12 files changed, 399 insertions, 0 deletions
diff --git a/roles/host/templates/devfs.rules.j2 b/roles/host/templates/devfs.rules.j2
new file mode 100644
index 0000000..9fc0bd1
--- /dev/null
+++ b/roles/host/templates/devfs.rules.j2
@@ -0,0 +1,69 @@
+[devfsrules_hide_all=1]
+add hide
+
+[devfsrules_unhide_basic=2]
+add path null unhide
+add path zero unhide
+add path crypto unhide
+add path random unhide
+add path urandom unhide
+
+[devfsrules_unhide_login=3]
+add path 'ptyp*' unhide
+add path 'ptyq*' unhide
+add path 'ptyr*' unhide
+add path 'ptys*' unhide
+add path 'ptyP*' unhide
+add path 'ptyQ*' unhide
+add path 'ptyR*' unhide
+add path 'ptyS*' unhide
+add path 'ptyl*' unhide
+add path 'ptym*' unhide
+add path 'ptyn*' unhide
+add path 'ptyo*' unhide
+add path 'ptyL*' unhide
+add path 'ptyM*' unhide
+add path 'ptyN*' unhide
+add path 'ptyO*' unhide
+add path 'ttyp*' unhide
+add path 'ttyq*' unhide
+add path 'ttyr*' unhide
+add path 'ttys*' unhide
+add path 'ttyP*' unhide
+add path 'ttyQ*' unhide
+add path 'ttyR*' unhide
+add path 'ttyS*' unhide
+add path 'ttyl*' unhide
+add path 'ttym*' unhide
+add path 'ttyn*' unhide
+add path 'ttyo*' unhide
+add path 'ttyL*' unhide
+add path 'ttyM*' unhide
+add path 'ttyN*' unhide
+add path 'ttyO*' unhide
+add path ptmx unhide
+add path pts unhide
+add path 'pts/*' unhide
+add path fd unhide
+add path 'fd/*' unhide
+add path stdin unhide
+add path stdout unhide
+add path stderr unhide
+add path 'drm' unhide
+add path 'drm/*' unhide
+add path 'dri' unhide
+add path 'dri/*' unhide
+
+[devfsrules_jail=4]
+add include $devfsrules_hide_all
+add include $devfsrules_unhide_basic
+add include $devfsrules_unhide_login
+
+[devfsrules_jail_postgres=5]
+add include $devfsrules_jail
+add path 'bpf*' unhide
+
+[devfsrules_jail_ingress=6]
+add include $devfsrules_jail
+add path 'bpf*' unhide
+add path 'pf*' unhide
diff --git a/roles/host/templates/etc_crontab.j2 b/roles/host/templates/etc_crontab.j2
new file mode 100644
index 0000000..de1f3c6
--- /dev/null
+++ b/roles/host/templates/etc_crontab.j2
@@ -0,0 +1,32 @@
+# /etc/crontab - root's crontab for FreeBSD
+#
+#
+SHELL=/bin/sh
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
+#
+#minute hour    mday    month   wday    who     command
+#
+# Save some entropy so that /dev/random can re-seed on boot.
+*/11    *       *       *       *       operator /usr/libexec/save-entropy
+#
+# Rotate log files every hour, if necessary.
+0       *       *       *       *       root    newsyslog
+#
+# Perform daily/weekly/monthly maintenance.
+1       3       *       *       *       root    periodic daily
+15      4       *       *       6       root    periodic weekly
+30      5       1       *       *       root    periodic monthly
+#
+# Adjust the time zone if the CMOS clock keeps local time, as opposed to
+# UTC time.  See adjkerntz(8) for details.
