Set up poudriere custom repo

21 files changed, 368 insertions, 54 deletions

diff --git a/roles/host/tasks/main.yml b/roles/host/tasks/main.yml
index 550804e..4bcdfdd 100644
--- a/roles/host/tasks/main.yml
+++ b/roles/host/tasks/main.yml
@@ -1,3 +1,21 @@
+- name: Detect system architecture
+  shell: "echo $(uname -m)/$(uname -p)"
+  register: _arch_result
+  changed_when: false
+
+- name: Set arch fact
+  set_fact:
+    arch: "{{ _arch_result.stdout }}"
+
+- name: Detect FreeBSD version
+  shell: "uname -r"
+  register: _freebsd_version_result
+  changed_when: false
+
+- name: Set FreeBSD version fact
+  set_fact:
+    poudriere_freebsd_version: "{{ _freebsd_version_result.stdout }}"
+
 - name: Disable resolvconf
   copy:
     content: "resolvconf=NO\n"
@@ -37,6 +55,7 @@
     - age
     - netdata
     - fd-find
+    - poudriere
   loop_control:
     loop_var: pkg_name
 
@@ -81,16 +100,148 @@
     mode: "0644"
 
 # Jail infrastructure
-- name: Fetch ports tree
-  shell: |
-    if [ ! -d /usr/ports/.git ]; then
-      git clone --depth 1 https://github.com/jantuomi/freebsd-ports.git /usr/ports
-    else
-      git -C /usr/ports fetch origin
-      git -C /usr/ports reset --hard origin/main
-    fi
-  register: _ports_fetch
-  changed_when: "'Already up to date' not in _ports_fetch.stdout"
+
+# Ports tree management
+- name: Deploy update-ports script
+  template:
+    src: usr_local_bin_update_ports.sh.j2
+    dest: /usr/local/bin/update-ports
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Deploy poudriere-start-build script
+  template:
+    src: usr_local_bin_poudriere_start_build.sh.j2
+    dest: /usr/local/bin/poudriere-start-build
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Check if quarterly ports tree exists
+  stat:
+    path: /usr/ports/quarterly/Mk
+  register: _quarterly_exists
+
+- name: Download quarterly ports tree
+  shell: /usr/local/bin/update-ports quarterly
+  when: not _quarterly_exists.stat.exists
+
+- name: Check if custom ports overlay exists
+  shell: "ls /usr/ports/custom/ 2>/dev/null | head -1"
+  register: _custom_exists
+  changed_when: false
+
+- name: Download custom ports overlay
+  shell: /usr/local/bin/update-ports custom
+  when: _custom_exists.stdout == ""
+
+# Poudriere setup
+- name: Deploy poudriere.conf
+  template:
+    src: usr_local_etc_poudriere.conf.j2
+    dest: /usr/local/etc/poudriere.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+  vars:
+    pkg_abi: "FreeBSD:{{ poudriere_freebsd_version.split('.')[0] }}:{{ arch.split('/')[1] }}"
+
+- name: Create distfiles directory
+  file:
+    path: /usr/local/poudriere/distfiles
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Check if poudriere jail exists
+  shell: poudriere jail -l -n | grep -q "^poudriere_build$"
+  failed_when: false
+  changed_when: false
+  register: _poudriere_jail_exists
+
+- name: Create poudriere jail
+  shell: poudriere jail -c -j poudriere_build -v {{ poudriere_freebsd_version }} -m tar=/usr/local/jails/media/{{ poudriere_freebsd_version }}-base.txz
+  when: _poudriere_jail_exists.rc != 0
+
+- name: Check if poudriere quarterly ports tree is registered
+  shell: poudriere ports -l -n | grep -q "^quarterly$"
+  failed_when: false
+  changed_when: false
+  register: _poudriere_quarterly_exists
+
+- name: Register quarterly ports tree with poudriere
+  shell: poudriere ports -c -p quarterly -m null -M /usr/ports/quarterly
+  when: _poudriere_quarterly_exists.rc != 0
+
+- name: Check if poudriere custom overlay is registered
+  shell: poudriere ports -l -n | grep -q "^custom$"
+  failed_when: false
+  changed_when: false
+  register: _poudriere_custom_exists
+
+- name: Register custom overlay with poudriere
+  shell: poudriere ports -c -p custom -m null -M /usr/ports/custom
+  when: _poudriere_custom_exists.rc != 0
+
+- name: Deploy poudriere package list
+  template:
+    src: usr_local_etc_poudriere_pkglist.j2
+    dest: /usr/local/etc/poudriere-pkglist
+    owner: root
+    group: wheel
+    mode: "0644"
+
+- name: Deploy poudriere build make.conf
+  template:
+    src: poudriere_build_make.conf.j2
+    dest: /usr/local/etc/poudriere.d/poudriere_build-make.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+
+# Repo validation gate
+- name: Check if poudriere repo has packages
+  stat:
+    path: "/usr/local/poudriere/data/packages/poudriere_build-quarterly/meta.pkg"
+  register: _poudriere_repo
+
+- name: "*** POUDRIERE REPO NOT READY ***"
+  fail:
+    msg: |
+      ════════════════════════════════════════════════════════════════
+        POUDRIERE REPOSITORY NOT READY
+      ════════════════════════════════════════════════════════════════
+        The local package repository has not been built yet.
+        Run the following command on the host to build packages:
+
+          poudriere bulk -j poudriere_build -p quarterly -O custom -f /usr/local/etc/poudriere-pkglist
+
+        Then re-run this playbook.
+      ════════════════════════════════════════════════════════════════
+  when: not _poudriere_repo.stat.exists
+
+# Configure local repo
+- name: Create pkg repos directory
+  file:
+    path: /usr/local/etc/pkg/repos
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Deploy local poudriere repo config
+  copy:
+    content: |
+      poudriere: {
+        url: "http://{{ jail_lan_cidr | ipv4_nth(21 + jail_lan_offset | int) }}/packages",
+        enabled: no
+      }
+    dest: /usr/local/etc/pkg/repos/poudriere.conf
+    owner: root
+    group: wheel
+    mode: "0644"
 - name: Discover jail directories
   find:
     paths: "{{ playbook_dir }}/roles/jails"
@@ -129,16 +280,14 @@
     - { name: "zroot/jails/volumes", mountpoint: "none" }
     - { name: "zroot/storage", mountpoint: "/usr/local/jails/volumes/storage" }
     - { name: "zroot/netdata_db", mountpoint: "/var/db/netdata" }
+    - { name: "zroot/ports", mountpoint: "/usr/ports" }
   loop_control:
     label: "{{ item.name }}"
 
-- name: Install custom ports
-  shell: cd /usr/ports/{{ item }} && make install WRKDIRPREFIX=/tmp/ports DISTDIR=/tmp/distfiles
-  loop:
-    - sysutils/pylogsentinel
-  register: _port_install
-  failed_when: "_port_install.rc != 0 and 'is already installed' not in _port_install.stdout"
-  changed_when: "'is already installed' not in _port_install.stdout"
+- name: Install custom packages from poudriere
+  shell: "pkg install -y -r poudriere pylogsentinel"
+  register: _custom_pkg
+  changed_when: "'Number of packages to be installed' in _custom_pkg.stdout"
 
 - name: Deploy pylogsentinel.conf
   template:
diff --git a/roles/host/templates/etc_crontab.j2 b/roles/host/templates/etc_crontab.j2
index 33276ab..a78c105 100644
--- a/roles/host/templates/etc_crontab.j2
+++ b/roles/host/templates/etc_crontab.j2
@@ -30,3 +30,7 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
 */10    *       *       *       *       root    python -m pylogsentinel
 # Run pylogsentinel batch job once a day
 5       6       *       *       *       root    /usr/local/bin/pylogsentinel-batch-email.sh
+
+# Update ports trees nightly
+0       2       *       *       *       root    /usr/local/bin/update-ports quarterly >>/var/log/update-ports.log 2>&1
+5       2       *       *       *       root    /usr/local/bin/update-ports custom >>/var/log/update-ports.log 2>&1
diff --git a/roles/host/templates/poudriere_build_make.conf.j2 b/roles/host/templates/poudriere_build_make.conf.j2
new file mode 100644
index 0000000..6bc860f
--- /dev/null
+++ b/roles/host/templates/poudriere_build_make.conf.j2
@@ -0,0 +1,2 @@
+DEFAULT_VERSIONS+=python=3.12 python3=3.12
+DISABLE_LICENSES=yes
diff --git a/roles/host/templates/usr_local_bin_poudriere_start_build.sh.j2 b/roles/host/templates/usr_local_bin_poudriere_start_build.sh.j2
new file mode 100644
index 0000000..6bbd379
--- /dev/null
+++ b/roles/host/templates/usr_local_bin_poudriere_start_build.sh.j2
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec poudriere bulk -j poudriere_build -p quarterly -O custom -f /usr/local/etc/poudriere-pkglist "$@"
diff --git a/roles/host/templates/usr_local_bin_update_ports.sh.j2 b/roles/host/templates/usr_local_bin_update_ports.sh.j2
new file mode 100644
index 0000000..ad4102d
--- /dev/null
+++ b/roles/host/templates/usr_local_bin_update_ports.sh.j2
@@ -0,0 +1,61 @@
+#!/bin/sh
+set -e
+
+usage() {
+    echo "Usage: update-ports [quarterly|custom]"
+    exit 1
+}
+
+[ $# -eq 1 ] || usage
+
+BASEDIR=/usr/ports
+REMOTE_QUARTERLY="https://github.com/freebsd/freebsd-ports.git"
+REMOTE_CUSTOM="https://github.com/jantuomi/freebsd-ports-custom.git"
+
+case "$1" in
+quarterly)
+    # Find the newest quarterly branch
+    BRANCH=$(git ls-remote --heads "$REMOTE_QUARTERLY" | grep -oE 'refs/heads/[0-9]{4}Q[0-9]' | sort -t/ -k3 -V | tail -1 | sed 's|refs/heads/||')
