copr: rotate buildsys SSH keys

Split the key for production / staging.  Drop the keys from hypervisors,
as we don't actually need them there (we copy images from backend ->
hypervisors these days, not from hypervisor to hypervisor).

Relates: https://github.com/fedora-copr/copr/pull/4221

roles/copr/backend/files/buildsys.production.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCao0nJaZ5JIE8rn5M/l5VXU1e1LSqGKVbDjNYIwbbT2n7T9SK91D2s7EpUq0/QdoFKuZVsGgl/P7V2Vk4PT5W3k+RG/ndBToa/9AJzFRRK3dbJncgdIKYuOHO6hqSOegbXihiLhML95R/XtN9ywwDw6H+ZvdA5A8HtDs/2VctRZ28zT2BYqUITZ78/Nhgq8ul315Oz+RDiZHp0NH6p0JPhsqtXuCQw/C7GipVgUAm4y4rbkpprPDweGFGN2Xpaps0NWafx9IuC752Kb3vg2IDYCTr2jn4Y5ISBzcJix4K57hR33KRhtdVLc25r7jfXoJzyoaUuHHTEqaYpXCLMO+aHAPruEFEPVIFK68POjebqY/O6ppglpf/qQNKipy0ujnMXTj5ZPMCSQeoTe1ym6ws1R1Nctvp9CBuHKDJg0PHHOLwktpdI6LxBg7gqj76tMiUsclH75JfbM7eSzeX0lMHRca9PoZgFRqduinHonB5mHjnen4mHlumCPVX0fATJ98IoI7VVveI+cZJ4NDklXTedl0K/KV3BhUWeSIM0UrqYiooHDRftenslLDTUFgPAzPst1bLUr/Oqa+66pv8qpbH6g7IHPnf3/xaKd4899SUgBcr9KhFFOTu6HvG9lrk/bZDh+pxp/8NwpJhqN74e0qkokwBjC5YonVNa34DDVF+Y9Q== copr-buildsys-prod

roles/copr/backend/files/buildsys.staging.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDOcf6r8Q7qCELUVCc3jNYx2YiQ3wCnxwxfxKa76plR7jmbhhUdiXNZEeKybEKNzYd+7sKSxkT8rl9fympTziB7uGOL18350MvstVGRxsgtuZLfoh0yGa78ZNVuOHBCgwD8wl3swdogwgJydqJNijEaJbrYLru7CuTbbGcXLtPpA8blszH9CNH2OyWJtGXSiQyB5PmLyJXsATZiqAZI4/M53K8z3Zp4qiwTwGsS+OVRjlY5S+7MIgb5SH5JOsiTdEf5VkPM5j8WG70cL6Y6mp+DQ0KdDeCEPX7mUvqhRU9KImWuD2QKCfYXGzG9NmR+ycmK7NrR1sLkMTtjmJTm9gRVOtlE1QWMFGmkq/4NvQAm7Qw4G3QDbnMbVntUftWqeC6dQM2q2FX1yqA9ogoCIwkz5nIq8YH5cjO0UqVYICfw5rqN3LLALSsusKvPyiNGXwckSiV647i9PZgUxsnBfX8zZJaiBiwYE+S9dEhPSc3ejVx6INVXB8lXRvFO6A2i4KrXWpkL8NvCcUuH3q0CwxGpOrxB1NIadMNLVk6CiWPBWW03L55SIu82rgUcJqtP44/MLTUUseIB8sh7+ReFbbdNrpaX1pAfn67k8/Q4alisN0NLoCSucxN3tck1KgboAoGsN9s8YfUjGvOzy2h5c5jqgGF22/0asA4y6OLKHDEa4Q== copr-buildsys-2026-04-16

roles/copr/backend/files/provision/files/buildsys.pub

@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCeTO0ddXuhDZYM9HyM0a47aeV2yIVWhTpddrQ7/RAIs99XyrsicQLABzmdMBfiZnP0FnHBF/e+2xEkT8hHJpX6bX81jjvs2bb8KP18Nh8vaXI3QospWrRygpu1tjzqZT0Llh4ZVFscum8TrMw4VWXclzdDw6x7csCBjSttqq8F3iTJtQ9XM9/5tCAAOzGBKJrsGKV1CNIrfUo5CSzY+IUVIr8XJ93IB2ZQVASK34T/49egmrWlNB32fqAbDMC+XNmobgn6gO33Yq5Ly7Dk4kqTUx2TEaqDkZfhsVu0YcwV81bmqsltRvpj6bIXrEoMeav7nbuqKcPLTxWEY/2icePF

roles/copr/backend/files/provision/provision_builder_tasks.yml

@@ -274,10 +274,14 @@
     - preparing_image
 
 - name: mockbuilder authorized_keys
-  authorized_key: user=mockbuilder key='{{ lookup('file', 'files/buildsys.pub') }}'
+  authorized_key:
+    user: mockbuilder
+    key: "{{ lookup('file', 'files/buildsys.pub') }}"
 
