From 5ab2061c88cc5548a02e23cc64b1e772728d8e18 Mon Sep 17 00:00:00 2001
From: Stephen Smoogen <smooge@redhat.com>
Date: Fri, 7 Feb 2020 20:06:08 +0000
Subject: [PATCH] This removes all files related to keyserver and sks. Revert
 if still needed

---
 files/keyserver/sks.conf            |  83 -----------
 master.yml                          |   1 -
 playbooks/fedmsgupdate.yml          |   1 -
 playbooks/groups/keyserver.yml      |  40 -----
 roles/keyserver/files/css.css       | 132 ----------------
 roles/keyserver/files/index.html    |  91 -----------
 roles/keyserver/files/keyserver.mod | Bin 1052 -> 0 bytes
 roles/keyserver/files/keyserver.pp  | Bin 1068 -> 0 bytes
 roles/keyserver/files/keyserver.te  |  13 --
 roles/keyserver/files/membership    |  42 ------
 roles/keyserver/files/robots.txt    |   2 -
 roles/keyserver/files/sksconf       |  14 --
 roles/keyserver/handlers/main.yml   |   6 -
 roles/keyserver/tasks/main.yml      | 101 -------------
 roles/keyserver/templates/sks.conf  |  98 ------------
 roles/keyserver/templates/ssl.conf  | 224 ----------------------------
 16 files changed, 848 deletions(-)
 delete mode 100644 files/keyserver/sks.conf
 delete mode 100644 playbooks/groups/keyserver.yml
 delete mode 100644 roles/keyserver/files/css.css
 delete mode 100644 roles/keyserver/files/index.html
 delete mode 100644 roles/keyserver/files/keyserver.mod
 delete mode 100644 roles/keyserver/files/keyserver.pp
 delete mode 100644 roles/keyserver/files/keyserver.te
 delete mode 100644 roles/keyserver/files/membership
 delete mode 100644 roles/keyserver/files/robots.txt
 delete mode 100644 roles/keyserver/files/sksconf
 delete mode 100644 roles/keyserver/handlers/main.yml
 delete mode 100644 roles/keyserver/tasks/main.yml
 delete mode 100644 roles/keyserver/templates/sks.conf
 delete mode 100644 roles/keyserver/templates/ssl.conf

diff --git a/files/keyserver/sks.conf b/files/keyserver/sks.conf
deleted file mode 100644
index e91dfd764b..0000000000
--- a/files/keyserver/sks.conf
+++ /dev/null
@@ -1,83 +0,0 @@
-ServerName keys.fedoraproject.org
-Listen 80.239.156.219:11371
-NameVirtualHost *:443
-
-<ifModule !mod_proxy.c>
-    LoadModule proxy_module modules/mod_proxy.so
-</IfModule>
-
-<IfModule !mod_proxy_http.c>
-    LoadModule proxy_http_module modules/mod_proxy_http.so
-</IfModule>
-
-<IfModule !mod_proxy_balancer.c>
-    LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
-</IfModule>
-
-<IfModule !mod_headers.c>
-    LoadModule headers_module modules/mod_headers.so
-</IfModule>
-
-<IfModule !mod_authz_host.c>
-    LoadModule authz_host_module modules/mod_authz_host.so
-</IfModule>
-
-<IfModule !mod_log_config.c>
-    LoadModule log_config_module modules/mod_log_config.so
-</IfModule>
-
-<IfModule !mod_env.c>
-    LoadModule env_module modules/mod_env.so
-</IfModule>
-
-<Directory />
-    Options FollowSymLinks
-    AllowOverride None
-    Order deny,allow
-    Deny from all
-</Directory>
-
-<VirtualHost *:80>
-        ServerAdmin sysadmin-keys-members@fedoraproject.org
-        ServerName keys.fedoraproject.org
-        ProxyPass / http://127.0.0.1:11371/
-        ProxyPassReverse / http://127.0.0.1:11371/
-        SetEnv proxy-nokeepalive 1
-	ProxyVia Full
-</VirtualHost>
-<VirtualHost *:443>
-        ServerAdmin sysadmin-keys-members@fedoraproject.org
-        ServerName keys.fedoraproject.org
-	ServerAlias keys01.fedoraproject.org
-
-        SSLEngine on
-        SSLCertificateFile /etc/pki/tls/wildcard-2014.fedoraproject.org.cert
-	SSLCertificateChainFile /etc/pki/tls/wildcard-2014.fedoraproject.org.intermediate.cert
-        SSLCertificateKeyFile /etc/pki/tls/wildcard-2014.fedoraproject.org.key
-	ProxyPass / http://localhost:11371/
-	ProxyPassReverse / http://localhost:11371/
-        SetEnv proxy-nokeepalive 1
-	ProxyVia Full
-</VirtualHost>
-<VirtualHost *:443>
-        ServerAdmin sysadmin-keys-members@fedoraproject.org
-        ServerName pool.sks-keyservers.net
-        ServerAlias sks-keyservers.net
-	ServerAlias *.sks-keyservers.net
-
-        SSLEngine on
-        SSLCertificateFile /etc/pki/tls/keys_fedoraproject_org.crt.pem
-        SSLCertificateKeyFile /etc/pki/tls/keys_fedoraproject_org.key
-        ProxyPass / http://localhost:11371/
