR" "$STAGING_RPM_SRC_DIR" "*.src.rpm"
|
|
||||||
import_koji_pkg "$BIN_RPM_DIR" "$STAGING_RPM_BIN_DIR" "*.$RPM_ARCH.rpm"
|
|
||||||
if [[ -n "$DEBUG_RPM_DIR" ]]; then
|
|
||||||
import_koji_pkg "$DEBUG_RPM_DIR" "$STAGING_RPM_DEBUG_DIR" "*.$RPM_ARCH.rpm"
|
|
||||||
fi
|
|
||||||
|
|
||||||
rm -rf "$STAGING_RPM_DIR" "$HOME/.koji"
|
|
||||||
fi
|
|
||||||
sudo -u kojiadmin koji add-tag dist-"$TAG_NAME"
|
|
||||||
sudo -u kojiadmin koji edit-tag dist-"$TAG_NAME" -x mock.package_manager=dnf
|
|
||||||
if [[ -n "$SRC_RPM_DIR" && -n "$BIN_RPM_DIR" ]]; then
|
|
||||||
sudo -u kojiadmin koji list-pkgs --quiet | xargs sudo -u kojiadmin koji add-pkg --owner kojiadmin dist-"$TAG_NAME"
|
|
||||||
sudo -u kojiadmin koji list-untagged | xargs -n 1 -P 100 sudo -u kojiadmin koji call tagBuildBypass dist-"$TAG_NAME" > /dev/null
|
|
||||||
fi
|
|
||||||
sudo -u kojiadmin koji add-tag --parent dist-"$TAG_NAME" --arches "$RPM_ARCH" dist-"$TAG_NAME"-build
|
|
||||||
sudo -u kojiadmin koji add-target dist-"$TAG_NAME" dist-"$TAG_NAME"-build
|
|
||||||
sudo -u kojiadmin koji add-group dist-"$TAG_NAME"-build build
|
|
||||||
sudo -u kojiadmin koji add-group dist-"$TAG_NAME"-build srpm-build
|
|
||||||
sudo -u kojiadmin koji add-group-pkg dist-"$TAG_NAME"-build build autoconf automake automake-dev binutils bzip2 clr-rpm-config coreutils cpio diffutils elfutils file gawk gcc gcc-dev gettext gettext-bin git glibc-dev glibc-locale glibc-utils grep gzip hostname libc6-dev libcap libtool libtool-dev linux-libc-headers m4 make netbase nss-altfiles patch pigz pkg-config pkg-config-dev rpm sed shadow systemd-lib tar unzip which xz
|
|
||||||
sudo -u kojiadmin koji add-group-pkg dist-"$TAG_NAME"-build srpm-build coreutils cpio curl-bin elfutils file git glibc-utils grep gzip make pigz plzip rpm sed shadow tar unzip wget xz
|
|
||||||
if [[ -n "$EXTERNAL_REPO" ]]; then
|
|
||||||
sudo -u kojiadmin koji add-external-repo -t dist-"$TAG_NAME"-build dist-"$TAG_NAME"-external-repo "$EXTERNAL_REPO"
|
|
||||||
fi
|
|
||||||
sudo -u kojiadmin koji regen-repo dist-"$TAG_NAME"-build
|
|
||||||
@ -1,57 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Copyright (C) 2019 Intel Corporation
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
|
|
||||||
set -xe
|
|
||||||
SCRIPT_DIR="$(dirname "$(realpath "$0")")"
|
|
||||||
source "$SCRIPT_DIR"/globals.sh
|
|
||||||
source "$SCRIPT_DIR"/parameters.sh
|
|
||||||
|
|
||||||
KOJI_BUILD_FQDN="$(hostname -f)"
|
|
||||||
# Install the koji builder componelts from epel
|
|
||||||
dnf install -y epel-release
|
|
||||||
dnf install -y koji-builder
|
|
||||||
|
|
||||||
# Create mock folders and permissions
|
|
||||||
mkdir -p /etc/mock/koji
|
|
||||||
mkdir -p /var/lib/mock
|
|
||||||
chown -R root:mock /var/lib/mock
|
|
||||||
|
|
||||||
# Setup User Accounts
|
|
||||||
# useradd -r kojibuilder
|
|
||||||
usermod -G mock kojibuilder
|
|
||||||
|
|
||||||
# Kojid Configuration Files
|
|
||||||
KOJI_TOP_DIR="$KOJI_DIR"
|
|
||||||
mkdir -p /etc/kojid
|
|
||||||
cat > /etc/kojid/kojid.conf <<- EOF
|
|
||||||
[kojid]
|
|
||||||
sleeptime=5
|
|
||||||
maxjobs=16
|
|
||||||
topdir=$KOJI_TOP_DIR
|
|
||||||
workdir=/tmp/koji
|
|
||||||
mockdir=/var/lib/mock
|
|
||||||
mockuser=kojibuilder
|
|
||||||
mockhost=generic-linux-gnu
|
|
||||||
user=$KOJI_BUILD_FQDN
|
|
||||||
server=$KOJI_URL/kojihub
|
|
||||||
topurl=$KOJI_URL/kojifiles
|
|
||||||
use_createrepo_c=True
|
|
||||||
allowed_scms=$GIT_FQDN:/packages/*
|
|
||||||
cert = $KOJI_PKI_DIR/$KOJI_BUILD_FQDN.pem
|
|
||||||
serverca = $KOJI_PKI_DIR/koji_ca_cert.crt
|
|
||||||
EOF
|
|
||||||
|
|
||||||
if env | grep -q proxy; then
|
|
||||||
echo "yum_proxy = $https_proxy" >> /etc/kojid/kojid.conf
|
|
||||||
mkdir -p /etc/systemd/system/kojid.service.d
|
|
||||||
cat > /etc/systemd/system/kojid.service.d/00-proxy.conf <<- EOF
|
|
||||||
[Service]
|
|
||||||
Environment="http_proxy=$http_proxy"
|
|
||||||
Environment="https_proxy=$https_proxy"
|
|
||||||
Environment="no_proxy=$no_proxy"
|
|
||||||
EOF
|
|
||||||
systemctl daemon-reload
|
|
||||||
fi
|
|
||||||
|
|
||||||
systemctl enable --now kojid
|
|
||||||
@ -1,31 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Copyright (C) 2019 Intel Corporation
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
|
|
||||||
set -xe
|
|
||||||
SCRIPT_DIR="$(dirname "$(realpath "$0")")"
|
|
||||||
source "$SCRIPT_DIR"/globals.sh
|
|
||||||
source "$SCRIPT_DIR"/parameters.sh
|
|
||||||
|
|
||||||
# Install nfs-utils
|
|
||||||
dnf install -y nfs-utils
|
|
||||||
|
|
||||||
KOJI_MOUNT_SERVICE="${KOJI_DIR:1}"
|
|
||||||
KOJI_MOUNT_SERVICE="${KOJI_MOUNT_SERVICE/\//-}".mount
|
|
||||||
mkdir -p /etc/systemd/system
|
|
||||||
cat > /etc/systemd/system/"$KOJI_MOUNT_SERVICE" <<- EOF
|
|
||||||
[Unit]
|
|
||||||
Description=Koji NFS Mount
|
|
||||||
After=network.target
|
|
||||||
|
|
||||||
[Mount]
|
|
||||||
What=$KOJI_HUB_FQDN:$KOJI_DIR
|
|
||||||
Where=$KOJI_DIR
|
|
||||||
Type=nfs
|
|
||||||
Options=defaults,ro
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
EOF
|
|
||||||
systemctl daemon-reload
|
|
||||||
systemctl enable --now "$KOJI_MOUNT_SERVICE"
|
|
||||||
@ -1,26 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Copyright (C) 2019 Intel Corporation
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
|
|
||||||
set -xe
|
|
||||||
SCRIPT_DIR="$(dirname "$(realpath "$0")")"
|
|
||||||
source "$SCRIPT_DIR"/globals.sh
|
|
||||||
source "$SCRIPT_DIR"/parameters.sh
|
|
||||||
|
|
||||||
KOJI_BUILD_FQDN=$1
|
|
||||||
|
|
||||||
dnf install -y nfs-utils
|
|
||||||
|
|
||||||
