draft: add roles for siguldry server and bridge

These roles deploy the Siguldry server and bridge.

There's a few TODOs, and one step that isn't covered at all is the
deployment of the TLS private keys. These need to be encrypted with
systemd-creds, which should be doable via ansible, but the pesign bridge
isn't doing it so I've left it out for now.

.gitignore

@@ -1,6 +1,9 @@
 *.swp
 *.pyc
 
+# Cursor workspace
+.cursor
+
 # emacs projectile
 .projectile
 

files/scripts/ansilog-playbook.py

@@ -77,6 +77,7 @@ _suffix_dns_replace = {}
 conf_play_remap = {
     'generate-updates-uptimes-per-host-file' : 'Updates+uptimes',
     'communishift_send_email_notifications' : 'CS_emails',
+    'communishift_disable_project' : 'CS_disable',
 }
 
 #  Dir. where we put, and look for, the files...

files/scripts/file-retention-iso-date

@@ -0,0 +1,94 @@
+#!/bin/bash
+# vim: ts=4:sw=4:expandtab:tw=100
+
+# This script manages a set of backup files which are prefixed with ISO dates  (YYYY-MM-DD).
+# - As new files come in, we want to delete the old ones.
+#   - RETENTION_DAYS decides how old is "old".
+# - But if no new files come in (e.g. the backup process is broken), we don't want to
+#   end up deleting _all_ the files, just because they're old.
+#   - MIN_KEEP decides how many files to keep.
+#
+# Usage: ./retain.sh --dry-run <directory>
+
+set -euo pipefail
+
+DRY_RUN=false
+DIR=""
+
+# Parse arguments (extremely verbosely to satisfy the LLM reviewing this PR)
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --dry-run)
+            DRY_RUN=true
+            shift
+            ;;
+        -*)
+            echo "Error: Unknown flag '$1'" >&2
+            exit 1
+            ;;
+        *)
+            if [[ -z "$DIR" ]]; then
+                DIR="$1"
+                shift
+            else
+                echo "Error: Multiple positional arguments provided. Expected only DIR." >&2
+                exit 1
+            fi
+            ;;
+    esac
+done
+
+# Validate required argument
+if [[ -z "$DIR" ]]; then
+    echo "Error: DIR argument is required." >&2
+    echo "Usage: $0 [--dry-run] DIR" >&2
+    exit 1
+fi
+
+RETENTION_DAYS="${RETENTION_DAYS:-31}"
+MIN_KEEP="${MIN_KEEP:-31}"
+CUTOFF=$(date -d "${RETENTION_DAYS} days ago" +%Y-%m-%d)
+
+# Collect all dated files (basename matches YYYY-MM-DD-*)
+mapfile -t DATED_FILES < <(
+    find "$DIR" -maxdepth 1 -type f -name "[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]-*" \
+        | sort -r # sort descending by filename (date first)
+)
+
+total=${#DATED_FILES[@]}
+
+$DRY_RUN && echo "*** DRY RUN — no files will be deleted ***"
+echo ""
+
+if [[ $total -eq 0 ]]; then
+    echo "No dated files found in '$DIR'."
+    exit 0
+fi
+
+deleted=0
+skipped_retention=0
+
+for i in "${!DATED_FILES[@]}"; do
+    filepath="${DATED_FILES[$i]}"
+    filename=$(basename "$filepath")
+    file_date="${filename:0:10}"  # extract YYYY-MM-DD
+
+    # Always keep the MIN_KEEP most-recent files (indices 0..MIN_KEEP-1)
+    if [[ $i -lt $MIN_KEEP ]]; then
+        echo "KEEP (newest ${MIN_KEEP}): $filename"
+        continue
+    fi
+
+    # Delete if the file's date is before the cutoff
+    if [[ "$file_date" < "$CUTOFF" ]]; then
+        echo "DELETE (expired): $filename"
+        $DRY_RUN || rm -- "$filepath"
+        deleted="$((deleted + 1))"
+    else
+        echo "KEEP (within retention): $filename"
+        skipped_retention="$((skipped_retention + 1))"
+    fi
+done
+
+echo ""
+echo "Deleted: $deleted files (dry-run=$DRY_RUN).  Kept by min-count: $(( total < MIN_KEEP ? total : MIN_KEEP )).  Kept by date window: $skipped_retention."

inventory/cloud

@@ -33,6 +33,8 @@ copr-keygen.aws.fedoraproject.org
 copr-keygen-dev.aws.fedoraproject.org
 #copr-be-dev.cloud.fedoraproject.org
 copr-dist-git-dev.fedorainfracloud.org
+rpmeta.stg.fedoraproject.org
+rpmeta.fedoraproject.org
 f42-test.fedorainfracloud.org
 f43-test.fedorainfracloud.org
 f44-test.fedorainfracloud.org

inventory/group_vars/all

@@ -105,6 +105,8 @@ communishift_projects:
     name: communishift-weekly-bootc
   communishift-draft-share:
     name: communishift-draft-share
+  communishift-happinesspackets:
+    name: communishift-happinesspackets
 # true or false if we are or are not a copr build virthost.
 # Default to false
 copr_build_virthost: false

inventory/group_vars/copr_aws

@@ -24,7 +24,7 @@ builders:
   # put here the number -1 of the actuall reserved instances
   aws_reserved:
     aarch64: [50, 20, 33]
-    x86_64: [64, 20, 52]
+    x86_64: [70, 20, 52]
   aws_reserved_powerful:
     x86_64: [1, 1, 1]
   aws_powerful:

inventory/group_vars/copr_dev_aws

@@ -195,3 +195,11 @@ nrpe_client_uid: 500
 pulp_content_url: "https://packages.redhat.com/api/pulp-content/public-copr-stage/"
 
 zabbix_host: 38.145.32.42
+zabbix_server: zabbix.stg.fedoraproject.org
+zabbix_auth_key: "{{ zabbix_stg_apikey }}" # in ansible-private repo
+zabbix_tls_psk: "{{ zabbix_tls_stg_psk }}" # in ansible-private repo
+# This is used to populate the inventory fields, only specific keys are allowed, see
+# https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory
+zabbix_inventory:
+  # Env is not a valid key, so use this field for environment
+  deployment_status: staging

inventory/group_vars/copr_rpmeta_aws

@@ -0,0 +1,28 @@
+---
+copr_machine_type: rpmeta
+copr_hostbase: copr-rpmeta
+
+rpmeta_hostname: rpmeta.fedoraproject.org
+rpmeta_port: 44882
+rpmeta_model_name: xgboost
+
+rpmeta_hf_repo_base: https://huggingface.co/fedora-copr/rpmeta/resolve
+rpmeta_hf_model_ref: v2025.12.24
+
+letsencrypt:
+  certificates:
+    rpmeta.fedoraproject.org:
+      challenge_dir: /var/www/html
+      domains:
+        - rpmeta.fedoraproject.org
+      mail: copr-devel@lists.fedorahosted.org
+  predefined_deploy_script: nginx
+
+tcp_ports: [22, 80, 443,
+    # node_exporter/prometheus
+    9100,
+]
+services_disabled: false
+
+notes: |
+  Production instance for RPMeta build duration prediction service.

inventory/group_vars/copr_rpmeta_dev_aws

@@ -0,0 +1,28 @@
+---
+copr_machine_type: rpmeta
+copr_hostbase: copr-rpmeta-dev
+
+rpmeta_hostname: rpmeta.stg.fedoraproject.org
+rpmeta_port: 44882
+rpmeta_model_name: xgboost
+
+rpmeta_hf_repo_base: https://huggingface.co/fedora-copr/rpmeta/resolve
+rpmeta_hf_model_ref: v2025.12.24
+
+letsencrypt:
+  certificates:
+    rpmeta.stg.fedoraproject.org:
+      challenge_dir: /var/www/html
+      domains:
+        - rpmeta.stg.fedoraproject.org
+      mail: copr-devel@lists.fedorahosted.org
+  predefined_deploy_script: nginx
+
+tcp_ports: [22, 80, 443,
+    # node_exporter/prometheus
+    9100,
+]
+services_disabled: false
+
+notes: |
+  Staging instance for RPMeta build duration prediction service.

inventory/host_vars/ipsilon02.stg.rdu3.fedoraproject.org

@@ -1,16 +0,0 @@
----
-datacenter: rdu3
-eth0_ipv4_gw: 10.16.166.254
-eth0_ipv4_ip: 10.16.166.83
-ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/
-ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
-vmhost: vmhost-x86-04.stg.rdu3.fedoraproject.org
-volgroup: /dev/vg_guests
-# Network configuration for RDU3
-dns: 10.16.163.33
-dns1: 10.16.163.33
-dns2: 10.16.163.34
-dns_search1: "rdu3.fedoraproject.org"
-dns_search2: "vpn.fedoraproject.org"
-dns_search3: "fedoraproject.org"
-openid: yes

inventory/host_vars/vmhost-x86-01.stg.rdu3.fedoraproject.org

@@ -14,6 +14,8 @@ dns2: 10.16.163.34
 dns_search1: "stg.rdu3.fedoraproject.org"
 dns_search2: "fedoraproject.org"
 has_ipv4: yes
+# ipa01.stg is the default, but runs on this vmhost.
+ipa_server: ipa02.stg.rdu3.fedoraproject.org
 mac0: c4:cb:e1:e1:71:5a
 mac1: c4:cb:e1:e1:71:5b
 mac2: c4:70:bd:aa:71:14

inventory/inventory

@@ -323,11 +323,9 @@ ipatuura01.stg.rdu3.fedoraproject.org
 
 [ipsilon_stg]
 ipsilon01.stg.rdu3.fedoraproject.org
-ipsilon02.stg.rdu3.fedoraproject.org
 
 [ipsilon_stg_rdu3]
 ipsilon01.stg.rdu3.fedoraproject.org
-ipsilon02.stg.rdu3.fedoraproject.org
 
 [ipsilon]
 ipsilon01.rdu3.fedoraproject.org
@@ -644,7 +642,6 @@ ipa02.stg.rdu3.fedoraproject.org
 ipa03.stg.rdu3.fedoraproject.org
 ipatuura01.stg.rdu3.fedoraproject.org
 ipsilon01.stg.rdu3.fedoraproject.org
-ipsilon02.stg.rdu3.fedoraproject.org
 koji01.stg.rdu3.fedoraproject.org
 mailman01.stg.rdu3.fedoraproject.org
 memcached02.stg.rdu3.fedoraproject.org
@@ -865,13 +862,21 @@ copr-keygen-dev.aws.fedoraproject.org
 copr-dist-git-dev.aws.fedoraproject.org
 copr-dist-git-dev.fedorainfracloud.org
 
+[copr_rpmeta_aws]
+rpmeta.fedoraproject.org
+
+[copr_rpmeta_dev_aws]
+rpmeta.stg.fedoraproject.org
+
 [copr_aws:children]
 copr_front_aws
 copr_back_aws
 copr_dist_git_aws
 copr_keygen_aws
+copr_rpmeta_aws
 
 [copr_dev_aws:children]
+copr_rpmeta_dev_aws
 copr_front_dev_aws
 copr_back_dev_aws
 copr_dist_git_dev_aws

playbooks/groups/copr-rpmeta.yml

@@ -0,0 +1,50 @@
+---
+- name: Check/create instance
+  hosts: copr_rpmeta_dev_aws:copr_rpmeta_aws
+  user: root
+  gather_facts: false
+
+  vars_files:
+  - /srv/web/infra/ansible/vars/global.yml
+  - "/srv/private/ansible/vars.yml"
+
+  handlers:
+  - import_tasks: "{{ handlers_path }}/restart_services.yml"
+
+  tasks:
+  - import_tasks: "{{ tasks_path }}/aws_cloud.yml"
+    when: datacenter == "aws"
+    tags: always
+
+  - import_tasks: "{{ tasks_path }}/swap.yml"
+    when:
+      - datacenter == 'aws'
+      - swap_file_size_mb is defined
+
+- name: Cloud basic setup
+  hosts: copr_rpmeta_dev_aws:copr_rpmeta_aws
+  gather_facts: true
+  vars_files:
+  - /srv/web/infra/ansible/vars/global.yml
+  - "/srv/private/ansible/vars.yml"
+
+  pre_tasks:
+  - import_tasks: "{{ tasks_path }}/yumrepos.yml"
+
+  tasks:
+  - import_tasks: "{{ tasks_path }}/cloud_setup_basic.yml"
+
+- name: Provision instance
+  hosts: copr_rpmeta_dev_aws:copr_rpmeta_aws
+  gather_facts: true
+
+  vars_files:
+    - /srv/web/infra/ansible/vars/global.yml
+    - "/srv/private/ansible/vars.yml"
+    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
+
+  roles:
+    - base
+    - nagios_client
+    - zabbix/zabbix_agent
+    - copr/rpmeta

playbooks/groups/maintainer-test.yml

@@ -37,5 +37,12 @@
     tags:
     - config
 
+  - name: Remove AWS users ssh keys override
+    ansible.builtin.file:
+      state: absent
+      path: "/usr/lib/systemd/system/sshd.service.d/ec2-instance-connect.conf"
+    tags:
+    - config
+
   handlers:
   - import_tasks: "{{ handlers_path }}/restart_services.yml"

playbooks/include/proxies-reverseproxy.yml

@@ -307,6 +307,7 @@
     wpath: /w
     wikipath: /wiki
     proxyurl: "{{ varnish_url }}"
+    tags: fp-wiki
 
   - role: httpd/reverseproxy
     website: bodhi.fedoraproject.org

playbooks/include/proxies-websites.yml

@@ -922,6 +922,18 @@
     cert_name: "{{wildcard_cert_name}}"
     server_aliases: [openqa.stg.fedoraproject.org]
     sslonly: true
+    anubis: true
+    tags: openqa
+    when: env != "staging"
+
+  - role: httpd/website
+    site_name: openqa.fedoraproject.org
+    cert_name: "{{wildcard_cert_name}}"
+    server_aliases: [openqa.stg.fedoraproject.org]
+    sslonly: true
+    anubis: true
+    tags: openqa
+    when: env == "staging"
 