-        ProxyPassReverse / http://localhost:11371/
-        SetEnv proxy-nokeepalive 1
-	ProxyVia Full
-</VirtualHost>
-<VirtualHost *:11371>
-	ServerAdmin sysadmin-keys-members@fedoraproject.org
-	ServerName keys.fedoraproject.org
-	ProxyPass / http://127.0.0.1:11371/
-	ProxyPassReverse / http://127.0.0.1:11371/
-	SetEnv proxy-nokeepalive 1
-	ProxyVia Full
-</VirtualHost>
diff --git a/master.yml b/master.yml
index f235fe9485..c6f913c685 100644
--- a/master.yml
+++ b/master.yml
@@ -46,7 +46,6 @@
 - import_playbook: /srv/web/infra/ansible/playbooks/groups/gnome-backups.yml
 - import_playbook: /srv/web/infra/ansible/playbooks/groups/ipa.yml
 - import_playbook: /srv/web/infra/ansible/playbooks/groups/kerneltest.yml
-- import_playbook: /srv/web/infra/ansible/playbooks/groups/keyserver.yml
 - import_playbook: /srv/web/infra/ansible/playbooks/groups/koji-hub.yml
 - import_playbook: /srv/web/infra/ansible/playbooks/groups/kojipkgs.yml
 - import_playbook: /srv/web/infra/ansible/playbooks/groups/logserver.yml
diff --git a/playbooks/fedmsgupdate.yml b/playbooks/fedmsgupdate.yml
index da1cf3a06f..a73425ede0 100644
--- a/playbooks/fedmsgupdate.yml
+++ b/playbooks/fedmsgupdate.yml
@@ -13,7 +13,6 @@
 - include_playbook: /srv/web/infra/ansible/playbooks/groups/elections.yml
 - include_playbook: /srv/web/infra/ansible/playbooks/groups/fedocal.yml
 - include_playbook: /srv/web/infra/ansible/playbooks/groups/gallery.yml
-- include_playbook: /srv/web/infra/ansible/playbooks/groups/keyserver.yml
 - include_playbook: /srv/web/infra/ansible/playbooks/groups/koji-hub.yml
 - include_playbook: /srv/web/infra/ansible/playbooks/groups/mailman.yml
 - include_playbook: /srv/web/infra/ansible/playbooks/groups/notifs-backend.yml
diff --git a/playbooks/groups/keyserver.yml b/playbooks/groups/keyserver.yml
deleted file mode 100644
index 76598c25f1..0000000000
--- a/playbooks/groups/keyserver.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-# create a new sks keyserver
-# NOTE: should be used with --limit most of the time
-# NOTE: make sure there is room/space for this server on the vmhost
-# NOTE: most of these vars_path come from group_vars/gallery-web* or from hostvars
-
-- import_playbook: "/srv/web/infra/ansible/playbooks/include/virt-create.yml myhosts=keys"
-
-- name: make the box be real
-  hosts: keys
-  user: root
-  gather_facts: True
-
-  vars_files:
-   - /srv/web/infra/ansible/vars/global.yml
-   - "/srv/private/ansible/vars.yml"
-   - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
-
-  roles:
-  - base
-  - rkhunter
-  - nagios_client
-  - hosts
-  - fas_client
-  - sudo
-  - collectd/base
-  - { role: openvpn/client,
-      when: env != "staging" }
-  - apache
-  - certbot
-  - keyserver
-
-  pre_tasks:
-  - import_tasks: "{{ tasks_path }}/yumrepos.yml"
-
-  tasks:
-  - import_tasks: "{{ tasks_path }}/2fa_client.yml"
-  - import_tasks: "{{ tasks_path }}/motd.yml"
-
-  handlers:
-  - import_tasks: "{{ handlers_path }}/restart_services.yml"
diff --git a/roles/keyserver/files/css.css b/roles/keyserver/files/css.css
deleted file mode 100644
index 99443a0054..0000000000
--- a/roles/keyserver/files/css.css
+++ /dev/null
@@ -1,132 +0,0 @@
-    * { font-family: helvetica, sans-serif; }
- 
-    h1,
-    p {
-      margin: 0; /* Let's zero those margins */
-    }
-
-h2 {	color: #3c6eb4; margin: 0;}
- 
-    #container {
- /*     border: 1px solid #555; /* Nice transition from white background */
-      width: 600px; /* Should be narrow enough for small screens */
-      margin: 0 auto; /* Centering */
-      font-size: 1.1em; /* Font big enough not to need to squint */
-      line-height: 1.3em;
-
-    }
- 
-    #title {
- /*     background-color:#e2e5e2; */
-      padding: 10px;
-    }
-   
-    #title h1, #title h2 {
-      margin-top: 0.3em;
-    }
- 
-    #info {
-      /* background-color:#e2e5e2; */
-      padding: 5px 10px;
-    }
- 
-    #main {
-     /* background : #FAFBEA; */
-      padding: 0 10px 10px 10px;
-    }
- 
-    #main header {
-      padding-top: 1em;
-    }
- 
-    #main p {
-      margin: 0.5em 0;
-    }
- 
-    #keytext {
-      width: 100%;
-      height: 150px;
-      border: 1px solid #555;
-      background : #fff;
