Work on networking

7 files changed, 130 insertions, 8 deletions

diff --git a/templates/etc_jail.conf.j2 b/templates/etc_jail.conf.j2
index 708e5c1..0b8c18b 100644
--- a/templates/etc_jail.conf.j2
+++ b/templates/etc_jail.conf.j2
@@ -12,7 +12,7 @@ exec.prestart    += "ifconfig ${epl}a up";
 exec.prestart    += "ifconfig brlan0 addm ${epl}a";
 exec.clean;
 exec.start        = "/bin/sh /etc/rc";
-exec.poststart    = "jexec ${name} ifconfig ${epl}b 192.168.2.${num}/16";
+exec.poststart    = "jexec ${name} ifconfig ${epl}b 192.168.2.${num}/16 up";
 exec.poststart   += "jexec ${name} route add default 192.168.0.1 || echo 'Failed to add default route'";
 exec.stop         = "/bin/sh /etc/rc.shutdown";
 exec.poststop    += "ifconfig ${epl}b -vnet $name"; # workaround to bug 238326: move ${epl}b from the jail to the host when stopping jail services
@@ -32,6 +32,10 @@ path = "/usr/local/jails/containers/${name}";
 {% for jail in jails %}
 {{ jail.name }} {
   $num           = "{{ jail.num }}";
+  {% if jail.name == "ingress" %}
+  exec.poststart    = "jexec ${name} ifconfig ${epl}b 192.168.2.${num}/16 up";
+  exec.poststart    = "jexec ${name} ifconfig epw1b up";
+  exec.poststart   += "jexec ${name} service dhclient restart epw1b";
+  {% endif %}
 }
-
 {% endfor %}
diff --git a/templates/etc_resolv.conf.j2 b/templates/etc_resolv.conf.j2
index 29f6bf6..9232f25 100644
--- a/templates/etc_resolv.conf.j2
+++ b/templates/etc_resolv.conf.j2
@@ -1,3 +1,2 @@
 search {{ lan_search_domain }}
 nameserver {{ lan_ipv4_gateway }}
-nameserver 8.8.8.8
diff --git a/templates/usr_local_bin_hetzner_ddns.sh.j2 b/templates/usr_local_bin_hetzner_ddns.sh.j2
new file mode 100644
index 0000000..aee1016
--- /dev/null
+++ b/templates/usr_local_bin_hetzner_ddns.sh.j2
@@ -0,0 +1,66 @@
+#!/bin/sh
+# Minimal Hetzner DNS updater for pfSense/FreeBSD
+# - Always updates on startup (no pre-check)
+# - Then polls and only updates when IP changes
+# - Keeps last IP only in memory (no files)
+
+# --- CONFIG ---------------------------------------------------------------
+API_TOKEN="$(cat /usr/local/etc/hetzner_auth)"
+ZONE_ID="{{ hetzner_zone_id }}"
+RECORD_ID="{{ hetzner_record_id }}"
+RECORD_NAME=pursotin
+RECORD_TYPE="A"
+IFACE_CMD="ifconfig epw1b"
+
+POLL_INTERVAL=60
+API_BASE="https://dns.hetzner.com/api/v1"
+TTL="300"
+# --------------------------------------------------------------------------
+
+get_ip() {
+  # Expect FreeBSD-style ifconfig output; grab first IPv4 addr
+  # Example: 'inet 192.0.2.3 ...'
+  sh -c "$IFACE_CMD" 2>/dev/null | awk '/inet[[:space:]]/ {print $2; exit}'
+}
+
+update_record() {
+  ip="$1"
+  body=$(printf '{"type":"%s","name":"%s","value":"%s","zone_id":"%s","ttl":%s}' \
+               "$RECORD_TYPE" "$RECORD_NAME" "$ip" "$ZONE_ID" "$TTL")
+
+  http_code=$(
+    curl -sS -o /dev/null -w "%{http_code}" -X PUT \
+      -H "Content-Type: application/json" \
+      -H "Auth-API-Token: ${API_TOKEN}" \
+      --data "$body" \
+      "${API_BASE}/records/${RECORD_ID}"
+  )
+
+  [ "$http_code" = "200" ] || {
+    echo "$(date -u +"%F %T") update failed (HTTP $http_code)" >&2
+    return 1
+  }
+
+  echo "$(date -u +"%F %T") updated ${RECORD_NAME} to ${ip}"
+  return 0
+}
+
+# --- Startup: always update once (no check) --------------------------------
+last_ip=""
+ip="$(get_ip)"
+if [ -n "$ip" ]; then
+  update_record "$ip" && last_ip="$ip"
+else
+  echo "$(date -u +"%F %T") no IPv4 from: ${IFACE_CMD}; will retry..." >&2
+fi
+
+# --- Poll loop: update only on change --------------------------------------
+while :; do
+  ip="$(get_ip)"
+  if [ -n "$ip" ] && [ "$ip" != "$last_ip" ]; then
+    if update_record "$ip"; then
+      last_ip="$ip"
+    fi
+  fi
+  sleep "$POLL_INTERVAL"
+done
diff --git a/templates/usr_local_etc_do_dyndns_auth.j2 b/templates/usr_local_etc_do_dyndns_auth.j2
deleted file mode 100644
index 2a9cbc5..0000000
--- a/templates/usr_local_etc_do_dyndns_auth.j2
+++ /dev/null
@@ -1 +0,0 @@
-{{ do_api_token }}
diff --git a/templates/usr_local_etc_hetzner_auth.j2 b/templates/usr_local_etc_hetzner_auth.j2
new file mode 100644
index 0000000..129dccf
--- /dev/null
+++ b/templates/usr_local_etc_hetzner_auth.j2
@@ -0,0 +1 @@
+{{ hetzner_pat }}
diff --git a/templates/usr_local_etc_nginx_nginx.conf.j2 b/templates/usr_local_etc_nginx_nginx.conf.j2
index 55c55df..cee7878 100644
--- a/templates/usr_local_etc_nginx_nginx.conf.j2
+++ b/templates/usr_local_etc_nginx_nginx.conf.j2
@@ -22,17 +22,23 @@ http {
 
