1 files changed, 53 insertions, 10 deletions
diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml
index b40148e..75e364e 100644
--- a/tasks/jail_ingress.yml
+++ b/tasks/jail_ingress.yml
@@ -13,31 +13,74 @@
     owner: root
     group: wheel
     mode: "0644"
+  register: ingress_pf_conf
 
 - name: Reload pf.conf
   shell: jexec ingress pfctl -f /etc/pf.conf
+  when: ingress_pf_conf.changed
+
+- name: Check if gateway mode is enabled
+  shell: jexec ingress sysrc gateway_enable | grep -q "YES"
+  register: ingress_gateway_enabled
+  failed_when: false
+  changed_when: false
 
 - name: Enable gateway mode
-  shell: jexec ingress sysrc gateway_enable=YES && jexec ingress sysctl net.inet.ip.forwarding=1
+  shell: jexec ingress sysrc gateway_enable=YES
+  when: ingress_gateway_enabled.rc != 0
+
+- name: Check if IP forwarding is enabled
+  shell: jexec ingress sysctl net.inet.ip.forwarding | grep -q "1"
+  register: ingress_ip_forwarding_enabled
+  failed_when: false
+  changed_when: false
+
+- name: Enable IP forwarding
+  shell: jexec ingress sysctl net.inet.ip.forwarding=1
+  when: ingress_ip_forwarding_enabled.rc != 0
+
+- name: Check if pf enabled
+  shell: jexec ingress sysrc pf_enable | grep -q "YES"
+  register: ingress_pf_enabled
+  failed_when: false
+  changed_when: false
 
 - name: Enable pf
   shell: jexec ingress sysrc pf_enable=YES
+  when: ingress_pf_enabled.rc != 0
 
 - name: Check if pf is running
   shell: service -j ingress pf status
-  register: pf_status
-  changed_when: pf_status.rc != 0
+  register: ingress_pf_status
+  changed_when: ingress_pf_status.rc != 0
 
 - name: Start pf
   shell: service -j ingress pf start
-  when: pf_status.rc != 0
-#
-#- name: Generate LetsEncrypt certs
-#  shell: jexec ingress certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ item }}
-#  loop: "{{ ingress_routes | map(attribute='host') | unique }}"
+  when: ingress_pf_status.rc != 0
+
+- name: Copy acme-dns-auth.py
+  copy:
+    src: templates/ingress/acme-dns-auth.py
+    dest: /usr/local/jails/containers/ingress/usr/local/bin/acme-dns-auth.py
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Check if LetsEncrypt certs are generated
+  shell: ls /usr/local/jails/containers/ingress/usr/local/etc/letsencrypt/live/{{ cert_name }}
+  register: cert_exists
+  failed_when: false
+  changed_when: false
+
+- name: Manually get certs with certbot and DNS challenge
+  pause:
+    prompt: |
+      /usr/local/etc/letsencrypt/live/{{ cert_name }} does not exist. This means that this is the first run of this playbook.
+      The {{ cert_name }} cert contains all of the @ and * certs for all domains.
+      Check the ingress crontab template and run the certbot command manually in the ingress jail. Remove the "-n" flag.
+      Add the requested DNS records manually into Hetzner DNS. Continue after this is done.
+  when: cert_exists.rc != 0
 
-# It's important to run this after generating certs, because nginx.conf refers to files
-# generated by certbot. Certbot will fail validation if nginx.conf is configured too early.
 - name: Configure nginx.conf
   template:
     src: ingress/usr_local_etc_nginx_nginx.conf.j2