# Export server directory to be mounted by clients
|
|
||||||
echo "$KOJI_DIR $KOJI_BUILD_FQDN(ro,no_root_squash)" >> /etc/exports
|
|
||||||
|
|
||||||
# allow nfs usage in selinux and firewall
|
|
||||||
setsebool -P httpd_use_nfs=1
|
|
||||||
|
|
||||||
firewall-cmd --permanent --add-service=nfs
|
|
||||||
firewall-cmd --permanent --add-service=mountd
|
|
||||||
firewall-cmd --permanent --add-service=rpc-bind
|
|
||||||
firewall-cmd --reload
|
|
||||||
|
|
||||||
systemctl enable --now rpcbind
|
|
||||||
systemctl enable --now nfs-server
|
|
||||||
@ -1,345 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Copyright (C) 2019 Intel Corporation
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
|
|
||||||
set -xe
|
|
||||||
SCRIPT_DIR="$(dirname "$(realpath "$0")")"
|
|
||||||
source "$SCRIPT_DIR"/globals.sh
|
|
||||||
source "$SCRIPT_DIR"/parameters.sh
|
|
||||||
|
|
||||||
# Install all the required packages (some live in the epel repo, so we need to install that too)
|
|
||||||
dnf config-manager --set-enabled powertools
|
|
||||||
dnf install -y epel-release
|
|
||||||
dnf install -y koji-hub mod_ssl koji koji-web koji-utils policycoreutils-python-utils
|
|
||||||
dnf module enable postgresql:10 -y
|
|
||||||
dnf install -y postgresql-server
|
|
||||||
|
|
||||||
## SETTING UP SSL CERTIFICATES FOR AUTHENTICATION
|
|
||||||
mkdir -p "$KOJI_PKI_DIR"/{certs,private}
|
|
||||||
RANDFILE="$KOJI_PKI_DIR"/.rand
|
|
||||||
dd if=/dev/urandom of="$RANDFILE" bs=256 count=1
|
|
||||||
|
|
||||||
# Certificate generation
|
|
||||||
cat > "$KOJI_PKI_DIR"/ssl.cnf <<- EOF
|
|
||||||
HOME = $KOJI_PKI_DIR
|
|
||||||
RANDFILE = $RANDFILE
|
|
||||||
|
|
||||||
[ca]
|
|
||||||
default_ca = ca_default
|
|
||||||
|
|
||||||
[ca_default]
|
|
||||||
dir = $KOJI_PKI_DIR
|
|
||||||
certs = \$dir/certs
|
|
||||||
crl_dir = \$dir/crl
|
|
||||||
database = \$dir/index.txt
|
|
||||||
new_certs_dir = \$dir/newcerts
|
|
||||||
certificate = \$dir/%s_ca_cert.pem
|
|
||||||
private_key = \$dir/private/%s_ca_key.pem
|
|
||||||
serial = \$dir/serial
|
|
||||||
crl = \$dir/crl.pem
|
|
||||||
x509_extensions = usr_cert
|
|
||||||
name_opt = ca_default
|
|
||||||
cert_opt = ca_default
|
|
||||||
default_days = 3650
|
|
||||||
default_crl_days = 30
|
|
||||||
default_md = sha512
|
|
||||||
preserve = no
|
|
||||||
policy = policy_match
|
|
||||||
|
|
||||||
[policy_match]
|
|
||||||
countryName = match
|
|
||||||
stateOrProvinceName = match
|
|
||||||
organizationName = match
|
|
||||||
organizationalUnitName = optional
|
|
||||||
commonName = supplied
|
|
||||||
emailAddress = optional
|
|
||||||
|
|
||||||
[req]
|
|
||||||
default_bits = 4096
|
|
||||||
default_keyfile = privkey.pem
|
|
||||||
default_md = sha512
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
