Fix postgres

15 files changed, 212 insertions, 106 deletions

diff --git a/ports/pylogsentinel/Makefile b/ports/pylogsentinel/Makefile
new file mode 100644
index 0000000..20224b1
--- /dev/null
+++ b/ports/pylogsentinel/Makefile
@@ -0,0 +1,19 @@
+PORTNAME=	pylogsentinel
+PORTVERSION=	0.3.1
+CATEGORIES=	sysutils python
+MASTER_SITES=	PYPI
+PKGNAMEPREFIX=	${PYTHON_PKGNAMEPREFIX}
+
+MAINTAINER=	jan@jantuomi.fi
+COMMENT=	Lightweight cron-friendly log monitoring utility
+
+LICENSE=	MIT
+
+BUILD_DEPENDS=	${PYTHON_PKGNAMEPREFIX}setuptools>=0:devel/py-setuptools@${PY_FLAVOR}
+
+USES=		python
+USE_PYTHON=	autoplist pep517
+
+NO_ARCH=	yes
+
+.include <bsd.port.mk>
diff --git a/ports/pylogsentinel/distinfo b/ports/pylogsentinel/distinfo
new file mode 100644
index 0000000..4171f3b
--- /dev/null
+++ b/ports/pylogsentinel/distinfo
@@ -0,0 +1,3 @@
+TIMESTAMP = 1747478400
+SHA256 (pylogsentinel-0.3.1.tar.gz) = 229c12e9925c29569b7f118f47bffa867c789624bd41df19d76611be401d0fdb
+SIZE (pylogsentinel-0.3.1.tar.gz) = 15257
diff --git a/ports/pylogsentinel/pkg-descr b/ports/pylogsentinel/pkg-descr
new file mode 100644
index 0000000..dab5b1d
--- /dev/null
+++ b/ports/pylogsentinel/pkg-descr
@@ -0,0 +1,2 @@
+Lightweight cron-friendly log monitoring utility with regex rules
+and per-rule shell actions.
diff --git a/roles/host/tasks/main.yml b/roles/host/tasks/main.yml
index 7f2567c..d1f710e 100644
--- a/roles/host/tasks/main.yml
+++ b/roles/host/tasks/main.yml
@@ -16,7 +16,7 @@
 
 - name: Install packages
   package:
-    name: "{{ item }}"
+    name: "{{ pkg_name }}"
     state: present
   loop:
     - rsync
@@ -24,9 +24,13 @@
     - jq
     - curl
     - bash
+    - git
     - python
     - py311-pip
+    - py311-wheel
     - fastfetch
+  loop_control:
+    loop_var: pkg_name
 
 - name: Set up sshd
   template:
@@ -42,40 +46,6 @@
     name: sshd
     state: started
 
-- name: Deploy logto script
-  template:
-    src: usr_local_bin_logto.sh.j2
-    dest: /usr/local/bin/logto
-    owner: root
-    group: wheel
-    mode: "0755"
-
-- name: Check if pylogsentinel is installed
-  shell: pip show pylogsentinel
-  register: pylogsentinel_check
-  failed_when: false
-  changed_when: false
-
-- name: Install pylogsentinel
-  shell: pip install pylogsentinel==0.3.0 --force --no-input
-  when: pylogsentinel_check.rc != 0
-
-- name: Deploy pylogsentinel.conf
-  template:
-    src: usr_local_etc_pylogsentinel.conf.j2
-    dest: /usr/local/etc/pylogsentinel.conf
-    owner: root
-    group: wheel
-    mode: "0644"
-
-- name: Deploy pylogsentinel-batch-email.sh
-  template:
-    src: usr_local_bin_pylogsentinel-batch-email.sh.j2
-    dest: /usr/local/bin/pylogsentinel-batch-email.sh
-    owner: root
-    group: wheel
-    mode: "0755"
-
 - name: Start syslogd
   service:
     name: syslogd
@@ -94,15 +64,6 @@
     group: wheel
     mode: "0644"
 
-- name: Set up crontab
-  template:
-    src: etc_crontab.j2
-    dest: /etc/crontab
-    owner: root
-    group: wheel
-    mode: "0644"
-  notify: Restart cron
-
 - name: Install .bashrc
   copy:
     src: root_bashrc
@@ -112,6 +73,15 @@
     mode: "0644"
 