-      max-width: 100%;
-      display: block;
-    }
- 
-    ul {
-      width: 100%;
-      list-style-type: none;
-      padding-left: 0;
-    }
- 
-    li {
-      width: 99%;
-    }
- 
-    li label {
-      width: 57%;
-      display: inline-block;
-    }
-   
-    button {
-      border-radius: 3px;
-      -moz-border-radius: 3px;
-      background: -webkit-gradient(linear, left top, left bottom, from(#fff), to(#ddd));
-      background: -moz-linear-gradient(top, #fff, #ddd);  
-      border: 1px solid #bbb;
-    }
- 
-    #info p {line-height: 1.1em; margin-bottom: 0.3em;}
-
-
-
-#bodyform {
-	margin-top: 20px;
-	color: #555;
-	font-weight: normal;
-	font-size: 16px;
-
-}
-
-#headcontent {
-	width: 700px;
-	margin: auto;
-	display: table;
-
-}
-
-#lefttop {
-	float: left;
-	text-align: left;
-}
-
-#righttop {
-	float:right;
-	text-align: right;
-}
-
-hr {
-	background: #3c6eb4;
-	height: 8px;
-	border: 0px;
-}
-
-footer {
-	background: #3c6eb4;
-	margin: auto;
-	color: #fff;
-
-}
-
-footer p { width: 500px; margin: auto; text-align: center;}
-
-a {text-decoration: none; color: #B8C9FF; font-weight: bold;}
-
-fieldset {
-	border: 2px solid #4462C4;
-}
-
-legend {
-	color: #3c6eb4;
-}
-
-
diff --git a/roles/keyserver/files/index.html b/roles/keyserver/files/index.html
deleted file mode 100644
index 12b7be5c05..0000000000
--- a/roles/keyserver/files/index.html
+++ /dev/null
@@ -1,91 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> 
-<head>
-  <link rel="stylesheet" type="text/css" media="all" href="css.css" /> 
-  <title>Fedora Project GPG Key Server</title>
-</head>
-
-  <body> 
-
-<div id=bodyform>
-	<div id=headcontent>
-		<div id=lefttop>
-			<a href="https://fedoraproject.org">
-				<img src='https://fedoraproject.org/static/images/fedora-logo.png'>
-			</a>
-		</div>
-		<div id=righttop>
-			<h1>SKS OpenPGP Key server</h1> 
-			<h2>keys.fedoraproject.org</h2> 
-		</div>
-	</div>
-	<hr></hr>
-
-    <div id="container"> 
- 
-      <div id="main" role="main"> 
-        <header> 
-          <h2>Extract a key</h2> 
-        </header> 
-        <p>You can find a key by typing in some words that appear in the
-          userid (name, email, etc.) of the key you're looking for, or
-          by typing in the keyid in hex format ("0x&#8230;")</p> 
-        <form id="lookup" action="/pks/lookup" method="get"> 
-          <fieldset checked="true"> <legend>Search for a public key</legend> 
-            <ul> 
-              <li> <label for="search">String</label> <input id="search"
-                  name="search" placeholder="0xDEADBEEF" required="" autofocus=""
-                  type="text"> </li> 
-              <li> <label for="fingerprint">Show PGP Fingerprints</label> 
-                <input id="fingerprint" name="fingerprint" type="checkbox"> 
-              </li> 
-              <li> <label for="hash">Show SKS full-key hashes</label> <input
-                  id="hash" name="hash" type="checkbox"> </li> 
-              <li> <label for="matching">Get regular index of matching
-                  keys</label> <input id="matching" name="op" value="index"
-                  type="radio"> </li> 
-              <li> <label for="verbose">Get verbose index of matching
-                  keys</label> <input id="verbose" name="op" value="vindex"
-                  checked="checked" type="radio"> </li> 
-              <li> <label for="asciiarmored">Retrieve ascii-armored
-                  keys</label> <input id="asciiarmored" name="op" value="get"
-                  type="radio"> </li> 
-              <li> <label for="fullkey">Retrieve keys by full-key hash</label> 
-                <input id="fullkey" name="op" value="hget" type="radio"> 
-              </li> 
-            </ul> 
-            <button type="reset">Reset</button> <button type="submit">Search
- 
- 
- 
- 
- 
- 
-              for a key</button> </fieldset> 
-        </form> 
-        <header> 
-          <h2>Submit a key</h2> 
-        </header> 
-        <p>You can submit a key by simply pasting in the ASCII-armored
-          version of your key and clicking on submit.</p> 
-        <form id="add" action="/pks/add" method="post"> 
-          <fieldset> <textarea id="keytext" name="keytext" rows="5" cols="30"></textarea> 
