From 465c2ca3ecd4c21bcb7e1deee24b0474c966b614 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Thu, 25 Jun 2026 09:50:35 +0100
Subject: [PATCH] Revert "openQA etc: use a single-cert CA cert file for
 staging rabbitmq (#13422)"

This reverts commit 49f42faa1b6f3ea4d9a3acb87f9ccda13fef9dea.
I've updated to latest fedora-messaging and want to see if this
is unnecessary now.
---
 inventory/group_vars/openqa_servers_common |  2 +-
 roles/openqa/dispatcher/tasks/main.yml     | 22 ++++------------------
 2 files changed, 5 insertions(+), 19 deletions(-)

diff --git a/inventory/group_vars/openqa_servers_common b/inventory/group_vars/openqa_servers_common
index 4c9093a24a..97ec958d5f 100644
--- a/inventory/group_vars/openqa_servers_common
+++ b/inventory/group_vars/openqa_servers_common
@@ -30,7 +30,7 @@ openqa_amqp_prod_certfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_userna
 openqa_amqp_prod_keyfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_username }}-key.pem"
 openqa_amqp_prod_url: "amqps://{{ openqa_amqp_prod_username }}:@rabbitmq.fedoraproject.org/%2Fpubsub"
 openqa_amqp_prod_username: "openqa"
-openqa_amqp_stg_cacertfile: "/etc/fedora-messaging/stg-cacert-single.pem"
+openqa_amqp_stg_cacertfile: "/etc/fedora-messaging/stg-cacert.pem"
 openqa_amqp_stg_certfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_stg_username }}-cert.pem"
 openqa_amqp_stg_keyfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_stg_username }}-key.pem"
 openqa_amqp_stg_url: "amqps://{{ openqa_amqp_stg_username }}:@rabbitmq.stg.fedoraproject.org/%2Fpubsub"
diff --git a/roles/openqa/dispatcher/tasks/main.yml b/roles/openqa/dispatcher/tasks/main.yml
index d5c2371a62..ae7e07e6de 100644
--- a/roles/openqa/dispatcher/tasks/main.yml
+++ b/roles/openqa/dispatcher/tasks/main.yml
@@ -286,7 +286,7 @@
   - config
   - fedora-messaging
 
-- name: Deploy the cert for authenticating with fedora-messaging
+- name: Deploy the Fedora infra fedora-messaging cert
   ansible.builtin.copy:
     src: "{{ private }}/files/rabbitmq/{{ openqa_env }}/pki/issued/{{ openqa_amqp_this_username }}.crt"
     dest: "/etc/pki/fedora-messaging/{{ openqa_amqp_this_username }}-cert.pem"
@@ -298,7 +298,7 @@
   - config
   - fedora-messaging
 
-- name: Deploy the key for authenticating with fedora-messaging
+- name: Deploy the Fedora infra fedora-messaging key
   ansible.builtin.copy:
     src: "{{ private }}/files/rabbitmq/{{ openqa_env }}/pki/private/{{ openqa_amqp_this_username }}.key"
     dest: "/etc/pki/fedora-messaging/{{ openqa_amqp_this_username }}-key.pem"
@@ -310,7 +310,7 @@
   - config
   - fedora-messaging
 
-- name: Deploy the fedora-messaging prod auth cert on stg (for stg consumers that listen on prod)
+- name: Deploy the Fedora infra fedora-messaging prod cert on stg (for stg consumers that listen on prod)
   ansible.builtin.copy:
     src: "{{ private }}/files/rabbitmq/production/pki/issued/{{ openqa_amqp_prod_username }}.crt"
     dest: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_username }}-cert.pem"
@@ -322,7 +322,7 @@
   - config
   - fedora-messaging
 
-- name: Deploy the fedora-messaging prod auth key on stg (for stg consumers that listen on prod)
+- name: Deploy the Fedora infra fedora-messaging prod key on stg (for stg consumers that listen on prod)
   ansible.builtin.copy:
     src: "{{ private }}/files/rabbitmq/production/pki/private/{{ openqa_amqp_prod_username }}.key"
     dest: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_username }}-key.pem"
@@ -334,20 +334,6 @@
   - config
   - fedora-messaging
 
-- name: Deploy a working CA certificate file on staging (see https://forge.fedoraproject.org/infra/tickets/issues/13422)
-  ansible.builtin.copy:
-    src: "{{ private }}/files/rabbitmq/{{ openqa_env }}/pki/ca.crt"
-    dest: "/etc/fedora-messaging/{{ openqa_env_prefix }}cacert-single.pem"
-    # this is just a server cert, it is not actually private, we're
-    # just getting it from the private repo as it's convenient
-    mode: "0644"
-    owner: root
-    group: geekotest
-  when: "deployment_type is defined and deployment_type == 'stg'"
-  tags:
-  - config
-  - fedora-messaging
-
 - name: Configure fedora-messaging scheduler
   ansible.builtin.template: src=fedora_openqa_scheduler.toml.j2 dest=/etc/fedora-messaging/fedora_openqa_scheduler.toml owner=root group=root mode=0640
   notify: