Restructure jail ip references

9 files changed, 41 insertions, 54 deletions

diff --git a/roles/host/tasks/poudriere.yml b/roles/host/tasks/poudriere.yml
index b46293f..71832dc 100644
--- a/roles/host/tasks/poudriere.yml
+++ b/roles/host/tasks/poudriere.yml
@@ -84,7 +84,7 @@
   copy:
     content: |
       poudriere: {
-        url: "http://{{ poudriere_repo_ip }}/packages",
+        url: "http://{{ jail_ips.poudriere_repo }}/packages",
         enabled: no
       }
     dest: /usr/local/etc/pkg/repos/poudriere.conf
diff --git a/roles/jail/tasks/jail_setup.yml b/roles/jail/tasks/jail_setup.yml
index 2c8581d..aac91f7 100644
--- a/roles/jail/tasks/jail_setup.yml
+++ b/roles/jail/tasks/jail_setup.yml
@@ -84,21 +84,6 @@
     label: "{{ item.name }}"
   delegate_to: "{{ jail_delegate_host }}"
 
-- name: "Inherit mountpoint on ZFS volumes for {{ jail_name }}"
-  shell: |
-    source=$(zfs get -H -o source mountpoint {{ item.name }})
-    if [ "$source" != "inherited" ] && [ "$source" != "received" ]; then
-      zfs unmount {{ item.name }} 2>/dev/null
-      zfs inherit mountpoint {{ item.name }}
-      echo "changed"
-    fi
-  loop: "{{ _zfs }}"
-  loop_control:
-    label: "{{ item.name }}"
-  register: _zfs_inherit
-  changed_when: "'changed' in _zfs_inherit.stdout"
-  delegate_to: "{{ jail_delegate_host }}"
-
 - name: "Set ownership on ZFS volume host mountpoints for {{ jail_name }}"
   file:
     path: "/usr/local/jails/volumes/{{ item.name | basename }}"
@@ -162,6 +147,7 @@
     jail:
       name: "{{ jail_name }}"
       num: "{{ jail_num }}"
+      ip: "{{ jail_ips[jail_name] }}/{{ jail_lan_cidr | ipv4_prefixlen }}"
       devfs_ruleset: "{{ devfs_ruleset | default(4) }}"
       options: "{{ jail_conf_options | default([]) }}"
       exec_prestart: "{{ exec_prestart | default([]) }}"
@@ -193,7 +179,7 @@
   copy:
     content: |
       poudriere: {
-        url: "http://{{ hostvars[jail_delegate_host]['poudriere_repo_ip'] }}/packages",
+        url: "http://{{ jail_ips.poudriere_repo }}/packages",
         enabled: no,
         priority: 100
       }
diff --git a/roles/jail/templates/jail_conf.j2 b/roles/jail/templates/jail_conf.j2
index aa88049..f4243c7 100644
--- a/roles/jail/templates/jail_conf.j2
+++ b/roles/jail/templates/jail_conf.j2
@@ -16,10 +16,10 @@
   exec.stop  = "/bin/sh /etc/rc.shutdown";
 
   # Networking
-  exec.prestart  += "jail_net prestart  {{ jail.num }} ${name}";
-  exec.poststart += "jail_net poststart {{ jail.num }} ${name}";
-  exec.prestop   += "jail_net prestop   {{ jail.num }} ${name}";
-  exec.poststop  += "jail_net poststop  {{ jail.num }} ${name}";
+  exec.prestart  += "jail_net prestart  ${name} {{ jail.num }} {{ jail.ip }}";
+  exec.poststart += "jail_net poststart ${name} {{ jail.num }} {{ jail.ip }}";
+  exec.prestop   += "jail_net prestop   ${name} {{ jail.num }} {{ jail.ip }}";
+  exec.poststop  += "jail_net poststop  ${name} {{ jail.num }} {{ jail.ip }}";
 