 # Jail infrastructure
+- name: Fetch ports tree
+  shell: |
+    if [ ! -d /usr/ports/.git ]; then
+      git clone --depth 1 https://git.FreeBSD.org/ports.git /usr/ports
+    else
+      git -C /usr/ports pull --ff-only
+    fi
+  register: _ports_fetch
+  changed_when: "'Already up to date' not in _ports_fetch.stdout"
 - name: Discover jail directories
   find:
     paths: "{{ playbook_dir }}/roles/jails"
@@ -148,15 +118,64 @@
     - { name: "zroot/jails/templates" }
     - { name: "zroot/jails/containers" }
     - { name: "zroot/jails/volumes", mountpoint: "none" }
-    - { name: "zroot/jails/volumes/goaccess_www", mountpoint: "/usr/local/jails/volumes/goaccess_www" }
-    - { name: "zroot/jails/volumes/postgres_data", mountpoint: "/usr/local/jails/containers/postgres/var/db/postgres" }
-    - { name: "zroot/jails/volumes/irc_thelounge", mountpoint: "/usr/local/jails/containers/irc_thelounge/var/db/thelounge" }
-    - { name: "zroot/jails/volumes/taulubot", mountpoint: "/usr/local/jails/containers/taulubot/usr/local/taulubot/photos" }
-    - { name: "zroot/jails/volumes/komga_data", mountpoint: "/usr/local/jails/containers/komga/root/.komga" }
+    - {
+        name: "zroot/jails/volumes/goaccess_www",
+        mountpoint: "/usr/local/jails/volumes/goaccess_www",
+      }
+    - {
+        name: "zroot/jails/volumes/postgres_data",
+        mountpoint: "/usr/local/jails/containers/postgres/var/db/postgres",
+      }
+    - {
+        name: "zroot/jails/volumes/irc_thelounge",
+        mountpoint: "/usr/local/jails/containers/irc_thelounge/var/db/thelounge",
+      }
+    - {
+        name: "zroot/jails/volumes/taulubot",
+        mountpoint: "/usr/local/jails/containers/taulubot/usr/local/taulubot/photos",
+      }
+    - {
+        name: "zroot/jails/volumes/komga_data",
+        mountpoint: "/usr/local/jails/containers/komga/root/.komga",
+      }
     - { name: "zroot/storage", mountpoint: "/usr/local/jails/volumes/storage" }
+    - { name: "zroot/my-ports", mountpoint: "/usr/local/my-ports" }
   loop_control:
     label: "{{ item.name }}"
 
+- name: Sync custom ports tree to host
+  synchronize:
+    src: "{{ playbook_dir }}/ports/"
+    dest: /usr/local/my-ports/
+    delete: true
+    recursive: true
+    rsync_opts:
+      - "--exclude=work-*"
+
+- name: Install custom ports
+  shell: make -C /usr/local/my-ports/{{ item }} install clean BATCH=yes
+  loop:
+    - pylogsentinel
+  register: _port_install
+  failed_when: "_port_install.rc != 0 and 'already installed' not in _port_install.stdout"
+  changed_when: "'already installed' not in _port_install.stdout"
+
+- name: Deploy pylogsentinel.conf
+  template:
+    src: usr_local_etc_pylogsentinel.conf.j2
+    dest: /usr/local/etc/pylogsentinel.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+
+- name: Deploy pylogsentinel-batch-email.sh
+  template:
+    src: usr_local_bin_pylogsentinel-batch-email.sh.j2
+    dest: /usr/local/bin/pylogsentinel-batch-email.sh
+    owner: root
+    group: wheel
+    mode: "0755"
+
 - name: Create storage group
   group:
     name: storage
@@ -215,3 +234,12 @@
     owner: root
     group: wheel
     mode: "0644"
+
+- name: Set up crontab
+  template:
+    src: etc_crontab.j2
+    dest: /etc/crontab
+    owner: root
+    group: wheel
+    mode: "0644"
+  notify: Restart cron
diff --git a/roles/host/templates/etc_crontab.j2 b/roles/host/templates/etc_crontab.j2
index de1f3c6..5cd0d86 100644
--- a/roles/host/templates/etc_crontab.j2
+++ b/roles/host/templates/etc_crontab.j2
@@ -22,11 +22,11 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
 1,31    0-5     *       *       *       root    adjkerntz -a
 
 # Take snapshots every day at 3:05 AM
-5       3       *       *       *       root    logto /var/log/backup /usr/local/bin/backup snapshot prune-local
+5       3       *       *       *       root    /usr/local/bin/backup snapshot prune-local >>/var/log/backup 2>&1
 # Send backup snapshots to remote every third day at 4:05 AM
-5       4       */3     *       *       root    logto /var/log/backup /usr/local/bin/backup send-to-remote prune-remote notify
+5       4       */3     *       *       root    /usr/local/bin/backup send-to-remote prune-remote notify >>/var/log/backup 2>&1
 
-# Run pylogmonitor
+# Run pylogsentinel
 */10    *       *       *       *       root    python -m pylogsentinel
 # Run pylogsentinel batch job once a day
 5       6       *       *       *       root    /usr/local/bin/pylogsentinel-batch-email.sh
diff --git a/roles/host/templates/usr_local_bin_logto.sh.j2 b/roles/host/templates/usr_local_bin_logto.sh.j2
deleted file mode 100644
index 9bb5aa1..0000000
--- a/roles/host/templates/usr_local_bin_logto.sh.j2
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/bin/sh
-
-set -ue
-
-# Wrapper for logging to file and prepending a timestamp.
-# By default writes both stdout and stderr to the log file.
-
-usage() {
-    echo "Usage: logto [-s|-e] <log_file> <command>"
-    echo "Flags:"
-    echo "  -s: Write only stdout to the log file."
-    echo "  -e: Write only stderr to the log file."
-    echo ""
-    echo "Example usage:"
-    echo "  logto /var/log/my.log run some command"
-    exit 1
-}
-
-mode="all"
-
-while getopts "se" opt; do
-    case $opt in
-        s) mode="stdout" ;;
-        e) mode="stderr" ;;
-        *) usage ;;
-    esac
-done
-shift $((OPTIND-1))
-
-if [ $# -lt 2 ]; then
-    usage
-fi
-
-log_file="$1"
-shift
-
-if [ "$mode" = "stdout" ]; then
-    out=$(2>/dev/null $@)
-elif [ "$mode" = "stderr" ]; then
-    out=$(2>&1 >/dev/null $@)
-else
-    out=$(2>&1 $@)
-fi
-
-if [ ! -z "$out" ]; then
-    echo "$(date +"%Y-%m-%dT%H:%M:%S%z")" "$out" >>"$log_file"
-fi
diff --git a/roles/jail/tasks/jail_launch.yml b/roles/jail/tasks/jail_launch.yml
index 52cc1c1..31ccdf2 100644
--- a/roles/jail/tasks/jail_launch.yml
+++ b/roles/jail/tasks/jail_launch.yml
@@ -1,6 +1,3 @@
-- name: Flush handlers
-  meta: flush_handlers
-
 - name: Start services
   service:
     name: "{{ item }}"
diff --git a/roles/jails/01_ingress/defaults/main.yml b/roles/jails/01_ingress/defaults/main.yml
index f6d5aa4..6b95ef9 100644
--- a/roles/jails/01_ingress/defaults/main.yml
+++ b/roles/jails/01_ingress/defaults/main.yml
@@ -15,6 +15,7 @@ ingress_routes:
   - { host: immich.jan.systems, ip: 192.168.3.3, port: 2283 }
   - { host: plex.jan.systems, jail: plex, port: 32400, presets: [streaming] }
   - { host: komga.jan.systems, jail: komga, port: 25600 }
+  - { host: ports.jan.systems, jail: packager }
 
 cert_domains:
   - "jan.systems"
diff --git a/roles/jails/02_postgres/handlers/main.yml b/roles/jails/02_postgres/handlers/main.yml
index 29064ba..b4762b2 100644
--- a/roles/jails/02_postgres/handlers/main.yml
+++ b/roles/jails/02_postgres/handlers/main.yml
@@ -1,4 +1,4 @@
-- name: Restart postgresql
+- name: Reload postgresql
   service:
     name: postgresql
-    state: restarted
+    state: reloaded
diff --git a/roles/jails/02_postgres/tasks/main.yml b/roles/jails/02_postgres/tasks/main.yml
index 226e734..81d357a 100644
--- a/roles/jails/02_postgres/tasks/main.yml
+++ b/roles/jails/02_postgres/tasks/main.yml
@@ -7,6 +7,15 @@
     path: /var/db/postgres/data18/PG_VERSION
   register: _pg_data
 
+- name: Set postgres data directory ownership
+  file:
+    path: /var/db/postgres
+    state: directory
+    owner: postgres
+    group: postgres
+    mode: "0755"
+  when: not _pg_data.stat.exists
+
 - name: Initialize database
   shell: /usr/local/etc/rc.d/postgresql initdb
   when: not _pg_data.stat.exists
@@ -16,14 +25,22 @@
     path: /var/db/postgres/data18/pg_hba.conf
     line: "host    all             all             {{ jail_lan_cidr }}          scram-sha-256"
     regexp: "^host.*all.*all.*scram-sha-256"
-  notify: Restart postgresql
+  notify: Reload postgresql
 
