Remove registry installation from job

roles/rproxy/files/repo.conf

@@ -20,7 +20,7 @@ server {
         dav_methods PUT DELETE MKCOL;
         dav_access user:rw group:r all:r;
         create_full_put_path on;
-        client_max_body_size 100m;
+        client_max_body_size 5g;
 
         # auth_basic "Needs to auth";
         # auth_basic_user_file /etc/nginx/.htpasswd;

roles/rproxy/tasks/addconfig.yml

@@ -45,6 +45,17 @@
       become_user: "{{ ansible_user }}"
       ignore_errors: true
 
+    - name: Get all tracking certificates
+      ansible.builtin.shell:
+        cmd: ipa-getcert list | grep "ID" | awk '{print $NF}' | tr -d "'\|:"
+      register: tracking_list
+
+    - name: Remove certificates from IPA tracking
+      ansible.builtin.shell:
+        cmd: "ipa-getcert stop-tracking -i {{ item }}"
+      loop: "{{ tracking_list.stdout_lines }}"
+      ignore_errors: true
+
     - name: Request certificate via ipa-getcert
       ansible.builtin.command: >
         ipa-getcert request
@@ -53,8 +64,6 @@
         -K HTTP/{{ rproxy_service_name }}.{{ ansible_facts['domain'] }}
         -N CN={{ rproxy_service_name }}.{{ ansible_facts['domain'] }}
 
-    # sudo ipa-getcert stop-tracking -i 20250813210258 if track already exists
-
     - name: Wait for certificate to appear
       ansible.builtin.wait_for:
         path: "{{ rproxy_dir }}/certs/{{ rproxy_service_name }}.{{ ansible_facts['domain'] }}.crt"

roles/rproxy/tasks/dockerrepo.yml

@@ -1,113 +0,0 @@
----
-- name: Prepare for image repository
-  block:
-    - name: Remove dockerrepo dir
-      ansible.builtin.file:
-        path: "{{ dockerrepo_dir }}"
-        state: absent
-
-    - name: Create dockerrepo dir
-      ansible.builtin.file:
-        path: "{{ dockerrepo_dir }}"
-        state: directory
-
-    - name: Create repo dir
-      ansible.builtin.file:
-        path: "{{ dockerrepo_data_dir }}"
-        state: directory
-
-    - name: Create certs dir
-      ansible.builtin.file:
-        path: "{{ dockerrepo_dir }}/certs"
-        state: directory
-
-- name: Create certificates for image repository
-  block:
-    - name: Kinit
-      ansible.builtin.shell:
-        cmd: "echo '{{ ansible_password }}' | kinit"
-      become: false
-      become_user: "{{ ansible_user }}"
-
-    - name: Create SPN for HTTP
-      ansible.builtin.shell:
-        cmd: "ipa service-add HTTP/{{ ansible_facts['hostname'] }}.{{ ansible_facts['domain'] }}"
-      become: false
-      become_user: "{{ ansible_user }}"
-      ignore_errors: true
-
-    - name: Request certificate via ipa-getcert
-      ansible.builtin.command: >
-        ipa-getcert request
-        -f {{ rproxy_dir }}/certs/dockerrepo.crt
-        -k {{ rproxy_dir }}/certs/dockerrepo.key
-        -K HTTP/{{ ansible_facts['hostname'] }}.{{ ansible_facts['domain'] }}
-        -N CN={{ ansible_facts['hostname'] }}.{{ ansible_facts['domain'] }}
-
-    # sudo ipa-getcert stop-tracking -i 20250813210258 if track already exists
-
-    - name: Wait for certificate to appear
-      ansible.builtin.wait_for:
-        path: "{{ rproxy_dir }}/certs/dockerrepo.crt"
-        timeout: 60
-
-    - name: Change certificate permissions
-      ansible.builtin.file:
-        path: "{{ rproxy_dir }}/certs/dockerrepo.crt"
-        mode: "0744"
-
-    - name: Wait for certificate key to appear
-      ansible.builtin.wait_for:
-        path: "{{ rproxy_dir }}/certs/dockerrepo.key"
-        timeout: 60
-
-    - name: Change certificate key permissions
-      ansible.builtin.file:
-        path: "{{ rproxy_dir }}/certs/dockerrepo.key"
-        mode: "0744"
-
-- name: Start image repository
-  block:
-    - name: Pull repo image
-      containers.podman.podman_image:
-        name: registry:latest
-        state: present
-
-    - name: Delete image repository container if exists
-      containers.podman.podman_container:
-        name: registry
-        state: absent
-
-    - name: Start registry
-      containers.podman.podman_container:
-        name: registry
-        image: registry:latest
-        state: started
-        ports:
-            - "5000:5000"
-        env:
-          REGISTRY_HTTP_TLS_CERTIFICATE: "/certs/dockerrepo.crt"
-          REGISTRY_HTTP_TLS_KEY: "/certs/dockerrepo.key"
-        volumes:
-          - "{{ dockerrepo_data_dir }}:/var/lib/registry:z,rw"
-          - "{{ dockerrepo_dir }}/certs:/certs:z,rw"
-          - "/etc/localtime:/etc/localtime:ro"
-        privileged: true
-        security_opt:
-          - "label=disable"
-        log_driver: journald
-        generate_systemd:
-          path: /etc/systemd/system/
-          restart_policy: always
-          stop_timeout: 120
-          names: true
-
-    - name: Daemon reload
-      ansible.builtin.shell:
-        cmd: systemctl daemon-reload
-
-    - name: Enable registry service
-      ansible.builtin.systemd:
-        name: "container-registry.service"
-        state: started
-        enabled: yes