+1,31    0-5     *       *       *       root    adjkerntz -a
+
+# Take snapshots every day at 3:05 AM
+5       3       *       *       *       root    logto /var/log/backup /usr/local/bin/backup snapshot prune-local
+# Send backup snapshots to remote every third day at 4:05 AM
+5       4       */3     *       *       root    logto /var/log/backup /usr/local/bin/backup send-to-remote prune-remote notify
+
+# Run pylogmonitor
+*/10    *       *       *       *       root    python -m pylogsentinel
+# Run pylogsentinel batch job once a day
+5       6       *       *       *       root    /usr/local/bin/pylogsentinel-batch-email.sh
diff --git a/roles/host/templates/etc_periodic.conf.j2 b/roles/host/templates/etc_periodic.conf.j2
new file mode 100644
index 0000000..176b55d
--- /dev/null
+++ b/roles/host/templates/etc_periodic.conf.j2
@@ -0,0 +1,4 @@
+daily_status_smart_enable="YES"
+daily_status_security_inline="YES"
+daily_status_zfs_enable="YES"
+weekly_certbot_enable="YES"
diff --git a/roles/host/templates/etc_rc.conf.j2 b/roles/host/templates/etc_rc.conf.j2
new file mode 100644
index 0000000..7cdf65e
--- /dev/null
+++ b/roles/host/templates/etc_rc.conf.j2
@@ -0,0 +1,50 @@
+hostname="pursotin"
+keymap="fi.kbd"
+sshd_enable="YES"
+ntpd_enable="YES"
+ntpd_sync_on_start="YES"
+powerd_enable="YES"
+moused_nondefault_enable="NO"
+dumpdev="AUTO"
+zfs_enable="YES"
+defaultrouter="{{ lan_ipv4_gateway }}"
+cloned_interfaces="bridge0 bridge1"
+{% if is_prod %}
+ifconfig_{{ nic_lan }}_name="lan0"
+ifconfig_{{ nic_wan }}_name="wan0"
+ifconfig_bridge0_name="brlan0"
+ifconfig_bridge1_name="brwan0"
+ifconfig_lan0="inet {{ lan_ipv4_cidr }}"
+ifconfig_lan0_ipv6="inet6 accept_rtadv"
+ifconfig_wan0="up"
+ifconfig_brlan0="addm lan0 up"
+ifconfig_brwan0="addm wan0 up"
+{% else %}
+ifconfig_bridge0_name="brlan0"
+ifconfig_bridge1_name="brwan0"
+ifconfig_vtnet0="inet {{ lan_ipv4_cidr }}"
+ifconfig_vtnet0_ipv6="inet6 accept_rtadv"
+ifconfig_brlan0="addm vtnet0 up"
+ifconfig_brwan0="up"
+{% endif %}
+zpool_gpt_labels_enable="YES"
+smartd_enable="YES"
+pf_enable="YES"
+syslogd_enable="YES"
+syslogd_flags="-s"
+jail_enable="YES"
+jail_parallel_start="YES"
+jail_reverse_stop="YES"
+clear_tmp_enable="YES"
+cleanvar_enable="YES"
+auditd_enable="YES"
+devd_enable="YES"
+{% if is_prod %}
+vm_enable="YES"
+vm_dir="zfs:zroot/vm"
+vm_list="alpine0"
+vm_delay="5"
+kld_list="pf if_wg i915kms"
+{% else %}
+kld_list="pf"
+{% endif %}
diff --git a/roles/host/templates/etc_resolv.conf.j2 b/roles/host/templates/etc_resolv.conf.j2
new file mode 100644
index 0000000..b382ecf
--- /dev/null
+++ b/roles/host/templates/etc_resolv.conf.j2
@@ -0,0 +1,2 @@
+search {{ lan_search_domain }}
+nameserver {{ dns_nameserver | default(lan_ipv4_gateway) }}
diff --git a/roles/host/templates/etc_ssh_sshd_config.j2 b/roles/host/templates/etc_ssh_sshd_config.j2
new file mode 100644
index 0000000..06179ce
--- /dev/null
+++ b/roles/host/templates/etc_ssh_sshd_config.j2
@@ -0,0 +1,121 @@
+#	$OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+# Note that some of FreeBSD's defaults differ from OpenBSD's, and
+# FreeBSD has a few additional options.
+
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin prohibit-password
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+#PubkeyAuthentication yes
+
+# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
+# but this is overridden so installations will only check .ssh/authorized_keys
+AuthorizedKeysFile	.ssh/authorized_keys
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# Change to yes to enable built-in password authentication.
+# Note that passwords may also be accepted via KbdInteractiveAuthentication.
+PasswordAuthentication no
+#PermitEmptyPasswords no
+
+# Change to no to disable PAM authentication
+#KbdInteractiveAuthentication yes
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+# Set this to 'no' to disable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the KbdInteractiveAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via KbdInteractiveAuthentication may bypass
+# the setting of "PermitRootLogin prohibit-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and KbdInteractiveAuthentication to 'no'.
+#UsePAM yes
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS yes
+#PidFile /var/run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#UseBlacklist no
+#VersionAddendum FreeBSD-20250219
+
+# no default banner path
+#Banner none
+
+# override default of no subsystems
+Subsystem	sftp	/usr/libexec/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	PermitTTY no
+#	ForceCommand cvs server
diff --git a/roles/host/templates/jail.conf.j2 b/roles/host/templates/jail.conf.j2
new file mode 100644
index 0000000..81bfbad
--- /dev/null
+++ b/roles/host/templates/jail.conf.j2
@@ -0,0 +1 @@
+.include "/etc/jail.conf.d/*.conf";
diff --git a/roles/host/templates/usr_local_bin_logto.sh.j2 b/roles/host/templates/usr_local_bin_logto.sh.j2
new file mode 100644
index 0000000..9bb5aa1
--- /dev/null
+++ b/roles/host/templates/usr_local_bin_logto.sh.j2
@@ -0,0 +1,47 @@
+#!/bin/sh
+
+set -ue
+
+# Wrapper for logging to file and prepending a timestamp.
+# By default writes both stdout and stderr to the log file.
