Flavor: foreman-proxy-content

[arvind4501]

Why are you introducing these changes? (Problem description, related links)

What are the changes introduced in this pull request?

• Add deploy-proxy sub-command to deploy proxy specific flavors(ex: foreman-proxy-content)
• Add proxy specific parameters to deploy-proxy ex: certs tar file and foreman fqdn
• Make health checks, post-install tasks, and pull-images flavor-aware instead of hardcoded to katello
• Support certificate extraction from tar bundles on proxy nodes
• Add httpd vhosts for proxying Pulp content and RHSM requests
• Add flavor-specific test directories, --flavor pytest option, and proxy CI job
• Refactor deploy metadata into reusable obsah includes (_foreman, _foreman_proxy, _pulp, _flavors/katello)

How to test this pull request

• ./foremanctl deploy

• ./foremanctl certificate-bundle proxy.example.com to generate bundle

• ./foremanctl deploy-proxy --flavor foreman-proxy-content --certificate-bundle /path-to-tar --foreman-fqdn quadlet.example.com

• Observe only relevent services are deployed

Steps to reproduce:

• ./foremanctl deploy-proxy --flavor foreman-proxy-content --certificate-bundle /path-to-tar --foreman-fqdn quadlet.example.com

Checklist

• Tests added/updated (if applicable)
• Documentation updated (if applicable)

[ehelms]

There are definitely some good nuggets of changes that would make for good, go-ahead, stand-alone PRs to get added. This also points to the need for flavor specific parameters that are only shown for a given flavor.

[arvind4501]

I have been facing one issue which i already have a workaround implemented but i wanted to know if we should solve it properly?

so we have a static quadlet target in our playbooks(which may be fine for today as it points to localhost), but in CI and development we need to deploy on different servers not localhost. currently the workaround is to pass a extra var in command and use that to determine the host.

What about exposting a --target obsah option to manage that, but the issue is its visible to users

[Gauravtalreja1]

ACK, tested with foremanctl-3.0.0.develop-2.20260701164348391310.pr571.89.g56349d9.el9.noarch 🍏

Tested deploy-proxy with foreman-proxy-content flavor on a two-node setup (quadlet + proxy).

Certificate sources tested:

• Default (internal CA)
• Custom server certificates (generated via Robottelo scripts)

Validated:

• Proxy deploys successfully with both cert sources
• Only expected services running on proxy (pulp-api, pulp-content, pulp-worker, postgresql, valkey, httpd, foreman-proxy) (no foreman, candlepin, or dynflow)
• PostgreSQL has only pulp database and user on proxy (no foreman/candlepin)
• HTTPS endpoints working: /pulp/api/v3/status/ (200), /pulp/content/ (200), /rhsm (proxied to server), /katello/api/v2/repositories/ (proxied to server)
• Pulp mirror mode enabled on proxy (mirror: true, client_authentication: ["client_certificate"])
• Smart proxy capabilities include all expected features (core, smart_proxy, rpm, deb, ansible, python, container, file, certguard)
• Trusted hosts includes only foreman server FQDN

Issues found:

• #613
• #614