From ffca0313f5ec561cb3f0547d1ee03b478c3821ca Mon Sep 17 00:00:00 2001
From: Jiri Podivin <jpodivin@redhat.com>
Date: Wed, 8 Jul 2026 15:29:26 +0200
Subject: [PATCH] Derive Log Detective credentials from securely stored values

Signed-off-by: Jiri Podivin <jpodivin@redhat.com>
---
 roles/logdetective/handlers/main.yml     |  5 +++
 roles/logdetective/tasks/main.yml        | 33 +++++++++++++++
 roles/logdetective/templates/env_file.j2 | 52 ++++++++++++++++++++++++
 3 files changed, 90 insertions(+)
 create mode 100644 roles/logdetective/templates/env_file.j2

diff --git a/roles/logdetective/handlers/main.yml b/roles/logdetective/handlers/main.yml
index c28484f735..454ae0d672 100644
--- a/roles/logdetective/handlers/main.yml
+++ b/roles/logdetective/handlers/main.yml
@@ -2,3 +2,8 @@
 - name: Reload systemd
   ansible.builtin.systemd:
     daemon_reload: true
+
+- name: Restart Log Detective
+  ansible.builtin.systemd:
+    name: logdetective.service
+    state: restarted
diff --git a/roles/logdetective/tasks/main.yml b/roles/logdetective/tasks/main.yml
index fa60ed4eaf..d311487b7d 100644
--- a/roles/logdetective/tasks/main.yml
+++ b/roles/logdetective/tasks/main.yml
@@ -170,6 +170,39 @@
     - http
     - https
 
+
+# Log Detective needs certificates in a location that will be mounted
+# by the containerized service, not in the standar location where
+# the `messaging` role places them
+- name: Install Fedmsg certificates
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "/root/logdetective/fedora_messaging_certs/{{ item.file }}"
+    owner: root
+    group: root
+    mode: '0600'
+  with_items:
+    - src: "{{private}}/files/rabbitmq/{{env}}/pki/issued/logdetective-packit{{ env_suffix }}.crt"
+      file: logdetective-packit-cert.pem
+    - src: "{{private}}/files/rabbitmq/{{env}}/pki/private/logdetective-packit{{ env_suffix }}.key"
+      file: logdetective-packit-key.pem
+  notify:
+    - Restart Log Detective
+  tags:
+    - logdetective_credentials
+    - config
+
+- name: Render Log Detective env_file
+  ansible.builtin.template:
+    src: env_file.j2
+    dest: /root/logdetective/env_file
+    mode: '0600'
+  notify:
+    - Restart Log Detective
+  tags:
+    - config
+    - logdetective_credentials
+
 - name: Install logdetective systemd service
   ansible.builtin.copy:
     src: logdetective.service
diff --git a/roles/logdetective/templates/env_file.j2 b/roles/logdetective/templates/env_file.j2
new file mode 100644
index 0000000000..6d0e43525d
--- /dev/null
+++ b/roles/logdetective/templates/env_file.j2
@@ -0,0 +1,52 @@
+# From env_file of https://github.com/fedora-copr/logdetective
+# The default env_file will be overriden in production with this rendered template
+
+# compose sources this file
+# docs: https://docs.docker.com/compose/environment-variables/set-environment-variables/
+# Determines whether or not to use developer or production mode
+# used by `files/run_server.sh`
+ENV="production"
+# On which port should Log Detective listen
+LOGDETECTIVE_SERVER_PORT=443
+LOGDETECTIVE_CERTDIR="/src/server/"
+
+# Port of inference server both in container and on host
+INFERENCE_SERVER_PORT=8100
+# Port to common proxy of inference server containers
+INFERENCE_PROXY_PORT=8000
+# Path to Logdetective server configuration file
+LOGDETECTIVE_SERVER_CONF="/config.yml"
+# Path to prompt templates for Log Detective
+LOGDETECTIVE_PROMPT_TEMPLATES="/src/logdetective/prompts"
+# Path to patterns to be skipped during processing
+LOGDETECTIVE_SKIP_PATTERNS="/src/logdetective/skip_snippets.yml"
+
+# Authentication token for Log Detective API
+{% if logdetective_token is defined %}
+LOGDETECTIVE_TOKEN="{{ logdetective_token }}"
+{% endif %}
+
+# Database
+POSTGRESQL_USER=logdetective
+POSTGRESQL_PASSWORD="{{ log_detective_db_password }}"
+POSTGRESQL_DATABASE=logdetective
+POSTGRESQL_PORT=5432
+SQLALCHEMY_ECHO=0
+
+# logdetective-packit interface server github.com/fedora-copr/logdetective-packit
+# Set to value assuming container deployment on the same node
+LD_URL=https://logdetective01.fedorainfracloud.org/analyze
+# Only when the Log Detective server itself has `LOGDETECTIVE_TOKEN` variable set
+{% if logdetective_token is defined %}
+LD_TOKEN="{{ logdetective_token }}"
+{% endif %}
+
+# Token for logdetective packit server, allowing access to the `/analyze` API.
+# This token must not be the same as `LOGDETECTIVE_TOKEN` and `LD_TOKEN`.
+{% if logdetective_packit_token is defined %}
+LD_PACKIT_TOKEN="{{ logdetective_packit_token }}"
+{% endif %}
+{% if logdetective_packit_interface_sentry is defined %}
+LD_PACKIT_INTERFACE_SENTRY_DSN="{{ logdetective_packit_interface_sentry }}"
+{% endif %}
+LD_TIMEOUT=3017