9 files changed, 81 insertions, 65 deletions
diff --git a/playbook.yml b/playbook.yml
index a5b636c..2e9a3c0 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -38,6 +38,7 @@
       - { userland: "{{ jail_userland_14_3 }}", num: 14, name: freshrss }
       - { userland: "{{ jail_userland_14_3 }}", num: 15, name: paste }
       - { userland: "{{ jail_userland_15_0 }}", num: 16, name: dl }
+    ingress_ip: 192.168.2.1
     ingress_routes:
       - { host: jan.systems, jail: homepage }
       - { host: jantuomi.fi, redirect: jan.systems }
diff --git a/tasks/jails_single.yml b/tasks/jails_single.yml
index 3225d50..7c5dd74 100644
--- a/tasks/jails_single.yml
+++ b/tasks/jails_single.yml
@@ -15,13 +15,13 @@
     owner: root
     group: wheel
     mode: "0644"
-
-- name: "Check if jail {{ jail.name }} is running"
-  shell: jls -j "{{ jail.name }}"
-  failed_when: false
-  changed_when: false
-  register: check_jail_active
-
-- name: "(Re)start jail {{ jail.name }}"
-  shell: service jail restart "{{ jail.name }}"
-  when: check_jail_active.rc != 0
+#
+#- name: "Check if jail {{ jail.name }} is running"
+#  shell: jls -j "{{ jail.name }}"
+#  failed_when: false
+#  changed_when: false
+#  register: check_jail_active
+#
+#- name: "(Re)start jail {{ jail.name }}"
+#  shell: service jail restart "{{ jail.name }}"
+#  when: check_jail_active.rc != 0
diff --git a/templates/etc_jail.conf.d_[jailname].conf.j2 b/templates/etc_jail.conf.d_[jailname].conf.j2
index d87439c..df10f47 100644
--- a/templates/etc_jail.conf.d_[jailname].conf.j2
+++ b/templates/etc_jail.conf.d_[jailname].conf.j2
@@ -5,53 +5,13 @@
   vnet;
   persist;
   exec.clean;
-  exec.prestart     = "ifconfig epair{{ jail.num }}000 create || echo 'Failed to create epair{{ jail.num }}000'";
-  exec.prestart    += "ifconfig epair{{ jail.num }}000a name epl{{ jail.num }}a";
-  exec.prestart    += "ifconfig epair{{ jail.num }}000b name epl{{ jail.num }}b";
-  exec.prestart    += "ifconfig epl{{ jail.num }}b ether random";
-  exec.prestart    += "ifconfig brlan0 addm epl{{ jail.num }}a";
-  {% if jail.name == "ingress" -%}
-  exec.prestart    += "ifconfig epair{{ jail.num }}001 create || echo 'Failed to create epair{{ jail.num }}001'";
-  exec.prestart    += "ifconfig epair{{ jail.num }}001a name epw1a";
-  exec.prestart    += "ifconfig epair{{ jail.num }}001b name epw1b";
-  exec.prestart    += "ifconfig brwan0 addm epw{{ jail.num }}a";
-  {% endif %}
 
+  exec.prestart     = "";
   exec.start        = "/bin/sh /etc/rc";
-
-  exec.poststart    = "ifconfig epl{{ jail.num }}b vnet ${name}";
-  exec.poststart   += "jexec ${name} ifconfig epl{{ jail.num }}b up";
-  exec.poststart   += "ifconfig epl{{ jail.num }}a up";
-  exec.poststart   += "jexec ${name} ifconfig epl{{ jail.num }}b 192.168.2.{{ jail.num }}/16";
-  exec.poststart   += "jexec ${name} route delete default || echo 'No default route to delete'";
-  {% if jail.name != "ingress" %}
-  {% for ing in jails -%}
-  {% if ing.name == "ingress" -%}
-  exec.poststart   += "jexec ${name} route add default 192.168.2.{{ ing.num }} || echo 'Failed to add default route'";
-  exec.poststart   += "jexec ${name} route add 10.6.210.0/24 192.168.0.1 || echo 'Failed to add Wireguard return route'";
-  {% endif %}
-  {% endfor %}
-  {% else %}
-  exec.poststart   += "ifconfig epw{{ jail.num }}b vnet ${name}";
-  exec.poststart   += "jexec ${name} ifconfig epw{{ jail.num }}b up";
-  exec.poststart   += "ifconfig epw{{ jail.num }}a up";
-  exec.poststart   += "jexec ${name} service dhclient restart epw{{ jail.num }}b";
-  exec.poststart   += "mount -t nullfs /usr/local/jails/containers/goaccess/var/www/goaccess /usr/local/jails/containers/ingress/mnt/www_goaccess";
-  {% endif %}
-
-  {% if jail.name == "dl" -%}
-  exec.poststart   += "jexec ${name} sh ~/random_tunnel.sh";
-  {% elif jail.name == "plex" -%}
-  exec.poststart   += "jexec ${name} sh ~/start_plex.sh";
-  {% endif %}
-
+  exec.poststart    = "";
+  exec.prestop      = "";
   exec.stop         = "/bin/sh /etc/rc.shutdown";
-
-  exec.poststop    += "ifconfig epl{{ jail.num }}a destroy";
-  {% if jail.name == "ingress" -%}
-  exec.poststop    += "ifconfig epw{{ jail.num }}a destroy";
-  exec.poststop    += "umount /usr/local/jails/containers/ingress/mnt/www_goaccess";
-  {% endif %}
+  exec.poststop     = "";
 
   exec.consolelog   = "/var/log/jail_console_${name}.log";
 
