WIP: add roles for siguldry server and bridge #3292

Draft

jcline wants to merge 2 commits from jcline/ansible:siguldry into main

pull from: jcline/ansible:siguldry

merge into: infra:main

infra:main

infra:forge-atomic--members-group

infra:drop-cacombined

infra:master

infra:letsencrypt

infra:rawhide-greenwave

infra:openqa

infra:secarch

infra:darkserver

infra:openvpn_handler

infra:easyfix

infra:denyhosts

Conversation 2 Commits 2 Files changed 13 +686

jcline commented 2026-04-16 15:09:35 +00:00

Contributor

Copy link

These roles deploy the Siguldry server and bridge.

There's a few TODOs, and one step that isn't covered at all is the
deployment of the TLS private keys. These need to be encrypted with
systemd-creds, which should be doable via ansible, but the pesign bridge
isn't doing it so I've left it out for now.

Related: infra/tickets#13199

These roles deploy the Siguldry server and bridge. There's a few TODOs, and one step that isn't covered at all is the deployment of the TLS private keys. These need to be encrypted with systemd-creds, which should be doable via ansible, but the pesign bridge isn't doing it so I've left it out for now. Related: https://forge.fedoraproject.org/infra/tickets/issues/13199

jcline force-pushed siguldry from da381cebd9 to 8523b5d9f2 2026-04-16 15:24:04 +00:00 Compare

kevin changed title from draft: add roles for siguldry server and bridge to WIP: add roles for siguldry server and bridge 2026-04-30 17:50:59 +00:00

jcline force-pushed siguldry from 8523b5d9f2 to 7749af7760 2026-05-04 16:49:21 +00:00 Compare

jcline commented 2026-05-04 17:02:53 +00:00

Author

Contributor

Copy link

So, this mostly works with the caveat that it needs EPEL 10.2 (so either CentOS stream or the not-yet-released EL10.2). In theory we could install the siguldry and kryoptic RPMs on 10.1 and it would probably be fine.

The outstanding question for me is how do we want to handle the private keys for the PKI. One option would be to do something like:

openssl req -new -nodes -sha256 \
    -addext "subjectAltName = DNS:siguldry-server.example.com" \
    -addext "extendedKeyUsage = clientAuth,serverAuth" \
    -subj "/CN=siguldry-server.example.com" \
    -keyout - \
    -newkey rsa:4096 \
    -out server.csr | \
    sudo systemd-creds encrypt - \
    /etc/credstore.encrypted/siguldry.server.private_key.pem

and then deal with signing the CSR wherever the CA lives rather than copying private keys around. I didn't see anything in the pesign_bridge role to use as inspiration, so I assume it was handled by hand?

So, this mostly works with the caveat that it needs EPEL 10.2 (so either CentOS stream or the not-yet-released EL10.2). In theory we could install the siguldry and kryoptic RPMs on 10.1 and it would probably be fine. The outstanding question for me is how do we want to handle the private keys for the PKI. One option would be to do something like: ```bash openssl req -new -nodes -sha256 \ -addext "subjectAltName = DNS:siguldry-server.example.com" \ -addext "extendedKeyUsage = clientAuth,serverAuth" \ -subj "/CN=siguldry-server.example.com" \ -keyout - \ -newkey rsa:4096 \ -out server.csr | \ sudo systemd-creds encrypt - \ /etc/credstore.encrypted/siguldry.server.private_key.pem ``` and then deal with signing the CSR wherever the CA lives rather than copying private keys around. I didn't see anything in the pesign_bridge role to use as inspiration, so I assume it was handled by hand?

jcline force-pushed siguldry from 7749af7760 to ebaf8210f3 2026-06-02 18:47:04 +00:00 Compare

jcline added 1 commit 2026-06-10 15:52:04 +00:00

siguldry: raise max connections on the signing helper ... f4b8c5cb84

This is controls (indirectly) the number of concurrent signing
operations.

Signed-off-by: Jeremy Cline <jeremycline@microsoft.com>

kevin commented 2026-07-07 22:10:16 +00:00

Owner

Copy link

Hopefully @james will get cycles to work on this soon... or failing that I can try. :)

I think it looks pretty reasonable... we should also adjust (for staging only at first) the manual/ playbooks for the vault and the normal playbook for the bridge. Or we could just make new playbooks for them. We don't have any installed in staging, so we should make new sign-bridge01.stg and sign-vault01.stg vm's there.

I think we should just follow the same pattern we used for the pesign bridge. That is that a admin will add the creds on any reboots. Currently the bridge just has the cert .key on disk and has no passphrase, but we can/should just have admins install the creds on reboots.

Hopefully @james will get cycles to work on this soon... or failing that I can try. :) I think it looks pretty reasonable... we should also adjust (for staging only at first) the manual/ playbooks for the vault and the normal playbook for the bridge. Or we could just make new playbooks for them. We don't have any installed in staging, so we should make new sign-bridge01.stg and sign-vault01.stg vm's there. I think we should just follow the same pattern we used for the pesign bridge. That is that a admin will add the creds on any reboots. Currently the bridge just has the cert .key on disk and has no passphrase, but we can/should just have admins install the creds on reboots.

