Changes

8,353 bytes added , 7 March

→‎Additional Users

Line 1: Line 1: +

{{Note box|This howto is for building your own koji build farm.

For how to use the koozali.org build farm, please see [[Koji Usage]]}}

Official Koji documentation can be found at: https://docs.pagure.org/koji/

{{Note box|This is a work in progress.....

−

And some components do not work yet}}

And some components do not work yet.}}

I'll document what I have done so far, what is working and what is not.

Line 13: Line 16:

Major Koji components:

−

* hub

* hub (koji-hub)

−

* web server

* web server (koji-web)

−

* ~~build servers~~

* builders

−

* build daemon

* build daemon (kojid)

−

* Dnf|Yum repository creation and maintenance daemon

* Dnf|Yum repository creation and maintenance daemon (kojira)

You need at least the one server which can perform all functions, or split it into a hub, web plus 1+ build servers.

A typical scenario will be to have 2+ servers.

* hub - which will run the hub, web and dnf|Yum repository daemon

* builders - there can be multiple of these

For our purposes, all of these servers will be based on bare Rocky 8 - minimal install, servers.

−

~~In our~~ build, ~~we will have only 2 servers~~.

== Install ==

{{Note box|1=You can run everything (the hub, web and build) on the one server, just run the script without any parameters.}}

−

* hub - which will run the hub, web~~, build daemon~~ and ~~def|Yum repository daemon~~

Create your hub, web and build servers (Rocky 8 minimal install).

−

* build ~~server - there can be multiple of these, but we'll just do 1 to start with~~

−

~~These~~ servers ~~will~~ be ~~based on bare Rocky 8 - minimal install~~, ~~servers~~.

On all servers enable the network and name the servers as the FQDN (the servers need to be accessible via their FQDN's, so either via DNS or you need to add them to your /etc/hosts files).

−

===== Hub/Web Server =====

It's also a good idea to update them to the latest

nmtui

dnf update

</syntaxhighlight>

Log into the hub server, download and run the install script

curl https://src.koozali.org/smedev/smeserver-koji/raw/branch/master/install-koji-farm.sh > install-koji-farm.sh

chmod o+x install-koji-farm.sh

./install-koji-farm.sh

</syntaxhighlight>

The install-koji-farm.sh script will accept multiple parameters<syntaxhighlight lang="bash">

install-koji-farm.sh [web=<web FQDN> | build=<build FQDN> | scm=<scm ip or name>:/* | debug]

</syntaxhighlight>

* web=<FQDN> - defaults to hub FQDN

*build=<FQDN> - multiple allowed

*scm=<IP or Name of SCM>:/* - multiple allowed

*debug - will list each line executed, plus lots of other gunk (very noisy)

You will be prompted for various items

*values for your ssl certificates (e.g. Country, State, City, Organization, Organisational Unit)

* For the web server (unless it's the hub)

**to accept the build server signature

**for the root password on the web server

*For each build server

**to accept the build server signature

**for the root password on the build server

The web interface will be available via http://<your hub server>/koji

=== Build Targets ===

This will have created 6 build targets with various build tags to use

* dist-sme10-os (dist-sme10-os-build)

* dist-sme10-contribs (dist-sme10-contribs-build)

* dist-sme11-os (dist-sme11-os-build)

* dist-sme11-contribs (dist-sme11-contribs-build)

* dist-sme12-os (dist-sme12-os-build)

* dist-sme12-contribs (dist-sme12-contribs-build)

There is a hierarchy inheritance structure for each release (see 10, 11 & 12), where the basic settings are inherited (e.g. yum or dnf, centos:7 or rockylinux:8 bootstrap image for mock) as well as which external repositories to use (e.g. centos7/el7 versions or rocky8/el8 versions)

+ dist-sme<release>-os

++ dist-sme<release>-os-build

++ dist-sme<release>-contribs

+++ dist-sme<release>-contribs-buikl

++ dist-sme<release>-addons

++ dist-sme<release>-testing

++ dist-sme<release>-updates

++ dist-sme<release>-updates-testing

How to build etc. will be covered in the 'to be written' koji usage page......