 - name: Listen on all interfaces
   lineinfile:
     path: /var/db/postgres/data18/postgresql.conf
     line: "listen_addresses = '*'"
     regexp: "^listen_addresses"
-  notify: Restart postgresql
+  notify: Reload postgresql
+
+- name: Start postgres
+  service:
+    name: postgresql
+    state: started
+
+- name: Flush handlers
+  meta: flush_handlers
 
 - import_role:
     name: jail
diff --git a/roles/jails/20_packager/defaults/main.yml b/roles/jails/20_packager/defaults/main.yml
new file mode 100644
index 0000000..e9d0f26
--- /dev/null
+++ b/roles/jails/20_packager/defaults/main.yml
@@ -0,0 +1,22 @@
+userland: "15.0-RELEASE"
+
+pkg:
+  - nginx
+
+nullfs:
+  - src: /usr/local/my-ports
+    dst: /usr/local/my-ports
+  - src: /usr/ports
+    dst: /usr/ports
+
+files:
+  - src: usr_local_etc_nginx_nginx.conf
+    dest: /usr/local/etc/nginx/nginx.conf
+  - src: usr_local_bin_build_packages.sh
+    dest: /usr/local/bin/build-packages
+    mode: "0755"
+  - src: etc_crontab
+    dest: /etc/crontab
+
+services:
+  - nginx
diff --git a/roles/jails/20_packager/tasks/main.yml b/roles/jails/20_packager/tasks/main.yml
new file mode 100644
index 0000000..e1a44e1
--- /dev/null
+++ b/roles/jails/20_packager/tasks/main.yml
@@ -0,0 +1,15 @@
+- import_role:
+    name: jail
+    tasks_from: jail_setup
+
+- name: Create packages output directory
+  file:
+    path: /usr/local/packages
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- import_role:
+    name: jail
+    tasks_from: jail_launch
diff --git a/roles/jails/20_packager/templates/etc_crontab b/roles/jails/20_packager/templates/etc_crontab
new file mode 100644
index 0000000..ed18a07
--- /dev/null
+++ b/roles/jails/20_packager/templates/etc_crontab
@@ -0,0 +1,5 @@
+SHELL=/bin/sh
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
+
+# Build packages every hour
+0	*	*	*	*	root	/usr/local/bin/build-packages >> /var/log/build-packages.log 2>&1
diff --git a/roles/jails/20_packager/templates/usr_local_bin_build_packages.sh b/roles/jails/20_packager/templates/usr_local_bin_build_packages.sh
new file mode 100644
index 0000000..b4d5ea6
--- /dev/null
+++ b/roles/jails/20_packager/templates/usr_local_bin_build_packages.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+# Build all ports in /usr/local/my-ports, skip already-built packages.
+set -eu
+
+PORTS_DIR="/usr/local/my-ports"
+PKG_DIR="/usr/local/packages"
+
+for port_dir in "${PORTS_DIR}"/*/; do
+    [ -f "${port_dir}/Makefile" ] || continue
+
+    port_name=$(make -C "${port_dir}" -V PKGNAME)
+    pkg_file="${PKG_DIR}/All/${port_name}.pkg"
+
+    if [ -f "${pkg_file}" ]; then
+        echo "SKIP ${port_name} (already built)"
+        continue
+    fi
+
+    echo "BUILD ${port_name}"
+    make -C "${port_dir}" clean package PACKAGES="${PKG_DIR}" BATCH=yes
+    make -C "${port_dir}" clean
+done
+
+# Rebuild the repository catalog
+pkg repo "${PKG_DIR}"
+echo "Done."
diff --git a/roles/jails/20_packager/templates/usr_local_etc_nginx_nginx.conf b/roles/jails/20_packager/templates/usr_local_etc_nginx_nginx.conf
new file mode 100644
index 0000000..0d140ef
--- /dev/null
+++ b/roles/jails/20_packager/templates/usr_local_etc_nginx_nginx.conf
@@ -0,0 +1,18 @@
+worker_processes 1;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include mime.types;
+    default_type application/octet-stream;
+    sendfile on;
+
+    server {
+        listen 80;
+        server_name _;
+        root /usr/local/packages;
+        autoindex on;
+    }
+}