From 55ce8486a3118837b82d39750880a823e61204c7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= <aurelien@bompard.org>
Date: Thu, 11 May 2023 10:55:41 +0200
Subject: [PATCH] RabbitMQ: add topic authn for several CentOS users
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
---
 roles/rabbitmq_cluster/tasks/apps.yml | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/roles/rabbitmq_cluster/tasks/apps.yml b/roles/rabbitmq_cluster/tasks/apps.yml
index 2ff36f288f..132a084128 100644
--- a/roles/rabbitmq_cluster/tasks/apps.yml
+++ b/roles/rabbitmq_cluster/tasks/apps.yml
@@ -103,26 +103,30 @@
 # CENTOS GITLAB END
 
 # CENTOS KOJI BEGIN
-- name: CentOS Koji User
+- name: CentOS Koji User (maybe unused, to remove)
   run_once: true
   include_role:
     name: rabbit/user
   vars:
-     username: koji-centos{{ env_suffix }}
+    username: koji-centos{{ env_suffix }}
+    sent_topics: ^org\.centos\.{{ env_short }}\.buildsys\..*
+  when: env != 'staging'
 
 - name: CentOS Stream Koji User
   run_once: true
   include_role:
     name: rabbit/user
   vars:
-     username: centos-koji
+    username: centos-koji
+    sent_topics: ^org\.centos\.{{ env_short }}\.buildsys\..*
 
 - name: CBS Koji User
   run_once: true
   include_role:
     name: rabbit/user
   vars:
-     username: cbs{{ env_suffix }}
+    username: cbs{{ env_suffix }}
+    sent_topics: ^org\.centos\.{{ env_short }}\.cbs\.buildsys\..*
 # CENTOS KOJI END
 
 # CENTOS RESULSDB BEGIN
@@ -131,7 +135,8 @@
   include_role:
     name: rabbit/user
   vars:
-     username: resultsdb-centos{{ env_suffix }}
+    username: resultsdb-centos{{ env_suffix }}
+    sent_topics: ^org\.centos\.{{ env_short }}\.resultsdb\..*
 # CENTOS RESULTSDB END
 
 # CENTOS robosignatory BEGIN
@@ -142,6 +147,7 @@
     name: rabbit/queue
   vars:
     username: centos-stream-robosignatory
+    sent_topics: ^org\.centos\.{{ env_short }}\.(robosignatory|coreos)\..*\.finished$
     queue_name: centos-stream-robosignatory
     # TTL: 10 days (in miliseconds)
     message_ttl: 864000000