-            <button type="reset">Reset</button> <button checked="true"
-              type="submit">Submit this key</button></fieldset> 
-        </form> 
-      </div> 
-      <!-- end of #main -->  
-    </div> 
-    <!--! end of #container --> 
-      <footer id="info"> 
-        <p><a href="https://bitbucket.org/skskeyserver/sks-keyserver/wiki/Home">SKS</a> is
-          a new <a href="http://www.openpgp.org/">OpenPGP</a> 
-          keyserver. The main innovation of SKS is that it includes a
-          highly-efficient reconciliation algorithm for keeping the
-          keyservers synchronized.</p> 
-        <p style="text-align: center;"><a href="/pks/lookup?op=stats">SKS statistics</a></p> 
-      </footer>
-</div>
-  </body> 
-
-</html>
diff --git a/roles/keyserver/files/keyserver.mod b/roles/keyserver/files/keyserver.mod
deleted file mode 100644
index 87cf5aa3115d9606f56d4876a2434ea581ba46aa..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1052
zcmb_bOHKnZ41K_Yk1BP+1$qJmH(<k#t~fwMGZB<R5=~u1rCy;2W(9gB1}mDdnkQM~
zIDXI0$libLKBoX4?q>JPxcQjPQ@42y#{ez>9054P56%Is!gd|{_t2jJxVgH%Eq4~=
z(8wp~Q;$Z7&u*RkDhL&M8z0|-TP$NYDQSm*Pca5BD#teH6KU}hytv+$Z~26lzbw9L
z5|)>r^6v{>PQ5reEoEDjXOY}FIY|8jrRxg_cBN-_LDRE-ZFfYSr$4pMBj4H(cdQ!P
zgTnSw_d8Ux&f#nkwT_|{r}kJ{ts1TPSl}DDIDbpRh&Aqk&c99&@9A^C2WHsPInQNg
HZFmUZA0tG^

diff --git a/roles/keyserver/files/keyserver.pp b/roles/keyserver/files/keyserver.pp
deleted file mode 100644
index 1e39dc527b8b515f7469614b326a67e6c5ecc38b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1068
zcmb`GO-=(b422)C;73Rxae<xy!4253gB1seXeNTvl0;J%fz&G?&f8VdD=}Engw=eK
zHHl+CJ0s_7yWZ>ppq&Hw+^#og03L29ceA*9pWLTzwFvtFPD<DjemDj&4<F0WzlHt)
z!1d+TO*yluJo5?n)T0sc*)5Zw2caTQ<Kt^^(^>3JOW4lgQ;flj%CQZuNt(U{FRr)c
zTWg}_FUndqiOtJT`S*q{r(T>Kma?ssXOY}F*-8C_rt1v|yV5<opy^(}wmVYC=})cW
zm~U+;cdQ!PgJOHB`yHxT$8fett)sO3)E-N#Riot}3*Lbb=kJlwV~y`X=U*p?=Uj8X
P2WHr&bDqo0TK5p&_0>n*

diff --git a/roles/keyserver/files/keyserver.te b/roles/keyserver/files/keyserver.te
deleted file mode 100644
index 995035cfd2..0000000000
--- a/roles/keyserver/files/keyserver.te
+++ /dev/null
@@ -1,13 +0,0 @@
-
-module keyserver 1.0;
-
-require {
-	type httpd_t;
-	type pgpkeyserver_port_t;
-	class tcp_socket name_bind;
-	class tcp_socket name_connect;
-}
-
-#============= httpd_t ==============
-allow httpd_t pgpkeyserver_port_t:tcp_socket name_bind;
-allow httpd_t pgpkeyserver_port_t:tcp_socket name_connect;
diff --git a/roles/keyserver/files/membership b/roles/keyserver/files/membership
deleted file mode 100644
index c522e4c26d..0000000000
--- a/roles/keyserver/files/membership
+++ /dev/null
@@ -1,42 +0,0 @@
-ams.sks.heypete.com		11370 # Pete Stephenson <pete@heypete.com> (0x85EB9F44)
-key.adeti.org			11370 # Marco RODRIGUES <marco@adeti.org> 0x7CE697FC
-key.cccmz.de			11370 # Christian Felsing <hostmaster@ip6.li> 0xFDCAC0E5
-keys2.kfwebs.net		11370 # 0x0B7F8B60E3EDFAE3
-keys.andreas-puls.de 		11370 # Andreas Puls <appu@gmx.net> 0xDAC73FA6
-keys.christensenplace.us	11370 # Eric Christensen <eric@christensenplace.us> 0x024BB3D1
-keys.communityrack.org		11370 # Andre Keller <ak@0x2a.io> 0x2351B9E3
-keyserver.cais.rnp.br		11370 # Andre R. Landim <andre.landim@cais.rnp.br> 0xCBFE6A3E
-keyserver.cns.vt.edu		11370 # Phil Benchoff <benchoff@vt.edu> <keymaster@cns.vt.edu>
-keyserver.computer42.org	11370 # H.-Dirk Schmitt <dirk@computer42.org> 0x6A017B17
-keyserver.miniskipper.at 	11370 # Sven Kocksch <sven.kocksch@miniskipper.at> 0x90D94808 
-keyserver.nausch.org		11370 # Michael Nausch <michael@nausch.org> 0x2384C849 
-key-server.nl			11370 # Wijnand Modderman-Lenstra <maze@key-server.nl> 0x294DF221
-keyserver.saol.no-ip.com	11370 # Peter <peter@saol.no-ip.com> 0x39E97290
-keyserver.sincer.us 		11370 # Petru Ghita <petrutz@venaver.info> 0x7CF29D04
-keyservers.org			11370 # Rob Hansen <rjh@sixdemonbag.org>
-keyserver.stack.nl		11370 # Johan van Selst <johans@stack.nl> 0xD3AE8D3A
-keyserver.timlukas.de		11370 # Timlukas Bloch <timlukas@protonmail.ch> 0x54f43ad0f3139fc2
-keyserver.uz.sns.it		11370 # Giovanni Mascellani, D9AB457E
-keyserver.zap.org.au 		11370 # John Zaitseff <J.Zaitseff@zap.org.au> 0xB0F6BC7F46D30F1432FC46190D254111C4EE569B
