aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--inventory/prod/hosts.yml1
-rw-r--r--inventory/test/hosts.yml1
-rw-r--r--roles/host/tasks/main.yml182
-rw-r--r--roles/host/tasks/poudriere.yml93
-rw-r--r--roles/host/tasks/userland.yml2
-rw-r--r--roles/host_prod/tasks/main.yml38
-rw-r--r--roles/jail/tasks/jail_setup.yml11
-rw-r--r--roles/jails/01_ingress/defaults/main.yml5
-rw-r--r--roles/jails/01_ingress/handlers/main.yml4
-rw-r--r--roles/jails/01_ingress/tasks/main.yml9
-rw-r--r--roles/jails/21_poudriere_repo/defaults/main.yml2
11 files changed, 186 insertions, 162 deletions
diff --git a/inventory/prod/hosts.yml b/inventory/prod/hosts.yml
index 1a2a83f..c6f5fa9 100644
--- a/inventory/prod/hosts.yml
+++ b/inventory/prod/hosts.yml
@@ -10,6 +10,7 @@ all:
nic_wan: igc1
lan_ipv4_gateway: "192.168.0.1"
lan_ipv4_cidr: "192.168.0.10/16"
+ poudriere_repo_ip: "192.168.2.21"
is_prod: true
jails:
vars:
diff --git a/inventory/test/hosts.yml b/inventory/test/hosts.yml
index b03dcfc..d9f5bfb 100644
--- a/inventory/test/hosts.yml
+++ b/inventory/test/hosts.yml
@@ -15,6 +15,7 @@ all:
dns_nameserver: "10.0.20.1"
lan_ipv4_gateway: "10.0.20.1"
lan_ipv4_cidr: "10.0.20.2/24"
+ poudriere_repo_ip: "10.0.20.121"
is_prod: false
jails:
vars:
diff --git a/roles/host/tasks/main.yml b/roles/host/tasks/main.yml
index 4bcdfdd..86e33cf 100644
--- a/roles/host/tasks/main.yml
+++ b/roles/host/tasks/main.yml
@@ -14,7 +14,7 @@
- name: Set FreeBSD version fact
set_fact:
- poudriere_freebsd_version: "{{ _freebsd_version_result.stdout }}"
+ poudriere_freebsd_version: "{{ _freebsd_version_result.stdout | regex_replace('-p[0-9]+$', '') }}"
- name: Disable resolvconf
copy:
@@ -110,13 +110,6 @@
group: wheel
mode: "0755"
-- name: Deploy poudriere-start-build script
- template:
- src: usr_local_bin_poudriere_start_build.sh.j2
- dest: /usr/local/bin/poudriere-start-build
- owner: root
- group: wheel
- mode: "0755"
- name: Check if quarterly ports tree exists
stat:
@@ -135,113 +128,6 @@
- name: Download custom ports overlay
shell: /usr/local/bin/update-ports custom
when: _custom_exists.stdout == ""
-
-# Poudriere setup
-- name: Deploy poudriere.conf
- template:
- src: usr_local_etc_poudriere.conf.j2
- dest: /usr/local/etc/poudriere.conf
- owner: root
- group: wheel
- mode: "0644"
- vars:
- pkg_abi: "FreeBSD:{{ poudriere_freebsd_version.split('.')[0] }}:{{ arch.split('/')[1] }}"
-
-- name: Create distfiles directory
- file:
- path: /usr/local/poudriere/distfiles
- state: directory
- owner: root
- group: wheel
- mode: "0755"
-
-- name: Check if poudriere jail exists
- shell: poudriere jail -l -n | grep -q "^poudriere_build$"
- failed_when: false
- changed_when: false
- register: _poudriere_jail_exists
-
-- name: Create poudriere jail
- shell: poudriere jail -c -j poudriere_build -v {{ poudriere_freebsd_version }} -m tar=/usr/local/jails/media/{{ poudriere_freebsd_version }}-base.txz
- when: _poudriere_jail_exists.rc != 0
-
-- name: Check if poudriere quarterly ports tree is registered
- shell: poudriere ports -l -n | grep -q "^quarterly$"
- failed_when: false
- changed_when: false
- register: _poudriere_quarterly_exists
-
-- name: Register quarterly ports tree with poudriere
- shell: poudriere ports -c -p quarterly -m null -M /usr/ports/quarterly
- when: _poudriere_quarterly_exists.rc != 0
-
-- name: Check if poudriere custom overlay is registered
- shell: poudriere ports -l -n | grep -q "^custom$"
- failed_when: false
- changed_when: false
- register: _poudriere_custom_exists
-
-- name: Register custom overlay with poudriere
- shell: poudriere ports -c -p custom -m null -M /usr/ports/custom
- when: _poudriere_custom_exists.rc != 0
-
-- name: Deploy poudriere package list
- template:
- src: usr_local_etc_poudriere_pkglist.j2
- dest: /usr/local/etc/poudriere-pkglist
- owner: root
- group: wheel
- mode: "0644"
-
-- name: Deploy poudriere build make.conf
- template:
- src: poudriere_build_make.conf.j2
- dest: /usr/local/etc/poudriere.d/poudriere_build-make.conf
- owner: root
- group: wheel
- mode: "0644"
-
-# Repo validation gate
-- name: Check if poudriere repo has packages
- stat:
- path: "/usr/local/poudriere/data/packages/poudriere_build-quarterly/meta.pkg"
- register: _poudriere_repo
-
-- name: "*** POUDRIERE REPO NOT READY ***"
- fail:
- msg: |
- ════════════════════════════════════════════════════════════════
- POUDRIERE REPOSITORY NOT READY
- ════════════════════════════════════════════════════════════════
- The local package repository has not been built yet.
- Run the following command on the host to build packages:
-
- poudriere bulk -j poudriere_build -p quarterly -O custom -f /usr/local/etc/poudriere-pkglist
-
- Then re-run this playbook.
- ════════════════════════════════════════════════════════════════
- when: not _poudriere_repo.stat.exists
-
-# Configure local repo
-- name: Create pkg repos directory
- file:
- path: /usr/local/etc/pkg/repos
- state: directory
- owner: root
- group: wheel
- mode: "0755"
-
-- name: Deploy local poudriere repo config
- copy:
- content: |
- poudriere: {
- url: "http://{{ jail_lan_cidr | ipv4_nth(21 + jail_lan_offset | int) }}/packages",
- enabled: no
- }
- dest: /usr/local/etc/pkg/repos/poudriere.conf
- owner: root
- group: wheel
- mode: "0644"
- name: Discover jail directories
find:
paths: "{{ playbook_dir }}/roles/jails"
@@ -284,27 +170,6 @@
loop_control:
label: "{{ item.name }}"
-- name: Install custom packages from poudriere
- shell: "pkg install -y -r poudriere pylogsentinel"
- register: _custom_pkg
- changed_when: "'Number of packages to be installed' in _custom_pkg.stdout"
-
-- name: Deploy pylogsentinel.conf
- template:
- src: usr_local_etc_pylogsentinel.conf.j2
- dest: /usr/local/etc/pylogsentinel.conf
- owner: root
- group: wheel
- mode: "0644"
-
-- name: Deploy pylogsentinel-batch-email.sh
- template:
- src: usr_local_bin_pylogsentinel-batch-email.sh.j2
- dest: /usr/local/bin/pylogsentinel-batch-email.sh
- owner: root
- group: wheel
- mode: "0755"
-
- name: Create storage group
group:
name: storage
@@ -372,3 +237,48 @@
group: wheel
mode: "0644"
notify: Restart cron
+
+- name: Set up poudriere
+ include_tasks: poudriere.yml
+
+# Repo validation gate
+- name: Check if poudriere repo has packages
+ stat:
+ path: "/usr/local/poudriere/data/packages/poudriere_build-quarterly/meta"
+ register: _poudriere_repo
+
+- name: "*** POUDRIERE REPO NOT READY ***"
+ fail:
+ msg: |
+ ════════════════════════════════════════════════════════════════
+ POUDRIERE REPOSITORY NOT READY
+ ════════════════════════════════════════════════════════════════
+ The local package repository has not been built yet.
