config = dict(
    sign_messages={{fedmsg_sign_messages}},
    validate_signatures={{fedmsg_validate_signatures}},
    ssldir="/etc/pki/fedmsg",

    {% if env == 'staging' %}
    ca_cert_location="https://stg.fedoraproject.org/fedmsg/ca.crt",
    crl_location="https://stg.fedoraproject.org/fedmsg/crl.pem",
    {% else %}
    ca_cert_location="https://fedoraproject.org/fedmsg/ca.crt",
    crl_location="https://fedoraproject.org/fedmsg/crl.pem",
    {% endif %}
    crl_cache="/var/run/fedmsg/crl.pem",
    crl_cache_expiry=86400,  # Daily

    certnames=dict([
    # This is the set of certs for this host, dynamically generated from the
    # ``fedmsg_certs`` host vars
    {% for cert in fedmsg_certs %}
    ("{{cert.get('alias', cert['service'])}}.{{inventory_hostname_short}}", "{{cert['service']}}-{{fedmsg_fqdn | default(inventory_hostname)}}"),
    {% endfor %}
] + [
        ("shell.anitya-frontend01", "shell-anitya-frontend01.vpn.fedoraproject.org"),
        ("anitya.anitya-frontend01", "anitya-anitya-frontend01.vpn.fedoraproject.org"),
        ("shell.anitya-backend01", "shell-anitya-backend01.vpn.fedoraproject.org"),
        ("anitya.anitya-backend01", "anitya-anitya-backend01.vpn.fedoraproject.org"),

        # FAF/retrace is on the qa network and talks to an inbound relay.
        ("shell.retrace01", "shell-retrace01.qa.fedoraproject.org"),
        ("faf.retrace01", "faf-retrace01.qa.fedoraproject.org"),

        # This is for the copr backend, which is a little different.  The
        # "cert-prefix" is just "copr", and is hardcoded in
        # backend/dispatcher.py.  The hostname is also a little different,
        # since it is an openstack node.  This might be a little fragile.  :/
        # See https://github.com/fedora-infra/fedmsg/issues/199 for the plan.
        ("copr.dhcp-client03", "copr-copr-be.cloud.fedoraproject.org"),
        ("copr.copr-be-i-00000407", "copr-copr-be.cloud.fedoraproject.org"),
        ("copr.copr-be", "copr-copr-be.cloud.fedoraproject.org"),
    ]),
)