-keys.jhcloos.com  		11370 # James Cloos <cloos@jhcloos.com>  0xED7DAEA6
-keys.niif.hu			11370 # Gabor Kiss <kissg@ssg.ki.iif.hu>
-keys.schluesselbruecke.de	11370 # Matthias Schreiber <schreiber-matti@web.de>  0x586A2E13F52616561BFC32C95B964AE610D49726
-keys.techwolf12.nl		11370 # Christiaan de Die le Clercq <contact@techwolf12.nl> 0x2F2546D8
-keys.wuschelpuschel.org		11370 # 0x017D1C3D Peter Kornherr <peter@wuschelpuschel.org>
-pgp.archreactor.org		11370 # Travis Megee <twmegee@seek42.net> 0xdd6017f142b7c552
-pgp.circl.lu			11370 # CIRCL - info@circl.lu - 0x22BD4CD5
-pgp.codelabs.ru			11370 # Eygene Ryabinkin <rea@codelabs.ru> 0x8152ECFB
-pgp.key-server.io		11370 # Carles Tubio <carles.tubio@key-server.io> 0xC3B39DE0
-pgpkeys.mallos.nl		11370 # Arnold Schekkerman <arnold@mallos.nl> 0xB66BBBAA
-pgpkeys.urown.net		11370 # Alain Wolf <keymaster@urown.net> 0x27A69FC9A1744242
-pgp.rediris.es			11370 # Francisco.monserrat <francisco.monserrat@rediris.es> 0xD3A42C61
-pgp.ustc.edu.cn			11370 # Shengjing Zhu <zsj950618@gmail.com> 0xCF0E265B7DFBB2F2
-pki.colliertech.org		11370 # C.J. Adams-Collier <cjac@uw.edu> 0x8E562765BA27A83C
-sks.bootc.eu			11370 # Chris Boot <sks@bootc.net> 0xF5C83C05D9CEEEEE
-sks.es.net			11370 # keymaster@es.net
-sks.es.net			11370 # Michael Sinatra <ms@es.net> 0x35F5A79B5B4EBA62
-sks.fidocon.de			11370 # unknown
-sks.karotte.org			11370 # Sebastian Wiesinger <sebastian@karotte.org> 0x93A0B9CE
-sks-peer.spodhuis.org		11370 # Phil Pennock <keyserver@spodhuis.org> 0x3903637F
-vanunu.calyxinstitute.org	11370
-zimmermann.mayfirst.org		11370 # Daniel Kahn Gillmor <dkg@fifthhorseman.net> 0xCCD2ED94D21739E9
diff --git a/roles/keyserver/files/robots.txt b/roles/keyserver/files/robots.txt
deleted file mode 100644
index ff804f19c4..0000000000
--- a/roles/keyserver/files/robots.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-User-agent: *
-Disallow: /pks/
diff --git a/roles/keyserver/files/sksconf b/roles/keyserver/files/sksconf
deleted file mode 100644
index d17b3d4ec5..0000000000
--- a/roles/keyserver/files/sksconf
+++ /dev/null
@@ -1,14 +0,0 @@
-basedir: /srv/sks
-#debuglevel: 10
-#debug:
-hostname: keys.fedoraproject.org
-hkp_address: 127.0.0.1
-hkp_port: 11371
-recon_port: 11370
-#gossip_interval: 1440
-stat_hour: 00
-initial_stat:
-membership_reload_interval: 1
-disable_mailsync:
-debuglevel: 4
-server_contact: 0x167B4A54236BBEAA37DCCD92ED14D5E7110810E9
diff --git a/roles/keyserver/handlers/main.yml b/roles/keyserver/handlers/main.yml
deleted file mode 100644
index 259ede782f..0000000000
--- a/roles/keyserver/handlers/main.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-- name: restart sks-db
-  service: name=sks-db state=restarted
-
-- name: restart sks-recon
-  service: name=sks-recon state=restarted
-
diff --git a/roles/keyserver/tasks/main.yml b/roles/keyserver/tasks/main.yml
deleted file mode 100644
index 8888b461b2..0000000000
--- a/roles/keyserver/tasks/main.yml
+++ /dev/null
@@ -1,101 +0,0 @@
----
-- name: install sks
-  package: name=sks state=present
-  tags:
-  - packages
-
-- name: install mod_ssl
-  package: name=mod_ssl state=present
-  tags:
-  - packages
-
-- name: /srv/sks
-  file: >
-    path=/srv/sks
-    state=directory
-    owner=sks group=sks mode=0755
-
-- name: /srv/sks/membership
-  copy: src="membership" dest=/srv/sks/membership owner=sks group=sks mode=0644
-  tags:
-  - config
-  - membership
-
-- name: /srv/sks/sksconf
-  copy: src="sksconf" dest=/srv/sks/sksconf owner=sks group=sks mode=0644
-  tags:
-  - config
-
-- name: /srv/sks/web
-  file: >
-    path=/srv/sks/web
-    state=directory
-    owner=sks group=sks mode=0755
-
-- name: /srv/sks/web/index.html
-  copy: src="index.html" dest=/srv/sks/web/index.html owner=sks group=sks mode=0644
-  tags:
-  - config
-
-- name: /srv/sks/web/css.css
-  copy: src="css.css" dest=/srv/sks/web/css.css owner=sks group=sks mode=0644
-  tags:
-  - config
-
-- name: /srv/sks/web/robots.txt
-  copy: src="robots.txt" dest=/srv/sks/web/robots.txt owner=sks group=sks mode=0644
-  tags:
-  - config
-
-- name: /etc/httpd/conf.d/sks.conf
-  template: src="sks.conf" dest=/etc/httpd/conf.d/sks.conf owner=root group=root mode=0644
-  tags:
-  - config
-  - sslciphers
-
