copr-fe: deploy anubis

Relates: https://pagure.io/fedora-infrastructure/issue/12971
Fixes: https://github.com/fedora-copr/copr/issues/4064

Co-authored-by: Jiri Kyjovsky <j1.kyjovsky@gmail.com>

inventory/group_vars/copr_all_instances_aws

@@ -16,3 +16,7 @@ additional_known_hosts_cleanup:
 aws_ipv6_con: "cloud-init ens5"
 freezes: false
 cgit_uri: packages
+
+# We don't actually have an IPA host group allocated yet, but Anubis role needs
+# us to have something set in ipa_host_group.
+ipa_host_group: copr-infrastructure

inventory/group_vars/copr_dist_git_aws

@@ -1,9 +1,6 @@
 ---
 copr_machine_type: distgit
 
-# Set to a non-existent value so anubis role falls back to default.env.j2
-ipa_host_group: copr-dist-git-nonexistent
-
 freezes: false
 # consumed by roles/copr/certbot
 letsencrypt:

inventory/group_vars/copr_dist_git_dev_aws

@@ -1,9 +1,6 @@
 ---
 copr_machine_type: distgit
 
-# Set to a non-existent value so anubis role falls back to default.env.j2
-ipa_host_group: copr-dist-git-nonexistent
-
 devel: true
 freezes: false
 # consumed by roles/copr/certbot

roles/anubis/templates/policies.yaml.j2.copr-infrastructure

@@ -0,0 +1,12 @@
+---
+bots:
+  - name: all behind coprs
+    action: WEIGH
+    weight:
+      adjust: 20
+    path_regex: ^/coprs
+
+  - import: (data)/meta/default-config.yaml
+
+# Custom allowlist of API endpoint specified by each copr instance will live here
+# - import: /etc/anubis/endpoint-allowlist.yaml

roles/copr/frontend/meta/main.yml

@@ -1,3 +1,4 @@
 ---
 dependencies:
   - { role: copr/base }
+  - { role: anubis, tags: ['anubis'] }

roles/copr/frontend/templates/httpd/coprs.conf

@@ -27,6 +27,9 @@ WSGIDaemonProcess port80          user=copr-fe group=copr-fe {{ develizer(1,  3)
 # Allow large/long uploads, https://pagure.io/copr/copr/issue/1228
 WSGIDaemonProcess upload          user=copr-fe group=copr-fe {{ develizer(2, 10) }} display-name="httpd upload"          maximum-requests=100  graceful-timeout=1800
 
+# This is needed by Anubis.  TODO: find out why, and move to anubis role?
+LoadModule proxy_http_module modules/mod_proxy_http.so
+
 WSGIScriptAlias / /usr/share/copr/coprs_frontend/application
 WSGIApplicationGroup %{GLOBAL}
 
@@ -70,6 +73,26 @@ WSGIApplicationGroup %{GLOBAL}
     SSLCertificateKeyFile   /etc/letsencrypt/live/{{ copr_frontend_public_hostname }}/privkey.pem
     SSLCertificateChainFile /etc/letsencrypt/live/{{ copr_frontend_public_hostname }}/fullchain.pem
 
+    RewriteEngine on
+    RewriteRule ^/$ /coprs/ [R=301,L]
+
+    RequestHeader set "X-Real-Ip" expr=%{REMOTE_ADDR}
+    RequestHeader set X-Forwarded-Proto "https"
+    RequestHeader set "X-Http-Version" "%{SERVER_PROTOCOL}s"
+
+    ProxyPreserveHost On
+
+    ProxyRequests Off
+    ProxyVia Off
+
+    ProxyPass / http://127.0.0.1:8987/
+    ProxyPassReverse / http://127.0.0.1:8987/
+</VirtualHost>
+
+
+<VirtualHost *:8345>
+    ServerName {{ copr_frontend_public_hostname }}
+
     WSGIPassAuthorization On
 
     # Delegate requests to proper WSGIProcessGroup(s).  First move everything to