diff options
| -rw-r--r-- | playbook.yml | 6 | ||||
| -rw-r--r-- | tasks/jail_homepage.yml | 52 | ||||
| -rw-r--r-- | tasks/jails_single.yml | 8 | ||||
| -rw-r--r-- | templates/etc_jail.conf.d_[jailname].conf.j2 | 39 | ||||
| -rw-r--r-- | templates/etc_jail.conf.j2 | 50 | ||||
| -rw-r--r-- | templates/homepage/etc_crontab.j2 | 9 | ||||
| -rw-r--r-- | templates/homepage/usr_local_etc_nginx_nginx.conf.j2 | 26 |
7 files changed, 145 insertions, 45 deletions
diff --git a/playbook.yml b/playbook.yml index 095e058..52fcef9 100644 --- a/playbook.yml +++ b/playbook.yml @@ -25,7 +25,7 @@ - { name: postgres, num: 2, tls: false } - { name: irc_thelounge, num: 3, tls: false } - { name: taulubot, num: 4, tls: false } - #- { name: veetibot, num: 5, tls: false } + - { name: homepage, num: 5, tls: false } - { name: hommabot, num: 6, tls: false } - { name: aggro, num: 7, tls: true, host: aggro.jan.systems } - { name: diddle, num: 8, tls: true, host: diddle.jan.systems } @@ -76,3 +76,7 @@ - name: Run hommabot jail tasks tags: [jail_hommabot] import_tasks: tasks/jail_hommabot.yml + + - name: Run jail homepage tasks + tags: [jail_homepage] + import_tasks: tasks/jail_homepage.yml diff --git a/tasks/jail_homepage.yml b/tasks/jail_homepage.yml new file mode 100644 index 0000000..161d02c --- /dev/null +++ b/tasks/jail_homepage.yml @@ -0,0 +1,52 @@ +- name: Install packages inside jail + loop: + - { jail: homepage, package: nginx } + - { jail: homepage, package: rsync } + - { jail: homepage, package: bash } + include_tasks: pkg_jail_install.yml + +- name: Create /var/www + file: + path: /usr/local/jails/containers/homepage/var/www + state: directory + owner: www + group: www + mode: "0755" + +# It's important to run this after generating certs, because nginx.conf refers to files +# generated by certbot. Certbot will fail validation if nginx.conf is configured too early. +- name: Configure nginx.conf + template: + src: homepage/usr_local_etc_nginx_nginx.conf.j2 + dest: /usr/local/jails/containers/homepage/usr/local/etc/nginx/nginx.conf + owner: root + group: wheel + mode: "0644" + register: nginx_conf + +- name: Check if nginx is enabled + shell: service -j homepage nginx status + changed_when: false + failed_when: false + register: homepage_nginx_enabled + +- name: Enable and start nginx + shell: | + service -j homepage nginx enable + service -j homepage nginx onestart + when: homepage_nginx_enabled.rc != 0 + +- name: Set up crontab + template: + src: homepage/etc_crontab.j2 + dest: /usr/local/jails/containers/homepage/etc/crontab + owner: root + group: wheel + mode: "0644" + register: jail_homepage_etc_crontab + +- name: Restart cron + service: + name: cron + state: restarted + when: jail_homepage_etc_crontab.changed diff --git a/tasks/jails_single.yml b/tasks/jails_single.yml index 9d539d0..043086d 100644 --- a/tasks/jails_single.yml +++ b/tasks/jails_single.yml @@ -11,6 +11,14 @@ - name: Make resolv.conf immutable shell: chflags schg /usr/local/jails/containers/{{ jail.name }}/etc/resolv.conf +- name: Configure jail.conf.d/{{ jail.name }}.conf + template: + src: etc_jail.conf.d_[jailname].conf.j2 + dest: /etc/jail.conf.d/{{ jail.name }}.conf + owner: root + group: wheel + mode: "0644" + - name: "Check if jail {{ jail.name }} is running" shell: jls -j "{{ jail.name }}" failed_when: false diff --git a/templates/etc_jail.conf.d_[jailname].conf.j2 b/templates/etc_jail.conf.d_[jailname].conf.j2 new file mode 100644 index 0000000..7f7a049 --- /dev/null +++ b/templates/etc_jail.conf.d_[jailname].conf.j2 @@ -0,0 +1,39 @@ +# eplXa is host end (local network bridge), eplXb is jail end. +# The corresponding pubnet interface is epwX, but that's not created for all jails. +{{ jail.name }} { + # STARTUP/LOGGING/VNET + vnet; + vnet.interface = "epl{{ jail.num }}b"; + persist; + exec.prestart += "ifconfig epair{{ jail.num }} create || echo 'Failed to create epair{{ jail.num }}'"; + exec.prestart += "ifconfig epair{{ jail.num }}a name epl{{ jail.num }}a"; + exec.prestart += "ifconfig epair{{ jail.num }}b name epl{{ jail.num }}b"; + exec.prestart += "ifconfig epl{{ jail.num }}a up"; + exec.prestart += "ifconfig brlan0 addm epl{{ jail.num }}a"; + exec.clean; + exec.start = "/bin/sh /etc/rc"; + exec.poststart = "jexec ${name} ifconfig epl{{ jail.num }}b 192.168.2.{{ jail.num }}/16 up"; + exec.poststart += "ifconfig epl{{ jail.num }}a up"; + exec.poststart += "jexec ${name} route add default 192.168.0.1 || echo 'Failed to add default route'"; + {% if jail.name == "ingress" -%} + exec.poststart += "jexec ${name} ifconfig epw{{ jail.num }}b up"; + exec.poststart += "jexec ${name} service dhclient restart epw{{ jail.num }}b"; + {% endif %} + + exec.stop = "/bin/sh /etc/rc.shutdown"; + exec.poststop += "ifconfig epl{{ jail.num }}b -vnet $name"; # workaround to bug 238326: move epl{{ jail.num }}b from the jail to the host when stopping jail services + exec.poststop += "ifconfig epl{{ jail.num }}b destroy"; # and then destroy the pair by destroying one end of it + exec.consolelog = "/var/log/jail_console_${name}.log"; + + # PERMISSIONS + allow.raw_sockets; + exec.clean; + mount.devfs; + {%if jail.name == "postgres" -%} + allow.sysvipc; + {% endif %} + + # HOSTNAME/PATH + host.hostname = "${name}"; + path = "/usr/local/jails/containers/${name}"; +} diff --git a/templates/etc_jail.conf.j2 b/templates/etc_jail.conf.j2 index 25955ce..7190816 100644 --- a/templates/etc_jail.conf.j2 +++ b/templates/etc_jail.conf.j2 @@ -1,44 +1,6 @@ -# STARTUP/LOGGING/VNET -$tmp_epair = "epair${num}"; -$epl = "epl${num}"; # eplXa is host end (local network bridge), eplXb is jail end. - # The corresponding pubnet interface is epwX, but that's not created for all jails. -vnet; -vnet.interface = "${epl}b"; -persist; -exec.prestart += "ifconfig $tmp_epair create || echo 'Failed to create $tmp_epair'"; -exec.prestart += "ifconfig ${tmp_epair}a name ${epl}a"; -exec.prestart += "ifconfig ${tmp_epair}b name ${epl}b"; -exec.prestart += "ifconfig ${epl}a up"; -exec.prestart += "ifconfig brlan0 addm ${epl}a"; -exec.clean; -exec.start = "/bin/sh /etc/rc"; -exec.poststart = "jexec ${name} ifconfig ${epl}b 192.168.2.${num}/16 up"; -exec.poststart += "jexec ${name} route add default 192.168.0.1 || echo 'Failed to add default route'"; -exec.stop = "/bin/sh /etc/rc.shutdown"; -exec.poststop += "ifconfig ${epl}b -vnet $name"; # workaround to bug 238326: move ${epl}b from the jail to the host when stopping jail services -exec.poststop += "ifconfig ${epl}b destroy"; # and then destroy the pair by destroying one end of it -exec.consolelog = "/var/log/jail_console_${name}.log"; - -# PERMISSIONS -allow.raw_sockets; -exec.clean; -mount.devfs; - -# HOSTNAME/PATH -host.hostname = "${name}"; -path = "/usr/local/jails/containers/${name}"; - -# JAILS -{% for jail in jails %} -{{ jail.name }} { - $num = "{{ jail.num }}"; - {% if jail.name == "ingress" -%} - exec.poststart = "jexec ${name} ifconfig ${epl}b 192.168.2.${num}/16 up"; - exec.poststart = "jexec ${name} ifconfig epw1b up"; - exec.poststart += "jexec ${name} service dhclient restart epw1b"; - {% endif %} - {%if jail.name == "postgres" -%} - allow.sysvipc; - {% endif %} -} -{% endfor %} +# Include configurations from standard locations. +.include "/etc/jail.conf.d/*.conf"; +.include "/etc/jail.*.conf"; +.include "/usr/local/etc/jail[.]conf"; +.include "/usr/local/etc/jail.conf.d/*.conf"; +.include "/usr/local/etc/jail.*.conf"; diff --git a/templates/homepage/etc_crontab.j2 b/templates/homepage/etc_crontab.j2 new file mode 100644 index 0000000..8541f57 --- /dev/null +++ b/templates/homepage/etc_crontab.j2 @@ -0,0 +1,9 @@ +# /etc/crontab - root's crontab for FreeBSD +# +# +SHELL=/bin/sh +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin +# +#minute hour mday month wday who command + +# TODO: update linklog diff --git a/templates/homepage/usr_local_etc_nginx_nginx.conf.j2 b/templates/homepage/usr_local_etc_nginx_nginx.conf.j2 new file mode 100644 index 0000000..53d1c31 --- /dev/null +++ b/templates/homepage/usr_local_etc_nginx_nginx.conf.j2 @@ -0,0 +1,26 @@ +worker_processes auto; + +events { + worker_connections 1024; +} + +http { + include mime.types; + default_type application/octet-stream; + + sendfile on; + keepalive_timeout 65; + + server { + listen 80 default_server; + server_name _; + + root /var/www; + + index index.html; + + location / { + try_files $uri $uri.html $uri/ =404; + } + } +} |