+
+usage() {
+    echo "Usage: logto [-s|-e] <log_file> <command>"
+    echo "Flags:"
+    echo "  -s: Write only stdout to the log file."
+    echo "  -e: Write only stderr to the log file."
+    echo ""
+    echo "Example usage:"
+    echo "  logto /var/log/my.log run some command"
+    exit 1
+}
+
+mode="all"
+
+while getopts "se" opt; do
+    case $opt in
+        s) mode="stdout" ;;
+        e) mode="stderr" ;;
+        *) usage ;;
+    esac
+done
+shift $((OPTIND-1))
+
+if [ $# -lt 2 ]; then
+    usage
+fi
+
+log_file="$1"
+shift
+
+if [ "$mode" = "stdout" ]; then
+    out=$(2>/dev/null $@)
+elif [ "$mode" = "stderr" ]; then
+    out=$(2>&1 >/dev/null $@)
+else
+    out=$(2>&1 $@)
+fi
+
+if [ ! -z "$out" ]; then
+    echo "$(date +"%Y-%m-%dT%H:%M:%S%z")" "$out" >>"$log_file"
+fi
diff --git a/roles/host/templates/usr_local_bin_pylogsentinel-batch-email.sh.j2 b/roles/host/templates/usr_local_bin_pylogsentinel-batch-email.sh.j2
new file mode 100644
index 0000000..d28efd9
--- /dev/null
+++ b/roles/host/templates/usr_local_bin_pylogsentinel-batch-email.sh.j2
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+FILE=/tmp/pylogsentinel.daily
+
+if [ ! -f "$FILE" ]; then
+    echo "Nothing to do"
+    exit 0
+fi
+
+echo "Sending email"
+cat "$FILE" | mail -s "pylogsentinel alert batch" root
+
+echo "Removing batch file"
+rm "$FILE"
diff --git a/roles/host/templates/usr_local_etc_pylogsentinel.conf.j2 b/roles/host/templates/usr_local_etc_pylogsentinel.conf.j2
new file mode 100644
index 0000000..cb80742
--- /dev/null
+++ b/roles/host/templates/usr_local_etc_pylogsentinel.conf.j2
@@ -0,0 +1,22 @@
+[system]
+state_dir = /var/run/pylogsentinel
+max_block_size = 10M
+
+[logs.standard]
+cmd = find / -type f -path '*/var/log/*' ! -name '*access.log' ! -name '*.bz2' ! -name 'dmesg*' ! -name 'syncthing*'
+
+[logs.access]
+paths = /usr/local/jails/containers/ingress/var/log/nginx/access.log
+
+[action.default]
+cmd = echo -e "---------\nMatched $RULE_ID in $FILE at line $LINE, context:\n\n$CONTEXT\n" >> /tmp/pylogsentinel.daily
+
+[rule.error]
+description = Error-like conditions
+pattern = /(error|fatal|exception|killed)/i
+logs = standard
+
+[rule.access]
+description = HTTP code >=500 in access log
+pattern = /HTTP\/[0-9].[0-9]" 5[0-9][0-9]/
+logs = access
diff --git a/roles/host/templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 b/roles/host/templates/usr_local_etc_rc.d_zpool_gpt_labels.j2
new file mode 100644
index 0000000..36bc715
--- /dev/null
+++ b/roles/host/templates/usr_local_etc_rc.d_zpool_gpt_labels.j2
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+# PROVIDE: zpool_gpt_labels
+# REQUIRE: zfs
+# BEFORE:  LOGIN
+# KEYWORD: nojail
+
+. /etc/rc.subr
+
+name="zpool_gpt_labels"
+rcvar="zpool_gpt_labels_enable"
+start_cmd="zpool_gpt_labels_start"
+
+zpool_gpt_labels_start() {
+	logger "Setting zpool vdev paths to GPT labels"
+	local zpool_status="$(zpool status)"
+	for i in 0 1 2 3; do
+	    local raw="nda${i}p4.eli"
+		local path="/dev/gpt/zfs${i}.eli"
+		case "$zpool_status" in
+		    *"$raw"*)
+				zpool set "path=${path}" zroot "${raw}"
+				logger "Setting ${raw} -> ${path}"
+				;;
+			*)
+			    logger "Skipping ${raw}..."
+				;;
+		esac
+	done
+}
+
+load_rc_config $name
+run_rc_command "$1"
diff --git a/roles/host/templates/usr_local_etc_smartd.conf.j2 b/roles/host/templates/usr_local_etc_smartd.conf.j2
new file mode 100644
index 0000000..bdcbfd0
--- /dev/null
+++ b/roles/host/templates/usr_local_etc_smartd.conf.j2
@@ -0,0 +1,4 @@
+/dev/nvme0 -a -d nvme
+/dev/nvme1 -a -d nvme
+/dev/nvme2 -a -d nvme
+/dev/nvme3 -a -d nvme