+    if [ -z "$BRANCH" ]; then
+        echo "Error: Could not determine quarterly branch"
+        exit 1
+    fi
+
+    # Check if already at this version
+    VERSION_FILE="${BASEDIR}/quarterly/.version"
+    if [ -f "$VERSION_FILE" ] && [ "$(cat "$VERSION_FILE")" = "$BRANCH" ]; then
+        echo "Quarterly ports tree already at $BRANCH."
+        exit 0
+    fi
+
+    echo "Downloading quarterly ports tree (branch: $BRANCH)..."
+    TMPDIR="${BASEDIR}/.quarterly.new"
+    rm -rf "$TMPDIR"
+    mkdir -p "$TMPDIR"
+    fetch -qo- "https://github.com/freebsd/freebsd-ports/archive/refs/heads/${BRANCH}.tar.gz" | tar -xf - -C "$TMPDIR" --strip-components=1
+    echo "$BRANCH" > "$TMPDIR/.version"
+
+    if [ -d "${BASEDIR}/quarterly" ]; then
+        mv "${BASEDIR}/quarterly" "${BASEDIR}/.quarterly.old"
+    fi
+    mv "$TMPDIR" "${BASEDIR}/quarterly"
+    rm -rf "${BASEDIR}/.quarterly.old" &
+    echo "Done. Quarterly ports tree updated to $BRANCH."
+    ;;
+custom)
+    # Clone or update
+    if [ -d "${BASEDIR}/custom/.git" ]; then
+        echo "Updating custom ports overlay..."
+        git -C "${BASEDIR}/custom" fetch origin
+        git -C "${BASEDIR}/custom" reset --hard origin/main
+    else
+        echo "Cloning custom ports overlay..."
+        rm -rf "${BASEDIR}/custom"
+        git clone "$REMOTE_CUSTOM" "${BASEDIR}/custom"
+    fi
+    echo "Done. Custom ports overlay updated."
+    ;;
+*)
+    usage
+    ;;
+esac
diff --git a/roles/host/templates/usr_local_etc_poudriere.conf.j2 b/roles/host/templates/usr_local_etc_poudriere.conf.j2
new file mode 100644
index 0000000..965ca3a
--- /dev/null
+++ b/roles/host/templates/usr_local_etc_poudriere.conf.j2
@@ -0,0 +1,13 @@
+ZPOOL=zroot
+ZROOTFS=/poudriere
+FREEBSD_HOST=https://download.FreeBSD.org
+RESOLV_CONF=/etc/resolv.conf
+BASEFS=/usr/local/poudriere
+DISTFILES_CACHE=/usr/local/poudriere/distfiles
+USE_PORTLINT=no
+USE_TMPFS=yes
+NOLINUX=yes
+ALLOW_MAKE_JOBS=yes
+MAKE_JOBS_NUMBER={{ ansible_processor_count | default(4) }}
+PACKAGE_FETCH_BRANCH=quarterly
+PACKAGE_FETCH_URL=pkg+https://pkg.FreeBSD.org/{{ pkg_abi }}
diff --git a/roles/host/templates/usr_local_etc_poudriere_pkglist.j2 b/roles/host/templates/usr_local_etc_poudriere_pkglist.j2
new file mode 100644
index 0000000..add1784
--- /dev/null
+++ b/roles/host/templates/usr_local_etc_poudriere_pkglist.j2
@@ -0,0 +1,11 @@
+databases/py-tinydb
+www/py-ua-parser
+www/py-user-agents
+sysutils/pylogsentinel
+net-im/taulubot
+net-im/hommabot
+www/aggro
+www/diddle
+www/expense-tracker
+www/gdrive-photo-gallery
+www/pastebin
diff --git a/roles/jail/tasks/jail_setup.yml b/roles/jail/tasks/jail_setup.yml
index 538fc6e..9504ea9 100644
--- a/roles/jail/tasks/jail_setup.yml
+++ b/roles/jail/tasks/jail_setup.yml
@@ -250,6 +250,27 @@
   delegate_to: "{{ jail_delegate_host }}"
 
