diff options
| author | Jan Tuomi <jan@jantuomi.fi> | 2025-10-09 22:04:02 +0300 |
|---|---|---|
| committer | Jan Tuomi <jan@jantuomi.fi> | 2025-10-09 22:04:02 +0300 |
| commit | f4504129f6a1bfce8fc81f69b0f90f340acb1d34 (patch) | |
| tree | 80a912e83b9d9a6dc9626d15b71573afc597f5eb | |
| parent | e037ecfa8cc0133a84fbed791b7658c474c3e748 (diff) | |
Add postgres jail conf
| -rw-r--r-- | playbook.yml | 4 | ||||
| -rw-r--r-- | tasks/jail_postgres.yml | 10 | ||||
| -rw-r--r-- | templates/etc_jail.conf.j2 | 5 |
3 files changed, 18 insertions, 1 deletions
diff --git a/playbook.yml b/playbook.yml index 1ee0817..4f32363 100644 --- a/playbook.yml +++ b/playbook.yml @@ -82,6 +82,10 @@ tags: [jail_ingress] import_tasks: tasks/jail_ingress.yml + - name: Run postgres jail tasks + tags: [jail_postgres] + import_tasks: tasks/jail_postgres.yml + - name: Run diddle jail tasks tags: [jail_diddle] import_tasks: tasks/jail_diddle.yml diff --git a/tasks/jail_postgres.yml b/tasks/jail_postgres.yml new file mode 100644 index 0000000..42cdacf --- /dev/null +++ b/tasks/jail_postgres.yml @@ -0,0 +1,10 @@ +- name: Install packages inside jail + loop: + - { jail: postgres, package: postgresql18-server } + include_tasks: pkg_jail_install.yml + +- name: Enable postgresql service inside jail + shell: | + service -j postgres postgresql enable + changed_when: false +# Run initdb and start manually, not managed by Ansible diff --git a/templates/etc_jail.conf.j2 b/templates/etc_jail.conf.j2 index 0b8c18b..25955ce 100644 --- a/templates/etc_jail.conf.j2 +++ b/templates/etc_jail.conf.j2 @@ -32,10 +32,13 @@ path = "/usr/local/jails/containers/${name}"; {% for jail in jails %} {{ jail.name }} { $num = "{{ jail.num }}"; - {% if jail.name == "ingress" %} + {% if jail.name == "ingress" -%} exec.poststart = "jexec ${name} ifconfig ${epl}b 192.168.2.${num}/16 up"; exec.poststart = "jexec ${name} ifconfig epw1b up"; exec.poststart += "jexec ${name} service dhclient restart epw1b"; {% endif %} + {%if jail.name == "postgres" -%} + allow.sysvipc; + {% endif %} } {% endfor %} |