     {% for site in static_sites -%}
     {% if site.tls -%}
-    {#server {
-        listen 443 ssl;
+    server {
         server_name {{ site.host }};
-
         root /usr/local/www/{{ site.site }};
+
+        listen 443 ssl;
+        listen [::]:443 ssl;
+        http2 on;
+
         index index.html;
 
         location / {
             try_files $uri $uri.html $uri/ =404;
         }
 
+        # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
+        add_header Strict-Transport-Security "max-age=63072000" always;
+
         access_log /var/log/nginx/{{ site.site }}/access.log;
         error_log /var/log/nginx/{{ site.site }}/error.log;
 
@@ -41,7 +47,6 @@ http {
         include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
         ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
     }
-    #}
     {% endif -%}
 
     server {
diff --git a/templates/usr_local_etc_rc.d_hetzner_ddns.j2 b/templates/usr_local_etc_rc.d_hetzner_ddns.j2
new file mode 100644
index 0000000..ccbbb8c
--- /dev/null
+++ b/templates/usr_local_etc_rc.d_hetzner_ddns.j2
@@ -0,0 +1,48 @@
+#!/bin/sh
+#
+# PROVIDE: hetzner_ddns
+# REQUIRE: NETWORKING
+# KEYWORD: shutdown
+
+# Enable via:
+#   hetzner_ddns_enable="YES"
+#
+# (pfSense: System -> Advanced -> System Tunables or /etc/rc.conf)
+
+. /etc/rc.subr
+
+name="hetzner_ddns"
+rcvar=hetzner_ddns_enable
+
+load_rc_config $name
+
+: ${hetzner_ddns_enable:="NO"}
+: ${hetzner_ddns_user:="root"}
+: ${hetzner_ddns_command:="/usr/local/bin/hetzner-ddns.sh"}
+
+start_cmd="${name}_start"
+stop_cmd="${name}_stop"
+status_cmd="${name}_status"
+
+hetzner_ddns_start() {
+  echo "Starting ${name}..."
+  /usr/sbin/daemon -t "${name}" -u "${hetzner_ddns_user}" ${hetzner_ddns_command}
+}
+
+hetzner_ddns_stop() {
+  echo "Stopping ${name}..."
+  # First try by daemon title, then by command as fallback
+  pkill -f "^daemon: ${name}$" || pkill -f "${hetzner_ddns_command}"
+}
+
+hetzner_ddns_status() {
+  if pgrep -f "^daemon: ${name}$" >/dev/null 2>&1 || pgrep -f "${hetzner_ddns_command}" >/dev/null 2>&1; then
+    echo "${name} is running"
+    return 0
+  else
+    echo "${name} is not running"
+    return 1
+  fi
+}
+
+run_rc_command "$1"