diff options
Diffstat (limited to 'tasks')
| -rw-r--r-- | tasks/jail_ingress.yml | 53 | ||||
| -rw-r--r-- | tasks/jail_single.yml | 3 | ||||
| -rw-r--r-- | tasks/network.yml | 17 |
3 files changed, 45 insertions, 28 deletions
diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml index 1a87722..d6db2f5 100644 --- a/tasks/jail_ingress.yml +++ b/tasks/jail_ingress.yml @@ -2,17 +2,9 @@ loop: - { jail: ingress, package: nginx } - { jail: ingress, package: py311-certbot } + - { jail: ingress, package: py311-certbot-nginx } include_tasks: pkg_jail_install.yml -- name: Configure nginx.conf - template: - src: usr_local_etc_nginx_nginx.conf.j2 - dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf - owner: root - group: wheel - mode: "0644" - register: nginx_conf - - name: Create static sites log dir file: path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }} @@ -41,9 +33,19 @@ loop: "{{ static_sites | map(attribute='site') | unique }}" #- name: Generate LetsEncrypt certs -# shell: jexec ingress certbot certonly --standalone -n -m jan@jantuomi.fi --agree-tos -d {{ item }} +# shell: jexec ingress certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ item }} # loop: "{{ static_sites | selectattr('tls') | map(attribute='host') }}" -# when: nginx_conf.changed + +# It's important to run this after generating certs, because nginx.conf refers to files +# generated by certbot. Certbot will fail validation if nginx.conf is configured too early. +- name: Configure nginx.conf + template: + src: usr_local_etc_nginx_nginx.conf.j2 + dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf + owner: root + group: wheel + mode: "0644" + register: nginx_conf - name: Copy over static HTML ansible.posix.synchronize: @@ -62,3 +64,32 @@ service -j ingress nginx enable service -j ingress nginx onestart when: ingress_nginx_enabled.rc != 0 + +- name: Configure hetzner-ddns + template: + src: usr_local_etc_rc.d_hetzner_ddns.j2 + dest: /usr/local/jails/containers/ingress/usr/local/etc/rc.d/hetzner_ddns + owner: root + group: wheel + mode: "0755" + +- name: Install hetzner-ddns script + template: + src: usr_local_bin_hetzner_ddns.sh.j2 + dest: /usr/local/jails/containers/ingress/usr/local/bin/hetzner_ddns.sh + owner: root + group: wheel + mode: "0755" + +- name: Set up hetzner_auth + template: + src: usr_local_etc_hetzner_auth.j2 + dest: /usr/local/jails/containers/ingress/usr/local/etc/hetzner_auth + owner: root + group: wheel + mode: "0600" + +- name: Restart hetzner-ddns + shell: | + service -j ingress hetzner_ddns enable + service -j ingress hetzner_ddns restart diff --git a/tasks/jail_single.yml b/tasks/jail_single.yml index 9c5d1ee..9d539d0 100644 --- a/tasks/jail_single.yml +++ b/tasks/jail_single.yml @@ -8,6 +8,9 @@ shell: zfs clone zroot/jails/templates/{{ jail_userland_version }}@base "zroot/jails/containers/{{ jail.name }}" when: check_jail_directory.rc != 0 +- name: Make resolv.conf immutable + shell: chflags schg /usr/local/jails/containers/{{ jail.name }}/etc/resolv.conf + - name: "Check if jail {{ jail.name }} is running" shell: jls -j "{{ jail.name }}" failed_when: false diff --git a/tasks/network.yml b/tasks/network.yml index 15c4494..bf22044 100644 --- a/tasks/network.yml +++ b/tasks/network.yml @@ -66,20 +66,3 @@ - name: Reload pf rules shell: pfctl -f /etc/pf.conf when: pf_conf.changed - -- name: Set up /usr/local/etc/do_dyndns_auth - template: - src: usr_local_etc_do_dyndns_auth.j2 - dest: /usr/local/etc/do_dyndns_auth - owner: root - group: wheel - mode: "0600" - -- name: Set up /usr/local/bin/do_dyndns.sh - template: - src: usr_local_bin_do_dyndns.sh.j2 - dest: /usr/local/bin/do_dyndns.sh - owner: root - group: wheel - mode: "0755" - register: do_dyndns_sh |