 # In-jail provisioning
+- name: Create pkg repos directory
+  file:
+    path: /usr/local/etc/pkg/repos
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Configure poudriere repo in jail
+  copy:
+    content: |
+      poudriere: {
+        url: "http://{{ jail_lan_cidr | ipv4_nth(21 + jail_lan_offset | int) }}/packages",
+        enabled: no,
+        priority: 100
+      }
+    dest: /usr/local/etc/pkg/repos/poudriere.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+
 - name: Set default Python version
   copy:
     content: "DEFAULT_VERSIONS+=python=3.12 python3=3.12\n"
diff --git a/roles/jail/templates/jail_conf.j2 b/roles/jail/templates/jail_conf.j2
index 68a7c21..2a0ea27 100644
--- a/roles/jail/templates/jail_conf.j2
+++ b/roles/jail/templates/jail_conf.j2
@@ -53,7 +53,4 @@
   exec.prestart += "mount -t nullfs {{ mount.src }} /usr/local/jails/containers/{{ jail.name }}{{ mount.dst }} || true";
   exec.poststop += "umount /usr/local/jails/containers/{{ jail.name }}{{ mount.dst }} || true";
 {% endfor %}
-  exec.prestart += "mkdir -p /usr/local/jails/containers/{{ jail.name }}/usr/ports";
-  exec.prestart += "mount -t nullfs -o ro /usr/ports /usr/local/jails/containers/{{ jail.name }}/usr/ports || true";
-  exec.poststop += "umount /usr/local/jails/containers/{{ jail.name }}/usr/ports || true";
 }
diff --git a/roles/jails/01_ingress/defaults/main.yml b/roles/jails/01_ingress/defaults/main.yml
index 0774424..e507905 100644
--- a/roles/jails/01_ingress/defaults/main.yml
+++ b/roles/jails/01_ingress/defaults/main.yml
@@ -22,6 +22,7 @@ ingress_routes:
   - { host: plex.jan.systems, jail: plex, port: 32400, presets: [streaming] }
   - { host: komga.jan.systems, jail: komga }
   - { host: goaccess.jan.systems, jail: goaccess }
+  - { host: poudriere.jan.systems, jail: poudriere_repo }
 
 cert_domains:
   - "jan.systems"
diff --git a/roles/jails/04_taulubot/tasks/main.yml b/roles/jails/04_taulubot/tasks/main.yml
index e45b2d9..9116fc4 100644
--- a/roles/jails/04_taulubot/tasks/main.yml
+++ b/roles/jails/04_taulubot/tasks/main.yml
@@ -2,13 +2,10 @@
     name: jail
     tasks_from: jail_setup
 
-- name: Install taulubot from port
-  shell: |
-    cd /usr/ports/net-im/taulubot
-    make install WRKDIRPREFIX=/tmp/ports DISTDIR=/tmp/distfiles
+- name: Install taulubot
+  shell: pkg install -y -r poudriere taulubot
   register: _taulubot_install
-  failed_when: "_taulubot_install.rc != 0"
-  changed_when: "'Installing taulubot' in _taulubot_install.stdout"
+  changed_when: "'Installing' in _taulubot_install.stdout"
 
 - name: Deploy bot token file
   copy:
diff --git a/roles/jails/06_hommabot/tasks/main.yml b/roles/jails/06_hommabot/tasks/main.yml
index d19beb1..b3c4481 100644
--- a/roles/jails/06_hommabot/tasks/main.yml
+++ b/roles/jails/06_hommabot/tasks/main.yml
@@ -2,11 +2,10 @@
     name: jail
     tasks_from: jail_setup
 