   # Custom hooks
 {% for cmd in jail.exec_prestart %}
diff --git a/roles/jail/templates/usr_local_bin_jail_net.j2 b/roles/jail/templates/usr_local_bin_jail_net.j2
index e9873a3..e8ce462 100644
--- a/roles/jail/templates/usr_local_bin_jail_net.j2
+++ b/roles/jail/templates/usr_local_bin_jail_net.j2
@@ -1,27 +1,16 @@
 #!/bin/sh
 # jail_net - manage jail LAN networking lifecycle
-# Usage: jail_net <prestart|poststart|prestop|poststop> <jail_num> <jail_name>
+# Usage: jail_net <prestart|poststart|prestop|poststop> <jail_name> <jail_num> <jail_ip_cidr>
 
 set -e
 
 STAGE="$1"
-NUM="$2"
-NAME="$3"
+NAME="$2"
+NUM="$3"
+IP="$4"
 
 BRIDGE="brlan0"
-LAN_BASE="{{ jail_lan_cidr | ipv4_host }}"
-LAN_PREFIX="{{ jail_lan_cidr | ipv4_prefixlen }}"
-LAN_OFFSET="{{ jail_lan_offset }}"
-DEFAULT_ROUTE="{{ jail_lan_cidr | ipv4_nth(1 + jail_lan_offset | int) }}"
-
-# Compute jail IP from jail_num + offset
-_nth=$(( LAN_OFFSET + NUM ))
-_a=$(echo "$LAN_BASE" | cut -d. -f1)
-_b=$(echo "$LAN_BASE" | cut -d. -f2)
-_c=$(echo "$LAN_BASE" | cut -d. -f3)
-_d=$(echo "$LAN_BASE" | cut -d. -f4)
-_total=$(( (_a << 24) + (_b << 16) + (_c << 8) + _d + _nth ))
-IP="$(( (_total >> 24) & 255 )).$(( (_total >> 16) & 255 )).$(( (_total >> 8) & 255 )).$(( _total & 255 ))/${LAN_PREFIX}"
+DEFAULT_ROUTE="{{ jail_ips.ingress }}"
 
 # --- Cleanup functions ---
 
@@ -121,7 +110,7 @@ case "$STAGE" in
     prestop)   _prestop   ;;
     poststop)  _poststop  ;;
     *)
-        echo "Usage: jail_net <prestart|poststart|prestop|poststop> <num> <name>" >&2
+        echo "Usage: jail_net <prestart|poststart|prestop|poststop> <name> <num> <ip_cidr>" >&2
         exit 1
         ;;
 esac
diff --git a/roles/jails/01_ingress/templates/etc_pf.conf.j2 b/roles/jails/01_ingress/templates/etc_pf.conf.j2
index 1d8f4c8..5250f79 100644
--- a/roles/jails/01_ingress/templates/etc_pf.conf.j2
+++ b/roles/jails/01_ingress/templates/etc_pf.conf.j2
@@ -4,7 +4,7 @@
 lan = "epl{{ jail.num }}b"
 wan = "epw{{ jail.num }}b"
 lan_net = "{{ lan_ipv4_network }}"
-gemini_host = "{{ jail_lan_cidr | ipv4_nth(5 + jail_lan_offset | int) }}"
+gemini_host = "{{ jail_ips.homepage }}"
 
 table <blocked> persist
 
diff --git a/roles/jails/17_syncthing/defaults/main.yml b/roles/jails/17_syncthing/defaults/main.yml
index 9e1f3f1..d7449c3 100644
--- a/roles/jails/17_syncthing/defaults/main.yml
+++ b/roles/jails/17_syncthing/defaults/main.yml
@@ -1,5 +1,10 @@
 userland: "15.1-RELEASE"
 
+zfs:
+  - name: syncthing_config
+    owner: "1001"
+    group: "1001"
+
 nullfs:
   - src: storage/docs
     dst: /mnt/docs
@@ -9,13 +14,6 @@ nullfs:
     dst: /mnt/jan-systems-2025-content
   - src: storage/projects-ableton
     dst: /mnt/projects-ableton
-
-zfs:
-  - name: syncthing_config
-    owner: "1001"
-    group: "1001"
-
-nullfs:
   - src: syncthing_config
     dst: /usr/local/etc/syncthing
 
diff --git a/roles/jails/20_immich/tasks/main.yml b/roles/jails/20_immich/tasks/main.yml
index 39decd1..cac290e 100644
--- a/roles/jails/20_immich/tasks/main.yml
+++ b/roles/jails/20_immich/tasks/main.yml
@@ -10,6 +10,20 @@
     owner: root
     group: wheel
     mode: "0644"
+  vars:
+    jail:
+      name: "{{ jail_name }}"
+      num: "{{ jail_num }}"
+      ip: "{{ jail_ips[jail_name] }}/{{ jail_lan_cidr | ipv4_prefixlen }}"
+      devfs_ruleset: "{{ devfs_ruleset | default(4) }}"
+      options: "{{ jail_conf_options | default([]) }}"
+      exec_prestart: "{{ exec_prestart | default([]) }}"
+      exec_start: "{{ exec_start | default([]) }}"
+      exec_poststart: "{{ exec_poststart | default([]) }}"
+      exec_prestop: "{{ exec_prestop | default([]) }}"
+      exec_stop: "{{ exec_stop | default([]) }}"
+      exec_poststop: "{{ exec_poststop | default([]) }}"
+      nullfs: "{{ nullfs | default([]) | normalize_nullfs }}"
   delegate_to: "{{ jail_delegate_host }}"
 
 # Deploy extraction script
diff --git a/roles/jails/20_immich/templates/jail.conf.j2 b/roles/jails/20_immich/templates/jail.conf.j2
index 8e3c626..fb7f363 100644
--- a/roles/jails/20_immich/templates/jail.conf.j2
+++ b/roles/jails/20_immich/templates/jail.conf.j2
@@ -1,4 +1,4 @@
-immich {
+{{ jail.name }} {
   vnet;
   persist;
   exec.clean;
@@ -20,13 +20,13 @@ immich {
   exec.stop  = "/bin/sh /etc/rc.shutdown";
 
   # Networking
-  exec.prestart  += "jail_net prestart  {{ jail_num }} ${name}";
-  exec.poststart += "jail_net poststart {{ jail_num }} ${name}";
-  exec.prestop   += "jail_net prestop   {{ jail_num }} ${name}";
-  exec.poststop  += "jail_net poststop  {{ jail_num }} ${name}";
+  exec.prestart  += "jail_net prestart  ${name} {{ jail.num }} {{ jail.ip }}";
+  exec.poststart += "jail_net poststart ${name} {{ jail.num }} {{ jail.ip }}";
+  exec.prestop   += "jail_net prestop   ${name} {{ jail.num }} {{ jail.ip }}";
+  exec.poststop  += "jail_net poststop  ${name} {{ jail.num }} {{ jail.ip }}";
 
   # nullfs mounts
-{% for mount in nullfs | default([]) | normalize_nullfs %}
+{% for mount in jail.nullfs %}
   mount += "{{ mount.src }}  ${path}{{ mount.dst }}  nullfs  {{ mount.mode | default('rw') }}  0  0";
 {% endfor %}
 {% for img in oci_images %}
diff --git a/roles/jails/20_immich/templates/usr_local_etc_immich_server.env.j2 b/roles/jails/20_immich/templates/usr_local_etc_immich_server.env.j2
index 87c563d..5712234 100644
--- a/roles/jails/20_immich/templates/usr_local_etc_immich_server.env.j2
+++ b/roles/jails/20_immich/templates/usr_local_etc_immich_server.env.j2
@@ -5,14 +5,14 @@ IMMICH_PORT=80
 NODE_ENV=production
 
 # Database
-DB_HOSTNAME={{ jail_lan_cidr | ipv4_nth(2 + jail_lan_offset | int) }}
+DB_HOSTNAME={{ jail_ips.postgres }}
 DB_PORT=5432
 DB_USERNAME=immich
 DB_PASSWORD={{ pg_user_passwords.immich }}
 DB_DATABASE_NAME=immich
 
 # Redis
-REDIS_HOSTNAME={{ jail_lan_cidr | ipv4_nth(9 + jail_lan_offset | int) }}
+REDIS_HOSTNAME={{ jail_ips.redis }}
 REDIS_PORT=6379
 REDIS_PASSWORD={{ valkey_password }}