siguldry/pesign-bridge: Move acl handling to systemd unit

We have been moving this around, but decided that just putting it in as
a override for the systemd unit would be the best way to do it.

- Putting it in ansible means you have to run ansible every time you
  restart the service for any reason. If it's in systemd it will
  automagically get that set on start
- If for some reason the socket doesn't appear/the service doesn't start
  right or dies, this will error out.
- adding it in the client is tricky and error prone and not needed
  possibly for other installs, only fedora, so dropping it from there is
  a win.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>

roles/siguldry/pesign_bridge/files/sigul-pesign-bridge-override.conf

@@ -0,0 +1,5 @@
+[Service]
+ExecStartPost=/usr/bin/setfacl -m u:kojibuilder:rwx /run/pesign
+ExecStartPost=/usr/bin/setfacl -m u:kojibuilder:rwx /run/pesign/socket
+ExecStartPost=/usr/bin/setfacl -m u:pesign:rwx /run/pesign
+ExecStartPost=/usr/bin/setfacl -m u:pesign:rwx /run/pesign/socket

roles/siguldry/pesign_bridge/tasks/main.yml

@@ -156,30 +156,27 @@
     - siguldry
     - siguldry/pesign_bridge
 
-- name: /run/pesign directory perms (kojibuilder)
-  acl: path=/run/pesign entity=kojibuilder etype=user permissions=rwx recursive=true state=present
-  when: "'secureboot' in group_names"
+- name: setup systemd override dir for sigul-pesign-bridge service
+  file:
+    path: /etc/systemd/system/sigul-pesign-bridge.service.d/
+    state: directory
+    owner: root
+    group: root
+    mode: 0755
   tags:
+    - services
     - siguldry
     - siguldry/pesign_bridge
 
-- name: /run/pesign directory perms (pesign)
-  acl: path=/run/pesign entity=pesign etype=user permissions=rwx recursive=true state=present
-  when: "'secureboot' in group_names"
-  tags:
-    - siguldry
-    - siguldry/pesign_bridge
-
-- name: /run/pesign socket perms (kojibuilder)
-  acl: path=/run/pesign/socket entity=kojibuilder etype=user permissions=rwx recursive=true state=present
-  when: "'secureboot' in group_names"
-  tags:
-    - siguldry
-    - siguldry/pesign_bridge
-
-- name: /run/pesign socket perms (pesign)
-  acl: path=/run/pesign/socket default=true entity=pesign etype=group permissions=rwx recursive=true state=present
-  when: "'secureboot' in group_names"
+- name: apply override to sigul-pesign-bridge service to setup acls
+  ansible.builtin.copy:
+    src: sigul-pesign-bridge-override.conf
+    dest: /etc/systemd/system/sigul-pesign-bridge.service.d/override.conf
+    mode: "0644"
+    owner: root
+    group: root
+  notify: Reload systemd
   tags:
+    - services
     - siguldry
     - siguldry/pesign_bridge

roles/siguldry/pesign_bridge/templates/config.toml.j2

@@ -1,6 +1,5 @@
 total_request_timeout_secs = 86400
 sigul_request_timeout_secs = 60
-socket_acl = ["user:kojibuilder:rwx", "user:pesign:rwx"]
 
 [sigul]
 bridge_hostname = "sign-bridge.rdu3.fedoraproject.org"