All checks were successful

Hide all checks

Linter / yamllint (pull_request) Successful in 27s

Details

Linter / ansible-lint (pull_request) Successful in 1m17s

Details

This pull request is marked as a work in progress.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u siguldry:jcline-siguldry

git switch jcline-siguldry

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff jcline-siguldry

git switch jcline-siguldry

git rebase main

git switch main

git merge --ff-only jcline-siguldry

git switch jcline-siguldry

git rebase main

git switch main

git merge --no-ff jcline-siguldry

git switch main

git merge --squash jcline-siguldry

git switch main

git merge --ff-only jcline-siguldry

git switch main

git merge jcline-siguldry

git push origin main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

ai-review-please

label for requesting AI code review

  

freeze-break-request

  

post-freeze

  

Backlog Status

Needs Review

Work items that have been created or updated but need review, refinement, or approval before they can be considered ready for sprint planning.

  

Backlog Status

Ready

Work items that have been reviewed, refined, and are ready to be committed to a sprint. These items have clear requirements and can be worked on immediately when capacity is available.

  

chore

Work that needs to be done but doesn't add new functionality or fix bugs. Maintenance tasks that keep the system running smoothly and the codebase clean.

  

documentation

Work focused on creating, updating, or improving documentation for users, developers, or system administrators.

  

points

01

A task that is simple, small, and has very little uncertainty. It should be easy enough for any team member to pick up and complete quickly, without a lot of discussion or research.

  

points

02

This is a task that is slightly more complex or larger than a "1." It might involve two or three simple steps, but the outcome is still very clear and there's little uncertainty.

  

points

03

Medium-sized task with some noticeable complexity. It might require a bit more thought or collaboration. The steps are well-defined, but it's not a trivial change.

  

points

05

A significant piece of work. It has more complexity and a higher degree of uncertainty than smaller tasks. It might require some research, a design discussion, or collaboration across multiple teams.

  

points

08

Complex task with a lot of uncertainty. It's often the largest size that a team will consider for a single sprint. It likely requires a detailed breakdown and multiple team members to complete.

  

points

13

Any task that feels like it's a "13" or more is considered an Epic. These are too large and uncertain to be worked on in a single sprint and should be broken down.

  

Priority

High

This is for work that is critical and needs to be addressed in the next sprint. It's often for urgent bugs, important features, or a major piece of technical debt that is blocking other work.

  

Priority

Low

This is for work that is good to do but not urgent. It's a candidate for being worked on when there's extra time or when it rises in importance. It can stay in the backlog for a longer period.

  

Priority

Medium

This is for important work that should be done soon, but isn't as urgent as a high-priority item. It will likely be considered for the next 1-2 sprints.

  

Sprint Status

Blocked

Work items that cannot progress due to external dependencies, blockers, or issues that need resolution.

  

Sprint Status

Done

Work items that have been completed, reviewed, and integrated. No further work is needed within the current sprint.

  

Sprint Status

In Progress

Work items currently being worked on by a team member. Active development, research, or implementation is happening.

  

Sprint Status

Review

Work items that are complete but need review, testing, or approval before being marked as done.

  

Sprint Status

To Do

Work items that are committed to the sprint but haven't been started yet. These items are ready to be picked up by team members.

  

Technical Debt

Work that addresses shortcuts, workarounds, or suboptimal implementations that were done previously to meet deadlines. These items improve code quality, maintainability, or performance without adding new features.

  

Work Item

Bug

Issues where the system is not working as intended or designed. Bugs represent deviations from expected behavior.

  

Work Item

Epic

Large initiatives that are broken down into multiple smaller work items (user stories, tasks, bugs). Epics represent significant features or projects that span multiple sprints.

  

Work Item

Spike

Time-boxed research, investigation, or proof-of-concept work to reduce uncertainty or explore solutions. Spikes help inform future development decisions.

  

Work Item

Task

Used to break down larger user stories into smaller, manageable implementation pieces. They focus on the specific technical steps needed to deliver the user story's value.

  

Work Item

User Story

User-facing features or functionality that can be framed from a user perspective, describing what someone wants to accomplish and why.

No labels

ai-review-please

freeze-break-request

post-freeze

Backlog Status

Needs Review

Backlog Status

Ready

chore

documentation

points

01

points

02

points

03

points

05

points

08

points

13

Priority

High

Priority

Low

Priority

Medium

Sprint Status

Blocked

Sprint Status

Done

Sprint Status

In Progress

Sprint Status

Review

Sprint Status

To Do

Technical Debt

Work Item

Bug

Work Item

Epic

Work Item

Spike

Work Item

Task

Work Item

User Story

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

infra/ansible!3292

No description provided.