10 files changed, 88 insertions, 60 deletions

diff --git a/playbook.yml b/playbook.yml
index 91c5334..a140b6b 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -19,12 +19,18 @@
     smtp_port: "{{ lookup('env', 'SMTP_PORT') }}"
     dma_mail_hostname: "{{ lookup('env', 'DMA_MAILNAME') }}"
     dma_to_address: "{{ lookup('env', 'DMA_TO_ADDRESS') }}"
+    lan_ipv4_cidr: 192.168.0.10/16
+    lan_ipv4_gateway: 192.168.0.1
+    lan_search_domain: local.jan.systems
     jail_userland_version: 14.3-RELEASE
     jails:
       - { name: nginx_test, ip: "192.168.2.1" }
       - { name: postgres, ip: "192.168.2.2" }
 
   tasks:
+    - name: Run general tasks
+      import_tasks: tasks/general.yml
+
     - name: Run network tasks
       import_tasks: tasks/network.yml
 
diff --git a/tasks/general.yml b/tasks/general.yml
new file mode 100644
index 0000000..e46da9d
--- /dev/null
+++ b/tasks/general.yml
@@ -0,0 +1,16 @@
+- name: Set up periodic.conf
+  template:
+    src: etc_periodic.conf.j2
+    dest: /etc/periodic.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+
+- name: Set up /etc/rc.conf
+  template:
+    src: etc_rc.conf.j2
+    dest: /etc/rc.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+  register: rc_conf
diff --git a/tasks/jail_single.yml b/tasks/jail_single.yml
index f51bc37..9c5d1ee 100644
--- a/tasks/jail_single.yml
+++ b/tasks/jail_single.yml
@@ -14,6 +14,6 @@
   changed_when: false
   register: check_jail_active
 
-- name: "Start jail {{ jail.name }}"
-  shell: service jail start "{{ jail.name }}"
+- name: "(Re)start jail {{ jail.name }}"
+  shell: service jail restart "{{ jail.name }}"
   when: check_jail_active.rc != 0
diff --git a/tasks/jails.yml b/tasks/jails.yml
index e75d632..8233dc5 100644
--- a/tasks/jails.yml
+++ b/tasks/jails.yml
@@ -67,11 +67,3 @@
       loop_control:
         loop_var: jail
       include_tasks: jail_single.yml
-
-- name: Enable jails
-  community.general.sysrc:
-    name: "{{ item }}"
-    value: "YES"
-  loop:
-    - "jail_enable"
-    - "jail_parallel_start"
diff --git a/tasks/network.yml b/tasks/network.yml
index 8824501..f0b545b 100644
--- a/tasks/network.yml
+++ b/tasks/network.yml
@@ -1,34 +1,15 @@
-- name: Set up network interfaces
-  community.general.sysrc:
-    name: "{{ item.name }}"
-    value: "{{ item.value | default(omit) }}"
-    state: "{{ item.state | default(omit) }}"
-  loop:
-    - { name: "ifconfig_igc0", state: "absent" }
-    - { name: "ifconfig_igc1", state: "absent" }
-    - { name: "ifconfig_igc0_name", value: "lan0" }
-    - { name: "ifconfig_igc1_name", value: "wan0" }
-    - { name: "ifconfig_lan0", value: "DHCP" }
-    - { name: "ifconfig_wan0", value: "DHCP" }
-    - { name: "ifconfig_lan0_ipv6", value: "inet6 accept_rtadv" }
-    - { name: "ifconfig_wan0_ipv6", value: "inet6 accept_rtadv" }
-  register: ifconfig_base_sysrc
-
-- name: Set up jail aliases on lan0
-  community.general.sysrc:
-    name: "ifconfig_lan0_alias{{ index }}"
-    value: "inet {{ item.ip }}/32"
-  loop: "{{ jails }}"
-  loop_control:
-    index_var: index
-  register: ifconfig_jail_sysrc
+- name: Set up resolv.conf
+  template:
+    src: etc_resolv.conf.j2
+    dest: /etc/resolv.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+  register: resolv_conf
 
 - name: Restart networking if interface configuration changed
-  shell: service netif restart
-  when: ifconfig_base_sysrc.changed or ifconfig_jail_sysrc.changed
-
-- name: Update facts
-  setup:
+  shell: service netif restart && service routing restart
+  when: rc_conf.changed or resolv_conf.changed
 
 - name: Set up sshd
   template:
@@ -39,28 +20,29 @@
     mode: "0644"
   register: etc_sshd_config
 
+- name: Start sshd
+  service:
+    name: sshd
+    state: started
+  register: started_sshd
+
 - name: Restart sshd
   service:
     name: sshd
     state: restarted
-  when: etc_sshd_config.changed
+  when: not started_sshd.changed and etc_sshd_config.changed
 
