dkirwan/infra-ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

Revert "openQA etc: use a single-cert CA cert file for staging rabbitmq (#13422)"

Browse source 
This reverts commit 49f42faa1b.
I've updated to latest fedora-messaging and want to see if this
is unnecessary now.
This commit is contained in:
Adam Williamson 2026-06-25 09:50:35 +01:00
commit 465c2ca3ec
2 changed files with 5 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

2
inventory/group_vars/openqa_servers_common
View file

@ -30,7 +30,7 @@ openqa_amqp_prod_certfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_userna
openqa_amqp_prod_keyfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_username }}-key.pem"
openqa_amqp_prod_url: "amqps://{{ openqa_amqp_prod_username }}:@rabbitmq.fedoraproject.org/%2Fpubsub"
openqa_amqp_prod_username: "openqa"
openqa_amqp_stg_cacertfile: "/etc/fedora-messaging/stg-cacert-single.pem"
openqa_amqp_stg_cacertfile: "/etc/fedora-messaging/stg-cacert.pem"
openqa_amqp_stg_certfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_stg_username }}-cert.pem"
openqa_amqp_stg_keyfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_stg_username }}-key.pem"
openqa_amqp_stg_url: "amqps://{{ openqa_amqp_stg_username }}:@rabbitmq.stg.fedoraproject.org/%2Fpubsub"

22
roles/openqa/dispatcher/tasks/main.yml
View file

@ -286,7 +286,7 @@
- config
- fedora-messaging
- name: Deploy the cert for authenticating with fedora-messaging
- name: Deploy the Fedora infra fedora-messaging cert
ansible.builtin.copy:
src: "{{ private }}/files/rabbitmq/{{ openqa_env }}/pki/issued/{{ openqa_amqp_this_username }}.crt"
dest: "/etc/pki/fedora-messaging/{{ openqa_amqp_this_username }}-cert.pem"
@ -298,7 +298,7 @@
- config
- fedora-messaging
- name: Deploy the key for authenticating with fedora-messaging
- name: Deploy the Fedora infra fedora-messaging key
ansible.builtin.copy:
src: "{{ private }}/files/rabbitmq/{{ openqa_env }}/pki/private/{{ openqa_amqp_this_username }}.key"
dest: "/etc/pki/fedora-messaging/{{ openqa_amqp_this_username }}-key.pem"
@ -310,7 +310,7 @@
- config
- fedora-messaging
- name: Deploy the fedora-messaging prod auth cert on stg (for stg consumers that listen on prod)
- name: Deploy the Fedora infra fedora-messaging prod cert on stg (for stg consumers that listen on prod)
ansible.builtin.copy:
src: "{{ private }}/files/rabbitmq/production/pki/issued/{{ openqa_amqp_prod_username }}.crt"
dest: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_username }}-cert.pem"
@ -322,7 +322,7 @@
- config
- fedora-messaging
- name: Deploy the fedora-messaging prod auth key on stg (for stg consumers that listen on prod)
- name: Deploy the Fedora infra fedora-messaging prod key on stg (for stg consumers that listen on prod)
ansible.builtin.copy:
src: "{{ private }}/files/rabbitmq/production/pki/private/{{ openqa_amqp_prod_username }}.key"
dest: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_username }}-key.pem"
@ -334,20 +334,6 @@
- config
- fedora-messaging
- name: Deploy a working CA certificate file on staging (see https://forge.fedoraproject.org/infra/tickets/issues/13422)
ansible.builtin.copy:
src: "{{ private }}/files/rabbitmq/{{ openqa_env }}/pki/ca.crt"
dest: "/etc/fedora-messaging/{{ openqa_env_prefix }}cacert-single.pem"
# this is just a server cert, it is not actually private, we're
# just getting it from the private repo as it's convenient
mode: "0644"
owner: root
group: geekotest
when: "deployment_type is defined and deployment_type == 'stg'"
tags:
- config
- fedora-messaging
- name: Configure fedora-messaging scheduler
ansible.builtin.template: src=fedora_openqa_scheduler.toml.j2 dest=/etc/fedora-messaging/fedora_openqa_scheduler.toml owner=root group=root mode=0640
notify: