Improvements

4 files changed, 30 insertions, 7 deletions

diff --git a/roles/jails/01_ingress/defaults/main.yml b/roles/jails/01_ingress/defaults/main.yml
index 1527cd9..f5e848b 100644
--- a/roles/jails/01_ingress/defaults/main.yml
+++ b/roles/jails/01_ingress/defaults/main.yml
@@ -46,8 +46,6 @@ pkg:
   - py312-certbot-nginx
 
 files:
-  - src: etc_pf.conf.j2
-    dest: /etc/pf.conf
   - src: acme-dns-auth.py
     dest: /usr/local/bin/acme-dns-auth.py
     mode: "0755"
diff --git a/roles/jails/01_ingress/handlers/main.yml b/roles/jails/01_ingress/handlers/main.yml
index 1819a68..f9c7907 100644
--- a/roles/jails/01_ingress/handlers/main.yml
+++ b/roles/jails/01_ingress/handlers/main.yml
@@ -2,3 +2,6 @@
   service:
     name: nginx
     state: reloaded
+
+- name: Reload pf
+  shell: pfctl -f /etc/pf.conf
diff --git a/roles/jails/01_ingress/tasks/main.yml b/roles/jails/01_ingress/tasks/main.yml
index a6fdc3c..6c8a30b 100644
--- a/roles/jails/01_ingress/tasks/main.yml
+++ b/roles/jails/01_ingress/tasks/main.yml
@@ -38,6 +38,15 @@
     name: jail
     tasks_from: jail_setup
 
+- name: Deploy pf.conf
+  template:
+    src: "{{ jail_role_dir }}/templates/etc_pf.conf.j2"
+    dest: /etc/pf.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+  notify: Reload pf
+
 - name: Deploy nginx config
   template:
     src: "{{ jail_role_dir }}/templates/usr_local_etc_nginx_nginx.conf.j2"
diff --git a/roles/jails/01_ingress/templates/etc_pf.conf.j2 b/roles/jails/01_ingress/templates/etc_pf.conf.j2
index c0528e1..1d8f4c8 100644
--- a/roles/jails/01_ingress/templates/etc_pf.conf.j2
+++ b/roles/jails/01_ingress/templates/etc_pf.conf.j2
@@ -4,24 +4,37 @@
 lan = "epl{{ jail.num }}b"
 wan = "epw{{ jail.num }}b"
 lan_net = "{{ lan_ipv4_network }}"
+gemini_host = "{{ jail_lan_cidr | ipv4_nth(5 + jail_lan_offset | int) }}"
 
 table <blocked> persist
 
-# Keep PF out of loopback, drop by default if you add blocks later
+# Keep PF out of loopback
 set skip on lo0
 set block-policy drop
 
 # NAT: translate LAN traffic to the WAN interface address
 nat on $wan from $lan_net to any -> ($wan)
 
-# Block traffic from IPs in the blocked table
+# Gemini: redirect WAN port 1965 to the homepage jail
+rdr on $wan inet proto tcp from any to ($wan) port 1965 -> $gemini_host
+
+# Default deny
+block all
+
+# Always block listed source addresses
 block in quick from <blocked> to any
 
-# Allow all outbound traffic from the jail and LAN via both interfaces
-# NAT will be applied automatically when source is in $lan_net and going out $wan
+# Allow LAN traffic to enter for forwarding/NAT
+pass in on $lan inet from $lan_net to any keep state
+
+# Allow outbound traffic
 pass out on $wan all keep state
 pass out on $lan all keep state
 
-pass in on $wan inet proto {tcp, udp} from any to any port {80, 443} keep state
+# Allow public HTTP and HTTPS
+pass in on $wan inet proto { tcp, udp } from any to ($wan) port { 80, 443 } keep state
+
+# Allow redirected Gemini traffic to the backend
+pass in on $wan inet proto tcp from any to $gemini_host port 1965 keep state
 {% endif %}
 {% endfor %}