aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--roles/host/templates/etc_rc.conf.j28
-rw-r--r--roles/host/templates/usr_local_bin_update_ports.sh.j23
-rw-r--r--roles/jails/01_ingress/defaults/main.yml5
-rw-r--r--roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j226
-rw-r--r--roles/jails/23_marikajajan/defaults/main.yml21
-rw-r--r--roles/jails/23_marikajajan/handlers/main.yml1
-rw-r--r--roles/jails/23_marikajajan/tasks/main.yml7
-rw-r--r--roles/jails/23_marikajajan/templates/usr_local_etc_nginx_nginx.conf.j231
8 files changed, 83 insertions, 19 deletions
diff --git a/roles/host/templates/etc_rc.conf.j2 b/roles/host/templates/etc_rc.conf.j2
index 985ec41..2fa289d 100644
--- a/roles/host/templates/etc_rc.conf.j2
+++ b/roles/host/templates/etc_rc.conf.j2
@@ -19,6 +19,7 @@ ifconfig_lan0_ipv6="inet6 accept_rtadv"
ifconfig_wan0="up"
ifconfig_brlan0="addm lan0 up"
ifconfig_brwan0="addm wan0 up"
+kld_list="pf if_wg fdescfs linux64"
{% else %}
ifconfig_bridge0_name="brlan0"
ifconfig_bridge1_name="brwan0"
@@ -26,6 +27,7 @@ ifconfig_vtnet0="inet {{ lan_ipv4_cidr }}"
ifconfig_vtnet0_ipv6="inet6 accept_rtadv"
ifconfig_brlan0="addm vtnet0 up"
ifconfig_brwan0="up"
+kld_list="pf if_wg linux64"
{% endif %}
zpool_gpt_labels_enable="YES"
smartd_enable="YES"
@@ -40,8 +42,4 @@ clear_tmp_enable="YES"
cleanvar_enable="YES"
auditd_enable="YES"
devd_enable="YES"
-{% if is_prod %}
-kld_list="pf if_wg fdescfs linux64"
-{% else %}
-kld_list="pf if_wg linux64"
-{% endif %}
+netdata_enable="YES"
diff --git a/roles/host/templates/usr_local_bin_update_ports.sh.j2 b/roles/host/templates/usr_local_bin_update_ports.sh.j2
index 1a512af..7f6522e 100644
--- a/roles/host/templates/usr_local_bin_update_ports.sh.j2
+++ b/roles/host/templates/usr_local_bin_update_ports.sh.j2
@@ -10,7 +10,7 @@ usage() {
BASEDIR=/usr/ports
REMOTE_QUARTERLY="https://github.com/freebsd/freebsd-ports.git"
-REMOTE_CUSTOM="https://github.com/jantuomi/freebsd-ports-custom.git"
+REMOTE_CUSTOM="http://{{ jail_ips.forge }}/freebsd-ports-custom.git"
case "$1" in
quarterly)
@@ -46,6 +46,7 @@ custom)
# Clone or update
if [ -d "${BASEDIR}/custom/.git" ]; then
echo "Updating custom ports overlay..."
+ git -C "${BASEDIR}/custom" remote set-url origin "$REMOTE_CUSTOM"
git -C "${BASEDIR}/custom" fetch origin
git -C "${BASEDIR}/custom" reset --hard origin/main
else
diff --git a/roles/jails/01_ingress/defaults/main.yml b/roles/jails/01_ingress/defaults/main.yml
index 0ec6006..5a187a1 100644
--- a/roles/jails/01_ingress/defaults/main.yml
+++ b/roles/jails/01_ingress/defaults/main.yml
@@ -27,6 +27,8 @@ ingress_routes:
- { host: komga.jan.systems, jail: komga }
- { host: poudriere.jan.systems, jail: poudriere_repo }
- { host: forge.jan.systems, jail: forge }
+ - { host: marikajajan.fi, jail: marikajajan }
+ - { host: www.marikajajan.fi, jail: marikajajan }
cert_domains:
- "jan.systems"
@@ -37,6 +39,8 @@ cert_domains:
- "*.sydanviita.fi"
- "leolalla.fi"
- "*.leolalla.fi"
+ - "marikajajan.fi"
+ - "*.marikajajan.fi"
cert_name: "{{ cert_domains[0] }}"
contact_email: jan@sydanviita.fi
@@ -49,6 +53,7 @@ pkg:
- nginx
- py312-certbot
- py312-certbot-nginx
+ - curl
files:
- src: acme-dns-auth.py
diff --git a/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 b/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2
index c154f2c..d8c44eb 100644