===Additional Builders===

You can add additional build servers later, via<syntaxhighlight lang="bash">

koji-add-builder.sh <FQDN of build server> [debug]

</syntaxhighlight>

===Additional Users===

You can add end Users via

koji-add-user.sh <User Name> [ permission=<permission> | debug ]

</syntaxhighlight>

Where <permission> could be "admin".

This will add the user into the koji db and generate ssl CLI and browser keys, which will be bundled up in a tgz file at /etc/pki/koji/bundle/koji-<User Name>-bundle.tgz.

This bundle should be copied and extracted into their home (~) directory and will create a .koji directory containing config and keys.This can be on a remote machine with the koji client installed.

cd ~

tar -zxf koji-<User Name>-bundle.tgz

koji moshimoshi

</syntaxhighlight>

=== Bootstrap ===

The setup of the repos used for building SME10, SME11 & SME12 are all included in the install script, but a brief description of what has been setup seems sensible.

==Install - The long way (Beware: Demons lurk here) ==

{{Warning box|This has been left here to help understand what is in the scripts (which may have changed since this was written)}}

=====Hub/Web Server=====

OS: Rocky 8.8-minimal

Line 33: Line 134:

Disk: 20GB (but I'm only using ~25%)

−

You'll need to set up your network:

FQDN: koji.koozali.org

You'll need to set up your network: either during install or post install (enable adapter, FQDN, IP address, Gateway, DNS)

Log into your server as root and<syntaxhighlight lang="bash">

Line 44: Line 147:

</syntaxhighlight>I installed and configured some basic tools and settings to help manage and debug the server (Cockpit can be accessed at http://<ip address or name>:9090)<syntaxhighlight lang="bash">

systemctl enable --now cockpit.socket

systemctl start cockpit.socket

dnf config-manager --set-enabled powertools

dnf install epel-release

Line 50: Line 154:

dnf install rsyslog

dnf install setroubleshoot-server

−

~~setsebool -P allow_httpd_anon_write=1~~

reboot

</syntaxhighlight>

−

===== SSL preparations =====

=====SSL preparations=====

We'll be using ssl certificates so let's create the koji ssl working directories and edit the koji ssl config file

Line 147: Line 250:

openssl req -config ssl.cnf -new -x509 -days 3650 -key private/koji_ca_cert.key -out koji_ca_cert.crt -extensions v3_ca

</syntaxhighlight>You will have to enter your details, but make sure the commonName is the full server name (e.g. koji.koozali.org).

Line 178: Line 282:

koji_make_cert.sh kojid

koji_make_cert.sh kojiadmin

−

~~</syntaxhighlight>Now we create the koji administration user (kojiadmin) and set up the certs.~~

−

~~We need to be the kojiadmin user to get the right permissions when we copy over the required certs, so...<syntaxhighlight lang="bash">~~

−

~~useradd kojiadmin~~

−

~~su - kojiadmin~~

−

~~mkdir ~/.koji~~

−

~~cp /etc/pki/koji/kojiadmin.pem ~/.koji/client.crt # NOTE: It is IMPORTANT you use the PEM and NOT the CRT~~

−

~~cp /etc/pki/koji/koji_ca_cert.crt ~/.koji/clientca.crt~~

−

~~cp /etc/pki/koji/koji_ca_cert.crt ~/.koji/serverca.crt~~

−

~~exit~~

</syntaxhighlight>

−

====== Koji Hub======

−

====== Koji Hub ======

Install koji hub and pre-requisites<syntaxhighlight lang="bash">

dnf install koji-hub mod_ssl

Line 197: Line 290:

dnf install koji

</syntaxhighlight>

−

====== POSTGRES setup ======

======POSTGRES setup======

As root we need to do the initial config<syntaxhighlight lang="bash">

postgresql-setup --initdb --unit postgresql

Line 217: Line 310:

</syntaxhighlight>Authorize the Koji-hub service to PostgreSQL. As the hub and DB are on the same server we are using Unix sockets for connection<syntaxhighlight lang="bash">

nano /var/lib/pgsql/data/pg_hba.conf

−

</syntaxhighlight>and add the following lines<syntaxhighlight lang="text">

</syntaxhighlight>and add the following lines (before the other settings)<syntaxhighlight lang="text">

#TYPE DATABASE USER CIDR-ADDRESS METHOD

local koji koji trust

Line 243: Line 336:

</syntaxhighlight>

−

===== Koji hub setup =====

=====Koji hub setup=====

We can now set up the hub itself.

