Add immich vm, changes

4 files changed, 57 insertions, 1 deletions

diff --git a/playbook.yml b/playbook.yml
index 93b4cb1..4314060 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -30,8 +30,8 @@
       - { userland: "{{ jail_userland_14_3 }}", num: 6, name: hommabot }
       - { userland: "{{ jail_userland_14_3 }}", num: 7, name: aggro }
       - { userland: "{{ jail_userland_14_3 }}", num: 8, name: diddle }
+      - { userland: "{{ jail_userland_15_0 }}", num: 9, name: redis }
       - { userland: "{{ jail_userland_14_3 }}", num: 11, name: spliit }
-      - { userland: "{{ jail_userland_15_0 }}", num: 13, name: immich }
       - { userland: "{{ jail_userland_14_3 }}", num: 14, name: freshrss }
       - { userland: "{{ jail_userland_14_3 }}", num: 15, name: paste }
     ingress_routes:
@@ -44,6 +44,7 @@
       - { host: irc.jan.systems, jail: irc_thelounge }
       - { host: goaccess.jan.systems, static: /var/www/goaccess }
       - { host: paste.jan.systems, jail: paste }
+      - { host: immich.jan.systems, ip: 192.168.3.3, port: 2283 } # vms aren't configured in ansible
     cert_domains:
       - "jan.systems"
       - "*.jan.systems"
diff --git a/tasks/general.yml b/tasks/general.yml
index 87e5a54..b8d3f45 100644
--- a/tasks/general.yml
+++ b/tasks/general.yml
@@ -10,6 +10,7 @@
     - bash
     - python
     - py311-pip
+    - vm-bhyve
 
 - name: Set up periodic.conf
   template:
@@ -126,3 +127,18 @@
     owner: root
     group: wheel
     mode: "0755"
+
+- name: Check if zroot/vm exists
+  shell: zfs list zroot/vm
+  register: zroot_vm_check
+  failed_when: false
+  changed_when: false
+
+- name: Add vm dataset for bhyve and init
+  when: zroot_vm_check.rc != 0
+  block:
+    - name: Create vm dataset
+      shell: zfs create zroot/vm
+
+    - name: Run vm init
+      shell: vm init
diff --git a/templates/etc_rc.conf.j2 b/templates/etc_rc.conf.j2
index 03b5d10..5df2d7c 100644
--- a/templates/etc_rc.conf.j2
+++ b/templates/etc_rc.conf.j2
@@ -31,3 +31,5 @@ clear_tmp_enable="YES"
 cleanvar_enable="YES"
 auditd_enable="YES"
 devd_enable="YES"
+vm_enable="YES"
+vm_dir="zfs:zroot/vm"
diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
index c568a7f..e6e35b2 100644
--- a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
+++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
@@ -109,6 +109,43 @@ http {
             index index.html;
         }
     }
+    {% elif route.ip is defined -%}
+    server {
+        server_name {{ route.host }};
+        http2 on;
+
+        listen 443 ssl;
+        listen [::]:443 ssl;
+
+        # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
+        add_header Strict-Transport-Security "max-age=63072000" always;
+
+        ssl_certificate /usr/local/etc/letsencrypt/live/{{ cert_name }}/fullchain.pem;
+        ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ cert_name }}/privkey.pem;
+        include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
+        ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
+
+        location / {
+            proxy_pass http://{{ route.ip }}:{{ route.port }};
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            # TODO: these shouldn't configured for all ip:port proxies but Immich needs them
+            proxy_http_version 1.1;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Upgrade $http_upgrade;
+
+            # by default nginx times out connections in one minute
+            proxy_read_timeout 1d;
+            proxy_send_timeout 1d;
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            client_max_body_size 10G;
+        }
+    }
     {% endif %}
     {% endfor %}
 }