roles/rproxy/tasks/main.yml

@@ -23,14 +23,6 @@
   tags:
   - install
 
-- name: Docker repo install
-  ansible.builtin.include_tasks: 
-    file: dockerrepo.yml
-    apply:
-      tags: install
-  tags:
-  - install
-
 - name: Add config
   ansible.builtin.include_tasks: 
     file: addconfig.yml

roles/rproxy/tasks/repo.yml

@@ -12,6 +12,12 @@
         src: files/repo.conf
         dest: "{{ rproxy_dir }}/sites/repo.conf"
 
+    - name: Install createrepo
+      ansible.builtin.yum:
+        name:
+          - createrepo
+        update_cache: yes
+
 - name: Create https certificates for repository
   block:
     - name: Kinit

roles/rproxy/tasks/rproxy.yml

@@ -6,11 +6,6 @@
         path: "{{ rproxy_dir }}"
         state: absent
 
-    - name: Create data dir
-      ansible.builtin.file:
-        path: "{{ data_dir }}"
-        state: directory
-
     - name: Create rproxy dir
       ansible.builtin.file:
         path: "{{ rproxy_dir }}"
@@ -40,7 +35,7 @@
   block:
     - name: Pull rproxy image
       containers.podman.podman_image:
-        name: "docker.io/library/nginx:{{ rproxy_version }}"
+        name: "{{ image_repo }}/{{ rproxy_image }}:{{ rproxy_version }}"
         state: present
 
     - name: Delete rproxy container if exists
@@ -51,7 +46,7 @@
     - name: Start rproxy
       containers.podman.podman_container:
         name: rproxy
-        image: "docker.io/library/nginx:{{ rproxy_version }}"
+        image: "{{ image_repo }}/{{ rproxy_image }}:{{ rproxy_version }}"
         state: started
         ports:
             - "443:443"

roles/rproxy/vars/main.yml

@@ -1,7 +1,9 @@
+---
+# General
 ansible_python_interpreter: /usr/bin/python3
+
+# Rproxy
+rproxy_image: nginx
+rproxy_version: 1.29
 rproxy_dir: /opt/rproxy
-rproxy_version: 1.29.0
-data_dir: /opt/data
-repo_data_dir: /opt/data/repo
-dockerrepo_dir: /opt/dockerrepo
-dockerrepo_data_dir: /opt/data/dockerrepo
+repo_data_dir: /opt/repodata