   - role: httpd/website
     site_name: redirect.fedoraproject.org

playbooks/manual/communishift_disable_project.yml

@@ -0,0 +1,26 @@
+---
+# Communishift project disable / shutdown path (inventory + per-project eligibility).
+# Uses communishift_projects and each entry's do_not_delete to skip exempt namespaces.
+# Currently logs intent; scale-to-zero in the role is still commented out.
+#
+# Run disable tasks only:
+#   ansible-playbook .../communishift_disable_project.yml --tags communishift_disable_project
+#
+- hosts: localhost
+  user: root
+  gather_facts: false
+
+  vars_files:
+    - /srv/web/infra/ansible/vars/global.yml
+    - "/srv/private/ansible/vars.yml"
+    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
+
+  tasks:
+    - name: Communishift project shutdown (eligible projects)
+      include_role:
+        name: communishift
+        tasks_from: cleanup-administration-shutdown-services
+        apply:
+          tags:
+            - communishift_disable_project
+      loop: "{{ lookup('dict', communishift_projects) }}"

playbooks/manual/communishift_send_email_notifications.yml

@@ -1,4 +1,10 @@
 ---
+# Sends Fedora Communishift lifecycle emails to project admins (FASJSON BCC).
+# Notifications only — see communishift_disable_project.yml for shutdown-related tasks.
+#
+# Run notifications only:
+#   ansible-playbook .../communishift_send_email_notifications.yml --tags communishift_send_notifications
+#
 - hosts: localhost
   user: root
   gather_facts: false
@@ -13,14 +19,15 @@
       include_role:
         name: communishift
         tasks_from: cleanup-administration-retrieve-data
-
-    - name: Communishift Cluster Cleanup Tasks
-      with_items: "{{ communishift_projects }}"
-      include_role:
-        name: communishift
-        tasks_from: cleanup-administration
         apply:
           tags:
-            - cleanup-administration-tasks
-      loop: "{{ lookup('dict', communishift_projects) }}"
+            - communishift_send_notifications
 
+    - name: Communishift send tenant notification emails
+      include_role:
+        name: communishift
+        tasks_from: cleanup-administration-send-notifications
+        apply:
+          tags:
+            - communishift_send_notifications
+      loop: "{{ lookup('dict', communishift_projects) }}"

playbooks/manual/ocp4-postinstall-setup.yml

@@ -20,3 +20,4 @@
     - zlopez
     cluster_readonly_appowners:
     - smoliicek
+    - phsmoura

playbooks/openshift-apps/flask-oidc-dev.yml

@@ -1,73 +0,0 @@
----
-- name: Make the app be real
-  hosts: os_control_stg:os_control
-  user: root
-  gather_facts: false
-
-  vars_files:
-    - /srv/web/infra/ansible/vars/global.yml
-    - "/srv/private/ansible/vars.yml"
-    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
-
-  vars:
-
-  roles:
-    - role: openshift/project
-      project_app: flask-oidc-dev
-      project_description: "Authentication testing"
-      project_appowners:
-        - abompard
-        - dkirwan
-        - jamricha
-        - sidharthvipul
-      tags:
-        - apply-appowners
-
-    - role: openshift/imagestream
-      imagestream_app: flask-oidc-dev
-      imagestream_imagename: flask-oidc-dev
-
-    - role: openshift/object
-      object_app: flask-oidc-dev
-      object_template: buildconfig.yml.j2
-      object_objectname: buildconfig.yml
-
-    - role: openshift/object
-      object_app: flask-oidc-dev
-      object_template: configmap.yml.j2
-      object_objectname: configmap.yml
-
-    - role: openshift/object
-      object_app: flask-oidc-dev
-      object_file: service.yml
-      object_objectname: service.yml
-
-    # - role: openshift/route
-    #   route_app: test-auth
-    #   route_name: test-auth
-    #   route_host: "admin{{ env_suffix }}.fedoraproject.org"
-    #   route_path: "/test-auth"
-    #   route_serviceport: web
-    #   route_servicename: test-auth
-    #   route_annotations:
-    #     haproxy.router.openshift.io/timeout: 5m
-
-    - role: openshift/route
-      route_app: flask-oidc-dev
-      route_name: flask-oidc-dev
-      route_host: "app-flask-oidc-dev.apps.ocp{{ env_suffix }}.fedoraproject.org"
-      route_serviceport: web
-      route_servicename: flask-oidc-dev
-      route_annotations:
-        haproxy.router.openshift.io/timeout: 5m
-      when: ocp4
-
-    - role: openshift/object
-      object_app: flask-oidc-dev
-      object_template: secret-webhook.yml.j2
-      object_objectname: secret-webhook.yml
-
-    - role: openshift/object
-      object_app: flask-oidc-dev
-      object_template: deploymentconfig.yml.j2
-      object_objectname: deploymentconfig.yml

playbooks/openshift-apps/greenwave.yml

@@ -81,8 +81,8 @@
 
   - role: openshift/object
     object_app: greenwave
-    object_template: deploymentconfig.yml.j2
-    object_objectname: deploymentconfig.yml
+    object_template: deployment.yml.j2
+    object_objectname: deployment.yml
     tags:
       - apply-deploymentconfig
 

playbooks/openshift-apps/kerneltest.yml

@@ -109,5 +109,5 @@
 
   - role: openshift/object
     object_app: kerneltest
-    object_file: deploymentconfig.yml
-    object_objectname: deploymentconfig.yml
+    object_file: deployment.yml
+    object_objectname: deployment.yml

playbooks/openshift-apps/mdapi.yml

@@ -83,8 +83,8 @@
 
   - role: openshift/object
     object_app: mdapi
-    object_template: deploymentconfig.yml.j2
-    object_objectname: deploymentconfig.yml
+    object_template: deployment.yml.j2
+    object_objectname: deployment.yml
 
   - role: openshift/rollout
     rollout_app: mdapi

playbooks/openshift-apps/the-new-hotness.yml

@@ -93,8 +93,8 @@
 
   - role: openshift/object
     object_app: the-new-hotness
-    object_template: deploymentconfig.yml.j2
-    object_objectname: deploymentconfig.yml
+    object_template: deployment.yml.j2
+    object_objectname: deployment.yml
 
   - role: openshift/rollout
     rollout_app: the-new-hotness

playbooks/openshift-apps/websites.yml

@@ -21,34 +21,6 @@
     - kevin
     - glb
 
-  # legacy websites
-  - role: openshift/object
-    object_app: websites
-    object_file: pvc.yml
-    object_objectname: pvc.yml
-
-  - role: openshift/imagestream
-    imagestream_app: websites
-    imagestream_imagename: fedora-websites
-
-  - role: openshift/object
-    object_app: websites
-    object_template: fedora-websites-bc.yml.j2
-    object_objectname: fedora-websites-bc.yml
-
-  - role: openshift/start-build
-    start_build_app: websites
-    start_build_buildname: fedora-websites
-    start_build_objectname: fedora-websites
-    tags:
-    - never
-    - build
-
-  - role: openshift/object
-    object_app: websites
-    object_template: fedora-websites-cron.yml.j2
-    object_objectname: fedora-websites-cron.yml
-
   # New websites 3.0
   - role: openshift/imagestream
     imagestream_app: websites

roles/batcave/files/public-db-copy.cron

@@ -1 +1 @@
-0 12 * * * root /usr/local/bin/public-db-copy.sh
+0 12 * * * root chronic /usr/local/bin/public-db-copy.sh

roles/batcave/files/public-db-copy.sh

@@ -1,5 +1,13 @@
 #!/bin/bash
+
+set -e
+
 mailto='admin@fedoraproject.org'
 source /root/sshagent >>/dev/null
 export ANSIBLE_HOST_KEY_CHECKING=False
-/srv/web/infra/ansible/scripts/public-db-copy >& /dev/null
+
+# Copy all public database backups from the database servers to our public directory
+/srv/web/infra/ansible/scripts/public-db-copy
+
+# Delete old datanommer-incremental backups
+/srv/web/infra/ansible/files/scripts/file-retention-iso-date /srv/web/infra/db-dumps/datanommer-incremental

roles/batcave/tasks/main.yml

@@ -38,7 +38,7 @@
   - dnf-plugins-core          # To get dnf reposync
   - fedora-messaging          # To send/receive messages on the amqp bus
   - ansible-freeipa           # For the IPA server configuration tasks
-  - moreutils                 # needed for pee command for dns repo hook
+  - moreutils                 # needed for pee command for dns repo hook + chronic for cron emails
   # - python39-jmespath         # for the copr playbooks
   - rhel-system-roles         # for networking
   - python3-requests-kerberos # for authentication via kinit inside ansible
@@ -475,6 +475,16 @@
   - httpd
   - httpd/website
 
+#
+# Setup public-db-copy target directory for datanommer-incremental.
+#
+- name: Create db-dumps/datanommer-incremental directory
+  ansible.builtin.file: dest=/srv/web/infra/db-dumps/datanommer-incremental mode=2755 state=directory owner=root group=sysadmin-main setype=httpd_sys_content_t
+  tags:
+  - batcave
+  - config
+  when: inventory_hostname.startswith('batcave01')
+
 #
 # set selinux context for public git repos
 #

roles/blockerbugs/templates/blockerbugs-settings.py.j2

@@ -21,6 +21,7 @@ FAS_CHECK_CERT = False
 PRODUCTION = False
 FAS_ENABLED = True
 SQLALCHEMY_TRACK_MODIFICATIONS = False
+DEBUG = 'true'
 {% endif %}
 
 FILE_LOGGING = False

roles/communishift/tasks/cleanup-administration-send-notifications.yml

@@ -12,7 +12,7 @@
       Dear Fedora Communishift Project Administrators (BCC'd),
 
 
-      This is a reminder that the Communishift project {{ item.value.name }} will be disasbled and then later deleted during the Fedora post
+      This is a reminder that the Communishift project {{ item.value.name }} will be disabled and then later deleted during the Fedora post
       release process at the same time the oldest fedora is retired (1 month after a new fedora release).
 
       Please ensure you have a backup of any important configuration or data from your project. Consult Openshift docs.

roles/communishift/tasks/cleanup-administration.yml

@@ -1,3 +0,0 @@
----
-- include_tasks: cleanup-administration-send-notifications.yml
-- include_tasks: cleanup-administration-shutdown-services.yml

roles/copr/backend/files/provision/files/copr-rpmbuild.yml

@@ -5,6 +5,8 @@ tags_to_mock_snippet:
       - on_demand_powerful
     snippet: config_opts['plugin_conf']['tmpfs_opts']['max_fs_size'] = '280g'
 
+macro_override_db_url: https://copr-be.cloud.fedoraproject.org/config/distro-arch-specific.json
+
 rhsm:
   - rhel-*
   - epel-*

roles/copr/backend/templates/copr-be.conf.j2

@@ -57,7 +57,7 @@ builds_max_workers_arch=
     riscv64={{ (max_x86_64_workers|int / 5)|int }}
 
 # Do not let one user waste the whole architecture capacity
-builds_max_workers_arch_per_owner=s390x=4
+#builds_max_workers_arch_per_owner=s390x=4
 
 # Maximum number of concurrently running tasks per project owner.
 {% if env == 'production' %}
@@ -70,7 +70,7 @@ builds_max_workers_owner=0
 
 # Maximum number of concurrently running tasks per build sandbox.
 {% if env == 'production' %}
-builds_max_workers_sandbox=10
+builds_max_workers_sandbox=35
 {% else %}
 builds_max_workers_sandbox=4
 {% endif %}
@@ -108,6 +108,11 @@ gently_gpg_sha256 = False
 # possible for more complicated deployments like hosted Fedora Pulp.
 pulp_content_url={{ pulp_content_url }}
 
+# Don't run any builds or actions for these owners
+# blocked_owners =
+#     frostyx
+#     praiskup
+
 
 [builder]
 # default is 1800, this probably has no effect!

roles/copr/certbot/templates/nginx

@@ -0,0 +1,6 @@
+#! /bin/sh
+
+case $1 in --init) exit 0 ;; esac
+
+systemctl reload nginx
+

roles/copr/frontend/templates/copr.conf

@@ -284,6 +284,10 @@ EXTRA_BUILDCHROOT_TAGS = [{
     # https://github.com/fedora-copr/copr/issues/4199
     "pattern": "eseiker/asahi-el-kernel/.*(x86_64|aarch64)/kernel",
     "tags": ["on_demand_powerful"],
+},{
+    # https://github.com/fedora-copr/copr/issues/4256
+    "pattern": "^@python/python3\.\d+/.*/root$",
+    "tags": ["on_demand_powerful"],
 }]
 {% endif %}
 

roles/copr/rpmeta/handlers/main.yml

@@ -0,0 +1,10 @@
+---
+- name: Restart nginx
+  ansible.builtin.service:
+    name: nginx
+    state: restarted
+
+- name: Restart rpmeta
+  ansible.builtin.service:
+    name: rpmeta
+    state: restarted