 - name: root authorized_keys
-  authorized_key: user=root key='{{ lookup('file', 'files/buildsys.pub') }}'
+  authorized_key:
+    use: root
+    key: "{{ lookup('file', 'files/buildsys.pub') }}"
 
 - name: setup 10x more fds in limits.conf
   ansible.builtin.copy:

roles/copr/backend/tasks/main.yml

@@ -61,7 +61,12 @@
   - .ssh
 
 - name: Setup privkey for copr user
-  ansible.builtin.copy: src="{{ private }}/files/copr/buildsys.priv" dest=/home/copr/.ssh/id_rsa owner=copr group=copr mode=600
+  ansible.builtin.copy:
+    src: "{{ private }}/files/copr/buildsys.{{ env }}.priv"
+    dest: /home/copr/.ssh/id_rsa
+    owner: copr
+    group: copr
+    mode: 600
 
 - name: Setup copr user ssh config file
   ansible.builtin.template:
@@ -88,11 +93,14 @@
 - name: Replace bashrc for copr user
   ansible.builtin.copy: src="copr_bashrc" dest=/home/copr/.bashrc owner=copr group=copr mode=600
 
+# TODO(praiskup): this is weird, doesn't seem to be needed
 - name: Auth_key so we can login to localhost as the copr user from the copr user
-  authorized_key: user=copr key="{{ item }}"
+  authorized_key:
+    user: copr
+    key: "{{ item }}"
   no_log: true
   with_file:
-  - "provision/files/buildsys.pub"
+  - "buildsys.{{ env }}.pub"
 
 - name: Copy .boto file
   ansible.builtin.copy: src="boto" dest=/home/copr/.boto owner=copr group=copr

roles/copr/backend/tasks/resalloc.yml

@@ -159,7 +159,7 @@
 
 - name: Resalloc, copy backend ssh identity
   ansible.builtin.copy:
-    src: "{{ private }}/files/copr/buildsys.priv"
+    src: "{{ private }}/files/copr/buildsys.{{ env }}.priv"
     dest: /var/lib/resallocserver/.ssh/id_rsa
     owner: resalloc
     group: resalloc

roles/copr/backend/tasks/setup_provisioning_environment.yml

@@ -19,6 +19,13 @@
   tags:
   - provision_config
 
+- name: install the correct buildsys.pub
+  ansible.builtin.copy:
+    dest: "{{ provision_directory }}/files/buildsys.pub"
+    src: "buildsys.{{ env }}.pub"
+  tags:
+  - provision_config
+
 - name: "Sync copr provisioning files [remove mock config leftovers]"
   ansible.posix.synchronize:
     src: "{{ roles_path }}/copr/backend/files/provision/files/mock/"

roles/copr/hypervisor/files/buildsys.pub

@@ -1 +0,0 @@
-../../../copr/backend/files/provision/files/buildsys.pub

roles/copr/hypervisor/tasks/main.yml

@@ -139,10 +139,13 @@
 - name: Create the copr user
   user: name=copr uid=11666 group=libvirt groups=qemu password_lock=true
 
-- name: Assure that copr-be can ssh there as copr@...
-  authorized_key: user=copr key="{{ item }}"
+- name: Assure that copr user on copr-backend can ssh as copr@...
+  authorized_key:
+    user: copr
+    key: "{{ item }}"
   with_file:
-  - buildsys.pub
+    - buildsys.production.pub
+    - buildsys.staging.pub
 
 - name: Add @copr keys for sysadmin-main and other allowed users
   authorized_key: user=copr key="{{ item }}"
@@ -153,18 +156,6 @@
   - config
   - sshkeys
 
-# todo: generate it's own key
-- name: Make sure hostA can ssh to hostB
-  ansible.builtin.copy:
-    src: "{{ private }}/files/copr/buildsys.priv"
-    dest: /home/copr/.ssh/id_rsa
-    owner: copr
-    mode: "0600"
-
-- name: Provide pub key, too, so we can install them to generated builder images
-  ansible.builtin.copy: src=buildsys.pub dest=/home/copr/.ssh/id_rsa.pub
-        owner=copr mode=0600
-
 - name: Enable praiskup-helpers repo
   ansible.builtin.shell: |
     dnf copr enable -y praiskup/helpers