attributes = req_attributes
|
|
||||||
x509_extensions = v3_ca # The extensions to add to the self signed cert
|
|
||||||
string_mask = MASK:0x2002
|
|
||||||
|
|
||||||
[req_distinguished_name]
|
|
||||||
countryName = Country Name (2 letter code)
|
|
||||||
countryName_min = 2
|
|
||||||
countryName_max = 2
|
|
||||||
stateOrProvinceName = State or Province Name (full name)
|
|
||||||
localityName = Locality Name (eg, city)
|
|
||||||
0.organizationName = Organization Name (eg, company)
|
|
||||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
|
||||||
commonName = Common Name (eg, your name or your server\'s hostname)
|
|
||||||
commonName_max = 64
|
|
||||||
emailAddress = Email Address
|
|
||||||
emailAddress_max = 64
|
|
||||||
|
|
||||||
[req_attributes]
|
|
||||||
challengePassword = A challenge password
|
|
||||||
challengePassword_min = 8
|
|
||||||
challengePassword_max = 64
|
|
||||||
unstructuredName = An optional company name
|
|
||||||
|
|
||||||
[usr_cert]
|
|
||||||
basicConstraints = CA:FALSE
|
|
||||||
nsComment = "OpenSSL Generated Certificate"
|
|
||||||
subjectKeyIdentifier = hash
|
|
||||||
authorityKeyIdentifier = keyid,issuer:always
|
|
||||||
|
|
||||||
[v3_ca]
|
|
||||||
subjectKeyIdentifier = hash
|
|
||||||
authorityKeyIdentifier = keyid:always,issuer:always
|
|
||||||
basicConstraints = CA:true
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Generate and trust CA
|
|
||||||
touch "$KOJI_PKI_DIR"/index.txt
|
|
||||||
echo 01 > "$KOJI_PKI_DIR"/serial
|
|
||||||
openssl genrsa -out "$KOJI_PKI_DIR"/private/koji_ca_cert.key 2048
|
|
||||||
openssl req -subj "/C=$COUNTRY_CODE/ST=$STATE/L=$LOCATION/O=$ORGANIZATION/OU=koji_ca/CN=$KOJI_HUB_FQDN" -config "$KOJI_PKI_DIR"/ssl.cnf -new -x509 -days 3650 -key "$KOJI_PKI_DIR"/private/koji_ca_cert.key -out "$KOJI_PKI_DIR"/koji_ca_cert.crt -extensions v3_ca
|
|
||||||
mkdir -p /etc/ca-certs/trusted
|
|
||||||
|
|
||||||
# Generate the koji component certificates and the admin certificate and generate a PKCS12 user certificate (for web browser)
|
|
||||||
cp "$SCRIPT_DIR"/gencert.sh "$KOJI_PKI_DIR"
|
|
||||||
pushd "$KOJI_PKI_DIR"
|
|
||||||
gencert.sh kojiweb "/C=$COUNTRY_CODE/ST=$STATE/L=$LOCATION/O=$ORGANIZATION/OU=kojiweb/CN=$KOJI_HUB_FQDN"
|
|
||||||
gencert.sh kojihub "/C=$COUNTRY_CODE/ST=$STATE/L=$LOCATION/O=$ORGANIZATION/OU=kojihub/CN=$KOJI_HUB_FQDN"
|
|
||||||
gencert.sh kojiadmin "/C=$COUNTRY_CODE/ST=$STATE/L=$LOCATION/O=$ORGANIZATION/OU=$ORG_UNIT/CN=kojiadmin"
|
|
||||||
gencert.sh kojira "/C=$COUNTRY_CODE/ST=$STATE/L=$LOCATION/O=$ORGANIZATION/OU=$ORG_UNIT/CN=kojira"
|
|
||||||
popd
|
|
||||||
|
|
||||||
# Copy certificates into ~/.koji for kojiadmin
|
|
||||||
useradd kojiadmin
|
|
||||||
ADMIN_KOJI_DIR="$(echo ~kojiadmin)"/.koji
|
|
||||||
mkdir -p "$ADMIN_KOJI_DIR"
