diff options
| author | Jan Tuomi <jan@jantuomi.fi> | 2026-08-04 12:00:39 +0300 |
|---|---|---|
| committer | Jan Tuomi <jan@jantuomi.fi> | 2026-08-04 12:00:39 +0300 |
| commit | d38fe54ab035f8e3248b8e20a58abd89861833bf (patch) | |
| tree | fcc78428a726799568a1ae2253a16590e883c816 /roles/jails/01_ingress | |
| parent | 017b29539749da3c62202879d757a45ffc71208c (diff) | |
Simplify jail configuration
Diffstat (limited to 'roles/jails/01_ingress')
| -rw-r--r-- | roles/jails/01_ingress/defaults/main.yml | 15 | ||||
| -rw-r--r-- | roles/jails/01_ingress/tasks/main.yml | 36 |
2 files changed, 8 insertions, 43 deletions
diff --git a/roles/jails/01_ingress/defaults/main.yml b/roles/jails/01_ingress/defaults/main.yml index f5e848b..37840eb 100644 --- a/roles/jails/01_ingress/defaults/main.yml +++ b/roles/jails/01_ingress/defaults/main.yml @@ -1,12 +1,15 @@ userland: "15.1-RELEASE" devfs_ruleset: 6 -no_default_route: true zfs: - - name: zroot/jails/volumes/ingress_letsencrypt - mountpoint: /usr/local/etc/letsencrypt - - name: zroot/jails/volumes/ingress_logs - mountpoint: /var/log/nginx + - name: ingress_letsencrypt + - name: ingress_logs + +nullfs: + - src: ingress_letsencrypt + dst: /usr/local/etc/letsencrypt + - src: ingress_logs + dst: /var/log/nginx ingress_routes: - { host: jan.systems, jail: homepage } @@ -37,8 +40,6 @@ contact_email: jan@jantuomi.fi jail_conf_options: - "allow.raw_sockets" -nullfs: [] - pkg: - pcre2 - nginx diff --git a/roles/jails/01_ingress/tasks/main.yml b/roles/jails/01_ingress/tasks/main.yml index 6c8a30b..98b8d13 100644 --- a/roles/jails/01_ingress/tasks/main.yml +++ b/roles/jails/01_ingress/tasks/main.yml @@ -1,39 +1,3 @@ -- name: Set WAN hooks (test) - set_fact: - exec_prestart: - - "ifconfig epw{{ jail_num }}a destroy 2>/dev/null || true" - - "ifconfig epair{{ jail_num }}001 create" - - "ifconfig epair{{ jail_num }}001a name epw{{ jail_num }}a" - - "ifconfig epair{{ jail_num }}001b name epw{{ jail_num }}b" - - "ifconfig brlan0 addm epw{{ jail_num }}a" - exec_poststart: - - "ifconfig epw{{ jail_num }}b vnet {{ jail_name }}" - - "ifconfig epw{{ jail_num }}a up" - - "jexec {{ jail_name }} ifconfig epw{{ jail_num }}b up" - - "jexec {{ jail_name }} ifconfig epw{{ jail_num }}b inet {{ ingress_wan_static }}" - - "jexec {{ jail_name }} route add default {{ lan_ipv4_gateway }}" - exec_poststop: - - "ifconfig epw{{ jail_num }}a destroy 2>/dev/null || true" - when: not is_prod - -- name: Set WAN hooks (prod) - set_fact: - exec_prestart: - - "ifconfig epw{{ jail_num }}a destroy 2>/dev/null || true" - - "ifconfig epair{{ jail_num }}001 create" - - "ifconfig epair{{ jail_num }}001a name epw{{ jail_num }}a" - - "ifconfig epair{{ jail_num }}001b name epw{{ jail_num }}b" - - "ifconfig brwan0 addm epw{{ jail_num }}a" - exec_poststart: - - "ifconfig epw{{ jail_num }}b vnet {{ jail_name }}" - - "ifconfig epw{{ jail_num }}a up" - - "jexec {{ jail_name }} ifconfig epw{{ jail_num }}b up" - - "jexec {{ jail_name }} dhclient epw{{ jail_num }}b" - - "jexec {{ jail_name }} route add 10.6.210.0/24 {{ lan_ipv4_gateway }} || true" - exec_poststop: - - "ifconfig epw{{ jail_num }}a destroy 2>/dev/null || true" - when: is_prod - - import_role: name: jail tasks_from: jail_setup |