roles/copr/rpmeta/meta/main.yml

@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: copr/base

roles/copr/rpmeta/tasks/main.yml

@@ -0,0 +1,174 @@
+---
+- name: Prepare mount point
+  ansible.builtin.file: state=directory path=/var/lib/rpmeta
+
+- name: Mount up disk of rpmeta data
+  mount: name=/var/lib/rpmeta src='LABEL=copr-rpmeta' fstype=xfs state=mounted
+
+- name: Enable copr rpmeta repository
+  community.general.copr:
+    name: "@copr/rpmeta"
+    state: enabled
+  tags:
+    - packages
+    - repos
+
+- name: Install rpmeta packages
+  ansible.builtin.dnf:
+    name:
+      - rpmeta
+      - "rpmeta+server"
+      - python3-pip
+    state: present
+  tags:
+    - packages
+
+# xgboost and lightgbm are not available in Fedora, rpmeta allows installing dependencies
+# separately to pylibs to avoid conflicts with other packages
+- name: Install model into pylibs
+  ansible.builtin.command:
+    cmd: pip install --target /var/lib/rpmeta/pylibs {{ rpmeta_model_name }}
+    creates: /var/lib/rpmeta/pylibs/{{ rpmeta_model_name }}
+  tags:
+    - packages
+
+- name: Install rpmeta sysconfig configuration
+  ansible.builtin.template:
+    src: rpmeta.sysconfig.j2
+    dest: /etc/sysconfig/rpmeta
+    owner: root
+    group: root
+    mode: '0644'
+  notify:
+    - Restart rpmeta
+  tags:
+    - config
+
+- name: Install rpmeta configuration
+  ansible.builtin.template:
+    src: config.toml.j2
+    dest: /etc/rpmeta/config.toml
+    owner: root
+    group: rpmeta
+    mode: '0644'
+  notify:
+    - Restart rpmeta
+  tags:
+    - config
+
+- name: Check current model version
+  ansible.builtin.slurp:
+    src: /var/lib/rpmeta/models/.model_ref
+  register: _rpmeta_current_ref
+  failed_when: false
+  tags:
+    - config
+    - models
+
+- name: Download rpmeta model from HuggingFace
+  ansible.builtin.get_url:
+    url: "{{ rpmeta_hf_repo_base }}/{{ rpmeta_hf_model_ref }}/{{ rpmeta_model_name }}/native_model.{% if rpmeta_model_name == 'lightgbm' %}txt{% else %}ubj{% endif %}"
+    dest: "/var/lib/rpmeta/models/native_model.{% if rpmeta_model_name == 'lightgbm' %}txt{% else %}ubj{% endif %}"
+    owner: rpmeta
+    group: rpmeta
+    mode: '0644'
+    force: yes
+  # Only download model if it is not already downloaded or if the model version is different
+  when: _rpmeta_current_ref.content is not defined or (_rpmeta_current_ref.content | b64decode | trim) != rpmeta_hf_model_ref
+  notify:
+    - Restart rpmeta
+  tags:
+    - config
+    - models
+
+- name: Download rpmeta categories from HuggingFace
+  ansible.builtin.get_url:
+    url: "{{ rpmeta_hf_repo_base }}/{{ rpmeta_hf_model_ref }}/categories.json"
+    dest: "/var/lib/rpmeta/models/categories.json"
+    owner: rpmeta
+    group: rpmeta
+    mode: '0644'
+    force: yes
+  when: _rpmeta_current_ref.content is not defined or (_rpmeta_current_ref.content | b64decode | trim) != rpmeta_hf_model_ref
+  notify:
+    - Restart rpmeta
+  tags:
+    - config
+    - models
+
+- name: Record model version
+  ansible.builtin.copy:
+    content: "{{ rpmeta_hf_model_ref }}\n"
+    dest: /var/lib/rpmeta/models/.model_ref
+    owner: rpmeta
+    group: rpmeta
+    mode: '0644'
+  tags:
+    - config
+    - models
+
+- name: Install nginx
+  ansible.builtin.dnf:
+    name:
+      - nginx
+    state: present
+  tags:
+    - packages
+
+- name: Create directory for ACME challenge
+  ansible.builtin.file:
+    path: /var/www/html/.well-known/acme-challenge
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+    recurse: yes
+  when: letsencrypt is defined
+  tags:
+    - config
+    - certbot
+
+- name: Install letsencrypt ssl certificates
+  include_role: name=copr/certbot
+  when: letsencrypt is defined
+  tags:
+    - config
+    - certbot
+
+- name: Install nginx configuration for rpmeta
+  ansible.builtin.template:
+    src: nginx/rpmeta.conf.j2
+    dest: /etc/nginx/conf.d/rpmeta.conf
+    owner: root
+    group: root
+    mode: '0644'
+  notify:
+    - Restart nginx
+  tags:
+    - config
+
+- name: Allow nginx to connect to upstream services
+  ansible.posix.seboolean:
+    name: httpd_can_network_connect
+    state: true
+    persistent: true
+  tags:
+    - selinux
+
+- name: Enable rpmeta service
+  ansible.builtin.service:
+    name: rpmeta
+    enabled: yes
+    state: started
+  tags:
+    - services
+    - always
+
+- name: Enable and start nginx service
+  ansible.builtin.service:
+    name: nginx
+    state: started
+    enabled: yes
+  tags:
+    - services
+    - always

roles/copr/rpmeta/templates/config.toml.j2

@@ -0,0 +1,11 @@
+result_dir = "/var/lib/rpmeta"
+
+[api]
+host = "localhost"
+port = {{ rpmeta_port | default(44882) }}
+
+[model.behavior]
+time_format = "minutes"
+
+[logging]
+file = "/var/log/rpmeta.log"

roles/copr/rpmeta/templates/nginx/rpmeta.conf.j2

@@ -0,0 +1,58 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ rpmeta_hostname }};
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+        allow all;
+    }
+
+    location / {
+        return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name {{ rpmeta_hostname }};
+
+    ssl_certificate     /etc/letsencrypt/live/{{ rpmeta_hostname }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ rpmeta_hostname }}/privkey.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:50m;
+    ssl_session_tickets off;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    add_header X-Frame-Options DENY always;
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    location / {
+        proxy_pass http://127.0.0.1:{{ rpmeta_port | default(44882) }};
+
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+    }
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+        allow all;
+    }
+}

roles/copr/rpmeta/templates/rpmeta.sysconfig.j2

@@ -0,0 +1,21 @@
+# RPMeta Service Configuration
+# This file contains environment variables for the rpmeta.service
+# Modify these values to match your environment
+
+# Path to model directory
+MODEL_DIR=/var/lib/rpmeta/models
+
+# Name of the model to use
+MODEL_NAME={{ rpmeta_model_name | default('xgboost') }}
+
+# Path to categories file
+CATEGORIES=/var/lib/rpmeta/models/categories.json
+
+# Path to configuration file
+CONFIG=/etc/rpmeta/config.toml
+
+# Log level to use
+LOG_LEVEL=INFO
+
+# Additional options
+EXTRA_OPTS=

roles/fasjson/files/aliases.static

@@ -212,13 +212,13 @@ fudcon-latam: flock-staff
 # flock
 #flockpress: fca,fpl
 #flockinfo: fca,fpl
-flock-staff: flock-team-members@fedoraproject.org
+flock-staff: flock-team-members@fedoraproject.org, jwheel@redhat.com
 #flock-admin: flock-staff
 #flock-access: flock-admin
 #
 # flock/sponsor alias
 # https://forge.fedoraproject.org/infra/tickets/issues/10591
-sponsors: flock-team-sponsors@fedoraproject.org
+sponsors: flock-team-sponsors@fedoraproject.org, jwheel@redhat.com
 
 # swag customer email alias https://forge.fedoraproject.org/infra/tickets/issues/10794
 swag-info: fca,shaunm,designteam-sponsors@fedoraproject.org
@@ -237,7 +237,7 @@ infra-security: puiterwijk,kevin,codeblock,mobrien
 webmaster: websites@lists.fedoraproject.org
 logo: rlerch@redhat.com,duffy@redhat.com,mpeck@redhat.com
 ham-radio-exams: nb,jbwillia
-podcast: x3mboy,fca,nomiller@redhat.com,itguyeric,dogphilosopher,kernellinux
+podcast: podcast-sponsors@fedoraproject.org,jwheel@redhat.com
 
 # Misc Aliases
 cvs-access: accounts

roles/haproxy/templates/haproxy.cfg

@@ -182,7 +182,7 @@ backend ipsilon-backend-openid
     balance hdr(appserver)
     cookie OPENID insert indirect nocache attr Max-Age=300
 {% if env == "staging" %}
-    server  ipsilon02 ipsilon02:80 cookie true check inter 10s rise 1 fall 3
+    server  ipsilon01 ipsilon01:80 cookie true check inter 10s rise 1 fall 3
 {% else %}
     server  ipsilon03 ipsilon03:80 cookie true check inter 10s rise 1 fall 3
 {% endif %}

roles/httpd/reverseproxy/templates/reversepassproxy.fp-wiki.conf

@@ -11,7 +11,7 @@ RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NE,L]
 # Spiders-gone-wild
 # These spiders may not follow robots.txt and will
 # hit admin sections which consume large amounts of CPU
-RewriteCond %{HTTP_USER_AGENT} "(Bytespider|ClaudeBot|Amazonbot|YandexBot|ChatGLM-Spider|GPTBot|Barkrowler|YisouSpider|MJ12bot)" [NC]
+RewriteCond %{HTTP_USER_AGENT} "(Bytespider|ClaudeBot|Amazonbot|YandexBot|ChatGLM-Spider|GPTBot|Barkrowler|YisouSpider|MJ12bot|Avengineers-Crawler)" [NC]
 RewriteRule .* - [F,L]
 
 # /wiki must come before /w due to prefix matching.

roles/httpd/website/templates/website.conf

@@ -143,8 +143,14 @@
   ProxyRequests Off
   ProxyVia Off
 
+{% if site_name.startswith('openqa') %}
+# Openqa uses websockets, so allow them through anubis proxying.
+  ProxyPass / http://127.0.0.1:8987/ upgrade=websocket
+  ProxyPassReverse / http://127.0.0.1:8987/
+{% else %}
   ProxyPass / http://127.0.0.1:8987/
   ProxyPassReverse / http://127.0.0.1:8987/
+{% endif %}
 {% else %}
   Include "conf.d/{{ site_name }}/*.conf"
 {% endif %}

roles/ipsilon/templates/httpd.conf.j2

@@ -12,7 +12,6 @@ RewriteMap lowercase int:tolower
 {% if env == "staging" %}
 RewriteCond ${lowercase:%{SERVER_NAME}} ^[a-z0-9_\.-]+\.id\.stg\.fedoraproject\.org$
 RewriteRule ^(.+) /${lowercase:%{SERVER_NAME}}$1 [C]
-RewriteRule ^/([a-z0-9_\.-]+)\.id\.stg\.fedoraproject\.org/.* /openid/id/$1/ [PT]
 {% else %}
 RewriteCond ${lowercase:%{SERVER_NAME}} ^[a-z0-9_\.-]+\.id\.fedoraproject\.org$
 RewriteRule ^(.+) /${lowercase:%{SERVER_NAME}}$1 [C]

roles/koji_builder/tasks/main.yml

@@ -388,27 +388,3 @@
   tags:
   - koji_builder
   - koji_builder/nspawn
-
-- name: /run/pesign directory perms (kojibuilder)
-  acl: path=/run/pesign entity=kojibuilder etype=user permissions=rwx recursive=true state=present
-  when: "'secureboot' in group_names"
-  tags:
-  - secureboot
-
-- name: /run/pesign directory perms (pesign)
-  acl: path=/run/pesign entity=pesign etype=user permissions=rwx recursive=true state=present
-  when: "'secureboot' in group_names"
-  tags:
-  - secureboot
-
-- name: /run/pesign socket perms (kojibuilder)
-  acl: path=/run/pesign/socket entity=kojibuilder etype=user permissions=rwx recursive=true state=present
-  when: "'secureboot' in group_names"
-  tags:
-  - secureboot
-
-- name: /run/pesign socket perms (pesign)
-  acl: path=/run/pesign/socket default=true entity=pesign etype=group permissions=rwx recursive=true state=present
-  when: "'secureboot' in group_names"
-  tags:
-  - secureboot

roles/koji_hub/templates/hub.conf.j2

@@ -198,6 +198,7 @@ channel =
     source */webkitgtk* :: use heavybuilder
     source */firefox* :: use heavybuilder
     source */cef* :: use heavybuilder
+    source */rccl* :: use heavybuilder
 {% endif %}
 
     is_child_task :: parent

roles/openshift-apps/blockerbugs/templates/cron.yml.j2

@@ -49,6 +49,10 @@ spec:
               value: "https://stg.pagure.io/api/0/"
             - name: BUGZILLA_URL
               value: "https://bugzilla.stage.redhat.com"
+            - name: FORGEJO_BOT_ACCESS_TOKEN
+              value: "{{ stg_blockerbugs_forge_bot_access_token }}"
+            - name: FORGEJO_REPO_WEBHOOK_SECRET
+              value: "{{ stg_blockerbugs_forge_repo_webhook_secret }}"
 {% else %}
             - name: POSTGRESQL_PASSWORD
               value: "{{ prod_blockerbugs_db_password }}"
@@ -66,6 +70,10 @@ spec:
               value: "https://pagure.io/api/0/"
             - name: BUGZILLA_URL
               value: "https://bugzilla.redhat.com"
+            - name: FORGEJO_BOT_ACCESS_TOKEN
+              value: "{{ prod_blockerbugs_forge_bot_access_token }}"
+            - name: FORGEJO_REPO_WEBHOOK_SECRET
+              value: "{{ prod_blockerbugs_forge_repo_webhook_secret }}"
 {% endif %}
             - name: BLOCKERBUGS_URL
               value: "https://qa{{ env_suffix }}.fedoraproject.org/blockerbugs/"
@@ -81,6 +89,20 @@ spec:
               value: "True"
             - name: PAGURE_REPO
               value: "fedora-qa/blocker-review"
+            - name: FORGEJO_REPO
+              value: "quality/blocker-review"
+            - name: FORGEJO_BOT_USERNAME
+              value: "blockerbot"
+            - name: FORGEJO_BOT_ENABLED
+              value: "True"
+            - name: FORGEJO_URL
+              value: "https://forge{{ env_suffix }}.fedoraproject.org/"
+            - name: FORGEJO_API
+              value: "https://forge{{ env_suffix }}.fedoraproject.org/api/v1/"
+            - name: FORGEJO_ADMIN_ORG
+              value: "quality"
+            - name: FORGEJO_ADMIN_TEAM
+              value: "members"
             - name: BODHI_URL
               value: "https://bodhi{{ env_suffix }}.fedoraproject.org/"
             - name: OPENSHIFT_PROD

roles/openshift-apps/blockerbugs/templates/deployment.yml.j2

@@ -58,6 +58,10 @@ spec:
           value: "https://stg.pagure.io/api/0/"
         - name: BUGZILLA_URL
           value: "https://bugzilla.stage.redhat.com"
+        - name: FORGEJO_BOT_ACCESS_TOKEN
+          value: "{{ stg_blockerbugs_forge_bot_access_token }}"
+        - name: FORGEJO_REPO_WEBHOOK_SECRET
+          value: "{{ stg_blockerbugs_forge_repo_webhook_secret }}"
 {% else %}
         - name: POSTGRESQL_PASSWORD
           value: "{{ prod_blockerbugs_db_password }}"
@@ -75,6 +79,10 @@ spec:
           value: "https://pagure.io/api/0/"
         - name: BUGZILLA_URL
           value: "https://bugzilla.redhat.com"
+        - name: FORGEJO_BOT_ACCESS_TOKEN
+          value: "{{ prod_blockerbugs_forge_bot_access_token }}"
+        - name: FORGEJO_REPO_WEBHOOK_SECRET
+          value: "{{ prod_blockerbugs_forge_repo_webhook_secret }}"
 {% endif %}
         - name: BLOCKERBUGS_URL
           value: "https://qa{{ env_suffix }}.fedoraproject.org/blockerbugs/"
@@ -90,6 +98,20 @@ spec:
           value: "True"
         - name: PAGURE_REPO
           value: "fedora-qa/blocker-review"
+        - name: FORGEJO_REPO
+          value: "quality/blocker-review"
+        - name: FORGEJO_BOT_USERNAME
+          value: "blockerbot"
+        - name: FORGEJO_BOT_ENABLED
+          value: "True"
+        - name: FORGEJO_URL
+          value: "https://forge{{ env_suffix }}.fedoraproject.org/"
+        - name: FORGEJO_API
+          value: "https://forge{{ env_suffix }}.fedoraproject.org/api/v1/"
+        - name: FORGEJO_ADMIN_ORG
+          value: "quality"
+        - name: FORGEJO_ADMIN_TEAM
+          value: "members"
         - name: BODHI_URL
           value: "https://bodhi{{ env_suffix }}.fedoraproject.org/"
         - name: OPENSHIFT_PROD

