diff options
Diffstat (limited to 'tasks')
| -rw-r--r-- | tasks/general.yml | 2 | ||||
| -rw-r--r-- | tasks/jail_ingress.yml | 64 | ||||
| -rw-r--r-- | tasks/jails.yml | 20 | ||||
| -rw-r--r-- | tasks/network.yml | 49 | ||||
| -rw-r--r-- | tasks/pkg_jail_install.yml | 9 |
5 files changed, 88 insertions, 56 deletions
diff --git a/tasks/general.yml b/tasks/general.yml index 3c55117..9361217 100644 --- a/tasks/general.yml +++ b/tasks/general.yml @@ -4,11 +4,9 @@ state: present loop: - rsync - - nginx - dma - jq - curl - - py311-certbot - name: Set up periodic.conf template: diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml new file mode 100644 index 0000000..1a87722 --- /dev/null +++ b/tasks/jail_ingress.yml @@ -0,0 +1,64 @@ +- name: Install packages inside ingress jail + loop: + - { jail: ingress, package: nginx } + - { jail: ingress, package: py311-certbot } + include_tasks: pkg_jail_install.yml + +- name: Configure nginx.conf + template: + src: usr_local_etc_nginx_nginx.conf.j2 + dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf + owner: root + group: wheel + mode: "0644" + register: nginx_conf + +- name: Create static sites log dir + file: + path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }} + state: directory + owner: root + group: wheel + mode: "0755" + loop: "{{ static_sites | map(attribute='site') | unique }}" + +- name: Create access.log for static sites + file: + path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }}/access.log + state: touch + owner: root + group: wheel + mode: "0644" + loop: "{{ static_sites | map(attribute='site') | unique }}" + +- name: Create error.log for static sites + file: + path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }}/error.log + state: touch + owner: root + group: wheel + mode: "0644" + loop: "{{ static_sites | map(attribute='site') | unique }}" + +#- name: Generate LetsEncrypt certs +# shell: jexec ingress certbot certonly --standalone -n -m jan@jantuomi.fi --agree-tos -d {{ item }} +# loop: "{{ static_sites | selectattr('tls') | map(attribute='host') }}" +# when: nginx_conf.changed + +- name: Copy over static HTML + ansible.posix.synchronize: + src: "{{ item.value.rstrip('/') + '/' }}" + dest: /usr/local/jails/containers/ingress/usr/local/www/{{ item.key }} + loop: "{{ static_site_dirs | dict2items }}" + +- name: Check if nginx is enabled + shell: service -j ingress nginx status + changed_when: false + failed_when: false + register: ingress_nginx_enabled + +- name: Enable and start nginx + shell: | + service -j ingress nginx enable + service -j ingress nginx onestart + when: ingress_nginx_enabled.rc != 0 diff --git a/tasks/jails.yml b/tasks/jails.yml index 8233dc5..7cbe707 100644 --- a/tasks/jails.yml +++ b/tasks/jails.yml @@ -37,18 +37,23 @@ - name: Unarchive userland shell: tar -xzf /usr/local/jails/media/{{ jail_userland_version }}-base.txz -C /usr/local/jails/templates/{{ jail_userland_version }} - - name: Copy localtime and resolv.conf to jail userland + - name: Copy localtime to jail userland copy: remote_src: true - src: "{{ item }}" - dest: "/usr/local/jails/templates/{{ jail_userland_version }}{{ item }}" - loop: - - /etc/resolv.conf - - /etc/localtime + src: /etc/localtime + dest: /usr/local/jails/templates/{{ jail_userland_version }}/etc/localtime + + - name: Copy resolv.conf to jail userland + shell: | + cat /etc/resolv.conf > /usr/local/jails/templates/{{ jail_userland_version }}/etc/resolv.conf + chmod 644 /usr/local/jails/templates/{{ jail_userland_version }}/etc/resolv.conf - name: Update userland to latest patch level shell: freebsd-update -b /usr/local/jails/templates/{{ jail_userland_version }}/ fetch install + - name: Disable syslogd in the template + shell: echo 'syslogd_enable="NO"' >> /usr/local/jails/templates/{{ jail_userland_version }}/etc/rc.conf + - name: Create userland ZFS snapshot shell: zfs snapshot zroot/jails/templates/{{ jail_userland_version }}@base @@ -67,3 +72,6 @@ loop_control: loop_var: jail include_tasks: jail_single.yml + +- name: Configure ingress jail + include_tasks: jail_ingress.yml diff --git a/tasks/network.yml b/tasks/network.yml index ed57a13..a8749a7 100644 --- a/tasks/network.yml +++ b/tasks/network.yml @@ -12,7 +12,7 @@ when: resolv_conf.changed - name: Restart networking if interface configuration changed - shell: service netif restart && service routing restart + shell: service netif restart && service routing restart && service dhclient restart wan0 when: rc_conf.changed or resolv_conf.changed - name: Set up sshd @@ -67,53 +67,6 @@ shell: pfctl -f /etc/pf.conf when: pf_conf.changed -- name: Configure nginx.conf - template: - src: usr_local_etc_nginx_nginx.conf.j2 - dest: /usr/local/etc/nginx/nginx.conf - owner: root - group: wheel - mode: "0644" - register: nginx_conf - -- name: Generate LetsEncrypt certs - shell: certbot certonly --standalone -n -m jan@jantuomi.fi --agree-tos -d {{ item }} - loop: "{{ static_sites | selectattr('tls') | map(attribute='host') }}" - when: nginx_conf.changed - -- name: Copy over jan.systems HTML - ansible.posix.synchronize: - src: "{{ jan_systems_html_dir.rstrip('/') + '/' }}" - dest: /usr/local/www/jan.systems - -- name: Start nginx - service: - name: nginx - state: started - register: started_nginx - -- name: Restart nginx - service: - name: nginx - state: restarted - when: not started_nginx.changed and nginx_conf.changed - -- name: Set up restore_jail_aliases.sh - template: - src: usr_local_bin_restore_jail_aliases.sh.j2 - dest: /usr/local/bin/restore_jail_aliases.sh - owner: root - group: wheel - mode: "0755" - -- name: Set up devd lan0_jail_restore.conf - template: - src: etc_devd_lan0_jail_restore.conf.j2 - dest: /etc/devd/lan0_jail_restore.conf - owner: root - group: wheel - mode: "0644" - - name: Set up /usr/local/etc/do_dyndns_auth template: src: usr_local_etc_do_dyndns_auth.j2 diff --git a/tasks/pkg_jail_install.yml b/tasks/pkg_jail_install.yml new file mode 100644 index 0000000..0315a03 --- /dev/null +++ b/tasks/pkg_jail_install.yml @@ -0,0 +1,9 @@ +- name: Check if {{ item.package }} is installed + shell: pkg -j {{ item.jail }} info {{ item.package }} + register: pkg_jail_installed + changed_when: false + failed_when: false + +- name: Install {{ item.package }} + shell: pkg -j {{ item.jail }} install -y {{ item.package }} + when: pkg_jail_installed.rc != 0 |