-- name: Install hommabot from port
-  shell: cd /usr/ports/net-im/hommabot && make install WRKDIRPREFIX=/tmp/ports DISTDIR=/tmp/distfiles
+- name: Install hommabot
+  shell: pkg install -y -r poudriere hommabot
   register: _hommabot_install
-  failed_when: "_hommabot_install.rc != 0"
-  changed_when: "'Installing hommabot' in _hommabot_install.stdout"
+  changed_when: "'Installing' in _hommabot_install.stdout"
 
 - name: Deploy bot token file
   copy:
diff --git a/roles/jails/07_aggro/tasks/main.yml b/roles/jails/07_aggro/tasks/main.yml
index 175fd80..a7194e5 100644
--- a/roles/jails/07_aggro/tasks/main.yml
+++ b/roles/jails/07_aggro/tasks/main.yml
@@ -2,11 +2,10 @@
     name: jail
     tasks_from: jail_setup
 
-- name: Install aggro from port
-  shell: cd /usr/ports/www/aggro && make install WRKDIRPREFIX=/tmp/ports DISTDIR=/tmp/distfiles
+- name: Install aggro
+  shell: pkg install -y -r poudriere aggro
   register: _aggro_install
-  failed_when: "_aggro_install.rc != 0 and 'already installed' not in _aggro_install.stdout"
-  changed_when: "'already installed' not in _aggro_install.stdout"
+  changed_when: "'Installing' in _aggro_install.stdout"
 
 - name: Deploy aggro env file
   template:
diff --git a/roles/jails/08_diddle/tasks/main.yml b/roles/jails/08_diddle/tasks/main.yml
index e5b9c7f..69a68d2 100644
--- a/roles/jails/08_diddle/tasks/main.yml
+++ b/roles/jails/08_diddle/tasks/main.yml
@@ -2,11 +2,10 @@
     name: jail
     tasks_from: jail_setup
 
-- name: Install diddle from port
-  shell: cd /usr/ports/www/diddle && make install WRKDIRPREFIX=/tmp/ports DISTDIR=/tmp/distfiles
+- name: Install diddle
+  shell: pkg install -y -r poudriere diddle
   register: _diddle_install
-  failed_when: "_diddle_install.rc != 0"
-  changed_when: "'Installing diddle' in _diddle_install.stdout"
+  changed_when: "'Installing' in _diddle_install.stdout"
 
 - name: Deploy diddle env file
   template:
diff --git a/roles/jails/11_spliit/tasks/main.yml b/roles/jails/11_spliit/tasks/main.yml
index d3f62e1..ef793b9 100644
--- a/roles/jails/11_spliit/tasks/main.yml
+++ b/roles/jails/11_spliit/tasks/main.yml
@@ -2,11 +2,10 @@
     name: jail
     tasks_from: jail_setup
 
-- name: Install expense-tracker from port
-  shell: cd /usr/ports/www/expense-tracker && make install WRKDIRPREFIX=/tmp/ports DISTDIR=/tmp/distfiles
+- name: Install expense-tracker
+  shell: pkg install -y -r poudriere expense-tracker
   register: _spliit_install
-  failed_when: "_spliit_install.rc != 0 and 'already installed' not in _spliit_install.stdout"
-  changed_when: "'already installed' not in _spliit_install.stdout"
+  changed_when: "'Installing' in _spliit_install.stdout"
 
 - name: Configure expense_tracker
   community.general.sysrc:
diff --git a/roles/jails/13_plex/tasks/main.yml b/roles/jails/13_plex/tasks/main.yml
index 438d6be..3effb64 100644
--- a/roles/jails/13_plex/tasks/main.yml
+++ b/roles/jails/13_plex/tasks/main.yml
@@ -2,11 +2,10 @@
     name: jail
     tasks_from: jail_setup
 
-- name: Install plexmediaserver from port
-  shell: cd /usr/ports/multimedia/plexmediaserver && make install BATCH=yes WRKDIRPREFIX=/tmp/ports DISTDIR=/tmp/distfiles
+- name: Install plexmediaserver
+  shell: pkg install -y -r poudriere plexmediaserver
   register: _plex_install
-  failed_when: "_plex_install.rc != 0 and 'already installed' not in _plex_install.stdout"
-  changed_when: "'already installed' not in _plex_install.stdout"
+  changed_when: "'Installing' in _plex_install.stdout"
 
