diff options
Diffstat (limited to 'tasks')
| -rw-r--r-- | tasks/general.yml | 19 | ||||
| -rw-r--r-- | tasks/jail_ingress.yml | 17 | ||||
| -rw-r--r-- | tasks/jails_dataset.yml | 11 | ||||
| -rw-r--r-- | tasks/network.yml | 9 |
4 files changed, 44 insertions, 12 deletions
diff --git a/tasks/general.yml b/tasks/general.yml index 76315cd..0ec9219 100644 --- a/tasks/general.yml +++ b/tasks/general.yml @@ -10,9 +10,16 @@ - bash - python - py311-pip - - vm-bhyve - fastfetch + +- name: Install amd64-specific packages + package: + name: "{{ item }}" + state: present + loop: + - vm-bhyve - drm-kmod + when: not is_test_vm - name: Set up periodic.conf template: @@ -39,10 +46,11 @@ group: wheel mode: "0644" register: fstab + when: not is_test_vm - name: Run mount -a shell: mount -a - when: fstab.changed + when: not is_test_vm and fstab.changed - name: Start auditd service: @@ -105,6 +113,7 @@ owner: root group: wheel mode: "0600" + when: not is_test_vm - name: Copy backup SSH public key copy: @@ -113,6 +122,7 @@ owner: root group: wheel mode: "0644" + when: not is_test_vm - name: Copy SSH config template: @@ -121,6 +131,7 @@ owner: root group: wheel mode: "0644" + when: not is_test_vm - name: Copy backup script template: @@ -129,15 +140,17 @@ owner: root group: wheel mode: "0755" + when: not is_test_vm - name: Check if zroot/vm exists shell: zfs list zroot/vm register: zroot_vm_check failed_when: false changed_when: false + when: not is_test_vm - name: Add vm dataset for bhyve and init - when: zroot_vm_check.rc != 0 + when: not is_test_vm and zroot_vm_check.rc != 0 block: - name: Create vm dataset shell: zfs create zroot/vm diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml index 1848177..5945e42 100644 --- a/tasks/jail_ingress.yml +++ b/tasks/jail_ingress.yml @@ -1,3 +1,20 @@ +- name: Ensure ingress goaccess mount points exist + file: + path: "{{ item }}" + state: directory + owner: root + group: wheel + mode: "0755" + loop: + - /usr/local/jails/containers/goaccess/var/www/goaccess + - /usr/local/jails/containers/ingress/mnt/www_goaccess + +- name: Start ingress jail + shell: service jail start ingress + register: ingress_jail_start + failed_when: false + changed_when: "'already running' not in ingress_jail_start.stderr" + - name: Install packages inside jail loop: - { jail: ingress, package: nginx } diff --git a/tasks/jails_dataset.yml b/tasks/jails_dataset.yml index 3925a8c..9e2748c 100644 --- a/tasks/jails_dataset.yml +++ b/tasks/jails_dataset.yml @@ -25,7 +25,7 @@ block: - name: Download userland get_url: - url: https://download.freebsd.org/ftp/releases/amd64/amd64/{{ dataset.userland }}/base.txz + url: https://download.freebsd.org/ftp/releases/{{ arch }}/{{ dataset.userland }}/base.txz dest: /usr/local/jails/media/{{ dataset.userland }}-base.txz owner: root group: wheel @@ -41,9 +41,12 @@ dest: /usr/local/jails/templates/{{ dataset.userland }}/etc/localtime - name: Copy resolv.conf to jail userland - shell: | - cat /etc/resolv.conf > /usr/local/jails/templates/{{ dataset.userland }}/etc/resolv.conf - chmod 644 /usr/local/jails/templates/{{ dataset.userland }}/etc/resolv.conf + template: + src: etc_resolv.conf.j2 + dest: /usr/local/jails/templates/{{ dataset.userland }}/etc/resolv.conf + owner: root + group: wheel + mode: "0644" - name: Disable resolvconf in the template shell: echo 'resolvconf=NO' >> /usr/local/jails/templates/{{ dataset.userland }}/etc/resolvconf.conf diff --git a/tasks/network.yml b/tasks/network.yml index 5f60d05..86cbf46 100644 --- a/tasks/network.yml +++ b/tasks/network.yml @@ -5,17 +5,16 @@ owner: root group: wheel mode: "0644" - register: resolv_conf - -- name: Make resolv.conf immutable - shell: chflags schg /etc/resolv.conf - when: resolv_conf.changed # TODO: this doesn't work without rc_conf having been run #- name: Restart networking if interface configuration changed # shell: service netif restart && service routing restart # when: rc_conf.changed or resolv_conf.changed +- name: Apply network configuration + shell: service netif restart && service routing restart + when: rc_conf.changed + - name: Set up sshd template: src: etc_ssh_sshd_config.j2 |