|
|
||||||
cp -f "$KOJI_PKI_DIR"/kojiadmin.pem "$ADMIN_KOJI_DIR"/client.crt
|
|
||||||
cp -f "$KOJI_PKI_DIR"/koji_ca_cert.crt "$ADMIN_KOJI_DIR"/clientca.crt
|
|
||||||
cp -f "$KOJI_PKI_DIR"/koji_ca_cert.crt "$ADMIN_KOJI_DIR"/serverca.crt
|
|
||||||
chown -R kojiadmin:kojiadmin "$ADMIN_KOJI_DIR"
|
|
||||||
|
|
||||||
|
|
||||||
## POSTGRESQL SERVER
|
|
||||||
# Initialize PostgreSQL DB
|
|
||||||
mkdir -p "$POSTGRES_DIR"
|
|
||||||
chown -R "$POSTGRES_USER":"$POSTGRES_USER" "$POSTGRES_DIR"
|
|
||||||
if [[ "$POSTGRES_DIR" != "$POSTGRES_DEFAULT_DIR" ]]; then
|
|
||||||
if [ "$(ls -A "$POSTGRES_DEFAULT_DIR")" ]; then
|
|
||||||
mv "$POSTGRES_DEFAULT_DIR" "$POSTGRES_DEFAULT_DIR".old
|
|
||||||
else
|
|
||||||
rm -rf "$POSTGRES_DEFAULT_DIR"
|
|
||||||
fi
|
|
||||||
ln -sf "$POSTGRES_DIR" "$POSTGRES_DEFAULT_DIR"
|
|
||||||
chown -h "$POSTGRES_USER":"$POSTGRES_USER" "$POSTGRES_DEFAULT_DIR"
|
|
||||||
fi
|
|
||||||
sudo -u "$POSTGRES_USER" initdb --pgdata "$POSTGRES_DEFAULT_DIR"/data
|
|
||||||
systemctl enable --now postgresql
|
|
||||||
|
|
||||||
# Setup User Accounts
|
|
||||||
useradd -r koji
|
|
||||||
|
|
||||||
# Setup PostgreSQL and populate schema
|
|
||||||
sudo -u "$POSTGRES_USER" createuser --no-superuser --no-createrole --no-createdb koji
|
|
||||||
sudo -u "$POSTGRES_USER" createdb -O koji koji
|
|
||||||
sudo -u koji psql koji koji < /usr/share/doc/koji*/docs/schema.sql
|
|
||||||
|
|
||||||
# Authorize Koji-web and Koji-hub resources
|
|
||||||
cat > "$POSTGRES_DEFAULT_DIR"/data/pg_hba.conf <<- EOF
|
|
||||||
#TYPE DATABASE USER CIDR-ADDRESS METHOD
|
|
||||||
host koji all 127.0.0.1/32 trust
|
|
||||||
host koji all ::1/128 trust
|
|
||||||
local koji all trust
|
|
||||||
EOF
|
|
||||||
systemctl reload postgresql
|
|
||||||
|
|
||||||
# Bootstrapping the initial koji admin user into the PostgreSQL database
|
|
||||||
# SSL Certificate authentication
|
|
||||||
sudo -u koji psql -c "insert into users (name, status, usertype) values ('kojiadmin', 0, 0);"
|
|
||||||
|
|
||||||
# Give yourself admin permissions
|
|
||||||
sudo -u koji psql -c "insert into user_perms (user_id, perm_id, creator_id) values (1, 1, 1);"
|
|
||||||
|
|
||||||
## KOJI CONFIGURATION FILES
|
|
||||||
# Koji Hub
|
|
||||||
mkdir -p /etc/koji-hub
|
|
||||||
cat > /etc/koji-hub/hub.conf <<- EOF
|
|
||||||
[hub]
|
|
||||||
DBName = koji
|
|
||||||
DBUser = koji
|
|
||||||
KojiDir = $KOJI_DIR
|
|
||||||
DNUsernameComponent = CN
|
|
||||||
ProxyDNs = C=$COUNTRY_CODE,ST=$STATE,L=$LOCATION,O=$ORGANIZATION,OU=kojiweb,CN=$KOJI_HUB_FQDN
|
|
||||||
LoginCreatesUser = On
|
|
||||||
KojiWebURL = $KOJI_URL/koji
|
|
||||||
DisableNotifications = True
|
|
||||||
EOF
|
|
||||||
|
|
||||||
mkdir -p /etc/httpd/conf.d
|
|
||||||
cat > /etc/httpd/conf.d/kojihub.conf <<- EOF
