Set up immich jail

1 files changed, 131 insertions, 0 deletions

diff --git a/roles/jails/20_immich/tasks/main.yml b/roles/jails/20_immich/tasks/main.yml
new file mode 100644
index 0000000..835cd50
--- /dev/null
+++ b/roles/jails/20_immich/tasks/main.yml
@@ -0,0 +1,131 @@
+- import_role:
+    name: jail
+    tasks_from: jail_setup
+
+# Override jail.conf with immich-specific version
+- name: Deploy jail.conf.d/immich.conf
+  template:
+    src: "{{ jail_role_dir }}/templates/jail.conf.j2"
+    dest: /etc/jail.conf.d/immich.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+  delegate_to: "{{ jail_delegate_host }}"
+
+# Deploy extraction script
+- name: Deploy extract-image script
+  template:
+    src: "{{ jail_role_dir }}/templates/usr_local_bin_extract_image.sh"
+    dest: /usr/local/bin/extract-image.sh
+    owner: root
+    group: wheel
+    mode: "0755"
+
+# Create image directory
+- name: Create /image directory
+  file:
+    path: /image
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0755"
+
+# Extract OCI images
+- name: Check if images are extracted
+  stat:
+    path: "/image/{{ item.name }}{{ item.check_path }}"
+  loop: "{{ oci_images }}"
+  loop_control:
+    label: "{{ item.name }}"
+  register: _images_extracted
+
+- name: Extract OCI images
+  shell: "/usr/local/bin/extract-image.sh {{ item.item.image }} {{ item.item.name }}"
+  loop: "{{ _images_extracted.results }}"
+  loop_control:
+    label: "{{ item.item.name }}"
+  when: not item.stat.exists
+
+# Create mount points in each rootfs
+- name: Create base mount points in image rootfs
+  file:
+    path: "/image/{{ item[0].name }}/{{ item[1] }}"
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0755"
+  loop: "{{ oci_images | product(['proc', 'sys', 'dev', 'tmp', 'run']) | list }}"
+  loop_control:
+    label: "{{ item[0].name }}/{{ item[1] }}"
+
+- name: Create nullfs mount points in image rootfs
+  file:
+    path: "/image/{{ item.0.name }}{{ item.1.dst }}"
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0755"
+  loop: "{{ oci_images | subelements('mounts', skip_missing=True) }}"
+  loop_control:
+    label: "{{ item.0.name }}:{{ item.1.dst }}"
+
+# Deploy resolv.conf into each rootfs
+- name: Deploy resolv.conf into image rootfs
+  copy:
+    content: "nameserver {{ lan_ipv4_gateway }}\n"
+    dest: "/image/{{ item.name }}/etc/resolv.conf"
+    owner: root
+    group: wheel
+    mode: "0644"
+  loop: "{{ oci_images }}"
+  loop_control:
+    label: "{{ item.name }}"
+
+# Deploy rc.d scripts
+- name: Deploy immich_server rc.d script
+  template:
+    src: "{{ jail_role_dir }}/templates/usr_local_etc_rc.d_immich_server"
+    dest: /usr/local/etc/rc.d/immich_server
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Deploy immich_ml rc.d script
+  template:
+    src: "{{ jail_role_dir }}/templates/usr_local_etc_rc.d_immich_ml"
+    dest: /usr/local/etc/rc.d/immich_ml
+    owner: root
+    group: wheel
+    mode: "0755"
+
+# Deploy env files
+- name: Deploy immich_server.env
+  template:
+    src: "{{ jail_role_dir }}/templates/usr_local_etc_immich_server.env.j2"
+    dest: /usr/local/etc/immich_server.env
+    owner: root
+    group: wheel
+    mode: "0600"
+  notify: Restart immich services
+
+- name: Deploy immich_ml.env
+  template:
+    src: "{{ jail_role_dir }}/templates/usr_local_etc_immich_ml.env.j2"
+    dest: /usr/local/etc/immich_ml.env
+    owner: root
+    group: wheel
+    mode: "0600"
+  notify: Restart immich services
+
+# Enable services
+- name: Enable immich services
+  community.general.sysrc:
+    name: "{{ item }}_enable"
+    value: "YES"
+  loop:
+    - immich_server
+    - immich_ml
+
+- import_role:
+    name: jail
+    tasks_from: jail_launch