Restructure after 15.1 update

11 files changed, 186 insertions, 162 deletions

diff --git a/inventory/prod/hosts.yml b/inventory/prod/hosts.yml
index 1a2a83f..c6f5fa9 100644
--- a/inventory/prod/hosts.yml
+++ b/inventory/prod/hosts.yml
@@ -10,6 +10,7 @@ all:
           nic_wan: igc1
           lan_ipv4_gateway: "192.168.0.1"
           lan_ipv4_cidr: "192.168.0.10/16"
+          poudriere_repo_ip: "192.168.2.21"
           is_prod: true
     jails:
       vars:
diff --git a/inventory/test/hosts.yml b/inventory/test/hosts.yml
index b03dcfc..d9f5bfb 100644
--- a/inventory/test/hosts.yml
+++ b/inventory/test/hosts.yml
@@ -15,6 +15,7 @@ all:
           dns_nameserver: "10.0.20.1"
           lan_ipv4_gateway: "10.0.20.1"
           lan_ipv4_cidr: "10.0.20.2/24"
+          poudriere_repo_ip: "10.0.20.121"
           is_prod: false
     jails:
       vars:
diff --git a/roles/host/tasks/main.yml b/roles/host/tasks/main.yml
index 4bcdfdd..86e33cf 100644
--- a/roles/host/tasks/main.yml
+++ b/roles/host/tasks/main.yml
@@ -14,7 +14,7 @@
 
 - name: Set FreeBSD version fact
   set_fact:
-    poudriere_freebsd_version: "{{ _freebsd_version_result.stdout }}"
+    poudriere_freebsd_version: "{{ _freebsd_version_result.stdout | regex_replace('-p[0-9]+$', '') }}"
 
 - name: Disable resolvconf
   copy:
@@ -110,13 +110,6 @@
     group: wheel
     mode: "0755"
 
-- name: Deploy poudriere-start-build script
-  template:
-    src: usr_local_bin_poudriere_start_build.sh.j2
-    dest: /usr/local/bin/poudriere-start-build
-    owner: root
-    group: wheel
-    mode: "0755"
 
 - name: Check if quarterly ports tree exists
   stat:
@@ -135,113 +128,6 @@
 - name: Download custom ports overlay
   shell: /usr/local/bin/update-ports custom
   when: _custom_exists.stdout == ""
-
-# Poudriere setup
-- name: Deploy poudriere.conf
-  template:
-    src: usr_local_etc_poudriere.conf.j2
-    dest: /usr/local/etc/poudriere.conf
-    owner: root
-    group: wheel
-    mode: "0644"
-  vars:
-    pkg_abi: "FreeBSD:{{ poudriere_freebsd_version.split('.')[0] }}:{{ arch.split('/')[1] }}"
-
-- name: Create distfiles directory
-  file:
-    path: /usr/local/poudriere/distfiles
-    state: directory
-    owner: root
-    group: wheel
-    mode: "0755"
-
-- name: Check if poudriere jail exists
-  shell: poudriere jail -l -n | grep -q "^poudriere_build$"
-  failed_when: false
-  changed_when: false
-  register: _poudriere_jail_exists
-
-- name: Create poudriere jail
-  shell: poudriere jail -c -j poudriere_build -v {{ poudriere_freebsd_version }} -m tar=/usr/local/jails/media/{{ poudriere_freebsd_version }}-base.txz
-  when: _poudriere_jail_exists.rc != 0
-
-- name: Check if poudriere quarterly ports tree is registered
-  shell: poudriere ports -l -n | grep -q "^quarterly$"
-  failed_when: false
-  changed_when: false
-  register: _poudriere_quarterly_exists
-
-- name: Register quarterly ports tree with poudriere
-  shell: poudriere ports -c -p quarterly -m null -M /usr/ports/quarterly
-  when: _poudriere_quarterly_exists.rc != 0
-
-- name: Check if poudriere custom overlay is registered
-  shell: poudriere ports -l -n | grep -q "^custom$"
-  failed_when: false
-  changed_when: false
-  register: _poudriere_custom_exists
-
-- name: Register custom overlay with poudriere
-  shell: poudriere ports -c -p custom -m null -M /usr/ports/custom
-  when: _poudriere_custom_exists.rc != 0
-
-- name: Deploy poudriere package list
-  template:
-    src: usr_local_etc_poudriere_pkglist.j2
-    dest: /usr/local/etc/poudriere-pkglist
-    owner: root
-    group: wheel
-    mode: "0644"
-
-- name: Deploy poudriere build make.conf
-  template:
-    src: poudriere_build_make.conf.j2
-    dest: /usr/local/etc/poudriere.d/poudriere_build-make.conf
-    owner: root
-    group: wheel
-    mode: "0644"
-
-# Repo validation gate
-- name: Check if poudriere repo has packages
-  stat:
-    path: "/usr/local/poudriere/data/packages/poudriere_build-quarterly/meta.pkg"
-  register: _poudriere_repo
-
-- name: "*** POUDRIERE REPO NOT READY ***"
-  fail:
-    msg: |
-      ════════════════════════════════════════════════════════════════
-        POUDRIERE REPOSITORY NOT READY
-      ════════════════════════════════════════════════════════════════
-        The local package repository has not been built yet.
-        Run the following command on the host to build packages:
-
-          poudriere bulk -j poudriere_build -p quarterly -O custom -f /usr/local/etc/poudriere-pkglist
-
-        Then re-run this playbook.
-      ════════════════════════════════════════════════════════════════
-  when: not _poudriere_repo.stat.exists
-
-# Configure local repo
-- name: Create pkg repos directory
-  file:
-    path: /usr/local/etc/pkg/repos
-    state: directory
-    owner: root
-    group: wheel
-    mode: "0755"
-
-- name: Deploy local poudriere repo config
-  copy:
-    content: |
-      poudriere: {
-        url: "http://{{ jail_lan_cidr | ipv4_nth(21 + jail_lan_offset | int) }}/packages",
-        enabled: no
-      }
-    dest: /usr/local/etc/pkg/repos/poudriere.conf
-    owner: root
-    group: wheel
-    mode: "0644"
 - name: Discover jail directories
   find:
     paths: "{{ playbook_dir }}/roles/jails"
@@ -284,27 +170,6 @@
   loop_control:
     label: "{{ item.name }}"
 
