From 09e9acdcafe3e2ee50324036e3c37d70fa6769c1 Mon Sep 17 00:00:00 2001 From: Markus Frei Date: Sun, 24 May 2026 14:35:21 +0200 Subject: [PATCH] fix(roles/repo_baseos): align Rocky 8 security repo with Rocky 9/10 The Rocky 8 `Rocky-Security.repo` only shipped the `[security]` stanza without `countme`, `metadata_expire=6h` or the `$rltype` mirrorlist variable, and was missing the `security-debuginfo` / `security-source` sub-repositories that the Rocky 9/10 templates (and the upstream stock repo) include. Regenerate the Rocky 8 template from the Rocky 9 one (adjusting the version path and the gpg key) so all Rocky versions are consistent. --- CHANGELOG.md | 1 + .../etc/yum.repos.d/Rocky-Security.repo.j2 | 40 ++++++++++++++++++- 2 files changed, 39 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a4361a99..687479a6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -31,6 +31,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed +* **role:repo_baseos**: The Rocky 8 `security` repository now matches Rocky 9/10: it adds the `security-debuginfo` and `security-source` sub-repositories (disabled), a 6-hour metadata expiry so emergency hot-fixes are noticed quickly, and the `$rltype` mirrorlist variable. * **docs**: All role READMEs now follow a consistent structure that separates the dependencies a playbook sets up for you from what you must provide yourself. Documentation only, no behavior changes. * **role:keycloak**: The role no longer leaves the bootstrap admin credentials lying around in `/etc/sysconfig/keycloak` after the first run. It now writes the credentials, waits for Keycloak to consume them on startup (provisioning the bootstrap admin in the `master` realm), re-renders the sysconfig file with the credentials removed, and stores a state marker at `/etc/ansible/facts.d/keycloak__admin_login_bootstrapped.state` so subsequent runs skip the credential render entirely. After the first run, `keycloak__admin_login` can be removed from the inventory. Disaster recovery: delete the marker file, re-add the variable, re-run. Also recommend a `-temp` suffix for the initial admin username (example: `keycloak-admin-temp`) so it is visually obvious in the Keycloak UI which account must be deleted once a permanent admin exists. * **role:redis**: Bump default for `net.core.somaxconn` from `1024` to `4096` to match the RHEL 9 / RHEL 10 kernel default and the current Redis upstream recommendation. Hosts on RHEL 9 or 10 see no effective change (the override was already below the kernel default); RHEL 8 hosts now get `4096` instead of `1024`. diff --git a/roles/repo_baseos/templates/Rocky8/etc/yum.repos.d/Rocky-Security.repo.j2 b/roles/repo_baseos/templates/Rocky8/etc/yum.repos.d/Rocky-Security.repo.j2 index 98a163f5..cf317b1e 100644 --- a/roles/repo_baseos/templates/Rocky8/etc/yum.repos.d/Rocky-Security.repo.j2 +++ b/roles/repo_baseos/templates/Rocky8/etc/yum.repos.d/Rocky-Security.repo.j2 @@ -1,5 +1,5 @@ # {{ ansible_managed }} -# 2026052201 +# 2026052401 # Rocky-Security.repo # @@ -16,11 +16,47 @@ name=Rocky Linux $releasever - Security {% if repo_baseos__mirror_url is defined and repo_baseos__mirror_url | length %} baseurl={{ repo_baseos__mirror_url }}/rocky/8/security/x86_64/os/ {% else %} -mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=security-$releasever +mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=security-$releasever$rltype {% endif %} #baseurl=http://dl.rockylinux.org/$contentdir/$releasever/security/$basearch/os/ gpgcheck=1 enabled={{ repo_baseos__security_repo_enabled__combined_var | bool | ternary(1, 0) }} +countme=1 +metadata_expire=6h +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial +{% if repo_baseos__mirror_url is defined and repo_baseos__mirror_url | length and repo_baseos__basic_auth_login is defined and repo_baseos__basic_auth_login | length %} +username={{ repo_baseos__basic_auth_login["username"] }} +password={{ repo_baseos__basic_auth_login["password"] }} +{% endif %} + +[security-debuginfo] +name=Rocky Linux $releasever - Security Debug +{% if repo_baseos__mirror_url is defined and repo_baseos__mirror_url | length %} +baseurl={{ repo_baseos__mirror_url }}/rocky/8/security/x86_64/debug/tree/ +{% else %} +mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=security-$releasever-debug$rltype +{% endif %} +#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/security/$basearch/debug/tree/ +gpgcheck=1 +enabled=0 +metadata_expire=6h +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial +{% if repo_baseos__mirror_url is defined and repo_baseos__mirror_url | length and repo_baseos__basic_auth_login is defined and repo_baseos__basic_auth_login | length %} +username={{ repo_baseos__basic_auth_login["username"] }} +password={{ repo_baseos__basic_auth_login["password"] }} +{% endif %} + +[security-source] +name=Rocky Linux $releasever - Security Source +{% if repo_baseos__mirror_url is defined and repo_baseos__mirror_url | length %} +baseurl={{ repo_baseos__mirror_url }}/rocky/8/security/source/tree/ +{% else %} +mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=security-$releasever-source$rltype +{% endif %} +#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/security/source/tree/ +gpgcheck=1 +enabled=0 +metadata_expire=6h gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial {% if repo_baseos__mirror_url is defined and repo_baseos__mirror_url | length and repo_baseos__basic_auth_login is defined and repo_baseos__basic_auth_login | length %} username={{ repo_baseos__basic_auth_login["username"] }}