 - import_role:
     name: jail
diff --git a/roles/jails/15_paste/tasks/main.yml b/roles/jails/15_paste/tasks/main.yml
index 2c11f34..7ba86c9 100644
--- a/roles/jails/15_paste/tasks/main.yml
+++ b/roles/jails/15_paste/tasks/main.yml
@@ -2,11 +2,10 @@
     name: jail
     tasks_from: jail_setup
 
-- name: Install pastebin from port
-  shell: cd /usr/ports/www/pastebin && make install BATCH=yes WRKDIRPREFIX=/tmp/ports DISTDIR=/tmp/distfiles
+- name: Install pastebin
+  shell: pkg install -y -r poudriere pastebin
   register: _paste_install
-  failed_when: "_paste_install.rc != 0 and 'already installed' not in _paste_install.stdout"
-  changed_when: "'already installed' not in _paste_install.stdout"
+  changed_when: "'Installing' in _paste_install.stdout"
 
 - import_role:
     name: jail
diff --git a/roles/jails/19_leolalla_fi/tasks/main.yml b/roles/jails/19_leolalla_fi/tasks/main.yml
index 413f930..4a33140 100644
--- a/roles/jails/19_leolalla_fi/tasks/main.yml
+++ b/roles/jails/19_leolalla_fi/tasks/main.yml
@@ -2,11 +2,10 @@
     name: jail
     tasks_from: jail_setup
 
-- name: Install gdrive-photo-gallery from port
-  shell: cd /usr/ports/www/gdrive-photo-gallery && make install BATCH=yes WRKDIRPREFIX=/tmp/ports DISTDIR=/tmp/distfiles
+- name: Install gdrive-photo-gallery
+  shell: pkg install -y -r poudriere gdrive-photo-gallery
   register: _gallery_install
-  failed_when: "_gallery_install.rc != 0 and 'already installed' not in _gallery_install.stdout"
-  changed_when: "'already installed' not in _gallery_install.stdout"
+  changed_when: "'Installing' in _gallery_install.stdout"
 
 - name: Deploy environment file
   template:
diff --git a/roles/jails/21_poudriere_repo/defaults/main.yml b/roles/jails/21_poudriere_repo/defaults/main.yml
new file mode 100644
index 0000000..108c494
--- /dev/null
+++ b/roles/jails/21_poudriere_repo/defaults/main.yml
@@ -0,0 +1,19 @@
+userland: "15.0-RELEASE"
+
+nullfs:
+  - src: /usr/local/share/poudriere/html
+    dst: /mnt/poudriere-html
+  - src: /usr/local/poudriere/data/logs
+    dst: /mnt/poudriere-logs
+  - src: /usr/local/poudriere/data/packages
+    dst: /mnt/poudriere-packages
+
+pkg:
+  - nginx
+
+files:
+  - src: usr_local_etc_nginx_nginx.conf
+    dest: /usr/local/etc/nginx/nginx.conf
+
+services:
+  - nginx
diff --git a/roles/jails/21_poudriere_repo/tasks/main.yml b/roles/jails/21_poudriere_repo/tasks/main.yml
new file mode 100644
index 0000000..3a8383d
--- /dev/null
+++ b/roles/jails/21_poudriere_repo/tasks/main.yml
@@ -0,0 +1,11 @@
+- import_role:
+    name: jail
+    tasks_from: jail_setup
+
+- name: Add log extension to mime.types
+  shell: sed -i '' -E 's|text/plain[\t\ ]*txt|text/plain txt log|g' /usr/local/etc/nginx/mime.types
+  changed_when: false
+
+- import_role:
+    name: jail
+    tasks_from: jail_launch
diff --git a/roles/jails/21_poudriere_repo/templates/usr_local_etc_nginx_nginx.conf b/roles/jails/21_poudriere_repo/templates/usr_local_etc_nginx_nginx.conf
new file mode 100644
index 0000000..5599ef9
--- /dev/null
+++ b/roles/jails/21_poudriere_repo/templates/usr_local_etc_nginx_nginx.conf
@@ -0,0 +1,33 @@
+worker_processes 1;
+
+events {
+    worker_connections 128;
+}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+    sendfile      on;
+
+    server {
+        listen 80;
+        server_name _;
+
+        root /mnt/poudriere-html;
+        index index.html;
+
+        location /data {
+            alias /mnt/poudriere-logs/bulk;
+            autoindex on;
+        }
+
+        location /packages {
+            alias /mnt/poudriere-packages/poudriere_build-quarterly/.latest;
+            autoindex on;
+        }
+
+        location / {
+            try_files $uri $uri/ =404;
+        }
+    }
+}