-- name: Install custom packages from poudriere
-  shell: "pkg install -y -r poudriere pylogsentinel"
-  register: _custom_pkg
-  changed_when: "'Number of packages to be installed' in _custom_pkg.stdout"
-
-- name: Deploy pylogsentinel.conf
-  template:
-    src: usr_local_etc_pylogsentinel.conf.j2
-    dest: /usr/local/etc/pylogsentinel.conf
-    owner: root
-    group: wheel
-    mode: "0644"
-
-- name: Deploy pylogsentinel-batch-email.sh
-  template:
-    src: usr_local_bin_pylogsentinel-batch-email.sh.j2
-    dest: /usr/local/bin/pylogsentinel-batch-email.sh
-    owner: root
-    group: wheel
-    mode: "0755"
-
 - name: Create storage group
   group:
     name: storage
@@ -372,3 +237,48 @@
     group: wheel
     mode: "0644"
   notify: Restart cron
+
+- name: Set up poudriere
+  include_tasks: poudriere.yml
+
+# Repo validation gate
+- name: Check if poudriere repo has packages
+  stat:
+    path: "/usr/local/poudriere/data/packages/poudriere_build-quarterly/meta"
+  register: _poudriere_repo
+
+- name: "*** POUDRIERE REPO NOT READY ***"
+  fail:
+    msg: |
+      ════════════════════════════════════════════════════════════════
+        POUDRIERE REPOSITORY NOT READY
+      ════════════════════════════════════════════════════════════════
+        The local package repository has not been built yet.
+        Run the following command on the host to build packages:
+
+          poudriere bulk -j poudriere_build -p quarterly -O custom -f /usr/local/etc/poudriere-pkglist
+
+        Then re-run this playbook.
+      ════════════════════════════════════════════════════════════════
+  when: not _poudriere_repo.stat.exists
+
+- name: Install custom packages from poudriere
+  shell: "pkg install -y -r poudriere pylogsentinel"
+  register: _custom_pkg
+  changed_when: "'Number of packages to be installed' in _custom_pkg.stdout"
+
+- name: Deploy pylogsentinel.conf
+  template:
+    src: usr_local_etc_pylogsentinel.conf.j2
+    dest: /usr/local/etc/pylogsentinel.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+
+- name: Deploy pylogsentinel-batch-email.sh
+  template:
+    src: usr_local_bin_pylogsentinel-batch-email.sh.j2
+    dest: /usr/local/bin/pylogsentinel-batch-email.sh
+    owner: root
+    group: wheel
+    mode: "0755"
diff --git a/roles/host/tasks/poudriere.yml b/roles/host/tasks/poudriere.yml
new file mode 100644
index 0000000..83098b7
--- /dev/null
+++ b/roles/host/tasks/poudriere.yml
@@ -0,0 +1,93 @@
+# Poudriere setup
+- name: Deploy poudriere.conf
+  template:
+    src: usr_local_etc_poudriere.conf.j2
+    dest: /usr/local/etc/poudriere.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+  vars:
+    pkg_abi: "FreeBSD:{{ poudriere_freebsd_version.split('.')[0] }}:{{ arch.split('/')[1] }}"
+
+- name: Create distfiles directory
+  file:
+    path: /usr/local/poudriere/distfiles
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Check if poudriere jail exists
+  shell: poudriere jail -l -n | grep -q "^poudriere_build$"
+  failed_when: false
+  changed_when: false
+  register: _poudriere_jail_exists
+
+- name: Create poudriere jail
+  shell: poudriere jail -c -j poudriere_build -v {{ poudriere_freebsd_version }} -m tar=/usr/local/jails/media/{{ poudriere_freebsd_version }}-base.txz
+  when: _poudriere_jail_exists.rc != 0
+
+- name: Check if poudriere quarterly ports tree is registered
+  shell: poudriere ports -l -n | grep -q "^quarterly$"
+  failed_when: false
+  changed_when: false
+  register: _poudriere_quarterly_exists
+
+- name: Register quarterly ports tree with poudriere
+  shell: poudriere ports -c -p quarterly -m null -M /usr/ports/quarterly
+  when: _poudriere_quarterly_exists.rc != 0
+
+- name: Check if poudriere custom overlay is registered
+  shell: poudriere ports -l -n | grep -q "^custom$"
+  failed_when: false
+  changed_when: false
+  register: _poudriere_custom_exists
+
+- name: Register custom overlay with poudriere
+  shell: poudriere ports -c -p custom -m null -M /usr/ports/custom
+  when: _poudriere_custom_exists.rc != 0
+
+- name: Deploy poudriere package list
+  template:
+    src: usr_local_etc_poudriere_pkglist.j2
+    dest: /usr/local/etc/poudriere-pkglist
+    owner: root
+    group: wheel
+    mode: "0644"
+
+- name: Deploy poudriere-start-build script
+  template:
+    src: usr_local_bin_poudriere_start_build.sh.j2
+    dest: /usr/local/bin/poudriere-start-build
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Deploy poudriere build make.conf
+  template:
+    src: poudriere_build_make.conf.j2
+    dest: /usr/local/etc/poudriere.d/poudriere_build-make.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+
+# Configure local repo
+- name: Create pkg repos directory
+  file:
+    path: /usr/local/etc/pkg/repos
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Deploy local poudriere repo config
+  copy:
+    content: |
+      poudriere: {
+        url: "http://{{ poudriere_repo_ip }}/packages",
+        enabled: no
+      }
+    dest: /usr/local/etc/pkg/repos/poudriere.conf
+    owner: root
+    group: wheel
+    mode: "0644"
diff --git a/roles/host/tasks/userland.yml b/roles/host/tasks/userland.yml
index 59de0dd..535b6d5 100644
--- a/roles/host/tasks/userland.yml
+++ b/roles/host/tasks/userland.yml
@@ -44,7 +44,7 @@
         create: true
 