roles/openshift-apps/cloud-image-uploader/templates/config.toml

@@ -48,7 +48,6 @@ ami_regions = [
     "eu-west-1",
     "ap-northeast-3",
     "ap-northeast-2",
-    "me-south-1",
     "ap-northeast-1",
     "sa-east-1",
     "ca-central-1",

roles/openshift-apps/compose-tracker/templates/buildconfig.yml.j2

@@ -20,7 +20,7 @@ spec:
     dockerStrategy:
       from:
         kind: ImageStreamTag
-        name: fedora:38
+        name: fedora:44
   output:
     to:
       kind: ImageStreamTag

roles/openshift-apps/compose-tracker/templates/imagestream.yml.j2

@@ -2,7 +2,7 @@
 apiVersion: image.openshift.io/v1
 kind: List
 items:
-# ImageStream for Fedora 36 image
+# ImageStream for Fedora 44 image
 - apiVersion: image.openshift.io/v1
   kind: ImageStream
   metadata:
@@ -13,10 +13,10 @@ items:
     lookupPolicy:
       local: false
     tags:
-    - name: "38"
+    - name: "44"
       from:
         kind: DockerImage
-        name: registry.fedoraproject.org/fedora:38
+        name: registry.fedoraproject.org/fedora:44
       importPolicy:
         scheduled: true
       referencePolicy:

roles/openshift-apps/docstranslation/templates/cron.yml.j2

@@ -4,6 +4,7 @@ kind: CronJob
 metadata:
   name: cron
 spec:
+  suspend: true
   concurrencyPolicy: Forbid
   schedule: "0 21 * * *"
   startingDeadlineSeconds: 600

roles/openshift-apps/fedora-packages-static/files/service.yml

@@ -2,9 +2,8 @@
 apiVersion: v1
 kind: Service
 metadata:
-  labels:
-    app: fedora-packages-static
   name: fedora-packages-static
+  namespace: fedora-packages-static
 spec:
   ports:
   - name: 8080-tcp
@@ -17,9 +16,8 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  labels:
-    app: fedora-packages-static
   name: solr
+  namespace: fedora-packages-static
 spec:
   ports:
   - name: 8983-tcp
@@ -27,4 +25,4 @@ spec:
     protocol: TCP
     targetPort: 8983
   selector:
-    app: fedora-packages-static
+    app: solr

roles/openshift-apps/fedora-packages-static/templates/deployment.yml.j2

@@ -2,9 +2,6 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app: fedora-packages-static
-    service: fedora-packages-static
   name: fedora-packages-static
 spec:
   replicas: 1
@@ -71,23 +68,18 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app: fedora-packages-static
-    service: solr
   name: solr
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: fedora-packages-static
-      service: solr
+      app: solr
   strategy:
     type: Recreate
   template:
     metadata:
       labels:
-        app: fedora-packages-static
-        service: solr
+        app: solr
     spec:
       containers:
       - name: solr

roles/openshift-apps/flask-oidc-dev/files/service.yml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: flask-oidc-dev
-  labels:
-    app: flask-oidc-dev
-spec:
-  ports:
-    - name: web
-      port: 8080
-      targetPort: 8080
-  selector:
-    app: flask-oidc-dev
-    deploymentconfig: flask-oidc-dev

roles/openshift-apps/flask-oidc-dev/templates/buildconfig.yml.j2

@@ -1,42 +0,0 @@
----
-apiVersion: build.openshift.io/v1
-kind: BuildConfig
-metadata:
-  name: flask-oidc-dev
-  labels:
-    app: flask-oidc-dev
-    build: flask-oidc-dev
-spec:
-  runPolicy: Serial
-  source:
-    type: Git
-    git:
-      uri: https://github.com/fedora-infra/test-auth.git
-{% if env == "staging" %}
-      ref: main
-{% else %}
-      ref: stable
-{% endif %}
-    contextDir: /
-  strategy:
-    type: Source
-    sourceStrategy:
-      from:
-        kind: ImageStreamTag
-        name: python:3.9-ubi8
-        namespace: openshift
-  output:
-    to:
-      kind: ImageStreamTag
-      name: flask-oidc-dev:latest
-  triggers:
-  - type: ConfigChange
-  - type: ImageChange
-  - type: GitHub
-{% if test_auth_stg_github_secret is defined and env == 'staging' %}
-    github:
-      secret: "{{ test_auth_stg_github_secret }}"
-{% elif test_auth_github_secret is defined and env == 'production' %}
-    github:
-      secret: "{{ test_auth_github_secret }}"
-{% endif %}

roles/openshift-apps/flask-oidc-dev/templates/client_secrets.json

@@ -1,17 +0,0 @@
-{
-    "web": {
-        "auth_uri": "https://id{{env_suffix}}.fedoraproject.org/openidc/Authorization",
-        "client_id": "flask-oidc-dev",
-{% if env == 'staging' %}
-        "client_secret": "{{ flask_oidc_dev_stg_oidc_client_secret }}",
-{% else %}
-        "client_secret": "{{ flask_oidc_dev_oidc_client_secret }}",
-{% endif %}
-        "issuer": "https://id{{env_suffix}}.fedoraproject.org/openidc/",
-        "redirect_uris": [
-            "https://app-flask-oidc-dev.apps.ocp{{env_suffix}}.fedoraproject.org/oidc/oidc_callback"
-        ],
-        "token_uri": "https://id{{env_suffix}}.fedoraproject.org/openidc/Token",
-        "userinfo_uri": "https://id{{env_suffix}}.fedoraproject.org/openidc/UserInfo"
-    }
-}

roles/openshift-apps/flask-oidc-dev/templates/config.py

@@ -1,21 +0,0 @@
-#
-# This is the config file for Test Auth as intended to be used in OpenShift
-#
-
-
-# Deployed to a subpath
-# APPLICATION_ROOT = '/test-auth/'
-
-# Cookies
-SECRET_KEY = "{{ flask_oidc_dev_session_secret }}"
-SESSION_COOKIE_NAME = 'flask-oidc-dev'
-SESSION_COOKIE_HTTPONLY = True
-SESSION_COOKIE_SECURE = True
-
-# Auth
-OIDC_CLIENT_SECRETS = "/etc/flask-oidc-dev/oidc.json"
-OIDC_SCOPES = "openid profile email https://id.fedoraproject.org/scope/groups"
-OIDC_INTROSPECTION_AUTH_METHOD = "client_secret_post"
-OIDC_CALLBACK_ROUTE = "/oidc_callback"
-OPENID_ENDPOINT = "https://id{{ env_suffix }}.fedoraproject.org/openid/"
-FAS_OPENID_ENDPOINT = "https://id{{ env_suffix }}.fedoraproject.org/openid/"

roles/openshift-apps/flask-oidc-dev/templates/configmap.yml.j2

@@ -1,17 +0,0 @@
-{% macro load_file(filename) %}{% include filename %}{%- endmacro -%}
----
-apiVersion: v1
-kind: List
-metadata: {}
-items:
-- apiVersion: v1
-  kind: ConfigMap
-  metadata:
-    name: flask-oidc-dev-config
-    labels:
-      app: flask-oidc-dev
-  data:
-    flask-oidc-dev.cfg: |-
-      {{ load_file('config.py') | indent(6) }}
-    oidc.json: |-
-      {{ load_file('client_secrets.json') | indent(6) }}

roles/openshift-apps/flask-oidc-dev/templates/deploymentconfig.yml.j2

@@ -1,60 +0,0 @@
----
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
-metadata:
-  name: flask-oidc-dev
-  labels:
-    app: flask-oidc-dev
-spec:
-  replicas: 1
-  selector:
-    app: flask-oidc-dev
-    deploymentconfig: flask-oidc-dev
-  strategy:
-    type: Rolling
-    activeDeadlineSeconds: 21600
-    rollingParams:
-      intervalSeconds: 1
-      maxSurge: 25%
-      maxUnavailable: 25%
-      timeoutSeconds: 600
-      updatePeriodSeconds: 1
-  template:
-    metadata:
-      creationTimestamp: null
-      labels:
-        app: flask-oidc-dev
-        deploymentconfig: flask-oidc-dev
-    spec:
-      containers:
-        - name: flask-oidc-dev
-          imagePullPolicy: Always
-          ports:
-            - containerPort: 8080
-              # protocol: TCP
-          # resources: {}
-          # terminationMessagePath: /dev/termination-log
-          # terminationMessagePolicy: File
-          volumeMounts:
-            - name: flask-oidc-dev-config-volume
-              mountPath: "/etc/flask-oidc-dev"
-              readOnly: true
-          env:
-            - name: TESTAUTH_SETTINGS
-              value: "/etc/flask-oidc-dev/flask-oidc-dev.cfg"
-            # - name: SCRIPT_NAME
-            #   value: "/flask-oidc-dev"
-      volumes:
-        - name: flask-oidc-dev-config-volume
-          configMap:
-            name: flask-oidc-dev-config
-  triggers:
-    - imageChangeParams:
-        automatic: true
-        containerNames:
-          - flask-oidc-dev
-        from:
-          kind: ImageStreamTag
-          name: flask-oidc-dev:latest
-      type: ImageChange
-    - type: ConfigChange

roles/openshift-apps/flask-oidc-dev/templates/secret-webhook.yml.j2

@@ -1,8 +0,0 @@
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: test-auth-github-webhook-secret
-data:
-  WebHookSecretKey: "{{ (env == 'production')|ternary(test_auth_github_secret, test_auth_stg_github_secret) }}"
-type: Opaque

roles/openshift-apps/forgejo/defaults/main.yml

@@ -4,5 +4,13 @@ forgejo_project_description: "Forgejo Gitforge"
 forgejo_application_name: "{{ forgejo_namespace }}"
 
 forgejo_runnerhost_packages:
+  - ansible
   - podman
+  - python3
+  - python3-kubernetes
   - git
+  - cronie
+  - gawk
+  - sed
+  - zabbix-agent
+  - ca-certificates

roles/openshift-apps/forgejo/tasks/create-forgejo-runnerhost-sa-rbac.yaml

@@ -0,0 +1,44 @@
+---
+- name: Generate the forgejo-runnerhost-serviceaccount.yaml from template
+  ansible.builtin.template:
+    src: "forgejo-runnerhost-serviceaccount.yaml.j2"
+    dest: "/root/ocp4/openshift-apps/forgejo/forgejo-runnerhost-serviceaccount.yaml"
+    mode: "0770"
+
+- name: Deploy the forgejo-runnerhost-serviceaccount.yaml config
+  kubernetes.core.k8s:
+    state: present
+    src: "/root/ocp4/openshift-apps/forgejo/forgejo-runnerhost-serviceaccount.yaml"
+
+- name: Generate the forgejo-runnerhost-role.yaml from template
+  ansible.builtin.template:
+    src: "forgejo-runnerhost-role.yaml.j2"
+    dest: "/root/ocp4/openshift-apps/forgejo/forgejo-runnerhost-role.yaml"
+    mode: "0770"
+
+- name: Deploy the forgejo-runnerhost-role.yaml config
+  kubernetes.core.k8s:
+    state: present
+    src: "/root/ocp4/openshift-apps/forgejo/forgejo-runnerhost-role.yaml"
+
+- name: Generate the forgejo-runnerhost-rolebinding.yaml from template
+  ansible.builtin.template:
+    src: "forgejo-runnerhost-rolebinding.yaml.j2"
+    dest: "/root/ocp4/openshift-apps/forgejo/forgejo-runnerhost-rolebinding.yaml"
+    mode: "0770"
+
+- name: Deploy the forgejo-runnerhost-rolebinding.yaml config
+  kubernetes.core.k8s:
+    state: present
+    src: "/root/ocp4/openshift-apps/forgejo/forgejo-runnerhost-rolebinding.yaml"
+
+- name: Generate the forgejo-runnerhost-sa-token-secret.yaml from template
+  ansible.builtin.template:
+    src: "forgejo-runnerhost-sa-token-secret.yaml.j2"
+    dest: "/root/ocp4/openshift-apps/forgejo/forgejo-runnerhost-sa-token-secret.yaml"
+    mode: "0770"
+
+- name: Deploy the forgejo-runnerhost-sa-token-secret.yaml config
+  kubernetes.core.k8s:
+    state: present
+    src: "/root/ocp4/openshift-apps/forgejo/forgejo-runnerhost-sa-token-secret.yaml"

roles/openshift-apps/forgejo/tasks/main.yaml

@@ -59,5 +59,6 @@
 - include_tasks: call-helm.yaml
 - include_tasks: copy-forgejo-runner-vars.yaml
 - include_tasks: create-forgejo-runner-config-secret.yaml
+- include_tasks: create-forgejo-runnerhost-sa-rbac.yaml
 - include_tasks: create-forgejo-runnerhost-vm.yaml
 - include_tasks: register-runners.yaml

roles/openshift-apps/forgejo/templates/forgejo-runnerhost-vm.yaml.j2

@@ -31,10 +31,15 @@ spec:
       labels:
         network.kubevirt.io/headlessService: headless
     spec:
+      serviceAccountName: forgejo-runner-vm
       architecture: amd64
       domain:
         devices:
           autoattachPodInterface: false
+          disks:
+            - name: sa-token-disk
+              disk: {}
+              serial: SATOKEN000001
           interfaces:
           - macAddress: "{{ '02:79:58' | community.general.random_mac }}"
             masquerade: {}
@@ -57,6 +62,9 @@ spec:
               expire: false
             password: "{{ (env == 'production') | ternary(forgejo_runnerhostvm_password, forgejo_stg_runnerhostvm_password) }}"
             user: "{{ (env == 'production') | ternary(forgejo_runnerhostvm_user, forgejo_stg_runnerhostvm_user) }}"
+            bootcmd:
+              - "mkdir -p /mnt/sa-token"
+              - "mount /dev/$(lsblk --nodeps -no name,serial | grep SATOKEN000001 | cut -f1 -d' ') /mnt/sa-token"
 {% if forgejo_runnerhost_packages | default([]) | length > 0 %}
             package_update: true
             packages:
@@ -64,4 +72,28 @@ spec:
               - {{ pkg }}
 {% endfor %}
 {% endif %}
+{% set _vm_user = (env == 'production') | ternary(forgejo_runnerhostvm_user, forgejo_stg_runnerhostvm_user) %}
+            write_files:
+              - path: /home/{{ _vm_user }}/.config/systemd/user/podman.socket.d/chown.conf
+                owner: "{{ _vm_user }}:{{ _vm_user }}"
+                defer: true
+                content: |
+                  [Socket]
+                  ExecStartPost=/usr/bin/podman unshare chown 0:1000 %t/podman/podman.sock
+            runcmd:
+              - "chown -R {{ _vm_user }}:{{ _vm_user }} /home/{{ _vm_user }}"
+              - "loginctl enable-linger {{ _vm_user }}"
+              - >-
+                sudo -u {{ _vm_user }} bash -c
+                'export XDG_RUNTIME_DIR=/run/user/$(id -u)
+                && systemctl --user daemon-reload
+                && systemctl --user enable --now podman.socket'
+              - >-
+                sudo -u {{ _vm_user }} bash -c
+                'ansible-pull -U https://codeberg.org/fedora/ansible-role-forgejo-runner.git -C main
+                playbooks/ansible-pull.yml
+                >> /home/{{ _vm_user }}/ansible-pull.log 2>&1'
         name: cloudinitdisk
+      - name: sa-token-disk
+        secret:
+          secretName: forgejo-runner-vm-token