|
|
||||||
Alias /kojihub /usr/share/koji-hub/kojiapp.py
|
|
||||||
<Directory "/usr/share/koji-hub">
|
|
||||||
Options ExecCGI
|
|
||||||
SetHandler wsgi-script
|
|
||||||
Require all granted
|
|
||||||
</Directory>
|
|
||||||
Alias /kojifiles "$KOJI_DIR"
|
|
||||||
<Directory "$KOJI_DIR">
|
|
||||||
Options Indexes SymLinksIfOwnerMatch
|
|
||||||
AllowOverride None
|
|
||||||
Require all granted
|
|
||||||
</Directory>
|
|
||||||
<Location /kojihub/ssllogin>
|
|
||||||
SSLVerifyClient require
|
|
||||||
SSLVerifyDepth 10
|
|
||||||
SSLOptions +StdEnvVars
|
|
||||||
</Location>
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# SELinux changes to allow db access
|
|
||||||
setsebool -P httpd_can_network_connect_db 1
|
|
||||||
|
|
||||||
# Koji Web
|
|
||||||
mkdir -p /etc/kojiweb
|
|
||||||
cat > /etc/kojiweb/web.conf <<- EOF
|
|
||||||
[web]
|
|
||||||
SiteName = koji
|
|
||||||
KojiHubURL = $KOJI_URL/kojihub
|
|
||||||
KojiFilesURL = $KOJI_URL/kojifiles
|
|
||||||
WebCert = $KOJI_PKI_DIR/kojiweb.pem
|
|
||||||
ClientCA = $KOJI_PKI_DIR/koji_ca_cert.crt
|
|
||||||
KojiHubCA = $KOJI_PKI_DIR/koji_ca_cert.crt
|
|
||||||
LoginTimeout = 72
|
|
||||||
Secret = NITRA_IS_NOT_CLEAR
|
|
||||||
LibPath = /usr/share/koji-web/lib
|
|
||||||
LiteralFooter = True
|
|
||||||
EOF
|
|
||||||
|
|
||||||
mkdir -p /etc/httpd/conf.d
|
|
||||||
cat > /etc/httpd/conf.d/kojiweb.conf <<- EOF
|
|
||||||
Alias /koji "/usr/share/koji-web/scripts/wsgi_publisher.py"
|
|
||||||
<Directory "/usr/share/koji-web/scripts">
|
|
||||||
Options ExecCGI
|
|
||||||
SetHandler wsgi-script
|
|
||||||
Require all granted
|
|
||||||
</Directory>
|
|
||||||
Alias /koji-static "/usr/share/koji-web/static"
|
|
||||||
<Directory "/usr/share/koji-web/static">
|
|
||||||
Options None
|
|
||||||
AllowOverride None
|
|
||||||
Require all granted
|
|
||||||
</Directory>
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# SELinux changes to allow httpd network access
|
|
||||||
setsebool -P httpd_can_network_connect 1
|
|
||||||
|
|
||||||
# Koji CLI
|
|
||||||
cat > /etc/koji.conf <<- EOF
|
|
||||||
[koji]
|
|
||||||
server = $KOJI_URL/kojihub
|
|
||||||
weburl = $KOJI_URL/koji
|
|
||||||
topurl = $KOJI_URL/kojifiles
|
|
||||||
topdir = $KOJI_DIR
|
|
||||||
cert = ~/.koji/client.crt
|
|
||||||
serverca = ~/.koji/serverca.crt
|
|
||||||
anon_retry = true
|
|
||||||
EOF
|
|
||||||
|
|
||||||
## KOJI APPLICATION HOSTING
|
|
||||||
# Koji Filesystem Skeleton
|
|
||||||
mkdir -p "$KOJI_DIR"/{packages,repos,work,scratch,repos-dist}
|
|
||||||
chown -R "$HTTPD_USER":"$HTTPD_USER" "$KOJI_DIR"
|
|
||||||
|
|
||||||
# twealk SELinux to allow $HTTPD_USER write access
|
|
||||||
setsebool -P allow_httpd_anon_write=1
|
|
||||||
semanage fcontext -a -t public_content_rw_t "$KOJI_DIR(/.*)?"