-- name: /etc/httpd/conf.d/ssl.conf
-  template: src="ssl.conf" dest=/etc/httpd/conf.d/ssl.conf owner=root group=root mode=0644
-  tags:
-  - config
-  - sslciphers
-
-- name: /etc/pki/tls/keys_fedoraproject_org.crt.pem
-  copy: src="{{ private }}/files/httpd/keys_fedoraproject_org-2017.crt.pem" dest=/etc/pki/tls/keys_fedoraproject_org.crt.pem owner=root group=root mode=0600
-  tags:
-  - config
-
-- name: /etc/pki/tls/keys_fedoraproject_org.key
-  copy: src="{{ private }}/files/httpd/keys_fedoraproject_org-2017.key" dest=/etc/pki/tls/keys_fedoraproject_org.key owner=root group=root mode=0600
-  tags:
-  - config
-
-- cron: name="regenerate stats hourly"
-        hour="*"
-        minute="5"
-        job="pkill -f -n -SIGUSR2 'sks db'"
-        state=present
-
-- name: Set sks-db to run on boot
-  service: name=sks-db enabled=no
-  ignore_errors: true
-  notify:
-  - restart sks-db
-  tags:
-  - service
-
-- name: Set sks-recon to run on boot
-  service: name=sks-recon enabled=no
-  ignore_errors: true
-  notify:
-  - restart sks-recon
-  tags:
-  - service
-
-# Two tasks for handling our custom selinux module
-- name: copy over our custom selinux module
-  copy: src=keyserver.pp dest=/srv/sks/keyserver.pp
-  register: selinux_module
-
-- name: install our custom selinux module
-  command: semodule -i /srv/sks/keyserver.pp
-  when: selinux_module is changed
diff --git a/roles/keyserver/templates/sks.conf b/roles/keyserver/templates/sks.conf
deleted file mode 100644
index a9dcf2474c..0000000000
--- a/roles/keyserver/templates/sks.conf
+++ /dev/null
@@ -1,98 +0,0 @@
-ServerName keys.fedoraproject.org
-Listen 140.211.169.207:11371
-Listen [2605:bc80:3010:600:dead:beef:cafe:fedc]:11371
-NameVirtualHost *:443
-
-<ifModule !mod_proxy.c>
-    LoadModule proxy_module modules/mod_proxy.so
-</IfModule>
-
-<IfModule !mod_proxy_http.c>
-    LoadModule proxy_http_module modules/mod_proxy_http.so
-</IfModule>
-
-<IfModule !mod_proxy_balancer.c>
-    LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
-</IfModule>
-
-<IfModule !mod_headers.c>
-    LoadModule headers_module modules/mod_headers.so
-</IfModule>
-
-<IfModule !mod_authz_host.c>
-    LoadModule authz_host_module modules/mod_authz_host.so
-</IfModule>
-
-<IfModule !mod_log_config.c>
-    LoadModule log_config_module modules/mod_log_config.so
-</IfModule>
-
-<IfModule !mod_env.c>
-    LoadModule env_module modules/mod_env.so
-</IfModule>
-
-<Directory />
-    Options FollowSymLinks
-    AllowOverride None
-    Order deny,allow
-    Deny from all
-</Directory>
-
-<Directory /srv/web/acme-challenge/.well-known/>
-    require all granted
-    Allow from all
-</Directory>
-
-<VirtualHost *:80>
-        ServerAdmin sysadmin-keys-members@fedoraproject.org
-        ServerName keys.fedoraproject.org
-        RewriteEngine On
-        RewriteCond %{HTTPS} off
-        RewriteRule ^/\.well-known/(.*) /srv/web/acme-challenge/.well-known/$1 [L]
-        RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [NE]
-        Header always add Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-</VirtualHost>
-
-<VirtualHost *:443>
-        ServerAdmin sysadmin-keys-members@fedoraproject.org
-        ServerName keys.fedoraproject.org
-	ServerAlias keys01.fedoraproject.org
-        Header always add Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-
-        SSLEngine on
-        SSLCertificateFile    /etc/letsencrypt/live/keys.fedoraproject.org/cert.pem
-        SSLCertificateKeyFile /etc/letsencrypt/live/keys.fedoraproject.org/privkey.pem
-        SSLCertificateChainFile /etc/letsencrypt/live/keys.fedoraproject.org/fullchain.pem
-        SSLProtocol {{ ssl_protocols }}
-	SSLCipherSuite {{ ssl_ciphers }}
-
-	ProxyPass / http://pool.sks-keyservers.net:11371/
-	ProxyPassReverse / http://pool.sks-keyservers.net:11371/
-        SetEnv proxy-nokeepalive 1
-	ProxyVia Full
-</VirtualHost>
-#<VirtualHost *:443>
-#        ServerAdmin sysadmin-keys-members@fedoraproject.org
-#        ServerName pool.sks-keyservers.net
-#        ServerAlias sks-keyservers.net
-#	ServerAlias *.sks-keyservers.net
-#
-#        SSLEngine on
-#        SSLCertificateFile /etc/pki/tls/keys_fedoraproject_org.crt.pem
-#        SSLCertificateKeyFile /etc/pki/tls/keys_fedoraproject_org.key