roles/openshift-apps/forgejo/templates/values.yaml.j2

@@ -452,7 +452,9 @@ gitea:
         "forge-infra-owners":{"infra":["Owners"]},
         "forge-infra-members":{"infra":["Members"]},
         "forge-playground-owners":{"playground":["Owners"]},
-        "forge-playground-members":{"playground":["Members"]}
+        "forge-playground-members":{"playground":["Members"]},
+        "forge-quality-members":{"quality":["Members"]},
+        "forge-quality-owners":{"quality":["Owners"]}
       }'
 {% else %}
       group-team-map: '{
@@ -472,6 +474,7 @@ gitea:
         "forge-server-members":{"server":["Members"]},
         "forge-docs-owners":{"docs":["Owners"]},
         "forge-docs-members":{"docs":["Members"]},
+        "forge-docs-quickdocs":{"docs":["Quickdocs"]},
         "forge-forge-owners":{"forge":["Owners"]},
         "forge-forge-members":{"forge":["Members"]},
         "forge-commops-owners":{"commops":["Owners"]},
@@ -487,6 +490,7 @@ gitea:
         "forge-reproduciblebuilds-owners":{"reproduciblebuilds":["Owners"]},
         "forge-dei-owners":{"dei":["Owners"]},
         "forge-dei-members":{"dei":["Members"]},
+        "forge-dei-pride":{"dei":["Pride"]},
         "forge-rust-owners":{"rust":["Owners"]},
         "forge-rust-members":{"rust":["Members"]},
         "forge-mobility-owners":{"mobility":["Owners"]},
@@ -550,7 +554,11 @@ gitea:
         "forge-science-owners":{"science":["Owners"]},
         "forge-science-members":{"science":["Members"]},
         "forge-eln-owners":{"eln":["Owners"]},
-        "forge-eln-members":{"eln":["Members"]}
+        "forge-eln-members":{"eln":["Members"]},
+        "forge-koji-owners":{"koji":["Owners"]},
+        "forge-koji-members":{"koji":["Members"]},
+        "forge-i18n-owners":{"i18n":["Owners"]},
+        "forge-i18n-members":{"i18n":["Members"]}
       }'
 {% endif %}
     # - name: 'OAuth 1'

roles/openshift-apps/greenwave/templates/deployment.yml.j2

@@ -1,6 +1,6 @@
 ---
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: greenwave-web
   labels:
@@ -9,17 +9,21 @@ metadata:
 spec:
   replicas: 2
   selector:
-    app: greenwave
-    service: web
+    matchLabels:
+      app: greenwave
+      service: web
+  strategy: {}
   template:
     metadata:
       labels:
         app: greenwave
         service: web
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"greenwave:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"web\")].image"}]'
     spec:
       containers:
       - name: web
-        image: registry/greenwave:latest
+        image: image-registry.openshift-image-registry.svc:5000/greenwave/greenwave:latest
         ports:
         - containerPort: 8080
         volumeMounts:
@@ -27,13 +31,13 @@ spec:
           mountPath: /etc/greenwave
           readOnly: true
         readinessProbe:
-          timeoutSeconds: 1
+          timeoutSeconds: 3
           initialDelaySeconds: 5
           httpGet:
             path: /healthcheck
             port: 8080
         livenessProbe:
-          timeoutSeconds: 1
+          timeoutSeconds: 3
           initialDelaySeconds: 30
           httpGet:
             path: /healthcheck
@@ -45,20 +49,9 @@ spec:
       - name: config-volume
         configMap:
           name: greenwave-configmap
-  triggers:
-  - type: ImageChange
-    imageChangeParams:
-      automatic: true
-      containerNames:
-      - web
-      from:
-        kind: ImageStreamTag
-        name: greenwave:latest
-  - type: ConfigChange
 ---
-# For fedmsg consumers
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: greenwave-fedmsg-consumers
   labels:
@@ -67,16 +60,20 @@ metadata:
 spec:
   replicas: 0
   selector:
-    service: fedmsg-consumers
+    matchLabels:
+      service: fedmsg-consumers
+  strategy: {}
   template:
     metadata:
       labels:
         app: greenwave
         service: fedmsg-consumers
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"greenwave:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"fedmsg-consumers\")].image"}]'
     spec:
       containers:
       - name: fedmsg-consumers
-        image: registry/greenwave:latest
+        image: image-registry.openshift-image-registry.svc:5000/greenwave/greenwave:latest
         ports:
         - containerPort: 8081
         command:
@@ -104,15 +101,12 @@ spec:
           limits:
             memory: 384Mi
       volumes:
-      # Give the fedmsg-consumer container access to the general config
       - name: config-volume
         configMap:
           name: greenwave-configmap
-      # But *also* access to the fedmsg-specific config
       - name: fedora-messaging-config-volume
         configMap:
           name: fedora-messaging-configmap
-      # And... this secret volume gets set up in the playbook
       - name: fedora-messaging-ca-volume
         secret:
           secretName: greenwave-fedora-messaging-ca
@@ -122,20 +116,9 @@ spec:
       - name: fedora-messaging-crt-volume
         secret:
           secretName: greenwave-fedora-messaging-crt
-  triggers:
-  - type: ImageChange
-    imageChangeParams:
-      automatic: true
-      containerNames:
-      - fedmsg-consumers
-      from:
-        kind: ImageStreamTag
-        name: greenwave:latest
-  - type: ConfigChange
 ---
-# For memcached
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: greenwave-memcached
   labels:
@@ -144,7 +127,9 @@ metadata:
 spec:
   replicas: 1
   selector:
-    service: greenwave-memcached
+    matchLabels:
+      service: greenwave-memcached
+  strategy: {}
   template:
     metadata:
       labels:
@@ -159,5 +144,3 @@ spec:
         resources:
           limits:
             memory: 384Mi
-  triggers:
-  - type: ConfigChange

roles/openshift-apps/kerneltest/files/deployment.yml

@@ -1,6 +1,6 @@
 ---
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   labels:
     app: kerneltest
@@ -9,43 +9,23 @@ metadata:
 spec:
   replicas: 1
   selector:
-    app: kerneltest
-    deploymentconfig: kerneltest
+    matchLabels:
+      app: kerneltest
   strategy:
-    type: Rolling
-    activeDeadlineSeconds: 21600
-    rollingParams:
-      intervalSeconds: 1
+    type: RollingUpdate
+    rollingUpdate:
       maxSurge: 25%
       maxUnavailable: 25%
-      timeoutSeconds: 600
-      updatePeriodSeconds: 1
-  # strategy:
-  #   type: Recreate
-  #   recreateParams:
-  #     mid:
-  #       failurePolicy: Abort
-  #       execNewPod:
-  #         containerName: kerneltest
-  #         command: ["/etc/alembic-upgrade-script/alembic_upgrade.sh"]
-  #         env:
-  #         - name: PYTHONPATH
-  #           value: /opt/app-root/src
-  #         volumes:
-  #           - kerneltest-config-volume
-  #           - kerneltest-secrets-volume
-  #           - alembic-upgrade-script-volume
-  #           - wsgi-script-volume
-  #           - ipa-config-volume
   template:
     metadata:
       labels:
         app: kerneltest
-        deploymentconfig: kerneltest
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"kerneltest:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"kerneltest\")].image"}]'
     spec:
       containers:
       - name: kerneltest
-        image: kerneltest:latest
+        image: image-registry.openshift-image-registry.svc:5000/kerneltest/kerneltest:latest
         ports:
         - containerPort: 8080
         resources: {}
@@ -87,13 +67,13 @@ spec:
         - name: testlogs
           mountPath: /srv/testlogs
         readinessProbe:
-          timeoutSeconds: 1
+          timeoutSeconds: 3
           initialDelaySeconds: 5
           httpGet:
             path: /
             port: 8080
         livenessProbe:
-          timeoutSeconds: 1
+          timeoutSeconds: 3
           initialDelaySeconds: 30
           httpGet:
             path: /
@@ -126,14 +106,3 @@ spec:
       - name: ipa-config-volume
         configMap:
           name: ipa-client-config
-
-  triggers:
-  - type: ConfigChange
-  - type: ImageChange
-    imageChangeParams:
-      automatic: true
-      containerNames:
-      - kerneltest
-      from:
-        kind: ImageStreamTag
-        name: kerneltest:latest

roles/openshift-apps/kerneltest/files/service.yml

@@ -13,4 +13,4 @@ spec:
       port: 8080
       targetPort: 8080
   selector:
-    deploymentconfig: kerneltest
+    app: kerneltest

roles/openshift-apps/maubot/files/imagestream.yml

@@ -18,10 +18,10 @@ items:
       lookupPolicy:
         local: false
       tags:
-      - name: "40"
+      - name: "43"
         from:
           kind: DockerImage
-          name: quay.io/fedora/fedora:40
+          name: quay.io/fedora/fedora:43
         importPolicy:
           scheduled: true
         referencePolicy:

roles/openshift-apps/maubot/templates/buildconfig.yml.j2

@@ -11,8 +11,8 @@ spec:
   runPolicy: Serial
   source:
     dockerfile: |-
-      FROM fedora:40
-      RUN dnf -y install python3-pip python3-gssapi git libpq-devel gcc python-devel && dnf -y clean all
+      FROM fedora:43
+      RUN dnf -y install python3-pip python3-gssapi git libpq-devel gcc gcc-c++ python-devel cmake && dnf -y clean all
       RUN pip install maubot[encryption] python-slugify httpx httpx_gssapi jinja2 fedora-messaging meetbot-messages pydantic maubot-fedora-messages backoff arrow python-gitlab pytz
       RUN \
         curl https://raw.githubusercontent.com/fedora-infra/matrix-bots/main/install-plugins-from-git.py -o /usr/local/bin/install-maubot-plugins && \
@@ -31,7 +31,7 @@ spec:
       noCache: false
       from:
         kind: ImageStreamTag
-        name: fedora:40
+        name: fedora:43
   output:
     to:
       kind: ImageStreamTag

roles/openshift-apps/mdapi/files/service.yml

@@ -13,4 +13,3 @@ spec:
     targetPort: 8080
   selector:
     app: mdapi
-    deploymentconfig: mdapi

roles/openshift-apps/mdapi/templates/deployment.yml.j2

@@ -0,0 +1,52 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mdapi
+  labels:
+    app: mdapi
+    service: mdapi
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mdapi
+      service: mdapi
+  strategy: {}
+  template:
+    metadata:
+      labels:
+        app: mdapi
+        service: mdapi
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"mdapi:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"mdapi\")].image"}]'
+    spec:
+      containers:
+      - name: mdapi
+        image: image-registry.openshift-image-registry.svc:5000/mdapi/mdapi:latest
+        command: ["/metasource/meta"]
+        args: ["-location", "/var/tmp", "-loglevel", "info", "dispense", "-hostname", "mdapi{{ env_suffix }}.fedoraproject.org"]
+        ports:
+        - containerPort: 8080
+        volumeMounts:
+          - name: data-volume
+            mountPath: /var/tmp/
+        readinessProbe:
+          timeoutSeconds: 5
+          initialDelaySeconds: 60
+          periodSeconds: 60
+          httpGet:
+            path: /
+            port: 8080
+        livenessProbe:
+          timeoutSeconds: 15
+          initialDelaySeconds: 60
+          periodSeconds: 60
+          httpGet:
+            path: /
+            port: 8080
+        resources: {}
+      volumes:
+        - name: data-volume
+          persistentVolumeClaim:
+            claimName: mdapi-storage

roles/openshift-apps/poddlers/templates/_macros.yml.j2

@@ -50,4 +50,13 @@
               value: "/code"
             - name: KRB5_CONFIG
               value: /etc/ipa/krb5.conf
+            # Git configuration variables
+            - name: GIT_AUTHOR_NAME
+              value: "releng-bot"
+            - name: GIT_AUTHOR_EMAIL
+              value: "releng-bot@fedoraproject.org"
+            - name: GIT_COMMITTER_NAME
+              value: "releng-bot"
+            - name: GIT_COMMITTER_EMAIL
+              value: "releng-bot@fedoraproject.org"
 {% endmacro %}

roles/openshift-apps/poddlers/templates/fedora-messaging.toml

@@ -140,9 +140,12 @@ bodhi_url = "https://bodhi{{ env_suffix }}.fedoraproject.org"
 dist_git_url = "https://src{{ env_suffix }}.fedoraproject.org"
 {% if env == "staging" %}
 dist_git_token = "{{ toddlers_stg_dist_git_token }}"
+oidc_distgit_token = "{{ toddlers_stg_oidc_dist_git_token }}"
 {% else %}
 dist_git_token_seed = "{{ toddlers_flag_ci_seed }}"
 dist_git_token = "{{ toddlers_dist_git_token }}"
+# OIDC token for dist-git
+oidc_distgit_token = "{{ toddlers_oidc_dist_git_token }}"
 {% endif %}
 
