Simplify jail configuration

3 files changed, 30 insertions, 36 deletions

diff --git a/roles/jails/20_immich/defaults/main.yml b/roles/jails/20_immich/defaults/main.yml
index b3347d3..6cb9390 100644
--- a/roles/jails/20_immich/defaults/main.yml
+++ b/roles/jails/20_immich/defaults/main.yml
@@ -8,22 +8,22 @@ oci_images:
   - name: immich-server
     image: "ghcr.io/immich-app/immich-server:{{ immich_version }}"
     check_path: /usr/src/app/server/dist/main.js
-    mounts:
-      - { type: nullfs, src: /immich_data, dst: /data }
   - name: immich-ml
     image: "ghcr.io/immich-app/immich-machine-learning:{{ immich_version }}"
     check_path: /opt/venv/bin/python
-    mounts:
-      - { type: nullfs, src: /model_cache, dst: /cache }
 
 zfs:
-  - name: zroot/jails/volumes/immich_data
-    mountpoint: /immich_data
+  - name: immich_data
     mode: "0755"
-  - name: zroot/jails/volumes/immich_model_cache
-    mountpoint: /model_cache
+  - name: immich_model_cache
     mode: "0755"
 
+nullfs:
+  - src: immich_data
+    dst: /image/immich-server/data
+  - src: immich_model_cache
+    dst: /image/immich-server/cache
+
 pkg:
   - skopeo
 
diff --git a/roles/jails/20_immich/tasks/main.yml b/roles/jails/20_immich/tasks/main.yml
index 835cd50..39decd1 100644
--- a/roles/jails/20_immich/tasks/main.yml
+++ b/roles/jails/20_immich/tasks/main.yml
@@ -46,28 +46,29 @@
     label: "{{ item.item.name }}"
   when: not item.stat.exists
 
-# Create mount points in each rootfs
-- name: Create base mount points in image rootfs
+- name: Create volume mount points in image rootfs
   file:
-    path: "/image/{{ item[0].name }}/{{ item[1] }}"
+    path: "/image/{{ item[0].name }}{{ item[1].dst }}"
     state: directory
     owner: root
     group: wheel
     mode: "0755"
-  loop: "{{ oci_images | product(['proc', 'sys', 'dev', 'tmp', 'run']) | list }}"
+  loop: "{{ oci_images | product(nullfs | default([]) | normalize_nullfs) | list }}"
   loop_control:
-    label: "{{ item[0].name }}/{{ item[1] }}"
+    label: "{{ item[0].name }}:{{ item[1].dst }}"
+  when: "item[1].dst.startswith('/image/' + item[0].name)"
 
-- name: Create nullfs mount points in image rootfs
+# Create mount points in each rootfs
+- name: Create base mount points in image rootfs
   file:
-    path: "/image/{{ item.0.name }}{{ item.1.dst }}"
+    path: "/image/{{ item[0].name }}/{{ item[1] }}"
     state: directory
     owner: root
     group: wheel
     mode: "0755"
-  loop: "{{ oci_images | subelements('mounts', skip_missing=True) }}"
+  loop: "{{ oci_images | product(['proc', 'sys', 'dev', 'tmp', 'run']) | list }}"
   loop_control:
-    label: "{{ item.0.name }}:{{ item.1.dst }}"
+    label: "{{ item[0].name }}/{{ item[1] }}"
 
 # Deploy resolv.conf into each rootfs
 - name: Deploy resolv.conf into image rootfs
diff --git a/roles/jails/20_immich/templates/jail.conf.j2 b/roles/jails/20_immich/templates/jail.conf.j2
index 13680af..8e3c626 100644
--- a/roles/jails/20_immich/templates/jail.conf.j2
+++ b/roles/jails/20_immich/templates/jail.conf.j2
@@ -13,26 +13,22 @@ immich {
   enforce_statfs = 1;
 
   devfs_ruleset = 4;
-  host.hostname = "immich";
-  path = "/usr/local/jails/containers/immich";
+  host.hostname = "${name}";
+  path = "/usr/local/jails/containers/${name}";
 
   exec.start = "/bin/sh /etc/rc";
   exec.stop  = "/bin/sh /etc/rc.shutdown";
 
-  # LAN epair
-  exec.prestart  += "ifconfig epl{{ jail_num }}a destroy 2>/dev/null || true";
-  exec.prestart  += "ifconfig epair{{ jail_num }}000 create";
-  exec.prestart  += "ifconfig epair{{ jail_num }}000a name epl{{ jail_num }}a";
-  exec.prestart  += "ifconfig epair{{ jail_num }}000b name epl{{ jail_num }}b";
-  exec.prestart  += "ifconfig epl{{ jail_num }}b ether random";
-  exec.prestart  += "ifconfig brlan0 addm epl{{ jail_num }}a";
-  exec.poststart += "ifconfig epl{{ jail_num }}b vnet immich";
-  exec.poststart += "ifconfig epl{{ jail_num }}a up";
-  exec.poststart += "jexec immich ifconfig epl{{ jail_num }}b up";
-  exec.poststart += "jexec immich ifconfig epl{{ jail_num }}b {{ jail_lan_cidr | ipv4_nth_cidr(jail_num | int + jail_lan_offset | int) }}";
-  exec.poststart += "jexec immich route delete default || true";
-  exec.poststart += "jexec immich route add default {{ ingress_ip }} || true";
-  exec.poststop  += "ifconfig epl{{ jail_num }}a destroy 2>/dev/null || true";
+  # Networking
+  exec.prestart  += "jail_net prestart  {{ jail_num }} ${name}";
+  exec.poststart += "jail_net poststart {{ jail_num }} ${name}";
+  exec.prestop   += "jail_net prestop   {{ jail_num }} ${name}";
+  exec.poststop  += "jail_net poststop  {{ jail_num }} ${name}";
+
+  # nullfs mounts
+{% for mount in nullfs | default([]) | normalize_nullfs %}
+  mount += "{{ mount.src }}  ${path}{{ mount.dst }}  nullfs  {{ mount.mode | default('rw') }}  0  0";
+{% endfor %}
 {% for img in oci_images %}
 
   # Mounts for {{ img.name }} rootfs
@@ -41,8 +37,5 @@ immich {
   mount += "devfs     $path/image/{{ img.name }}/dev   devfs     rw 0 0";
   mount += "tmpfs     $path/image/{{ img.name }}/tmp   tmpfs     rw 0 0";
   mount += "tmpfs     $path/image/{{ img.name }}/run   tmpfs     rw 0 0";
-{% for mnt in img.mounts | default([]) %}
-  mount += "$path{{ mnt.src }}  $path/image/{{ img.name }}{{ mnt.dst }}  nullfs rw 0 0";
-{% endfor %}
 {% endfor %}
 }