Line 257: Line 350:

</syntaxhighlight>Setup the SSL certificates required<syntaxhighlight lang="bash">

nano /etc/httpd/conf.d/ssl.conf

−

</syntaxhighlight>and add these lines<syntaxhighlight lang="ini">

</syntaxhighlight>and add these lines and comment out any existing sample lines that do NOT point at valid certs etc.<syntaxhighlight lang="ini">

SSLCertificateFile /etc/pki/koji/certs/kojihub.crt

SSLCertificateKeyFile /etc/pki/koji/private/kojihub.key

SSLCertificateChainFile /etc/pki/koji/koji_ca_cert.crt

SSLCACertificateFile /etc/pki/koji/koji_ca_cert.crt

</syntaxhighlight>and uncomment the following lines<syntaxhighlight lang="text">

SSLVerifyClient require

SSLVerifyDepth 10

</syntaxhighlight>Point Koji Hub to the database<syntaxhighlight lang="bash">

nano /etc/koji-hub/hub.conf

Line 274: Line 371:

KojiDir = /mnt/koji

LoginCreatesUser = On

−

KojiWebURL = ~~https~~://koji.~~example~~.~~com~~/koji

KojiWebURL = http://koji.koozali.org/koji

</syntaxhighlight>ProxyDNs should be set to the DN of the kojiweb certificate. For example: <syntaxhighlight lang="ini">

DNUsernameComponent = CN

−

ProxyDNs = CN=koji.koozali.org~~,OU~~=~~kojiweb,O~~=~~Koozali,ST=Victoria,C=AU~~

ProxyDNs = /C=AU/ST=Victoria/L=Melbourne/O=koji/OU=kojiweb/CN=koji.koozali.org

−

</syntaxhighlight>~~create~~ the koji skeleton file system<syntaxhighlight lang="bash">

</syntaxhighlight>SELinux changes to allow access<syntaxhighlight lang="bash">

setsebool -P httpd_can_network_connect_db 1

</syntaxhighlight>Restart httpd<syntaxhighlight lang="bash">

systemctl restart httpd

</syntaxhighlight>

=====Create the koji skeleton file system=====

cd /mnt

mkdir koji

cd koji

mkdir {packages,repos,work,scratch,repos-dist}

−

chown apache.apache *

chown apache:apache *

</syntaxhighlight>and tweak SELinux to allow apache write access<syntaxhighlight lang="bash">

setsebool -P allow_httpd_anon_write=1

semanage fcontext -a -t public_content_rw_t "/mnt/koji(/.*)?"

restorecon -r -v /mnt/koji

−

</syntaxhighlight>~~We'll want~~ the ~~build servers to have access to the koji filesystem via nfs<syntaxhighlight lang="bash">~~

</syntaxhighlight>Make sure that the firewall will allow http & https access<syntaxhighlight lang="bash">

−

~~dnf install nfs-utils~~

firewall-cmd --permanent --add-service=http

−

~~systemctl enable --now nfs-server~~

firewall-cmd --permanent --add-service=https

−

~~nano /etc/exports~~

−

~~</syntaxhighlight>we only have one build server, but you can add additional to the line, separated by a space<syntaxhighlight lang="ini">~~

−

~~/mnt/koji build1.koozali.org(rw,sync,root_squash)~~

−

~~</syntaxhighlight>export, verify and~~ allow ~~Apache~~ access ~~via SELinux~~<syntaxhighlight lang="bash">

−

~~exportfs -ra~~

−

~~exportfs -v~~

−

~~setsebool -P httpd_use_nfs=1~~

−

~~</syntaxhighlight>Allow nfs access through the firewall<syntaxhighlight lang="bash">~~

−

~~firewall-cmd --permanent --add-service=nfs~~

−

firewall-cmd --permanent --add-service=~~mountd~~

−

firewall-cmd --permanent --add-service=~~rpc-bind~~

firewall-cmd --reload

−

~~</syntaxhighlight>Restart httpd<syntaxhighlight lang="bash">~~

−

~~systemctl restart httpd~~

−

</syntaxhighlight>

−

===== Koji CLI client=====

−

===== Koji CLI client =====

Let's configure the cli client. The system setting is in /etc/koji.conf, individual user settings can be set in ~/.koji/config<syntaxhighlight lang="bash">

nano /etc/koji.conf

Line 318: Line 406:

;url of XMLRPC server

−

server = ~~https~~://koji.koozali.org/kojihub

server = http://koji.koozali.org/kojihub

;url of web interface

Line 336: Line 424:

;certificate of the CA that issued the HTTP server certificate

serverca = ~/.koji/serverca.crt

−

</syntaxhighlight>~~Log in as~~ kojiadmin and ~~test~~ the ~~connection~~<syntaxhighlight lang="bash">

</syntaxhighlight>Now we create the koji administration user (kojiadmin) and set up the certs.

We need to be the kojiadmin user to get the right permissions when we copy over the required certs, so...<syntaxhighlight lang="bash">

useradd kojiadmin

su - kojiadmin

mkdir ~/.koji

cp /etc/pki/koji/kojiadmin.pem ~/.koji/client.crt # NOTE: It is IMPORTANT you use the PEM and NOT the CRT

cp /etc/pki/koji/koji_ca_cert.crt ~/.koji/clientca.crt

cp /etc/pki/koji/koji_ca_cert.crt ~/.koji/serverca.crt

chmod 0600 ~/.koji/*.crt

</syntaxhighlight>Test the connection<syntaxhighlight lang="bash">

koji moshimoshi

−

~~exit~~

</syntaxhighlight>you should see<syntaxhighlight lang="bash">

zdravstvuite, kojiadmin!

Line 345: Line 441:

You are using the hub at https://koji.koozali.org/kojihub

Authenticated via client certificate /home/kojiadmin/.koji/client.crt

</syntaxhighlight>and don't forget to logout from the kojiadmin user :)<syntaxhighlight lang="bash">

exit

</syntaxhighlight>

−

===== Koji Web Service =====

=====Koji Web Service=====

Install the koji web components<syntaxhighlight lang="bash">

dnf install koji-web mod_ssl

</syntaxhighlight>edit the web config file to point at the right urls and SSL certificates<syntaxhighlight lang="bash">

nano /etc/kojiweb/web.conf

−

</syntaxhighlight><syntaxhighlight lang="ini">

</syntaxhighlight>Please insert a random string into the secret (replace CHANGE_ME)<syntaxhighlight lang="ini">

[web]

SiteName = koji

Line 358: Line 456:

# Necessary urls

−

KojiHubURL = ~~https~~://koji.koozali.org/kojihub

KojiHubURL = http://koji.koozali.org/kojihub

KojiFilesURL = http://koji.koozali.org/kojifiles

Line 367: Line 465:

## SSL authentication options

−

WebCert = /etc/~~pki~~/~~koji/koji-web~~.~~pem~~

WebCert = /etc/kojiweb/client.crt

−

KojiHubCA = /etc/~~pki/koji~~/~~koji_ca_cert~~.crt

KojiHubCA = /etc/kojiweb/clientca.crt

LoginTimeout = 72

Line 376: Line 474:

LibPath = /usr/share/koji-web/lib

−

</syntaxhighlight>~~Make sure that~~ the ~~firewall will~~ allow ~~http & https~~ access<syntaxhighlight lang="bash">

</syntaxhighlight>Copy the certificates into the /etc/kojiweb dir and give the correct permissions<syntaxhighlight lang="bash">

−

firewall-cmd --permanent --add-service=~~http~~

cp /etc/pki/koji/kojiweb.pem /etc/kojiweb/client.crt

−

firewall-cmd --permanent --add-service=~~https~~

cp /etc/pki/koji/koji_ca_cert.crt /etc/kojiweb/clientca.crt

cp /etc/pki/koji/koji_ca_cert.crt /etc/kojiweb/serverca.crt

chmod 0600 /etc/kojiweb/*.crt

</syntaxhighlight>Edit the httpd file <syntaxhighlight lang="bash">

nano /etc/httpd/conf.d/kojiweb.conf

</syntaxhighlight>and uncomment the required ssl options<syntaxhighlight lang="ini">

# uncomment this to enable authentication via SSL client certificates

# SSLVerifyClient require

# SSLVerifyDepth 10

SSLOptions +StdEnvVars

</Location>

</syntaxhighlight>Restart the httpd daemon<syntaxhighlight lang="bash">

systemctl restart httpd

</syntaxhighlight>

====Koji Builders====

For this exercise I only created 1 build server. You can have as many as you like...