 #  Configuration file storing all the email overrides in the form of:

roles/openshift-apps/the-new-hotness/files/imagestream.yml

@@ -16,7 +16,7 @@ items:
       - name: latest
         from:
           kind: DockerImage
-          name: docker.io/bitnami/redis:latest
+          name: docker.io/bitnamilegacy/redis:latest
         importPolicy:
           scheduled: true
 kind: List

roles/openshift-apps/the-new-hotness/files/service.yml

@@ -2,9 +2,8 @@
 apiVersion: v1
 kind: Service
 metadata:
-  labels:
-    app: the-new-hotness
   name: the-new-hotness-redis
+  namespace: the-new-hotness
 spec:
   ports:
   - name: 6379-tcp
@@ -12,5 +11,4 @@ spec:
     protocol: TCP
     targetPort: 6379
   selector:
-    app: the-new-hotness
-    deploymentconfig: the-new-hotness-redis
+    app: the-new-hotness-redis

roles/openshift-apps/the-new-hotness/templates/deployment.yml.j2

@@ -0,0 +1,93 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: the-new-hotness
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: the-new-hotness
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: the-new-hotness
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"the-new-hotness:latest","namespace":"the-new-hotness"},"fieldPath":"spec.template.spec.containers[?(@.name==\"the-new-hotness\")].image"}]'
+    spec:
+      containers:
+      - name: the-new-hotness
+        image: image-registry.openshift-image-registry.svc:5000/the-new-hotness/the-new-hotness:latest
+        command: ["fedora-messaging", "consume"]
+        env:
+          - name: RPM_PACKAGER
+            value: hotness
+        volumeMounts:
+          - name: keytab-volume
+            mountPath: /etc/keytabs
+            readOnly: true
+          - name: config-volume
+            mountPath: /etc/fedora-messaging
+            readOnly: true
+          - name: fedora-messaging-ca-volume
+            mountPath: /etc/pki/rabbitmq/ca
+            readOnly: true
+          - name: fedora-messaging-key-volume
+            mountPath: /etc/pki/rabbitmq/key
+            readOnly: true
+          - name: fedora-messaging-cert-volume
+            mountPath: /etc/pki/rabbitmq/cert
+            readOnly: true
+          - name: temp-volume
+            mountPath: /var/tmp
+          - name: krb-config-volume
+            mountPath: /etc/krb5
+            readOnly: true
+      volumes:
+      - name: config-volume
+        configMap:
+          name: the-new-hotness-configmap
+      - name: fedora-messaging-ca-volume
+        secret:
+          secretName: the-new-hotness-fedora-messaging-ca
+      - name: fedora-messaging-key-volume
+        secret:
+          secretName: the-new-hotness-fedora-messaging-key
+      - name: fedora-messaging-cert-volume
+        secret:
+          secretName: the-new-hotness-fedora-messaging-cert
+      - name: temp-volume
+        emptyDir: {}
+      - name: keytab-volume
+        secret:
+          secretName: the-new-hotness-keytab
+      - name: krb-config-volume
+        configMap:
+          name: krb5-configmap
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: the-new-hotness-redis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: the-new-hotness-redis
+  strategy: {}
+  template:
+    metadata:
+      labels:
+        app: the-new-hotness-redis
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"the-new-hotness-redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"the-new-hotness-redis\")].image"}]'
+    spec:
+      containers:
+      - name: the-new-hotness-redis
+        image: image-registry.openshift-image-registry.svc:5000/the-new-hotness/the-new-hotness-redis:latest
+        resources: {}
+        env:
+        - name: REDIS_PASSWORD
+          value: "{{ hotness_redis_pass }}"

roles/openshift-apps/websites/files/pvc.yml

@@ -1,12 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: websites-storage
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: ""

roles/openshift-apps/websites/templates/fedora-websites-bc.yml.j2

@@ -1,25 +0,0 @@
----
-apiVersion: build.openshift.io/v1
-kind: BuildConfig
-metadata:
-  name: fedora-websites
-spec:
-  successfulBuildsHistoryLimit: 1
-  failedBuildsHistoryLimit: 1
-  runPolicy: Serial
-  source:
-    git:
-      uri: "https://pagure.io/fedora-websites.git"
-{% if env == 'staging' %}
-      ref: staging
-{% else %}
-      ref: main
-{% endif %}
-  strategy:
-    type: Docker
-    dockerStrategy:
-      dockerfilePath: Dockerfile
-  output:
-    to:
-      kind: ImageStreamTag
-      name: fedora-websites:latest

roles/openshift-apps/websites/templates/fedora-websites-cron.yml.j2

@@ -1,46 +0,0 @@
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: fedora-websites-build
-spec:
-  concurrencyPolicy: Forbid
-  schedule: "10 * * * *"
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 1
-  startingDeadlineSeconds: 300
-  jobTemplate:
-    spec:
-      activeDeadlineSeconds: 900
-      backoffLimit: 0
-      template:
-        metadata:
-          labels:
-            parent: "cronjobbuild"
-        spec:
-          containers:
-          - name: build
-            image: image-registry.openshift-image-registry.svc:5000/websites/fedora-websites:latest
-            command: ["/bin/bash", "-c"]
-            args:
-            - |
-              cd /tmp
-              git clone --depth 1 --single-branch https://pagure.io/fedora-websites.git
-              cd fedora-websites
-
-              # build all sites in $OUTPUT
-              ./tools/build_all.sh
-            env:
-            - name: BUILD_ENV
-              value: "{{ env_short }}"
-            - name: OUTPUT
-              value: /output
-            volumeMounts:
-            - name: build-output
-              mountPath: /output
-              readOnly: false
-          restartPolicy: Never
-          volumes:
-          - name: build-output
-            persistentVolumeClaim:
-              claimName: websites-storage

roles/postgresql_server/files/datanommer-export-day

@@ -0,0 +1,147 @@
+#!/bin/bash
+# vim: ts=4:sw=4:expandtab
+
+set -euo pipefail
+
+# Exports one day of messages from datanommer as a single .tar file, using
+# psql and xz.
+#
+# Usage:
+# $0
+#  - defaults to "yesterday"
+# $0 2025-08-30
+
+
+# --- Config ---
+
+export PGDATABASE='datanommer2'
+export DESTDIR='/backups/datanommer-incremental'
+# tmp directory
+export WORKDIR='/tmp/datanommer-incremental'
+
+# --- Init ---
+
+if [[ ! -w "$WORKDIR" ]]; then
+    mkdir "$WORKDIR"
+    if [[ ! -w "$WORKDIR" ]]; then
+        echo "error: '$WORKDIR' is not writable"
+        exit 1
+    fi
+fi
+if [[ ! -w "$DESTDIR" ]]; then
+    echo "error: '$DESTDIR' is not writable"
+    exit 1
+fi
+
+QUERY_DATE=""
+
+set_default_date() {
+    QUERY_DATE=$(date -d "yesterday" +%Y-%m-%d)
+}
+
+usage () {
+    echo "Usage:"
+    echo
+    echo "$0"
+    echo "$0 2025-08-01"
+    exit 1
+}
+case $# in
+    0)
+        set_default_date
+        ;;
+    1)
+        QUERY_DATE="$1"
+        ;;
+    *)
+        usage
+        ;;
+esac
+
+# Validate the input date
+if [[ ! "$QUERY_DATE" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
+    echo "error: Invalid date format"
+    exit 1
+fi
+
+# Calculate the end range of our query
+QUERY_DATE_END=$(date -d "${QUERY_DATE} + 1 day" +%Y-%m-%d)
+
+# ON_ERROR_STOP turns SQL errors into bash errors
+PSQL="psql --set=ON_ERROR_STOP=on"
+
+# --- Export Tables ---
+
+echo "Exporting '$QUERY_DATE' to '$DESTDIR'..."
+echo "Query dates: \">= '$QUERY_DATE 00:00:00' AND < '$QUERY_DATE_END 00:00:00'\""
+
+export_table() {
+    local SELECT="$1"
+    # globals used:
+    #   TABLE
+    #   WORKDIR
+    #   QUERY_DATE
+
+    echo "$(date -Iseconds): $TABLE..."
+    # compression level 6 (out of 9)
+    # 4 threads
+    $PSQL --command="\COPY ( $SELECT ) TO STDOUT WITH (FORMAT csv, NULL '\N', HEADER true)" \
+        | xz -6 -T4 \
+        > "${WORKDIR}/${QUERY_DATE}-${TABLE}.csv.xz"
+}
+
+TABLE=messages
+export_table "
+  SELECT * FROM ${TABLE}
+  WHERE timestamp >= '${QUERY_DATE}'
+  AND timestamp    < '${QUERY_DATE_END}'
+"
+
+TABLE=users_messages
+export_table "
+  SELECT * FROM ${TABLE}
+  WHERE msg_timestamp >= '${QUERY_DATE}'
+  AND msg_timestamp    < '${QUERY_DATE_END}'
+"
+
+TABLE=packages_messages
+export_table "
+  SELECT * FROM ${TABLE}
+  WHERE msg_timestamp >= '${QUERY_DATE}'
+  AND msg_timestamp    < '${QUERY_DATE_END}'
+"
+
+# Since the 'users' and 'packages' tables are not timestamped, we export
+# both of them in their entirety.  Fortunately, they're both tiny.
+TABLE=users
+export_table "SELECT * FROM ${TABLE}"
+
+TABLE=packages
+export_table "SELECT * FROM ${TABLE}"
+
+# This gives us a historical record of when schema changes were applied
+ALEMBIC_FILE="$(date +%Y-%m-%d)-alembic_version.txt"
+echo "$(date -Iseconds): alembic_version..."
+# - "tuples-only" = data only, no ASCII box art
+# - "no-align" = no whitespace padding
+$PSQL --tuples-only --no-align --command="SELECT version_num FROM alembic_version;" > "${WORKDIR}/${ALEMBIC_FILE}"
+
+# --- tar ---
+
+TARFILE="${QUERY_DATE}-datanommer-incremental-csv.tar"
+echo "Combining into '${DESTDIR}/${TARFILE}'..."
+# weird subshell glob is so that this script location is irrelevant to tar invocation
+tar \
+    -cf "${DESTDIR}/${TARFILE}" \
+    -C "$WORKDIR" \
+    $(cd "$WORKDIR" && echo "${QUERY_DATE}"*.csv.xz) "${ALEMBIC_FILE}"
+# rm intermediate files
+rm "${WORKDIR}/${QUERY_DATE}"*.csv.xz
+rm "${WORKDIR}/${ALEMBIC_FILE}"
+echo
+
+echo "$(date -Iseconds): export done!"
+
+echo "Running retention script for '$DESTDIR'..."
+    /usr/local/bin/file-retention-iso-date "$DESTDIR"
+echo

roles/postgresql_server/tasks/datanommer.yml

@@ -1,4 +1,39 @@
 ---
+- name: Install packages for daily export
+  ansible.builtin.package:
+    state: present
+    name:
+    - moreutils # provides `chronic` for use with cron emails
+    - tar
+  when: inventory_hostname.startswith('db-datanommer02.rdu3')
+  tags:
+  - datanommer
+  - postgresql
+
+
+- name: Ensure datanommer incremental backups have a destination directory
+  ansible.builtin.file: dest=/backups/datanommer-incremental state=directory owner=postgres
+  when: inventory_hostname.startswith('db-datanommer02.rdu3')
+  tags:
+  - datanommer
+  - postgresql
+
+
+- name: Copy datanommer-export-day backup script
+  ansible.builtin.copy: src=datanommer-export-day dest=/usr/local/bin/datanommer-export-day mode=0755
+  when: inventory_hostname.startswith('db-datanommer02.rdu3')
+  tags:
+  - datanommer
+  - postgresql
+
+
+- name: Copy file-retention-iso-date script
+  ansible.builtin.copy: src="{{ files }}/scripts/file-retention-iso-date" dest=/usr/local/bin/file-retention-iso-date mode=0755
+  tags:
+  - datanommer
+  - postgresql
+
+
 - name: Install timescaledb
   dnf:
     name:

roles/postgresql_server/templates/cron-backup-database

@@ -1,5 +1,6 @@
 {% if inventory_hostname == 'db-datanommer02.rdu3.fedoraproject.org' %}
 0 0 * * * postgres /usr/local/bin/lock-wrapper backup-database "/usr/local/bin/backup-database {{ item }} |& grep -Ev 'warning:|hypertable|chunk|restore|data-only|continuous_agg'"
+0 3 * * * postgres chronic /usr/local/bin/datanommer-export-day
 {% else %}
 0 0 * * * postgres /usr/local/bin/backup-database {{ item }}
 {% endif %}

roles/siguldry/bridge/handlers/main.yml

@@ -0,0 +1,8 @@
+---
+- name: restart siguldry-bridge
+  ansible.builtin.systemd:
+    name: siguldry-bridge.service
+    state: restarted
+  tags:
+    - siguldry
+    - siguldry/bridge

roles/siguldry/bridge/tasks/main.yml

@@ -0,0 +1,111 @@
+---
+- name: Install siguldry package
+  ansible.builtin.package:
+    state: present
+    name: siguldry
+  tags:
+    - packages
+    - siguldry
+    - siguldry/bridge
+
+# TODO: only needed with systemd 257 or older
+- name: Set whether explicit AllowDevice override is needed
+  ansible.builtin.set_fact:
+    explicit_allow_tpm: true
+
+- name: Create siguldry config directory
+  ansible.builtin.file:
+    path: /etc/siguldry
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  tags:
+    - config
+    - siguldry
+    - siguldry/bridge
+
+- name: Create credstore.encrypted directory
+  ansible.builtin.file:
+    path: /etc/credstore.encrypted
+    state: directory
+    owner: root
+    group: root
+    mode: '0700'
+  tags:
+    - config
+    - siguldry
+    - siguldry/bridge
+
+- name: Create siguldry-bridge systemd override directory
+  ansible.builtin.file:
+    path: /etc/systemd/system/siguldry-bridge.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  tags:
+    - config
+    - siguldry
+    - siguldry/bridge
+
+- name: Setup siguldry-bridge systemd override file
+  ansible.builtin.template:
+    src: override.conf.j2
+    dest: /etc/systemd/system/siguldry-bridge.service.d/override.conf
+    owner: root
+    group: root
+    mode: '0644'
+  notify: restart siguldry-bridge
+  tags:
+    - config
+    - siguldry
+    - siguldry/bridge
+
+- name: Setup siguldry-bridge config file
+  ansible.builtin.template:
+    src: bridge.toml.j2
+    dest: /etc/siguldry/bridge.toml
+    owner: root
+    group: root
+    mode: '0644'
+  notify: restart siguldry-bridge
+  tags:
+    - config
+    - siguldry
+    - siguldry/bridge
+
+- name: Setup bridge certificate
+  ansible.builtin.copy:
+    src: "{{ private }}/files/siguldryca/{{ env }}/pki/issued/siguldry-bridge.crt"
+    dest: /etc/siguldry/bridge.crt
+    owner: root
+    group: root
+    mode: '0644'
+  tags:
+    - config
+    - siguldry
+    - siguldry/bridge
+
+- name: Setup CA certificate
+  ansible.builtin.copy:
+    src: "{{ private }}/files/siguldryca/{{ env }}/pki/ca.crt"
+    dest: /etc/siguldry/ca.crt
+    owner: root
+    group: root
+    mode: '0644'
+  tags:
+    - config
+    - siguldry
+    - siguldry/bridge
+
+- name: Enable and start siguldry-bridge service
+  ansible.builtin.systemd:
+    name: siguldry-bridge.service
+    enabled: yes
+    state: started
+    daemon_reload: yes
+  tags:
+    - services
+    - siguldry
+    - siguldry/bridge

