diff options
| author | Jan Tuomi <jan@jantuomi.fi> | 2025-10-22 22:45:15 +0300 |
|---|---|---|
| committer | Jan Tuomi <jan@jantuomi.fi> | 2025-10-22 22:45:15 +0300 |
| commit | 5263aa814da9852294ea64c77af22a1cd2507fca (patch) | |
| tree | 4bfec8e587cb34b803cb14f6d32fa3ee7381a118 /tasks | |
| parent | fea0aff43b6c7cc14ba848f97afb17999ff65c17 (diff) | |
Improvements
Diffstat (limited to 'tasks')
| -rw-r--r-- | tasks/jail_ingress.yml | 31 | ||||
| -rw-r--r-- | tasks/jails.yml | 8 |
2 files changed, 39 insertions, 0 deletions
diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml index 71d87fa..87dff41 100644 --- a/tasks/jail_ingress.yml +++ b/tasks/jail_ingress.yml @@ -6,6 +6,29 @@ - { jail: ingress, package: goaccess } include_tasks: pkg_jail_install.yml +- name: Configure pf.conf + template: + src: ingress/etc_pf.conf.j2 + dest: /usr/local/jails/containers/ingress/etc/pf.conf + owner: root + group: wheel + mode: "0644" + +- name: Enable gateway mode + shell: jexec ingress sysrc gateway_enable=YES && jexec ingress sysctl net.inet.ip.forwarding=1 + +- name: Enable pf + shell: jexec ingress sysrc pf_enable=YES + +- name: Check if pf is running + shell: service -j ingress pf status + register: pf_status + changed_when: pf_status.rc != 0 + +- name: Start pf + shell: service -j ingress pf start + when: pf_status.rc != 0 + - name: Generate LetsEncrypt certs shell: jexec ingress certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ item }} loop: "{{ ingress_routes | map(attribute='host') | unique }}" @@ -59,6 +82,14 @@ group: wheel mode: "0600" +- name: Set up gen_goaccess.sh + template: + src: ingress/usr_local_bin_gen_goaccess.sh.j2 + dest: /usr/local/jails/containers/ingress/usr/local/bin/gen_goaccess.sh + owner: root + group: wheel + mode: "0755" + - name: Set up crontab template: src: ingress/etc_crontab.j2 diff --git a/tasks/jails.yml b/tasks/jails.yml index 99eb938..fe94126 100644 --- a/tasks/jails.yml +++ b/tasks/jails.yml @@ -67,6 +67,14 @@ group: wheel mode: "0644" + - name: Configure devfs.rules + template: + src: etc_devfs.rules.j2 + dest: /etc/devfs.rules + owner: root + group: wheel + mode: "0644" + - name: Configure individual jails loop: "{{ jails }}" loop_control: |