Set up jails infra

4 files changed, 108 insertions, 3 deletions

diff --git a/tasks/jail_datasets.yml b/tasks/jail_datasets.yml
new file mode 100644
index 0000000..9466c46
--- /dev/null
+++ b/tasks/jail_datasets.yml
@@ -0,0 +1,14 @@
+- name: "Check if dataset {{ dataset.name }} exists"
+  shell: zfs list -o name | grep -Fxq "{{ dataset.name }}"
+  changed_when: false
+  failed_when: false
+  register: check_dataset_exists
+
+- name: "Create ZFS dataset {{ dataset.name }}"
+  shell: |
+    {% if dataset.mountpoint is defined %}
+    zfs create -o "mountpoint={{ dataset.mountpoint }}" -p "{{ dataset.name }}"
+    {% else %}
+    zfs create -p "{{ dataset.name }}"
+    {% endif %}
+  when: check_dataset_exists.rc != 0
diff --git a/tasks/jail_single.yml b/tasks/jail_single.yml
new file mode 100644
index 0000000..807f6a8
--- /dev/null
+++ b/tasks/jail_single.yml
@@ -0,0 +1,19 @@
+- name: "Check if jail directory for {{ jail.name }} exists"
+  shell: zfs list -o name | grep -Fxq "zroot/jails/containers/{{ jail.name }}"
+  failed_when: false
+  changed_when: false
+  register: check_jail_directory
+
+- name: "ZFS clone snapshot to jail directory for {{ jail.name }}"
+  shell: zfs clone zroot/jails/templates/14.3-RELEASE@base "zroot/jails/containers/{{ jail.name }}"
+  when: check_jail_directory.rc != 0
+
+- name: "Check if jail {{ jail.name }} is running"
+  shell: jls -j "{{ jail.name }}"
+  failed_when: false
+  changed_when: false
+  register: check_jail_active
+
+- name: "Start jail {{ jail.name }}"
+  shell: service jail start "{{ jail.name }}"
+  when: check_jail_active.rc != 0
diff --git a/tasks/jails.yml b/tasks/jails.yml
index 09f1d4c..46744d6 100644
--- a/tasks/jails.yml
+++ b/tasks/jails.yml
@@ -1,7 +1,80 @@
-- name: Ensure /usr/jails exists
+- name: Ensure jails directory exists
   file:
-    path: /usr/jails
+    path: /usr/local/jails
     state: directory
     owner: root
     group: wheel
     mode: "0755"
+
+- name: Create ZFS datasets
+  loop:
+    - { name: "zroot/jails", mountpoint: "/usr/local/jails" }
+    - { name: "zroot/jails/media" }
+    - { name: "zroot/jails/templates" }
+    - { name: "zroot/jails/templates/14.3-RELEASE" }
+    - { name: "zroot/jails/containers" }
+  loop_control:
+    loop_var: dataset
+  include_tasks: jail_datasets.yml
+
+- name: Check if userland snapshot already exists
+  shell: zfs list -t snapshot -o name | grep -Fxq "zroot/jails/templates/14.3-RELEASE@base"
+  failed_when: false
+  changed_when: false
+  register: zfs_userland_check
+
+- name: Set up userland
+  when: zfs_userland_check.rc != 0
+  block:
+    - name: Download userland
+      get_url:
+        url: https://download.freebsd.org/ftp/releases/amd64/amd64/14.3-RELEASE/base.txz
+        dest: /usr/local/jails/media/14.3-RELEASE-base.txz
+        owner: root
+        group: wheel
+        mode: "0644"
+
+    - name: Unarchive userland
+      shell: tar -xzf /usr/local/jails/media/14.3-RELEASE-base.txz -C /usr/local/jails/templates/14.3-RELEASE
+
+    - name: Copy localtime and resolv.conf to jail userland
+      copy:
+        remote_src: true
+        src: "{{ item }}"
+        dest: "/usr/local/jails/templates/14.3-RELEASE{{ item }}"
+      loop:
+        - /etc/resolv.conf
+        - /etc/localtime
+
+    - name: Update userland to latest patch level
+      shell: freebsd-update -b /usr/local/jails/templates/14.3-RELEASE/ fetch install
+
+    - name: Create userland ZFS snapshot
+      shell: zfs snapshot zroot/jails/templates/14.3-RELEASE@base
+
+- name: Configure jails
+  vars:
+    jails:
+      - { name: nginx_test, ip: "192.168.2.1" }
+  block:
+    - name: Configure jail.conf
+      template:
+        src: etc_jail.conf.j2
+        dest: /etc/jail.conf
+        owner: root
+        group: wheel
+        mode: "0644"
+
+    - name: Configure individual jails
+      loop: "{{ jails }}"
+      loop_control:
+        loop_var: jail
+      include_tasks: jail_single.yml
+
+- name: Enable jails
+  community.general.sysrc:
+    name: "{{ item }}"
+    value: "YES"
+  loop:
+    - "jail_enable"
+    - "jail_parallel_start"
diff --git a/tasks/network.yml b/tasks/network.yml
index cd9a148..7f75de6 100644
--- a/tasks/network.yml
+++ b/tasks/network.yml
@@ -12,7 +12,6 @@
     - { name: "ifconfig_wan0", value: "DHCP" }
     - { name: "ifconfig_lan0_ipv6", value: "inet6 accept_rtadv" }
     - { name: "ifconfig_wan0_ipv6", value: "inet6 accept_rtadv" }
-    - { name: "ifconfig_lan0_alias0", value: "inet 10.0.0.1/32" }
   register: ifconfig_sysrc
 
 - name: Restart networking if interface configuration changed