roles/siguldry/bridge/templates/bridge.toml.j2

@@ -0,0 +1,21 @@
+# The socket address to listen on for incoming connections from Siguldry servers.
+#
+# The default is to listen on all interfaces on port 44333.
+server_listening_address = "[::]:44333"
+
+# The socket address to listen on for incoming connections from Siguldry clients.
+#
+# The default is to listen on all interfaces on port 44334.
+client_listening_address = "[::]:44334"
+
+# The TLS credentials for the server and client listeners.
+#
+# Both clients and servers connect to the above addresses and perform mutual TLS.
+# Note that the certificate must have `serverAuth` in its extended key usage extension.
+#
+# Paths that aren't absolute are loaded relative to systemd's credentials directory,
+# which are encrypted, see https://systemd.io/CREDENTIALS/
+[credentials]
+private_key = "siguldry.bridge.private_key.pem"
+certificate = "/etc/siguldry/bridge.crt"
+ca_certificate = "/etc/siguldry/ca.crt"

roles/siguldry/bridge/templates/override.conf.j2

@@ -0,0 +1,12 @@
+[Service]
+# Tweak for lower/higher log verbosity.
+# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives
+Environment=SIGULDRY_BRIDGE_LOG="WARN,siguldry=INFO"
+
+{% if explicit_allow_tpm %}
+# Credentials require the TPM to decrypt.
+#
+# For systemd 257 and older you'll need to explicitly allow access to the TPM
+# Refer to https://github.com/systemd/systemd/issues/35959.
+DeviceAllow=/dev/tpmrm0
+{% endif %}

roles/siguldry/pesign_bridge/files/fedora-ca-20250530.crt

@@ -0,0 +1,130 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            66:86:bf:62:f4:ef:41:96:9f:bd:8c:7e:a7:61:b4:43
+        Signature Algorithm: sha384WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, L=Cambridge, O=Red Hat, Inc., OU=Fedora Secure Boot CA 20250530, CN=fedora-ca-20250530
+        Validity
+            Not Before: May 30 18:50:42 2025 GMT
+            Not After : Jan 19 03:14:07 2037 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Red Hat, Inc., OU=Fedora Secure Boot CA 20250530, CN=fedora-ca-20250530
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:9e:c9:15:76:f3:b3:e4:d9:1d:8b:08:c1:64:b5:
+                    4c:4a:17:be:c2:72:92:18:0e:ef:f0:37:c0:8a:5b:
+                    ae:52:13:1b:d3:f3:a1:11:ce:ee:f5:00:73:fa:9b:
+                    6d:9e:04:67:ec:15:33:27:4f:43:fa:95:07:c8:f3:
+                    af:1e:67:7f:8e:82:db:b6:3e:c1:1f:4b:3b:af:b8:
+                    cf:ef:b3:d5:eb:66:78:e7:70:70:9d:f8:01:28:81:
+                    e0:bd:45:7b:0a:7a:84:f9:ee:62:7b:bb:ef:32:82:
+                    7b:7d:d5:b5:61:a1:b1:27:88:d3:29:34:70:43:9b:
+                    f9:ff:84:da:0a:fc:62:b7:fd:a9:e2:d2:3f:8a:2f:
+                    93:f1:0e:63:12:0e:24:6a:82:37:50:e1:9b:5b:c3:
+                    0a:e2:e3:0e:59:b5:5b:c6:89:5b:be:f2:dc:34:dd:
+                    ff:01:82:57:12:cb:b9:29:86:09:da:80:63:34:e0:
+                    ee:ea:68:16:13:b8:27:d8:39:1c:81:61:ba:c3:e4:
+                    f9:07:15:36:d4:f2:ab:29:b0:b8:af:c5:d9:96:bf:
+                    c5:c1:9f:56:d8:9a:27:b8:29:96:1f:11:ca:f8:18:
+                    29:72:6a:83:fc:1e:38:19:b1:c3:f1:95:d0:f2:28:
+                    6c:58:77:3e:b9:6e:10:dd:a4:7b:98:5a:cc:59:be:
+                    2a:5a:40:d5:45:28:46:b0:37:3d:f3:1e:b8:00:19:
+                    6e:b7:54:88:ec:bf:2c:5f:f3:12:b4:d3:16:23:50:
+                    6c:af:16:b3:94:67:c5:71:81:d6:0f:e8:df:1f:ce:
+                    e0:03:32:a9:34:98:5f:c3:9d:7c:98:d5:7f:97:fe:
+                    d9:32:fb:be:b0:a1:93:60:4b:79:cc:60:58:cb:4b:
+                    93:1d:99:59:2d:a4:1d:d6:f0:20:00:fb:65:f6:7f:
+                    52:28:26:85:c6:31:e1:9d:3d:74:7d:21:e7:20:6a:
+                    92:e9:9c:69:fb:67:c3:dd:2b:07:c4:9a:be:12:02:
+                    e7:ef:18:e9:d1:da:f9:5b:bd:4a:9c:9b:a9:41:9d:
+                    11:92:b0:96:67:34:12:fb:b6:6e:5e:1d:46:2e:2f:
+                    5d:29:db:a2:b3:91:40:35:80:12:3a:6f:b0:ea:0e:
+                    11:12:50:81:5e:1c:44:8f:14:68:01:d8:42:7e:e3:
+                    97:98:bd:16:3c:91:da:c7:00:3e:1e:fa:36:05:00:
+                    a7:31:5e:0b:11:e8:e1:bb:ca:7a:a4:b9:d4:c9:81:
+                    52:d6:82:20:8f:5c:39:73:c4:0c:9f:2c:b3:54:56:
+                    fb:85:cf:51:04:91:e2:54:a6:fc:5a:9e:5f:11:5b:
+                    38:71:ec:05:ea:4a:c3:23:2b:84:a5:e7:bd:10:c4:
+                    95:01:b3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            Authority Information Access: 
+                CA Issuers - URI:https://fedoraproject.org/wiki/Features/SecureBoot
+            X509v3 Authority Key Identifier: 
+                72:04:3C:47:C9:DA:5C:9D:50:89:A3:E4:85:92:CB:85:CE:43:ED:EF
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Subject Key Identifier: 
+                72:04:3C:47:C9:DA:5C:9D:50:89:A3:E4:85:92:CB:85:CE:43:ED:EF
+    Signature Algorithm: sha384WithRSAEncryption
+    Signature Value:
+        9b:84:9d:78:eb:23:94:dd:75:e2:99:50:f7:14:09:ac:a1:bd:
+        28:66:9b:fc:bf:87:af:01:c2:56:e2:66:b4:db:ea:6a:cd:90:
+        cb:43:5f:23:95:f4:10:d4:80:6d:65:52:aa:a2:e2:b0:43:16:
+        55:1d:d0:e6:ef:95:e3:69:9c:c7:5d:2e:36:54:0a:01:29:50:
+        71:e6:ae:60:09:15:06:09:be:ee:a9:2d:b4:7a:7e:7b:89:46:
+        53:cd:2b:bc:36:20:0d:05:ee:37:f2:8c:4e:c6:04:21:b9:6a:
+        3a:a0:1a:33:63:cf:22:cd:01:ad:50:64:23:9f:4f:c0:37:ee:
+        b1:60:d2:25:f8:fa:7e:cb:8a:9b:6f:da:ca:99:ff:1e:cb:b8:
+        ab:ca:34:56:c2:21:e1:79:82:c9:92:14:54:73:a9:5f:39:52:
+        e1:ed:d5:2d:ea:5e:0a:bc:7c:57:3d:10:64:25:c9:cc:ef:a4:
+        e0:f8:a6:b7:40:38:d4:24:35:93:37:16:cd:32:92:b4:7e:69:
+        14:44:13:8d:94:f0:62:84:41:66:30:75:d7:5d:44:e8:6b:0e:
+        9e:55:07:f2:e4:ba:7b:ef:7e:9e:ff:22:a3:b1:98:9c:b6:3f:
+        57:39:89:da:5e:1e:9a:d4:13:65:dc:5c:c7:41:7e:fb:c8:1b:
+        be:c5:04:c6:43:14:a4:e6:f5:e5:13:10:e6:91:90:6a:e7:15:
+        34:37:51:90:84:4d:e8:43:ee:29:e6:f2:45:49:04:7c:00:f6:
+        6a:78:59:1e:22:2d:3b:d5:0d:c1:fc:45:fe:c7:31:e9:47:d2:
+        44:c5:76:66:c2:a6:6a:2a:3d:f0:41:7d:a9:b4:9a:c3:99:5b:
+        3b:43:45:c1:bc:70:d8:b2:52:a5:d5:65:f0:58:dd:be:f5:02:
+        c1:e9:11:ab:5f:a9:5e:c1:71:0f:52:af:f0:62:45:67:9a:47:
+        a5:88:4f:ab:d5:36:ab:cd:cc:0e:ff:cc:4f:7a:16:d4:e8:52:
+        fd:c2:10:27:2b:9f:09:64:03:32:f1:35:eb:d6:9e:0f:dc:fa:
+        26:c9:4a:3b:26:00:ea:7a:39:7c:3b:99:7c:d9:c3:19:03:32:
+        54:07:06:a0:a0:7a:64:9c:b3:e1:3b:d8:34:25:17:bc:ce:dc:
+        a9:bc:b6:37:b6:a6:36:83:81:ef:ae:f2:4e:07:65:3e:3f:aa:
+        98:e6:88:e4:c0:f5:14:3b:e4:c2:81:06:60:d1:86:d5:0c:4c:
+        5e:bb:7e:5b:cb:c8:c5:26:c0:eb:fa:1e:f4:7c:3a:48:3d:09:
+        a3:71:bf:16:ca:ed:e4:3b:71:e5:d3:62:1b:e9:43:f0:54:b9:
+        be:7a:e4:2a:a3:fd:af:d1
+-----BEGIN CERTIFICATE-----
+MIIGbzCCBFegAwIBAgIQZoa/YvTvQZafvYx+p2G0QzANBgkqhkiG9w0BAQwFADCB
+lzELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcT
+CUNhbWJyaWRnZTEWMBQGA1UEChMNUmVkIEhhdCwgSW5jLjEnMCUGA1UECxMeRmVk
+b3JhIFNlY3VyZSBCb290IENBIDIwMjUwNTMwMRswGQYDVQQDExJmZWRvcmEtY2Et
+MjAyNTA1MzAwHhcNMjUwNTMwMTg1MDQyWhcNMzcwMTE5MDMxNDA3WjCBlzELMAkG
+A1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcTCUNhbWJy
+aWRnZTEWMBQGA1UEChMNUmVkIEhhdCwgSW5jLjEnMCUGA1UECxMeRmVkb3JhIFNl
+Y3VyZSBCb290IENBIDIwMjUwNTMwMRswGQYDVQQDExJmZWRvcmEtY2EtMjAyNTA1
+MzAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCeyRV287Pk2R2LCMFk
+tUxKF77CcpIYDu/wN8CKW65SExvT86ERzu71AHP6m22eBGfsFTMnT0P6lQfI868e
+Z3+Ogtu2PsEfSzuvuM/vs9XrZnjncHCd+AEogeC9RXsKeoT57mJ7u+8ygnt91bVh
+obEniNMpNHBDm/n/hNoK/GK3/ani0j+KL5PxDmMSDiRqgjdQ4Ztbwwri4w5ZtVvG
+iVu+8tw03f8BglcSy7kphgnagGM04O7qaBYTuCfYORyBYbrD5PkHFTbU8qspsLiv
+xdmWv8XBn1bYmie4KZYfEcr4GClyaoP8HjgZscPxldDyKGxYdz65bhDdpHuYWsxZ
+vipaQNVFKEawNz3zHrgAGW63VIjsvyxf8xK00xYjUGyvFrOUZ8VxgdYP6N8fzuAD
+Mqk0mF/DnXyY1X+X/tky+76woZNgS3nMYFjLS5MdmVktpB3W8CAA+2X2f1IoJoXG
+MeGdPXR9IecgapLpnGn7Z8PdKwfEmr4SAufvGOnR2vlbvUqcm6lBnRGSsJZnNBL7
+tm5eHUYuL10p26KzkUA1gBI6b7DqDhESUIFeHESPFGgB2EJ+45eYvRY8kdrHAD4e
++jYFAKcxXgsR6OG7ynqkudTJgVLWgiCPXDlzxAyfLLNUVvuFz1EEkeJUpvxanl8R
+Wzhx7AXqSsMjK4Sl570QxJUBswIDAQABo4G0MIGxME4GCCsGAQUFBwEBBEIwQDA+
+BggrBgEFBQcwAoYyaHR0cHM6Ly9mZWRvcmFwcm9qZWN0Lm9yZy93aWtpL0ZlYXR1
+cmVzL1NlY3VyZUJvb3QwHwYDVR0jBBgwFoAUcgQ8R8naXJ1QiaPkhZLLhc5D7e8w
+DgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHIEPEfJ
+2lydUImj5IWSy4XOQ+3vMA0GCSqGSIb3DQEBDAUAA4ICAQCbhJ146yOU3XXimVD3
+FAmsob0oZpv8v4evAcJW4ma02+pqzZDLQ18jlfQQ1IBtZVKqouKwQxZVHdDm75Xj
+aZzHXS42VAoBKVBx5q5gCRUGCb7uqS20en57iUZTzSu8NiANBe438oxOxgQhuWo6
+oBozY88izQGtUGQjn0/AN+6xYNIl+Pp+y4qbb9rKmf8ey7iryjRWwiHheYLJkhRU
+c6lfOVLh7dUt6l4KvHxXPRBkJcnM76Tg+Ka3QDjUJDWTNxbNMpK0fmkURBONlPBi
+hEFmMHXXXUToaw6eVQfy5Lp7736e/yKjsZictj9XOYnaXh6a1BNl3FzHQX77yBu+
+xQTGQxSk5vXlExDmkZBq5xU0N1GQhE3oQ+4p5vJFSQR8APZqeFkeIi071Q3B/EX+
+xzHpR9JExXZmwqZqKj3wQX2ptJrDmVs7Q0XBvHDYslKl1WXwWN2+9QLB6RGrX6le
+wXEPUq/wYkVnmkeliE+r1TarzcwO/8xPehbU6FL9whAnK58JZAMy8TXr1p4P3Pom
+yUo7JgDqejl8O5l82cMZAzJUBwagoHpknLPhO9g0JRe8ztypvLY3tqY2g4HvrvJO
+B2U+P6qY5ojkwPUUO+TCgQZg0YbVDExeu35by8jFJsDr+h70fDpIPQmjcb8Wyu3k
+O3Hl02Ib6UPwVLm+euQqo/2v0Q==
+-----END CERTIFICATE-----

roles/siguldry/pesign_bridge/files/sigul-pesign-bridge-override.conf

@@ -0,0 +1,5 @@
+[Service]
+ExecStartPost=/usr/bin/setfacl -m u:kojibuilder:rwx /run/pesign
+ExecStartPost=/usr/bin/setfacl -m u:kojibuilder:rwx /run/pesign/socket
+ExecStartPost=/usr/bin/setfacl -m u:pesign:rwx /run/pesign
+ExecStartPost=/usr/bin/setfacl -m u:pesign:rwx /run/pesign/socket

roles/siguldry/pesign_bridge/tasks/main.yml

@@ -31,9 +31,9 @@
   ansible.builtin.file:
     path: /etc/sigul-pesign-bridge
     state: directory
-    owner: root
-    group: root
-    mode: '0755'
+    owner: pesign
+    group: pesign
+    mode: '0750'
   tags:
     - config
     - siguldry
@@ -109,7 +109,7 @@
     - siguldry
     - siguldry/pesign_bridge
 