@@ -59,19 +19,25 @@
   allow.raw_sockets;
   exec.clean;
   mount.devfs;
-  {%if jail.name == "postgres" -%}
-  allow.sysvipc;
-  devfs_ruleset = 5;
-  {% elif jail.name == "ingress" -%}
-  devfs_ruleset = 6;
-  {% elif jail.name == "dl" -%}
-  devfs_ruleset = 4;
-  allow.mlock;
-  {% else %}
-  devfs_ruleset = 4;
-  {% endif %}
 
   # HOSTNAME/PATH
   host.hostname = "${name}";
   path = "/usr/local/jails/containers/${name}";
+
+  # JAIL-SPECIFIC CONFIGURATION
+{% set t = lookup(
+  'ansible.builtin.first_found',
+  {
+    'files': [
+        'jail_confs/' ~ jail.name ~ '.j2',
+        'jail_confs/_default.j2',
+    ],
+    'paths': [ playbook_dir ~ '/templates' ]
+  },
+  errors='ignore'
+) %}
+
+{% if t %}
+{{ lookup('ansible.builtin.template', t) | indent(2, true) }}
+{% endif %}
 }
diff --git a/templates/jail_confs/_default.j2 b/templates/jail_confs/_default.j2
new file mode 100644
index 0000000..3a4e492
--- /dev/null
+++ b/templates/jail_confs/_default.j2
@@ -0,0 +1,5 @@
+devfs_ruleset = 4;
+
+{% include 'jail_confs/_epl_network.j2' %}
+
+exec.poststart   += "jexec ${name} route add default {{ ingress_ip }} || echo 'Failed to add default route'";
diff --git a/templates/jail_confs/_epl_network.j2 b/templates/jail_confs/_epl_network.j2
new file mode 100644
index 0000000..e80aebe
--- /dev/null
+++ b/templates/jail_confs/_epl_network.j2
@@ -0,0 +1,17 @@
+## _epl_network begin
+exec.prestart    += "ifconfig epair{{ jail.num }}000 create || echo 'Failed to create epair{{ jail.num }}000'";
+exec.prestart    += "ifconfig epair{{ jail.num }}000a name epl{{ jail.num }}a";
+exec.prestart    += "ifconfig epair{{ jail.num }}000b name epl{{ jail.num }}b";
+exec.prestart    += "ifconfig epl{{ jail.num }}b ether random";
+exec.prestart    += "ifconfig brlan0 addm epl{{ jail.num }}a";
+
+exec.poststart   += "ifconfig epl{{ jail.num }}b vnet ${name}";
+exec.poststart   += "jexec ${name} ifconfig epl{{ jail.num }}b up";
+exec.poststart   += "ifconfig epl{{ jail.num }}a up";
+exec.poststart   += "jexec ${name} ifconfig epl{{ jail.num }}b 192.168.2.{{ jail.num }}/16";
+exec.poststart   += "jexec ${name} route delete default || echo 'No default route to delete'";
+
+exec.poststart   += "jexec ${name} route add 10.6.210.0/24 {{ lan_ipv4_gateway }} || echo 'Failed to add Wireguard return route'";
+
+exec.poststop    += "ifconfig epl{{ jail.num }}a destroy";
+## _epl_network end
diff --git a/templates/jail_confs/dl.j2 b/templates/jail_confs/dl.j2
new file mode 100644
index 0000000..324906f
--- /dev/null
+++ b/templates/jail_confs/dl.j2
@@ -0,0 +1,5 @@
+{% include 'jail_confs/_epl_network.j2' %}
+devfs_ruleset = 4;
+allow.mlock;
+
+exec.poststart   += "jexec ${name} sh ~/random_tunnel.sh";
diff --git a/templates/jail_confs/ingress.j2 b/templates/jail_confs/ingress.j2
new file mode 100644
index 0000000..d6e4cad
--- /dev/null
+++ b/templates/jail_confs/ingress.j2
@@ -0,0 +1,15 @@
+devfs_ruleset = 6;
+
+{% include 'jail_confs/_epl_network.j2' %}
+
+exec.prestart    += "ifconfig epair{{ jail.num }}001 create || echo 'Failed to create epair{{ jail.num }}001'";
+exec.prestart    += "ifconfig epair{{ jail.num }}001a name epw1a";
+exec.prestart    += "ifconfig epair{{ jail.num }}001b name epw1b";
+exec.prestart    += "ifconfig brwan0 addm epw{{ jail.num }}a";
+
+exec.poststart   += "ifconfig epw{{ jail.num }}b vnet ${name}";
+exec.poststart   += "jexec ${name} ifconfig epw{{ jail.num }}b up";
+exec.poststart   += "ifconfig epw{{ jail.num }}a up";
+exec.poststart   += "jexec ${name} service dhclient restart epw{{ jail.num }}b";
+
+exec.poststop    += "ifconfig epw{{ jail.num }}a destroy";
diff --git a/templates/jail_confs/plex.j2 b/templates/jail_confs/plex.j2
new file mode 100644
index 0000000..fd91b58
--- /dev/null
+++ b/templates/jail_confs/plex.j2
@@ -0,0 +1,3 @@
+{% include 'jail_confs/_epl_network.j2' %}
+
+exec.poststart   += "jexec ${name} sh ~/start_plex.sh";
diff --git a/templates/jail_confs/postgres.j2 b/templates/jail_confs/postgres.j2
new file mode 100644
index 0000000..bb3d1f1
--- /dev/null
+++ b/templates/jail_confs/postgres.j2
@@ -0,0 +1,4 @@
+{% include 'jail_confs/_epl_network.j2' %}
+devfs_ruleset = 5;
+
+allow.sysvipc;