|
|
||||||
restorecon -r -v $KOJI_DIR
|
|
||||||
|
|
||||||
## Apache Configuration Files
|
|
||||||
mkdir -p /etc/httpd/conf.d
|
|
||||||
cat > /etc/httpd/conf.d/ssl.conf <<- EOF
|
|
||||||
ServerName $KOJI_HUB_FQDN
|
|
||||||
|
|
||||||
Listen 443 https
|
|
||||||
|
|
||||||
#SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
|
|
||||||
|
|
||||||
#SSLSessionCache shmcb:/run/httpd/sslcache(512000)
|
|
||||||
|
|
||||||
SSLRandomSeed startup file:/dev/urandom 256
|
|
||||||
SSLRandomSeed connect builtin
|
|
||||||
|
|
||||||
<VirtualHost _default_:443>
|
|
||||||
ErrorLog /var/log/httpd/ssl_error_log
|
|
||||||
TransferLog /var/log/httpd/ssl_access_log
|
|
||||||
LogLevel warn
|
|
||||||
|
|
||||||
SSLEngine on
|
|
||||||
SSLHonorCipherOrder on
|
|
||||||
SSLCipherSuite PROFILE=SYSTEM
|
|
||||||
SSLProxyCipherSuite PROFILE=SYSTEM
|
|
||||||
|
|
||||||
SSLCertificateFile $KOJI_PKI_DIR/kojihub.pem
|
|
||||||
SSLCertificateKeyFile $KOJI_PKI_DIR/private/kojihub.key
|
|
||||||
SSLCertificateChainFile $KOJI_PKI_DIR/koji_ca_cert.crt
|
|
||||||
SSLCACertificateFile $KOJI_PKI_DIR/koji_ca_cert.crt
|
|
||||||
SSLVerifyClient require
|
|
||||||
SSLVerifyDepth 10
|
|
||||||
|
|
||||||
<FilesMatch "\.(cgi|shtml|phtml|php3?)$">
|
|
||||||
SSLOptions +StdEnvVars
|
|
||||||
</FilesMatch>
|
|
||||||
<Directory "/var/www/cgi-bin">
|
|
||||||
SSLOptions +StdEnvVars
|
|
||||||
</Directory>
|
|
||||||
|
|
||||||
CustomLog /var/log/httpd/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
|
||||||
</VirtualHost>
|
|
||||||
EOF
|
|
||||||
|
|
||||||
mkdir -p /etc/httpd/conf.modules.d
|
|
||||||
cat > /etc/httpd/conf.modules.d/wsgi.conf <<- EOF
|
|
||||||
WSGISocketPrefix /run/httpd/wsgi
|
|
||||||
EOF
|
|
||||||
cat > /etc/httpd/conf.modules.d/ssl.conf <<- EOF
|
|
||||||
LoadModule ssl_module lib/httpd/modules/mod_ssl.so
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# allow httpd access through firewall
|
|
||||||
firewall-cmd --permanent --add-service=http
|
|
||||||
firewall-cmd --permanent --add-service=https
|
|
||||||
firewall-cmd --reload
|
|
||||||
|
|
||||||
# enable and start the httpd service
|
|
||||||
systemctl enable --now httpd
|
|
||||||
|
|
||||||
|
|
||||||
## TEST KOJI CONNECTIVITY
|
|
||||||
sudo -u kojiadmin koji moshimoshi
|
|
||||||
|
|
||||||
|
|
||||||
## KOJIRA - DNF|YUM REPOSITORY CREATION AND MAINTENANCE
|
|
||||||
# Add the user entry for the kojira user
|
|
||||||
sudo -u kojiadmin koji add-user kojira
|
|
||||||
sudo -u kojiadmin koji grant-permission repo kojira
|
|
||||||
|
|
||||||
# Kojira Configuration Files
|
|
||||||
mkdir -p /etc/kojira
|
|
||||||
cat > /etc/kojira/kojira.conf <<- EOF
|
|
||||||
[kojira]
|
|
||||||
server=$KOJI_URL/kojihub
|
|
||||||
topdir=$KOJI_DIR
|
|
||||||
logfile=/var/log/kojira.log