-- name: Install sb ca cert to verify signed artifacts
+- name: Install 20200709 sb ca cert to verify signed artifacts
   ansible.builtin.copy:
     src: fedora-ca-20200709.crt
     dest: /etc/sigul-pesign-bridge/fedora-ca-20200709.crt
@@ -121,6 +121,18 @@
     - siguldry
     - siguldry/pesign_bridge
 
+- name: Install 20250530 sb ca cert to verify signed artifacts
+  ansible.builtin.copy:
+    src: fedora-ca-20250530.crt
+    dest: /etc/sigul-pesign-bridge/fedora-ca-20250530.crt
+    owner: root
+    group: root
+    mode: '0644'
+  tags:
+    - config
+    - siguldry
+    - siguldry/pesign_bridge
+
 - name: Enable and start sigul-pesign-bridge service
   ansible.builtin.systemd:
     name: sigul-pesign-bridge.service
@@ -143,3 +155,28 @@
     - services
     - siguldry
     - siguldry/pesign_bridge
+
+- name: setup systemd override dir for sigul-pesign-bridge service
+  file:
+    path: /etc/systemd/system/sigul-pesign-bridge.service.d/
+    state: directory
+    owner: root
+    group: root
+    mode: 0755
+  tags:
+    - services
+    - siguldry
+    - siguldry/pesign_bridge
+
+- name: apply override to sigul-pesign-bridge service to setup acls
+  ansible.builtin.copy:
+    src: sigul-pesign-bridge-override.conf
+    dest: /etc/systemd/system/sigul-pesign-bridge.service.d/override.conf
+    mode: "0644"
+    owner: root
+    group: root
+  notify: Reload systemd
+  tags:
+    - services
+    - siguldry
+    - siguldry/pesign_bridge

roles/siguldry/pesign_bridge/templates/config.toml.j2

@@ -1,4 +1,4 @@
-total_request_timeout_secs = 600
+total_request_timeout_secs = 86400
 sigul_request_timeout_secs = 60
 
 [sigul]
@@ -13,6 +13,7 @@ client_certificate = "/etc/sigul-pesign-bridge/client.crt"
 ca_certificate = "/etc/sigul-pesign-bridge/ca.crt"
 
 [[keys]]
+# This key is the 20200709 kernel one
 # This is the smart card token name
 pesign_token_name = "OpenSC Card"
 # This is the cert name on the smart card
@@ -27,6 +28,7 @@ passphrase_path = "sigul.signing-key-passphrase"
 certificate_file = "/etc/sigul-pesign-bridge/fedora-ca-20200709.crt"
 
 [[keys]]
+# This key is the 20250530 one used already in grub2
 # This is the smart card token name
 pesign_token_name = "OpenSC Card"
 # This is the cert name on the smart card
@@ -34,13 +36,14 @@ pesign_certificate_name = "/CN=Fedora Secure Boot Signer"
 # This is the name of the key in sigul
 key_name = "fedora-signer"
 # This is also the cert name on the smart card
-certificate_name = "Certificate 4"
+certificate_name = "Certificate 6"
 # This is the passphrase for the bridge user and key name above
 passphrase_path = "sigul.signing-key-passphrase"
 # Need to get the right cert here to verify pesigned things.
-certificate_file = "/etc/sigul-pesign-bridge/fedora-ca-20200709.crt"
+certificate_file = "/etc/sigul-pesign-bridge/fedora-ca-20250530.crt"
 
 [[keys]]
+# This key is the 20200709 one used by grub2
 # This is the smart card token name
 pesign_token_name = "OpenSC Card"
 # This is the cert name on the smart card

roles/siguldry/server/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+
+siguldry_kryoptic_conf: "/etc/siguldry/kryoptic.toml"
+siguldry_kryoptic_db: "/var/lib/siguldry/kryoptic.sqlite"
+
+siguldry_kryoptic_so_pin: "12345678"
+siguldry_kryoptic_user_pin: "123456"

roles/siguldry/server/handlers/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Restart siguldry-server
+  ansible.builtin.systemd:
+    name: siguldry-server.service
+    state: restarted
+  tags:
+    - siguldry
+    - siguldry/server

roles/siguldry/server/tasks/kryoptic.yml

@@ -0,0 +1,151 @@
+---
+# For staging, use Kryoptic as a software HSM for binding
+- name: Install kryoptic and PKCS#11 tools (staging only)
+  ansible.builtin.package:
+    state: present
+    name:
+      - kryoptic
+      - opensc
+      - openssl
+      - pkcs11-provider
+  tags:
+    - packages
+    - siguldry
+    - siguldry/server
+
+- name: Setup kryoptic configuration
+  ansible.builtin.template:
+    src: kryoptic.toml.j2
+    dest: "{{ siguldry_kryoptic_conf }}"
+    owner: root
+    group: root
+    mode: '0644'
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Check if kryoptic token is initialized
+  ansible.builtin.stat:
+    path: "{{ siguldry_kryoptic_db }}"
+  register: kryoptic_db
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Initialize kryoptic PKCS#11 token
+  ansible.builtin.command:
+    cmd: >-
+      pkcs11-tool
+      --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so
+      --init-token
+      --label siguldry-stg-token
+      --so-pin env:KRYOPTIC_SO_PIN
+  environment:
+    KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}"
+    KRYOPTIC_SO_PIN: "{{ siguldry_kryoptic_so_pin }}"
+  when: not kryoptic_db.stat.exists
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Initialize kryoptic user PIN
+  ansible.builtin.command:
+    cmd: >-
+      pkcs11-tool
+      --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so
+      --login
+      --so-pin env:KRYOPTIC_SO_PIN
+      --init-pin
+      --new-pin env:KRYOPTIC_USER_PIN
+  environment:
+    KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}"
+    KRYOPTIC_SO_PIN: "{{ siguldry_kryoptic_so_pin }}"
+    KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}"
+  when: not kryoptic_db.stat.exists
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Check for existing binding key
+  ansible.builtin.command:
+    cmd: >-
+      pkcs11-tool
+      --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so
+      --login
+      --pin env:KRYOPTIC_USER_PIN
+      --list-objects
+      --type privkey
+  environment:
+    KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}"
+    KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}"
+  register: kryoptic_objects
+  changed_when: false
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Generate RSA binding key pair
+  ansible.builtin.command:
+    cmd: >-
+      pkcs11-tool
+      --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so
+      --login
+      --pin env:KRYOPTIC_USER_PIN
+      --keypairgen
+      --key-type rsa:4096
+      --usage-sign
+      --usage-decrypt
+      --id 1
+      --label siguldry-binding-key
+  environment:
+    KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}"
+    KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}"
+  when: "'siguldry-binding-key' not in kryoptic_objects.stdout"
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Create self-signed x509 binding certificate
+  ansible.builtin.command:
+    cmd: >-
+      openssl req -x509
+      -provider pkcs11
+      -subj /CN=siguldry-binding-key
+      -passin pass:{{ siguldry_kryoptic_user_pin }}
+      -key pkcs11:token=siguldry-stg-token;type=private
+      -out /etc/siguldry/kryoptic-binding.crt
+    creates: /etc/siguldry/kryoptic-binding.crt
+  environment:
+    KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}"
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Import x509 certificate to token
+  ansible.builtin.command:
+    cmd: >-
+      pkcs11-tool
+      --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so
+      --login
+      --pin env:KRYOPTIC_USER_PIN
+      --keypairgen
+      --key-type rsa:4096
+      --usage-sign
+      --usage-decrypt
+      --id 1
+      --label siguldry-binding-key
+  environment:
+    KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}"
+    KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}"
+  when: "'siguldry-binding-key' not in kryoptic_objects.stdout"
+  tags:
+    - config
+    - siguldry
+    - siguldry/server

roles/siguldry/server/tasks/main.yml

@@ -0,0 +1,197 @@
+---
+- name: Install siguldry package
+  ansible.builtin.package:
+    state: present
+    name: siguldry
+  tags:
+    - packages
+    - siguldry
+    - siguldry/server
+
+# TODO: only needed with systemd 257 or older
+- name: Set whether explicit AllowDevice override is needed
+  ansible.builtin.set_fact:
+    explicit_allow_tpm: true
+
+- name: Create siguldry config directory
+  ansible.builtin.file:
+    path: /etc/siguldry
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Create credstore.encrypted directory
+  ansible.builtin.file:
+    path: /etc/credstore.encrypted
+    state: directory
+    owner: root
+    group: root
+    mode: '0700'
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Ensure the siguldry state directory exists
+  ansible.builtin.file:
+    path: /var/lib/siguldry
+    state: directory
+    owner: siguldry
+    group: siguldry
+    mode: '0750'
+  tags:
+    - siguldry
+    - siguldry/server
+
+- name: Create siguldry-signer systemd override directory
+  ansible.builtin.file:
+    path: /etc/systemd/system/siguldry-signer@.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Setup siguldry-signer systemd override file
+  ansible.builtin.template:
+    src: signer-override.conf.j2
+    dest: /etc/systemd/system/siguldry-signer@.service.d/override.conf
+    owner: root
+    group: root
+    mode: '0644'
+  notify: Restart siguldry-server
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Create siguldry-server systemd override directory
+  ansible.builtin.file:
+    path: /etc/systemd/system/siguldry-server.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Setup siguldry-server systemd override file
+  ansible.builtin.template:
+    src: server-override.conf.j2
+    dest: /etc/systemd/system/siguldry-server.service.d/override.conf
+    owner: root
+    group: root
+    mode: '0644'
+  notify: Restart siguldry-server
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Setup siguldry-server config file
+  ansible.builtin.template:
+    src: server.toml.j2
+    dest: /etc/siguldry/server.toml
+    owner: root
+    group: root
+    mode: '0644'
+  notify: Restart siguldry-server
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Setup server certificate
+  ansible.builtin.copy:
+    src: "{{ private }}/files/siguldryca/{{ env }}/pki/issued/siguldry-server.crt"
+    dest: /etc/siguldry/server.crt
+    owner: root
+    group: root
+    mode: '0644'
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Setup CA certificate
+  ansible.builtin.copy:
+    src: "{{ private }}/files/siguldryca/{{ env }}/pki/ca.crt"
+    dest: /etc/siguldry/ca.crt
+    owner: root
+    group: root
+    mode: '0644'
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Setup binding certificates
+  ansible.builtin.copy:
+    src: "{{ private }}/files/sigul/{{ item }}"
+    dest: "/etc/siguldry/{{ item }}"
+    owner: root
+    group: root
+    mode: '0644'
+  with_items:
+    - yubikey_sv03.pem
+    - yubikey_sv04.pem
+    - yubikey_sv05.pem
+    - yubikey_sv06.pem
+  when: env == "production"
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Setup software HSM for binding certificate in staging 
+  ansible.builtin.include_tasks: kryoptic.yml
+  when: env != "production"
+  tags:
+    - siguldry
+    - siguldry/server
+
+- name: Check if siguldry database is initialized
+  ansible.builtin.stat:
+    path: /var/lib/siguldry/siguldry.sqlite 
+  register: siguldry_db 
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Initialize Siguldry database
+  ansible.builtin.command:
+    cmd: >-
+      systemd-run --pty --wait --collect
+      --working-directory=/var/lib/siguldry
+      --setenv=SIGULDRY_SERVER_CONFIG=/etc/siguldry/server.toml
+      --property=UMask=017
+      --uid=siguldry
+      --gid=siguldry
+      siguldry-server manage migrate
+  when: not siguldry_db.stat.exists
+  tags:
+    - config
+    - siguldry
+    - siguldry/server
+
+- name: Enable and start siguldry-server service
+  ansible.builtin.systemd:
+    name: siguldry-server.service
+    enabled: yes
+    state: started
+    daemon_reload: yes
+  tags:
+    - services
+    - siguldry
+    - siguldry/server

roles/siguldry/server/templates/kryoptic.toml.j2

@@ -0,0 +1,4 @@
+[[slots]]
+slot = 1
+dbtype = "sqlite"
+dbargs = "{{ siguldry_kryoptic_db }}"

roles/siguldry/server/templates/server-override.conf.j2

@@ -0,0 +1,17 @@
+[Service]
+# Tweak for lower/higher log verbosity.
+# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives
+Environment=SIGULDRY_SERVER_LOG="WARN,siguldry=INFO"
+
+{% if env != "production" %}
+# Kryoptic software HSM configuration for staging
+Environment=KRYOPTIC_CONF="{{ siguldry_kryoptic_conf }}"
+{% endif %}
+
+{% if explicit_allow_tpm %}
+# Credentials require the TPM to decrypt.
+#
+# For systemd 257 and older you'll need to explicitly allow access to the TPM
+# Refer to https://github.com/systemd/systemd/issues/35959.
+DeviceAllow=/dev/tpmrm0
+{% endif %}