Rework

1 files changed, 0 insertions, 211 deletions

diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml
deleted file mode 100644
index 5945e42..0000000
--- a/tasks/jail_ingress.yml
+++ /dev/null
@@ -1,211 +0,0 @@
-- name: Ensure ingress goaccess mount points exist
-  file:
-    path: "{{ item }}"
-    state: directory
-    owner: root
-    group: wheel
-    mode: "0755"
-  loop:
-    - /usr/local/jails/containers/goaccess/var/www/goaccess
-    - /usr/local/jails/containers/ingress/mnt/www_goaccess
-
-- name: Start ingress jail
-  shell: service jail start ingress
-  register: ingress_jail_start
-  failed_when: false
-  changed_when: "'already running' not in ingress_jail_start.stderr"
-
-- name: Install packages inside jail
-  loop:
-    - { jail: ingress, package: nginx }
-    - { jail: ingress, package: py311-certbot }
-    - { jail: ingress, package: py311-certbot-nginx }
-    - { jail: ingress, package: goaccess }
-  include_tasks: pkg_jail_install.yml
-
-- name: Configure pf.conf
-  template:
-    src: ingress/etc_pf.conf.j2
-    dest: /usr/local/jails/containers/ingress/etc/pf.conf
-    owner: root
-    group: wheel
-    mode: "0644"
-  register: ingress_pf_conf
-
-- name: Reload pf.conf
-  shell: jexec ingress pfctl -f /etc/pf.conf
-  when: ingress_pf_conf.changed
-
-- name: Check if gateway mode is enabled
-  shell: jexec ingress sysrc gateway_enable | grep -q "YES"
-  register: ingress_gateway_enabled
-  failed_when: false
-  changed_when: false
-
-- name: Enable gateway mode
-  shell: jexec ingress sysrc gateway_enable=YES
-  when: ingress_gateway_enabled.rc != 0
-
-- name: Check if IP forwarding is enabled
-  shell: jexec ingress sysctl net.inet.ip.forwarding | grep -q "1"
-  register: ingress_ip_forwarding_enabled
-  failed_when: false
-  changed_when: false
-
-- name: Enable IP forwarding
-  shell: jexec ingress sysctl net.inet.ip.forwarding=1
-  when: ingress_ip_forwarding_enabled.rc != 0
-
-- name: Install pf-ban-socket.py
-  copy:
-    src: templates/ingress/pf-ban-socket.py
-    dest: /usr/local/jails/containers/ingress/usr/local/bin/pf-ban-socket.py
-    owner: root
-    group: wheel
-    mode: "0755"
-  register: ingress_pf_ban_socket_py
-
-- name: Install pf-ban-socket service
-  copy:
-    src: templates/ingress/usr_local_etc_rc.d_pf_ban_socket
-    dest: /usr/local/jails/containers/ingress/usr/local/etc/rc.d/pf_ban_socket
-    owner: root
-    group: wheel
-    mode: "0755"
-  register: ingress_pf_ban_socket_service
-
-- name: Check if pf enabled
-  shell: jexec ingress sysrc pf_enable | grep -q "YES"
-  register: ingress_pf_enabled
-  failed_when: false
-  changed_when: false
-
-- name: Enable pf
-  shell: jexec ingress sysrc pf_enable=YES
-  when: ingress_pf_enabled.rc != 0
-
-- name: Check if pf is running
-  shell: service -j ingress pf status
-  register: ingress_pf_status
-  changed_when: ingress_pf_status.rc != 0
-
-- name: Start pf
-  shell: service -j ingress pf start
-  when: ingress_pf_status.rc != 0
-
-- name: Enable pf-ban-socket service
-  shell: |
-    service -j ingress pf_ban_socket enable
-    service -j ingress pf_ban_socket restart
-  when: ingress_pf_ban_socket_service.changed or ingress_pf_ban_socket_py.changed
-
-- name: Copy acme-dns-auth.py
-  copy:
-    src: templates/ingress/acme-dns-auth.py
-    dest: /usr/local/jails/containers/ingress/usr/local/bin/acme-dns-auth.py
-    owner: root
-    group: wheel
-    mode: "0755"
-
-- name: Check if LetsEncrypt certs are generated
-  shell: ls /usr/local/jails/containers/ingress/usr/local/etc/letsencrypt/live/{{ cert_name }}
-  register: cert_exists
-  failed_when: false
-  changed_when: false
-
-- name: Manually get certs with certbot and DNS challenge
-  pause:
-    prompt: |
-      /usr/local/etc/letsencrypt/live/{{ cert_name }} does not exist. This means that this is the first run of this playbook.
-      The {{ cert_name }} cert contains all of the @ and * certs for all domains.
-      Check the ingress crontab template and run the certbot command manually in the ingress jail. Remove the "-n" flag.
-      Add the requested DNS records manually into Hetzner DNS. Continue after this is done.
-  when: cert_exists.rc != 0
-
-- name: Configure nginx.conf
-  template:
-    src: ingress/usr_local_etc_nginx_nginx.conf.j2
-    dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf
-    owner: root
-    group: wheel
-    mode: "0644"
-  register: nginx_conf
-
-- name: Create nginx snippets directory
-  file:
-    path: "/usr/local/jails/containers/ingress/usr/local/etc/nginx/snippets"
-    state: directory
-    owner: root
-    group: wheel
-    mode: "0755"
-
-- name: Include ban.inc
-  template:
-    src: ingress/nginx_snippet_ban.inc
-    dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/snippets/ban.inc
-    owner: root
-    group: wheel
-    mode: "0644"
-
-- name: Create static directories
-  loop: "{{ ingress_routes | selectattr('static', 'defined') | map(attribute='static') | unique | list }}"
-  file:
-    path: "/usr/local/jails/containers/ingress{{ item }}"
-    state: directory
-    recurse: yes
-    owner: 80
-    group: 80
-    mode: "0755"
-
-- name: Check if nginx is enabled
-  shell: service -j ingress nginx status
-  changed_when: false
-  failed_when: false
-  register: ingress_nginx_enabled
-
-- name: Enable and start nginx
-  shell: |
-    service -j ingress nginx enable
-    service -j ingress nginx restart
-  when: ingress_nginx_enabled.rc != 0 or nginx_conf.changed
-
-- name: Install hetzner_ddns.sh
-  template:
-    src: ingress/usr_local_bin_hetzner_ddns.sh.j2
-    dest: /usr/local/jails/containers/ingress/usr/local/bin/hetzner_ddns.sh
-    owner: root
-    group: wheel
-    mode: "0755"
-
-- name: Set up hetzner_auth
-  template:
-    src: ingress/usr_local_etc_hetzner_auth.j2
-    dest: /usr/local/jails/containers/ingress/usr/local/etc/hetzner_auth
-    owner: root
-    group: wheel
-    mode: "0600"
-
-- name: Set up gen_goaccess.sh
-  template:
-    src: ingress/usr_local_bin_gen_goaccess.sh.j2
-    dest: /usr/local/jails/containers/ingress/usr/local/bin/gen_goaccess.sh
-    owner: root
-    group: wheel
-    mode: "0755"
-
-- name: Set up crontab
-  template:
-    src: ingress/etc_crontab.j2
-    dest: /usr/local/jails/containers/ingress/etc/crontab
-    owner: root
-    group: wheel
-    mode: "0644"
-  vars:
-    tls_hosts: "{{ ingress_routes | map(attribute='host') | unique }}"
-  register: jail_ingress_etc_crontab
-
-- name: Restart cron
-  service:
-    name: cron
-    state: restarted
-  when: jail_ingress_etc_crontab.changed