+ Run the following command on the host to build packages:
+
+ poudriere bulk -j poudriere_build -p quarterly -O custom -f /usr/local/etc/poudriere-pkglist
+
+ Then re-run this playbook.
+ ════════════════════════════════════════════════════════════════
+ when: not _poudriere_repo.stat.exists
+
+- name: Install custom packages from poudriere
+ shell: "pkg install -y -r poudriere pylogsentinel"
+ register: _custom_pkg
+ changed_when: "'Number of packages to be installed' in _custom_pkg.stdout"
+
+- name: Deploy pylogsentinel.conf
+ template:
+ src: usr_local_etc_pylogsentinel.conf.j2
+ dest: /usr/local/etc/pylogsentinel.conf
+ owner: root
+ group: wheel
+ mode: "0644"
+
+- name: Deploy pylogsentinel-batch-email.sh
+ template:
+ src: usr_local_bin_pylogsentinel-batch-email.sh.j2
+ dest: /usr/local/bin/pylogsentinel-batch-email.sh
+ owner: root
+ group: wheel
+ mode: "0755"
diff --git a/roles/host/tasks/poudriere.yml b/roles/host/tasks/poudriere.yml
new file mode 100644
index 0000000..83098b7
--- /dev/null
+++ b/roles/host/tasks/poudriere.yml
@@ -0,0 +1,93 @@
+# Poudriere setup
+- name: Deploy poudriere.conf
+ template:
+ src: usr_local_etc_poudriere.conf.j2
+ dest: /usr/local/etc/poudriere.conf
+ owner: root
+ group: wheel
+ mode: "0644"
+ vars:
+ pkg_abi: "FreeBSD:{{ poudriere_freebsd_version.split('.')[0] }}:{{ arch.split('/')[1] }}"
+
+- name: Create distfiles directory
+ file:
+ path: /usr/local/poudriere/distfiles
+ state: directory
+ owner: root
+ group: wheel
+ mode: "0755"
+
+- name: Check if poudriere jail exists
+ shell: poudriere jail -l -n | grep -q "^poudriere_build$"
+ failed_when: false
+ changed_when: false
+ register: _poudriere_jail_exists
+
+- name: Create poudriere jail
+ shell: poudriere jail -c -j poudriere_build -v {{ poudriere_freebsd_version }} -m tar=/usr/local/jails/media/{{ poudriere_freebsd_version }}-base.txz
+ when: _poudriere_jail_exists.rc != 0
+
+- name: Check if poudriere quarterly ports tree is registered
+ shell: poudriere ports -l -n | grep -q "^quarterly$"
+ failed_when: false
+ changed_when: false
+ register: _poudriere_quarterly_exists
+
+- name: Register quarterly ports tree with poudriere
+ shell: poudriere ports -c -p quarterly -m null -M /usr/ports/quarterly
+ when: _poudriere_quarterly_exists.rc != 0
+
+- name: Check if poudriere custom overlay is registered
+ shell: poudriere ports -l -n | grep -q "^custom$"
+ failed_when: false
+ changed_when: false
+ register: _poudriere_custom_exists
+
+- name: Register custom overlay with poudriere
+ shell: poudriere ports -c -p custom -m null -M /usr/ports/custom
+ when: _poudriere_custom_exists.rc != 0
+
+- name: Deploy poudriere package list
+ template:
+ src: usr_local_etc_poudriere_pkglist.j2
+ dest: /usr/local/etc/poudriere-pkglist
+ owner: root
+ group: wheel
+ mode: "0644"
+
+- name: Deploy poudriere-start-build script
+ template:
+ src: usr_local_bin_poudriere_start_build.sh.j2
+ dest: /usr/local/bin/poudriere-start-build
+ owner: root
+ group: wheel
+ mode: "0755"
+
+- name: Deploy poudriere build make.conf
+ template:
+ src: poudriere_build_make.conf.j2
+ dest: /usr/local/etc/poudriere.d/poudriere_build-make.conf
+ owner: root
+ group: wheel
+ mode: "0644"
+
+# Configure local repo
+- name: Create pkg repos directory
+ file:
+ path: /usr/local/etc/pkg/repos
+ state: directory
+ owner: root
+ group: wheel
+ mode: "0755"
+
+- name: Deploy local poudriere repo config
+ copy:
+ content: |
+ poudriere: {
+ url: "http://{{ poudriere_repo_ip }}/packages",
+ enabled: no
+ }
+ dest: /usr/local/etc/pkg/repos/poudriere.conf
+ owner: root
+ group: wheel
+ mode: "0644"
diff --git a/roles/host/tasks/userland.yml b/roles/host/tasks/userland.yml
index 59de0dd..535b6d5 100644
--- a/roles/host/tasks/userland.yml
+++ b/roles/host/tasks/userland.yml
@@ -44,7 +44,7 @@
create: true
- name: Update userland
- shell: "freebsd-update -b /usr/local/jails/templates/{{ userland }}/ fetch install"
+ shell: "freebsd-update -b /usr/local/jails/templates/{{ userland }}/ --currently-running {{ userland }} fetch install"
- name: Disable syslogd
lineinfile:
diff --git a/roles/host_prod/tasks/main.yml b/roles/host_prod/tasks/main.yml
index 9be1296..b6cd8e7 100644
--- a/roles/host_prod/tasks/main.yml
+++ b/roles/host_prod/tasks/main.yml
@@ -12,12 +12,12 @@
- name: Flush handlers
meta: flush_handlers
-- name: Install hardware packages
- package:
- name: "{{ item }}"
- state: present
- loop:
- - vm-bhyve
+# - name: Install hardware packages
+# package:
+# name: "{{ item }}"
+# state: present
+# loop:
+# - vm-bhyve
- name: Set up fstab
template:
@@ -28,21 +28,21 @@
mode: "0644"
notify: Mount filesystems
-- name: Set up bhyve
- block:
- - name: Create vm dataset
- community.general.zfs:
- name: zroot/vm
- state: present
+# - name: Set up bhyve
+# block:
+# - name: Create vm dataset
+# community.general.zfs:
+# name: zroot/vm
+# state: present
- - name: Check if vm-bhyve is initialized
- stat:
- path: /zroot/vm/.config
- register: vm_init_check
+ # - name: Check if vm-bhyve is initialized
+ # stat:
+ # path: /zroot/vm/.config
+ # register: vm_init_check
- - name: Run vm init
- shell: vm init
- when: not vm_init_check.stat.exists
+ # - name: Run vm init
+ # shell: vm init
+ # when: not vm_init_check.stat.exists
- name: Copy backup SSH private key
copy:
diff --git a/roles/jail/tasks/jail_setup.yml b/roles/jail/tasks/jail_setup.yml
index c09564d..931133f 100644
--- a/roles/jail/tasks/jail_setup.yml
+++ b/roles/jail/tasks/jail_setup.yml
@@ -140,6 +140,15 @@
- "userland + '@base' not in jail_origin.stdout"
delegate_to: "{{ jail_delegate_host }}"
+- name: "Unmount any remaining mounts inside {{ jail_name }} container"
+ shell: |
+ mount | awk '$3 ~ "^/usr/local/jails/containers/{{ jail_name }}/" {print $3}' | sort -r | xargs -I{} umount -f {} 2>/dev/null || true
