Initial impl of vnet jails

5 files changed, 88 insertions, 56 deletions

diff --git a/tasks/general.yml b/tasks/general.yml
index 3c55117..9361217 100644
--- a/tasks/general.yml
+++ b/tasks/general.yml
@@ -4,11 +4,9 @@
     state: present
   loop:
     - rsync
-    - nginx
     - dma
     - jq
     - curl
-    - py311-certbot
 
 - name: Set up periodic.conf
   template:
diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml
new file mode 100644
index 0000000..1a87722
--- /dev/null
+++ b/tasks/jail_ingress.yml
@@ -0,0 +1,64 @@
+- name: Install packages inside ingress jail
+  loop:
+    - { jail: ingress, package: nginx }
+    - { jail: ingress, package: py311-certbot }
+  include_tasks: pkg_jail_install.yml
+
+- name: Configure nginx.conf
+  template:
+    src: usr_local_etc_nginx_nginx.conf.j2
+    dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+  register: nginx_conf
+
+- name: Create static sites log dir
+  file:
+    path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }}
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0755"
+  loop: "{{ static_sites | map(attribute='site') | unique }}"
+
+- name: Create access.log for static sites
+  file:
+    path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }}/access.log
+    state: touch
+    owner: root
+    group: wheel
+    mode: "0644"
+  loop: "{{ static_sites | map(attribute='site') | unique }}"
+
+- name: Create error.log for static sites
+  file:
+    path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }}/error.log
+    state: touch
+    owner: root
+    group: wheel
+    mode: "0644"
+  loop: "{{ static_sites | map(attribute='site') | unique }}"
+
+#- name: Generate LetsEncrypt certs
+#  shell: jexec ingress certbot certonly --standalone -n -m jan@jantuomi.fi --agree-tos -d {{ item }}
+#  loop: "{{ static_sites | selectattr('tls') | map(attribute='host') }}"
+#  when: nginx_conf.changed
+
+- name: Copy over static HTML
+  ansible.posix.synchronize:
+    src: "{{ item.value.rstrip('/') + '/' }}"
+    dest: /usr/local/jails/containers/ingress/usr/local/www/{{ item.key }}
+  loop: "{{ static_site_dirs | dict2items }}"
+
+- name: Check if nginx is enabled
+  shell: service -j ingress nginx status
+  changed_when: false
+  failed_when: false
+  register: ingress_nginx_enabled
+
+- name: Enable and start nginx
+  shell: |
+    service -j ingress nginx enable
+    service -j ingress nginx onestart
+  when: ingress_nginx_enabled.rc != 0
diff --git a/tasks/jails.yml b/tasks/jails.yml
index 8233dc5..7cbe707 100644
--- a/tasks/jails.yml
+++ b/tasks/jails.yml
@@ -37,18 +37,23 @@
     - name: Unarchive userland
       shell: tar -xzf /usr/local/jails/media/{{ jail_userland_version }}-base.txz -C /usr/local/jails/templates/{{ jail_userland_version }}
 
-    - name: Copy localtime and resolv.conf to jail userland
+    - name: Copy localtime to jail userland
       copy:
         remote_src: true
-        src: "{{ item }}"
-        dest: "/usr/local/jails/templates/{{ jail_userland_version }}{{ item }}"
-      loop:
-        - /etc/resolv.conf
-        - /etc/localtime
+        src: /etc/localtime
+        dest: /usr/local/jails/templates/{{ jail_userland_version }}/etc/localtime
+
+    - name: Copy resolv.conf to jail userland
+      shell: |
+        cat /etc/resolv.conf > /usr/local/jails/templates/{{ jail_userland_version }}/etc/resolv.conf
+        chmod 644 /usr/local/jails/templates/{{ jail_userland_version }}/etc/resolv.conf
 
     - name: Update userland to latest patch level
       shell: freebsd-update -b /usr/local/jails/templates/{{ jail_userland_version }}/ fetch install
 
+    - name: Disable syslogd in the template
+      shell: echo 'syslogd_enable="NO"' >> /usr/local/jails/templates/{{ jail_userland_version }}/etc/rc.conf
+
     - name: Create userland ZFS snapshot
       shell: zfs snapshot zroot/jails/templates/{{ jail_userland_version }}@base
 
@@ -67,3 +72,6 @@
       loop_control:
         loop_var: jail
       include_tasks: jail_single.yml
+
+- name: Configure ingress jail
+  include_tasks: jail_ingress.yml
diff --git a/tasks/network.yml b/tasks/network.yml
index ed57a13..a8749a7 100644
--- a/tasks/network.yml
+++ b/tasks/network.yml
@@ -12,7 +12,7 @@
   when: resolv_conf.changed
 
 - name: Restart networking if interface configuration changed
-  shell: service netif restart && service routing restart
+  shell: service netif restart && service routing restart && service dhclient restart wan0
   when: rc_conf.changed or resolv_conf.changed
 
 - name: Set up sshd
@@ -67,53 +67,6 @@
   shell: pfctl -f /etc/pf.conf
   when: pf_conf.changed
 
-- name: Configure nginx.conf
-  template:
-    src: usr_local_etc_nginx_nginx.conf.j2
-    dest: /usr/local/etc/nginx/nginx.conf
-    owner: root
-    group: wheel
-    mode: "0644"
-  register: nginx_conf
-
-- name: Generate LetsEncrypt certs
-  shell: certbot certonly --standalone -n -m jan@jantuomi.fi --agree-tos -d {{ item }}
-  loop: "{{ static_sites | selectattr('tls') | map(attribute='host') }}"
-  when: nginx_conf.changed
-
-- name: Copy over jan.systems HTML
-  ansible.posix.synchronize:
-    src: "{{ jan_systems_html_dir.rstrip('/') + '/' }}"
-    dest: /usr/local/www/jan.systems
-
-- name: Start nginx
-  service:
-    name: nginx
-    state: started
-  register: started_nginx
-
-- name: Restart nginx
-  service:
-    name: nginx
-    state: restarted
-  when: not started_nginx.changed and nginx_conf.changed
-
-- name: Set up restore_jail_aliases.sh
-  template:
-    src: usr_local_bin_restore_jail_aliases.sh.j2
-    dest: /usr/local/bin/restore_jail_aliases.sh
-    owner: root
-    group: wheel
-    mode: "0755"
-
-- name: Set up devd lan0_jail_restore.conf
-  template:
-    src: etc_devd_lan0_jail_restore.conf.j2
-    dest: /etc/devd/lan0_jail_restore.conf
-    owner: root
-    group: wheel
-    mode: "0644"
-
 - name: Set up /usr/local/etc/do_dyndns_auth
   template:
     src: usr_local_etc_do_dyndns_auth.j2
diff --git a/tasks/pkg_jail_install.yml b/tasks/pkg_jail_install.yml
new file mode 100644
index 0000000..0315a03
--- /dev/null
+++ b/tasks/pkg_jail_install.yml
@@ -0,0 +1,9 @@
+- name: Check if {{ item.package }} is installed
+  shell: pkg -j {{ item.jail }} info {{ item.package }}
+  register: pkg_jail_installed
+  changed_when: false
+  failed_when: false
+
+- name: Install {{ item.package }}
+  shell: pkg -j {{ item.jail }} install -y {{ item.package }}
+  when: pkg_jail_installed.rc != 0