-#	SSLProtocol {{ ssl_protocols }}
-#	SSLCipherSuite {{ ssl_ciphers }}
-#
-#        ProxyPass / http://localhost:11371/
-#        ProxyPassReverse / http://localhost:11371/
-#        SetEnv proxy-nokeepalive 1
-#	ProxyVia Full
-#</VirtualHost>
-<VirtualHost *:11371>
-	ServerAdmin sysadmin-keys-members@fedoraproject.org
-	ServerName keys.fedoraproject.org
-	ProxyPass / http://pool.sks-keyservers.net:11371/
-	ProxyPassReverse / http://pool.sks-keyservers.net:11371/
-	SetEnv proxy-nokeepalive 1
-	ProxyVia Full
-</VirtualHost>
diff --git a/roles/keyserver/templates/ssl.conf b/roles/keyserver/templates/ssl.conf
deleted file mode 100644
index dd9c7e791e..0000000000
--- a/roles/keyserver/templates/ssl.conf
+++ /dev/null
@@ -1,224 +0,0 @@
-#
-# This is the Apache server configuration file providing SSL support.
-# It contains the configuration directives to instruct the server how to
-# serve pages over an https connection. For detailing information about these 
-# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
-# 
-# Do NOT simply read the instructions in here without understanding
-# what they do.  They're here only as hints or reminders.  If you are unsure
-# consult the online docs. You have been warned.  
-#
-
-LoadModule ssl_module modules/mod_ssl.so
-
-#
-# When we also provide SSL we have to listen to the 
-# the HTTPS port in addition.
-#
-Listen 443
-
-##
-##  SSL Global Context
-##
-##  All SSL configuration in this context applies both to
-##  the main server and all SSL-enabled virtual hosts.
-##
-
-#   Pass Phrase Dialog:
-#   Configure the pass phrase gathering process.
-#   The filtering dialog program (`builtin' is a internal
-#   terminal dialog) has to provide the pass phrase on stdout.
-SSLPassPhraseDialog  builtin
-
-#   Inter-Process Session Cache:
-#   Configure the SSL Session Cache: First the mechanism 
-#   to use and second the expiring timeout (in seconds).
-SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
-SSLSessionCacheTimeout  300
-
-#   Semaphore:
-#   Configure the path to the mutual exclusion semaphore the
-#   SSL engine uses internally for inter-process synchronization. 
-#SSLMutex default
-
-#   Pseudo Random Number Generator (PRNG):
-#   Configure one or more sources to seed the PRNG of the 
-#   SSL library. The seed data should be of good random quality.
-#   WARNING! On some platforms /dev/random blocks if not enough entropy
-#   is available. This means you then cannot use the /dev/random device
-#   because it would lead to very long connection times (as long as
-#   it requires to make more entropy available). But usually those
-#   platforms additionally provide a /dev/urandom device which doesn't
-#   block. So, if available, use this one instead. Read the mod_ssl User
-#   Manual for more details.
-SSLRandomSeed startup file:/dev/urandom  256
-SSLRandomSeed connect builtin
-#SSLRandomSeed startup file:/dev/random  512
-#SSLRandomSeed connect file:/dev/random  512
-#SSLRandomSeed connect file:/dev/urandom 512
-
-#
-# Use "SSLCryptoDevice" to enable any supported hardware
-# accelerators. Use "openssl engine -v" to list supported
-# engine names.  NOTE: If you enable an accelerator and the
-# server does not start, consult the error logs and ensure
-# your accelerator is functioning properly. 
-#
-SSLCryptoDevice builtin
-#SSLCryptoDevice ubsec
-
-##
-## SSL Virtual Host Context
-##
-
-<VirtualHost _default_:443>
-
-# General setup for the virtual host, inherited from global configuration
-#DocumentRoot "/var/www/html"
-    #    ProxyPass / http://localhost:11371/
-     #   ProxyPassReverse / http://localhost:11371/
-#ServerName www.example.com:443
-
-# Use separate log files for the SSL virtual host; note that LogLevel
-# is not inherited from httpd.conf.
-ErrorLog logs/ssl_error_log
-TransferLog logs/ssl_access_log
-LogLevel warn
-
-#   SSL Engine Switch:
-#   Enable/Disable SSL for this virtual host.
-SSLEngine on
-
-#   SSL Protocol support:
-# List the enable protocol levels with which clients will be able to
-# connect.  Disable SSLv2 access by default:
-SSLProtocol {{ ssl_protocols }}
-
-#   SSL Cipher Suite:
-# List the ciphers that the client is permitted to negotiate.