+ when:
+ - jail_exists.rc == 0
+ - jail_origin.stdout is defined
+ - "userland + '@base' not in jail_origin.stdout"
+ delegate_to: "{{ jail_delegate_host }}"
+
- name: "Migrate {{ jail_name }} to {{ userland }}"
shell: |
zfs rename zroot/jails/containers/{{ jail_name }} zroot/jails/containers/{{ jail_name }}.old.$(date +%s)
@@ -262,7 +271,7 @@
copy:
content: |
poudriere: {
- url: "http://{{ jail_lan_cidr | ipv4_nth(21 + jail_lan_offset | int) }}/packages",
+ url: "http://{{ hostvars[jail_delegate_host]['poudriere_repo_ip'] }}/packages",
enabled: no,
priority: 100
}
diff --git a/roles/jails/01_ingress/defaults/main.yml b/roles/jails/01_ingress/defaults/main.yml
index e507905..1527cd9 100644
--- a/roles/jails/01_ingress/defaults/main.yml
+++ b/roles/jails/01_ingress/defaults/main.yml
@@ -1,4 +1,4 @@
-userland: "15.0-RELEASE"
+userland: "15.1-RELEASE"
devfs_ruleset: 6
no_default_route: true
@@ -21,7 +21,6 @@ ingress_routes:
- { host: immich.jan.systems, jail: immich, presets: [large_body_size] }
- { host: plex.jan.systems, jail: plex, port: 32400, presets: [streaming] }
- { host: komga.jan.systems, jail: komga }
- - { host: goaccess.jan.systems, jail: goaccess }
- { host: poudriere.jan.systems, jail: poudriere_repo }
cert_domains:
@@ -49,8 +48,6 @@ pkg:
files:
- src: etc_pf.conf.j2
dest: /etc/pf.conf
- - src: usr_local_etc_nginx_nginx.conf.j2
- dest: /usr/local/etc/nginx/nginx.conf
- src: acme-dns-auth.py
dest: /usr/local/bin/acme-dns-auth.py
mode: "0755"
diff --git a/roles/jails/01_ingress/handlers/main.yml b/roles/jails/01_ingress/handlers/main.yml
new file mode 100644
index 0000000..1819a68
--- /dev/null
+++ b/roles/jails/01_ingress/handlers/main.yml
@@ -0,0 +1,4 @@
+- name: Reload nginx
+ service:
+ name: nginx
+ state: reloaded
diff --git a/roles/jails/01_ingress/tasks/main.yml b/roles/jails/01_ingress/tasks/main.yml
index 15992bd..a6fdc3c 100644
--- a/roles/jails/01_ingress/tasks/main.yml
+++ b/roles/jails/01_ingress/tasks/main.yml
@@ -38,6 +38,15 @@
name: jail
tasks_from: jail_setup
+- name: Deploy nginx config
+ template:
+ src: "{{ jail_role_dir }}/templates/usr_local_etc_nginx_nginx.conf.j2"
+ dest: /usr/local/etc/nginx/nginx.conf
+ owner: root
+ group: wheel
+ mode: "0644"
+ notify: Reload nginx
+
- name: Check if TLS certs exist
stat:
path: "/usr/local/etc/letsencrypt/live/{{ cert_name }}"
diff --git a/roles/jails/21_poudriere_repo/defaults/main.yml b/roles/jails/21_poudriere_repo/defaults/main.yml
index 108c494..6b774d4 100644
--- a/roles/jails/21_poudriere_repo/defaults/main.yml
+++ b/roles/jails/21_poudriere_repo/defaults/main.yml
@@ -1,4 +1,4 @@
-userland: "15.0-RELEASE"
+userland: "15.1-RELEASE"
nullfs:
- src: /usr/local/share/poudriere/html

Want to contribute? Host your changes somewhere and send me the link: jan (at) sydanviita.fi. Also, check out my website.


forge.jan.systems — powered by cgit