--- a/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2
+++ b/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2
@@ -15,19 +15,27 @@ http {
server_name _;
root /usr/local/www/cgit;
- try_files $uri @cgit;
+
+ # Block HTTP access to private (dot-prefixed) repos
+ location ~ ^/\..+ {
+ return 403;
+ }
# Anonymous git HTTP clone
- location ~ ^/(.+\.git)/(HEAD|info/refs|objects/.*|git-upload-pack)$ {
+ location ~ ^/(.+\.git)/(info/refs|git-upload-pack)$ {
include fastcgi_params;
- fastcgi_param SCRIPT_FILENAME /usr/local/bin/git-http-backend;
- fastcgi_param GIT_HTTP_EXPORT_ALL "";
+ fastcgi_param SCRIPT_FILENAME /usr/local/libexec/git-core/git-http-backend;
+ fastcgi_param GIT_HTTP_EXPORT_ALL 1;
fastcgi_param GIT_PROJECT_ROOT /var/db/repos;
fastcgi_param GIT_CONFIG_GLOBAL /usr/local/etc/git/gitconfig-www;
- fastcgi_param PATH_INFO /$1/$2;
+ fastcgi_param PATH_INFO $uri;
fastcgi_pass unix:/var/run/fcgiwrap/fcgiwrap.sock;
}
+ location / {
+ try_files $uri @cgit;
+ }
+
location @cgit {
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME /usr/local/www/cgit/cgit.cgi;
@@ -36,13 +44,5 @@ http {
fastcgi_param GIT_CONFIG_GLOBAL /usr/local/etc/git/gitconfig-www;
fastcgi_pass unix:/var/run/fcgiwrap/fcgiwrap.sock;
}
-
- location /cgit.css {
- root /usr/local/www/cgit;
- }
-
- location /cgit.png {
- root /usr/local/www/cgit;
- }
}
}
diff --git a/roles/jails/23_marikajajan/defaults/main.yml b/roles/jails/23_marikajajan/defaults/main.yml
new file mode 100644
index 0000000..0a96f97
--- /dev/null
+++ b/roles/jails/23_marikajajan/defaults/main.yml
@@ -0,0 +1,21 @@
+userland: "15.1-RELEASE"
+
+zfs:
+ - name: marikajajan_html
+ owner: "80" # www
+ group: "80"
+
+nullfs:
+ - src: marikajajan_html
+ dst: /var/www/marikajajan
+
+pkg:
+ - pcre2
+ - nginx
+
+files:
+ - src: usr_local_etc_nginx_nginx.conf.j2
+ dest: /usr/local/etc/nginx/nginx.conf
+
+services:
+ - nginx
diff --git a/roles/jails/23_marikajajan/handlers/main.yml b/roles/jails/23_marikajajan/handlers/main.yml
new file mode 100644
index 0000000..ed97d53
--- /dev/null
+++ b/roles/jails/23_marikajajan/handlers/main.yml
@@ -0,0 +1 @@
+---
diff --git a/roles/jails/23_marikajajan/tasks/main.yml b/roles/jails/23_marikajajan/tasks/main.yml
new file mode 100644
index 0000000..690eb5a
--- /dev/null
+++ b/roles/jails/23_marikajajan/tasks/main.yml
@@ -0,0 +1,7 @@
+- import_role:
+ name: jail
+ tasks_from: jail_setup
+
+- import_role:
+ name: jail
+ tasks_from: jail_launch
diff --git a/roles/jails/23_marikajajan/templates/usr_local_etc_nginx_nginx.conf.j2 b/roles/jails/23_marikajajan/templates/usr_local_etc_nginx_nginx.conf.j2
new file mode 100644
index 0000000..24f6a01
--- /dev/null
+++ b/roles/jails/23_marikajajan/templates/usr_local_etc_nginx_nginx.conf.j2
@@ -0,0 +1,31 @@
+worker_processes auto;
+
+events {
+ worker_connections 1024;
+}
+
+http {
+ include mime.types;
+ default_type application/octet-stream;
+
+ sendfile on;
+ keepalive_timeout 65;
+
+ server {
+ listen 80;
+ server_name www.marikajajan.fi;
+ return 301 http://marikajajan.fi$request_uri;
+ }
+
+ server {
+ listen 80;
+ server_name marikajajan.fi;
+
+ root /var/www/marikajajan;
+ index index.html;
+
+ location / {
+ try_files $uri $uri/ =404;
+ }
+ }
+}

Want to contribute? Host your changes somewhere and send me the link: jan (at) sydanviita.fi. Also, check out my website.


forge.jan.systems — powered by cgit