-# See the mod_ssl documentation for a complete list.
-SSLCipherSuite {{ ssl_ciphers }}
-
-#   Server Certificate:
-# Point SSLCertificateFile at a PEM encoded certificate.  If
-# the certificate is encrypted, then you will be prompted for a
-# pass phrase.  Note that a kill -HUP will prompt again.  A new
-# certificate can be generated using the genkey(1) command.
-SSLCertificateFile /etc/pki/tls/keys_fedoraproject_org.crt.pem
-
-#   Server Private Key:
-#   If the key is not combined with the certificate, use this
-#   directive to point at the key file.  Keep in mind that if
-#   you've both a RSA and a DSA private key you can configure
-#   both in parallel (to also allow the use of DSA ciphers, etc.)
-SSLCertificateKeyFile /etc/pki/tls/keys_fedoraproject_org.key
-
-#   Server Certificate Chain:
-#   Point SSLCertificateChainFile at a file containing the
-#   concatenation of PEM encoded CA certificates which form the
-#   certificate chain for the server certificate. Alternatively
-#   the referenced file can be the same as SSLCertificateFile
-#   when the CA certificates are directly appended to the server
-#   certificate for convinience.
-#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
-
-#   Certificate Authority (CA):
-#   Set the CA certificate verification path where to find CA
-#   certificates for client authentication or alternatively one
-#   huge file containing all of them (file must be PEM encoded)
-#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
-
-#   Client Authentication (Type):
-#   Client certificate verification type and depth.  Types are
-#   none, optional, require and optional_no_ca.  Depth is a
-#   number which specifies how deeply to verify the certificate
-#   issuer chain before deciding the certificate is not valid.
-#SSLVerifyClient require
-#SSLVerifyDepth  10
-
-#   Access Control:
-#   With SSLRequire you can do per-directory access control based
-#   on arbitrary complex boolean expressions containing server
-#   variable checks and other lookup directives.  The syntax is a
-#   mixture between C and Perl.  See the mod_ssl documentation
-#   for more details.
-#<Location />
-#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
-#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
-#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
-#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
-#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
-#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
-#</Location>
-
-#   SSL Engine Options:
-#   Set various options for the SSL engine.
-#   o FakeBasicAuth:
-#     Translate the client X.509 into a Basic Authorisation.  This means that
-#     the standard Auth/DBMAuth methods can be used for access control.  The
-#     user name is the `one line' version of the client's X.509 certificate.
-#     Note that no password is obtained from the user. Every entry in the user
-#     file needs this password: `xxj31ZMTZzkVA'.
-#   o ExportCertData:
-#     This exports two additional environment variables: SSL_CLIENT_CERT and
-#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
-#     server (always existing) and the client (only existing when client
-#     authentication is used). This can be used to import the certificates
-#     into CGI scripts.
-#   o StdEnvVars:
-#     This exports the standard SSL/TLS related `SSL_*' environment variables.
-#     Per default this exportation is switched off for performance reasons,
-#     because the extraction step is an expensive operation and is usually
-#     useless for serving static content. So one usually enables the
-#     exportation for CGI and SSI requests only.
-#   o StrictRequire:
-#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
-#     under a "Satisfy any" situation, i.e. when it applies access is denied
-#     and no other module can change it.
-#   o OptRenegotiate:
-#     This enables optimized SSL connection renegotiation handling when SSL
-#     directives are used in per-directory context. 
-#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
-<Files ~ "\.(cgi|shtml|phtml|php3?)$">
-    SSLOptions +StdEnvVars
-</Files>
-<Directory "/var/www/cgi-bin">
-    SSLOptions +StdEnvVars
-</Directory>
-
-#   SSL Protocol Adjustments:
-#   The safe and default but still SSL/TLS standard compliant shutdown
-#   approach is that mod_ssl sends the close notify alert but doesn't wait for
-#   the close notify alert from client. When you need a different shutdown
-#   approach you can use one of the following variables:
-#   o ssl-unclean-shutdown:
-#     This forces an unclean shutdown when the connection is closed, i.e. no
-#     SSL close notify alert is send or allowed to received.  This violates
-#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
-#     this when you receive I/O errors because of the standard approach where
-#     mod_ssl sends the close notify alert.
-#   o ssl-accurate-shutdown:
-#     This forces an accurate shutdown when the connection is closed, i.e. a
-#     SSL close notify alert is send and mod_ssl waits for the close notify
-#     alert of the client. This is 100% SSL/TLS standard compliant, but in
-#     practice often causes hanging connections with brain-dead browsers. Use
-#     this only for browsers where you know that their SSL implementation
-#     works correctly. 
-#   Notice: Most problems of broken clients are also related to the HTTP
-#   keep-alive facility, so you usually additionally want to disable
-#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
-#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
-#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
-#   "force-response-1.0" for this.
-SetEnvIf User-Agent ".*MSIE.*" \
-         nokeepalive ssl-unclean-shutdown \
-         downgrade-1.0 force-response-1.0
-
-#   Per-Server Logging:
-#   The home of a custom SSL log file. Use this when you want a
-#   compact non-error SSL logfile on a virtual host basis.
-CustomLog logs/ssl_request_log \
-          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
-
-</VirtualHost>                                  
-