OS: Rocky 8.8-minimal

Memory: 8GB

Disk: 20GB (can apparently use a lot of disk, depending on how active a build server it is)

FQDN: build1.koozali.org

=====Koji Hub setup for build server=====

First off, set up some items on the koji hub for your build server/s

Create a ssl cert for the build server with CN=build1.koozali.org<syntaxhighlight lang="bash">

koji_make_cert.sh build1.koozali.org

</syntaxhighlight>

Add the build server into the koji database<syntaxhighlight lang="bash">

su - kojiadmin

koji add-host build1.koozali.org x86_64 noarch

koji add-host-to-channel build1.koozali.org createrepo

exit

</syntaxhighlight>

We'll want the build servers to have access to the koji filesystem via nfs, so on the koji hub server (koji.koozali.org)<syntaxhighlight lang="bash">

dnf install nfs-utils

systemctl enable --now nfs-server

systemctl start nfs-server

nano /etc/exports

</syntaxhighlight>we only have one build server, but you can add additional build servers to the line, separated by a space<syntaxhighlight lang="ini">

/mnt/koji build1.koozali.org(rw,sync,root_squash)

</syntaxhighlight>export, verify and allow Apache access via SELinux<syntaxhighlight lang="bash">

exportfs -ra

exportfs -v

setsebool -P httpd_use_nfs=1

</syntaxhighlight>Allow nfs access through the firewall<syntaxhighlight lang="bash">

firewall-cmd --permanent --add-service=nfs

firewall-cmd --permanent --add-service=mountd

firewall-cmd --permanent --add-service=rpc-bind

firewall-cmd --reload

</syntaxhighlight>

=====Builder setup=====

You'll need to set up your network: You can do this during the install or post install (ensure network activated, IP address, FQDN, Gateway, DNS)

Log into your build server as root and<syntaxhighlight lang="bash">

nmtui

ip addr

ping google.com

</syntaxhighlight>Let's bring the server up to date<syntaxhighlight lang="bash">

dnf update

</syntaxhighlight>Add the epel repository and some tools to help with debugging (cockpit available at http://<IP addr or FQDN>:9090<syntaxhighlight lang="bash">

systemctl enable --now cockpit.socket

systemctl start cockpit.socket

dnf config-manager --set-enabled powertools

dnf install epel-release

dnf install rsyslog

dnf install setroubleshoot-server

</syntaxhighlight>Install the koji build daemon<syntaxhighlight lang="bash">

dnf install koji-builder

</syntaxhighlight>Edit the kojid config file<syntaxhighlight lang="bash">

nano /etc/kojid/kojid.conf

</syntaxhighlight>Point the builder at your koji hub and setup user/SSL credentials<syntaxhighlight lang="ini">

; The directory root where work data can be found from the koji hub

topdir=/mnt/koji

; The directory root for temporary storage

workdir=/tmp/koji

; The URL for the xmlrpc server

server=http://koji.koozali.org/kojihub

user=build1.koozali.org

; The URL for the file access

topurl=http://koji.koozali.org/kojifiles

;client certificate

cert = /etc/kojid/client.crt

;certificate of the CA that issued the HTTP server certificate

serverca = /etc/kojid/serverca.crt

</syntaxhighlight>Copy over your ssl certs from your koji hub and set their correct permissions<syntaxhighlight lang="bash">

scp root@koji.koozali.org:/etc/pki/koji/build1.koozali.org.pem /etc/kojid/client.crt

scp root@koji.koozali.org:/etc/pki/koji/koji_ca_cert.crt /etc/kojid/serverca.crt

chmod 0600 /etc/kojid/*.crt

</syntaxhighlight>Enable and start the kojid service<syntaxhighlight lang="bash">

systemctl enable kojid --now

systemctl start kojid

</syntaxhighlight>

[[Category:Developer]]

[[Category:Infrastructure]]

TrevorB

371

edits

Retrieved from "https://wiki.koozali.org/Special:MobileDiff/42204...42570"

Changes

Koji Build Farm (view source)

Revision as of 03:28, 7 March 2024

Navigation menu

Search