copr-frontend: restrict access to mbs to localhost only

roles/copr/frontend/templates/copr.conf

@@ -66,7 +66,7 @@ ENFORCE_PROTOCOL_FOR_FRONTEND_URL = "https"
 
 DIST_GIT_URL="http://{{ dist_git_base_url }}/cgit"
 COPR_DIST_GIT_LOGS_URL = "http://{{ dist_git_base_url }}/per-task-logs"
-MBS_URL = "{{ frontend_base_url }}/module/1/module-builds/"
+MBS_URL = "localhost/module/1/module-builds/"
 
 # no need to filter cla_* groups, they are already filtered by fedora openid
 BLACKLISTED_GROUPS = ['fedorabugs', 'packager', 'provenpackager']

roles/copr/mbs/files/httpd/mbs.conf

@@ -6,12 +6,13 @@
 WSGIDaemonProcess module-build-service user=mbs group=mbs threads=15 display-name=module-build-service
 WSGIScriptAlias /module-build-service /opt/module-build-service/mbs.wsgi
 <Location /module-build-service>
+    Require host localhost
     WSGIProcessGroup module-build-service
 </Location>
 
 <Directory /opt/module-build-service>
+    Require host localhost
     WSGIApplicationGroup %{GLOBAL}
-    Require all granted
 </Directory>
 
 RewriteEngine On