     - name: Update userland
-      shell: "freebsd-update -b /usr/local/jails/templates/{{ userland }}/ fetch install"
+      shell: "freebsd-update -b /usr/local/jails/templates/{{ userland }}/ --currently-running {{ userland }} fetch install"
 
     - name: Disable syslogd
       lineinfile:
diff --git a/roles/host_prod/tasks/main.yml b/roles/host_prod/tasks/main.yml
index 9be1296..b6cd8e7 100644
--- a/roles/host_prod/tasks/main.yml
+++ b/roles/host_prod/tasks/main.yml
@@ -12,12 +12,12 @@
 - name: Flush handlers
   meta: flush_handlers
 
-- name: Install hardware packages
-  package:
-    name: "{{ item }}"
-    state: present
-  loop:
-    - vm-bhyve
+# - name: Install hardware packages
+#   package:
+#     name: "{{ item }}"
+#     state: present
+#   loop:
+#     - vm-bhyve
 
 - name: Set up fstab
   template:
@@ -28,21 +28,21 @@
     mode: "0644"
   notify: Mount filesystems
 
-- name: Set up bhyve
-  block:
-    - name: Create vm dataset
-      community.general.zfs:
-        name: zroot/vm
-        state: present
+# - name: Set up bhyve
+#   block:
+#     - name: Create vm dataset
+#       community.general.zfs:
+#         name: zroot/vm
+#         state: present
 
-    - name: Check if vm-bhyve is initialized
-      stat:
-        path: /zroot/vm/.config
-      register: vm_init_check
+    # - name: Check if vm-bhyve is initialized
+    #   stat:
+    #     path: /zroot/vm/.config
+    #   register: vm_init_check
 
-    - name: Run vm init
-      shell: vm init
-      when: not vm_init_check.stat.exists
+    # - name: Run vm init
+    #   shell: vm init
+    #   when: not vm_init_check.stat.exists
 
 - name: Copy backup SSH private key
   copy:
diff --git a/roles/jail/tasks/jail_setup.yml b/roles/jail/tasks/jail_setup.yml
index c09564d..931133f 100644
--- a/roles/jail/tasks/jail_setup.yml
+++ b/roles/jail/tasks/jail_setup.yml
@@ -140,6 +140,15 @@
     - "userland + '@base' not in jail_origin.stdout"
   delegate_to: "{{ jail_delegate_host }}"
 
+- name: "Unmount any remaining mounts inside {{ jail_name }} container"
+  shell: |
+    mount | awk '$3 ~ "^/usr/local/jails/containers/{{ jail_name }}/" {print $3}' | sort -r | xargs -I{} umount -f {} 2>/dev/null || true
+  when:
+    - jail_exists.rc == 0
+    - jail_origin.stdout is defined
+    - "userland + '@base' not in jail_origin.stdout"
+  delegate_to: "{{ jail_delegate_host }}"
+
 - name: "Migrate {{ jail_name }} to {{ userland }}"
   shell: |
     zfs rename zroot/jails/containers/{{ jail_name }} zroot/jails/containers/{{ jail_name }}.old.$(date +%s)
@@ -262,7 +271,7 @@
   copy:
     content: |
       poudriere: {
-        url: "http://{{ jail_lan_cidr | ipv4_nth(21 + jail_lan_offset | int) }}/packages",
+        url: "http://{{ hostvars[jail_delegate_host]['poudriere_repo_ip'] }}/packages",
         enabled: no,
         priority: 100
       }
diff --git a/roles/jails/01_ingress/defaults/main.yml b/roles/jails/01_ingress/defaults/main.yml
index e507905..1527cd9 100644
--- a/roles/jails/01_ingress/defaults/main.yml
+++ b/roles/jails/01_ingress/defaults/main.yml
@@ -1,4 +1,4 @@
-userland: "15.0-RELEASE"
+userland: "15.1-RELEASE"
 devfs_ruleset: 6
 no_default_route: true
 
@@ -21,7 +21,6 @@ ingress_routes:
   - { host: immich.jan.systems, jail: immich, presets: [large_body_size] }
   - { host: plex.jan.systems, jail: plex, port: 32400, presets: [streaming] }
   - { host: komga.jan.systems, jail: komga }
-  - { host: goaccess.jan.systems, jail: goaccess }
   - { host: poudriere.jan.systems, jail: poudriere_repo }
 
 cert_domains:
@@ -49,8 +48,6 @@ pkg:
 files:
   - src: etc_pf.conf.j2
     dest: /etc/pf.conf
-  - src: usr_local_etc_nginx_nginx.conf.j2
-    dest: /usr/local/etc/nginx/nginx.conf
   - src: acme-dns-auth.py
     dest: /usr/local/bin/acme-dns-auth.py
     mode: "0755"
diff --git a/roles/jails/01_ingress/handlers/main.yml b/roles/jails/01_ingress/handlers/main.yml
new file mode 100644
index 0000000..1819a68
--- /dev/null
+++ b/roles/jails/01_ingress/handlers/main.yml
@@ -0,0 +1,4 @@
+- name: Reload nginx
+  service:
+    name: nginx
+    state: reloaded
diff --git a/roles/jails/01_ingress/tasks/main.yml b/roles/jails/01_ingress/tasks/main.yml
index 15992bd..a6fdc3c 100644
--- a/roles/jails/01_ingress/tasks/main.yml
+++ b/roles/jails/01_ingress/tasks/main.yml
@@ -38,6 +38,15 @@
     name: jail
     tasks_from: jail_setup
 
+- name: Deploy nginx config
+  template:
+    src: "{{ jail_role_dir }}/templates/usr_local_etc_nginx_nginx.conf.j2"
+    dest: /usr/local/etc/nginx/nginx.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+  notify: Reload nginx
+
 - name: Check if TLS certs exist
   stat:
     path: "/usr/local/etc/letsencrypt/live/{{ cert_name }}"
diff --git a/roles/jails/21_poudriere_repo/defaults/main.yml b/roles/jails/21_poudriere_repo/defaults/main.yml
index 108c494..6b774d4 100644
--- a/roles/jails/21_poudriere_repo/defaults/main.yml
+++ b/roles/jails/21_poudriere_repo/defaults/main.yml
@@ -1,4 +1,4 @@
-userland: "15.0-RELEASE"
+userland: "15.1-RELEASE"
 
 nullfs:
   - src: /usr/local/share/poudriere/html