-- name: Disable syslogd remote listening
-  community.general.sysrc:
-    name: syslogd_flags
-    value: "-s"
-  register: syslogd_flags
-
-- name: Enable syslogd
+- name: Start syslogd
   service:
     name: syslogd
-    enabled: true
+    state: started
+  register: started_syslogd
 
 - name: Restart syslogd
   service:
     name: syslogd
     state: restarted
-  when: syslogd_flags.changed
+  when: not started_syslogd.changed and rc_conf.changed
 
 - name: Configure pf
   template:
@@ -72,10 +54,9 @@
     backup: yes
   register: pf_conf
 
-- name: Enable and start pf
+- name: Start pf
   service:
     name: pf
-    enabled: true
     state: started
 
 - name: Reload pf rules
@@ -96,13 +77,14 @@
     mode: "0644"
   register: nginx_conf
 
-- name: Enable nginx
+- name: Start nginx
   service:
     name: nginx
-    enabled: true
+    state: started
+  register: started_nginx
 
 - name: Restart nginx
   service:
     name: nginx
     state: restarted
-  when: nginx_conf.changed
+  when: not started_nginx.changed and nginx_conf.changed
diff --git a/tasks/zfs.yml b/tasks/zfs.yml
index c869db7..c5d38f5 100644
--- a/tasks/zfs.yml
+++ b/tasks/zfs.yml
@@ -15,16 +15,17 @@
     mode: "0755"
   register: rc_zpool_gpt_labels
 
-- name: Enable zpool_gpt_labels
+- name: Start zpool_gpt_labels
   service:
     name: zpool_gpt_labels
-    enabled: true
+    state: started
+  register: started_zpool_gpt_labels
 
 - name: Restart zpool_gpt_labels
   service:
     name: zpool_gpt_labels
     state: restarted
-  when: rc_zpool_gpt_labels.changed
+  when: not started_zpool_gpt_labels.changed and rc_zpool_gpt_labels.changed
 
 - name: Install smartd
   package:
@@ -40,13 +41,14 @@
     mode: "0644"
   register: smartd_conf
 
-- name: Enable smartd
+- name: Start smartd
   service:
     name: smartd
-    enabled: true
+    state: started
+  register: started_smartd
 
 - name: Restart smartd
   service:
     name: smartd
     state: restarted
-  when: smartd_conf.changed
+  when: not started_smartd.changed and smartd_conf.changed
diff --git a/templates/etc_jail.conf.j2 b/templates/etc_jail.conf.j2
index eb6d128..bcfcef0 100644
--- a/templates/etc_jail.conf.j2
+++ b/templates/etc_jail.conf.j2
@@ -16,6 +16,7 @@ path = "/usr/local/jails/containers/${name}";
 {% for jail in jails %}
 {{ jail.name }} {
   ip4.addr = {{ jail.ip }};
+  interface = lan0;
 }
 
 {% endfor %}
diff --git a/templates/etc_periodic.conf.j2 b/templates/etc_periodic.conf.j2
new file mode 100644
index 0000000..22602c2
--- /dev/null
+++ b/templates/etc_periodic.conf.j2
@@ -0,0 +1 @@
+daily_status_smart_enable="YES"
diff --git a/templates/etc_rc.conf.j2 b/templates/etc_rc.conf.j2
new file mode 100644
index 0000000..c7e7b83
--- /dev/null
+++ b/templates/etc_rc.conf.j2
@@ -0,0 +1,25 @@
+hostname="pursotin"
+keymap="fi.kbd"
+sshd_enable="YES"
+ntpd_enable="YES"
+ntpd_sync_on_start="YES"
+powerd_enable="YES"
+moused_nondefault_enable="NO"
+# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
+dumpdev="AUTO"
+zfs_enable="YES"
+defaultrouter="{{ lan_ipv4_gateway }}"
+ifconfig_igc0_name="lan0"
+ifconfig_igc1_name="wan0"
+ifconfig_lan0="inet {{ lan_ipv4_cidr }}"
+ifconfig_lan0_ipv6="inet6 accept_rtadv"
+ifconfig_wan0="DHCP"
+ifconfig_wan0_ipv6="inet6 accept_rtadv"
+zpool_gpt_labels_enable="YES"
+smartd_enable="YES"
+pf_enable="YES"
+syslogd_enable="YES"
+syslogd_flags="-s"
+jail_enable="YES"
+jail_parallel_start="YES"
+nginx_enable="YES"
diff --git a/templates/etc_resolv.conf.j2 b/templates/etc_resolv.conf.j2
new file mode 100644
index 0000000..29f6bf6
--- /dev/null
+++ b/templates/etc_resolv.conf.j2
@@ -0,0 +1,3 @@
+search {{ lan_search_domain }}
+nameserver {{ lan_ipv4_gateway }}
+nameserver 8.8.8.8