With the latest urllib3 the CN match is no longer used for hostname
verification and instead the use of subjectAltName is required. With
openssl 3.3.1 this is needed to be handled with both an additional
parameter when generating the cert/request and also some new
configuration for the ssl.cnf. It is also necessary to have extensions
copied so the SAN information is preserved down the cert chain.
Signed-off-by: William Douglas <william.douglas@intel.com>
Want to enable spinning up a development environment quickly.
Increasing the countryName_max SSL configuration did not allow a country
name of 'Example Country Code' to be used when generating a certificate.
Prefer to revert back to the original value for countryName_max and
supply shorter parameters for certificate generation.
Change challengePassword_max to be consistent with the other limits.
Signed-off-by: George T Kramer <george.t.kramer@intel.com>
When koji builder and koji master are hosted on different machines, NFS
mounting is needed to connect the services. Make this process more
smooth to minimize manual editing of files. Namely, change the top
directory that koji looks at. If on the master, this is on the local
file system. If on the builder not on the master, this is also on the
local file system, but is backed by a NFS mount in a different location.
Signed-off-by: George T Kramer <george.t.kramer@intel.com>
A deployment of a "koji" server consists of additional services that
support development beyond koji itself. These include
git/cgit/gitolite, a mash containing the current snapshot of the
packages in koji, and an upstreams package sources cache.
Because these are required for integration with a DevOps workflow, they
are not included by default in the ansible playbook.
Because the kojid capacity is difficult and error-prone to calculate
automatically, let the user define this. Default the kojid capacity to
what is listed in the pagure documentation.
Signed-off-by: George T Kramer <george.t.kramer@intel.com>
Making external repository usage optional based on how it's defined or
not defined in parameter.sh so users do not need to edit any script
besides this one.
Signed-off-by: George T Kramer <george.t.kramer@intel.com>
William Douglas