|
|
||||||
cert = $KOJI_PKI_DIR/kojira.pem
|
|
||||||
serverca = $KOJI_PKI_DIR/koji_ca_cert.crt
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Ensure postgresql is started prior to running kojira service
|
|
||||||
mkdir -p /etc/systemd/system/kojira.service.d
|
|
||||||
cat > /etc/systemd/system/kojira.service.d/after-postgresql.conf <<EOF
|
|
||||||
[Unit]
|
|
||||||
After=postgresql.service
|
|
||||||
EOF
|
|
||||||
|
|
||||||
systemctl enable --now kojira
|
|
||||||
@ -1,28 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Copyright (C) 2019 Intel Corporation
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
|
|
||||||
#### START DO NOT EDIT ####
|
|
||||||
export GIT_USER=gitolite
|
|
||||||
export GIT_DEFAULT_DIR=/var/lib/gitolite
|
|
||||||
|
|
||||||
export POSTGRES_USER=postgres
|
|
||||||
export POSTGRES_DEFAULT_DIR=/var/lib/pgsql
|
|
||||||
|
|
||||||
export HTTPD_USER=apache
|
|
||||||
export HTTPD_DOCUMENT_ROOT=/var/www/html
|
|
||||||
|
|
||||||
export KOJI_PKI_DIR=/etc/pki/koji
|
|
||||||
|
|
||||||
check_dependency() {
|
|
||||||
if [[ "$#" -ne 1 ]]; then
|
|
||||||
echo "Incorrect number of arguments!" >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
if ! type "$1"; then
|
|
||||||
echo "$1 not found!" >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
#### END DO NOT EDIT ####
|
|
||||||
@ -1,36 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Copyright (C) 2019 Intel Corporation
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
|
|
||||||
## KOJI RPM BUILD AND TRACKER
|
|
||||||
export KOJI_DIR=/mnt/koji
|
|
||||||
export KOJI_HUB_FQDN="$(hostname -f)"
|
|
||||||
export KOJI_URL=http://"$KOJI_HUB_FQDN"
|
|
||||||
export KOJID_CAPACITY=16
|
|
||||||
export TAG_NAME=sme
|
|
||||||
# Use for koji SSL certificates
|
|
||||||
export COUNTRY_CODE='EX'
|
|
||||||
export STATE='Example'
|
|
||||||
export LOCATION='Example'
|
|
||||||
export ORGANIZATION='Koozali'
|
|
||||||
export ORG_UNIT='Koji'
|
|
||||||
# Use for importing existing RPMs
|
|
||||||
export RPM_ARCH='x86_64'
|
|
||||||
export SRC_RPM_DIR=
|
|
||||||
export BIN_RPM_DIR=
|
|
||||||
export DEBUG_RPM_DIR=
|
|
||||||
# Comment the following if supplying all RPMs as an upstream and not a downstream
|
|
||||||
export EXTERNAL_REPO=http://mirrorlist.centos.org/releases/10/smeos/
|
|
||||||
|
|
||||||
## POSTGRESQL DATABASE
|
|
||||||
export POSTGRES_DIR=/var/lib/pgsql
|
|
||||||
|
|
||||||
## GIT REPOSITORIES
|
|
||||||
export GIT_DIR=
|
|
||||||
export GIT_FQDN="https://src.koozali.org/"
|
|
||||||
export IS_ANONYMOUS_GIT_NEEDED=false
|
|
||||||
export GITOLITE_PUB_KEY=''
|
|
||||||
|
|
||||||
## UPSTREAMS CACHE
|
|
||||||
export UPSTREAMS_DIR=/srv/upstreams
|
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user