Update homepage jail to use single self-signed cert for gemini

5 files changed, 6 insertions, 49 deletions

diff --git a/roles/jail/templates/jail_conf.j2 b/roles/jail/templates/jail_conf.j2
index f4243c7..d8e0667 100644
--- a/roles/jail/templates/jail_conf.j2
+++ b/roles/jail/templates/jail_conf.j2
@@ -1,14 +1,16 @@
 {{ jail.name }} {
   vnet;
-  persist;
   exec.clean;
   allow.raw_sockets;
-  mount.devfs;
+
+  mount.devfs;      # Mount /dev according to devfs_ruleset
+  devfs_ruleset = {{ jail.devfs_ruleset }};
+
+  enforce_statfs = 1; # Let jail see own mounts
 {% for opt in jail.options %}
   {{ opt }};
 {% endfor %}
 
-  devfs_ruleset = {{ jail.devfs_ruleset }};
   host.hostname = "${name}";
   path = "/usr/local/jails/containers/${name}";
 
diff --git a/roles/jails/05_homepage/defaults/main.yml b/roles/jails/05_homepage/defaults/main.yml
index cb53bd7..9e6b353 100644
--- a/roles/jails/05_homepage/defaults/main.yml
+++ b/roles/jails/05_homepage/defaults/main.yml
@@ -14,9 +14,6 @@ nullfs:
     dst: /usr/local/etc/agate/tls
   - src: homepage_gemini
     dst: /var/gemini
-  - src: ingress_letsencrypt
-    dst: /mnt/letsencrypt
-    mode: ro
 
 pkg:
   - pcre2
@@ -28,11 +25,6 @@ pkg:
 files:
   - src: usr_local_etc_nginx_nginx.conf.j2
     dest: /usr/local/etc/nginx/nginx.conf
-  - src: etc_crontab.j2
-    dest: /etc/crontab
-  - src: usr_local_bin_update_agate_certs.sh.j2
-    dest: /usr/local/bin/update-agate-certs
-    mode: "0755"
 
 services:
   - nginx
diff --git a/roles/jails/05_homepage/templates/etc_crontab.j2 b/roles/jails/05_homepage/templates/etc_crontab.j2
deleted file mode 100644
index 6ec1b69..0000000
--- a/roles/jails/05_homepage/templates/etc_crontab.j2
+++ /dev/null
@@ -1,10 +0,0 @@
-# /etc/crontab - root's crontab for FreeBSD
-#
-#
-SHELL=/bin/sh
-PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
-#
-#minute hour    mday    month   wday    who     command
-
-# Update agate TLS certs if letsencrypt cert has changed
-*/5     *       *       *       *       root    /usr/local/bin/update-agate-certs >> /var/log/update-agate-certs.log 2>&1
diff --git a/roles/jails/05_homepage/templates/usr_local_bin_update_agate_certs.sh.j2 b/roles/jails/05_homepage/templates/usr_local_bin_update_agate_certs.sh.j2
deleted file mode 100644
index 4f0ddaf..0000000
--- a/roles/jails/05_homepage/templates/usr_local_bin_update_agate_certs.sh.j2
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/bin/sh
-# update-agate-certs - convert letsencrypt PEM certs to DER for agate
-# Runs from cron; only converts if the cert has changed
-
-set -eu
-
-CERT_SRC="/mnt/letsencrypt/live/jan.systems/fullchain.pem"
-KEY_SRC="/mnt/letsencrypt/live/jan.systems/privkey.pem"
-TLS_DIR="/usr/local/etc/agate/tls"
-CHECKSUM_FILE="${TLS_DIR}/.cert.sha256"
-
-# Check if cert has changed
-CURRENT_SUM=$(sha256 -q "${CERT_SRC}")
-if [ -f "${CHECKSUM_FILE}" ] && [ "$(cat "${CHECKSUM_FILE}")" = "${CURRENT_SUM}" ]; then
-    exit 0
-fi
-
-echo "Certificate changed, converting to DER..."
-
-openssl x509 -in "${CERT_SRC}" -out "${TLS_DIR}/cert.der" -outform DER
-openssl pkey -in "${KEY_SRC}" -out "${TLS_DIR}/key.der" -outform DER
-chown www:www "${TLS_DIR}/cert.der" "${TLS_DIR}/key.der"
-chmod 640 "${TLS_DIR}/cert.der" "${TLS_DIR}/key.der"
-
-echo "${CURRENT_SUM}" > "${CHECKSUM_FILE}"
-
-service agate status > /dev/null 2>&1 && service agate restart
-echo "Done."
diff --git a/roles/jails/05_homepage/templates/usr_local_etc_nginx_nginx.conf.j2 b/roles/jails/05_homepage/templates/usr_local_etc_nginx_nginx.conf.j2
index ee45405..19b9897 100644
--- a/roles/jails/05_homepage/templates/usr_local_etc_nginx_nginx.conf.j2
+++ b/roles/jails/05_homepage/templates/usr_local_etc_nginx_nginx.conf.j2
@@ -43,6 +43,7 @@ http {
         location ~ ^/archive(?:/(.*))?$ {
             return 307 /posts/$1$is_args$args;
         }
+
         location = /feed.xml {
             # Serve atom.xml content at the legacy feed.xml URL (no redirect)
             rewrite ^ /atom.xml break;