From b6747a645d2627d7672f77fd9d9f301c62c3ccb2 Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Thu, 9 Jul 2026 22:42:56 +0300
Subject: Set up freshrss jail

---
 roles/jails/14_freshrss/defaults/main.yml          | 39 +++++++++++++++++++
 roles/jails/14_freshrss/tasks/main.yml             | 38 +++++++++++++++++++
 .../templates/usr_local_etc_nginx_nginx.conf       | 44 ++++++++++++++++++++++
 .../templates/usr_local_etc_php_fpm.d_www.conf     | 14 +++++++
 4 files changed, 135 insertions(+)
 create mode 100644 roles/jails/14_freshrss/templates/usr_local_etc_nginx_nginx.conf
 create mode 100644 roles/jails/14_freshrss/templates/usr_local_etc_php_fpm.d_www.conf

diff --git a/roles/jails/14_freshrss/defaults/main.yml b/roles/jails/14_freshrss/defaults/main.yml
index 5416267..5a55d8f 100644
--- a/roles/jails/14_freshrss/defaults/main.yml
+++ b/roles/jails/14_freshrss/defaults/main.yml
@@ -1 +1,40 @@
 userland: "15.0-RELEASE"
+
+zfs:
+  - name: zroot/jails/volumes/freshrss_data
+    mountpoint: /usr/local/FreshRSS/data
+
+pkg:
+  - nginx
+  - php82
+  - php82-ctype
+  - php82-curl
+  - php82-dom
+  - php82-filter
+  - php82-gd
+  - php82-iconv
+  - php82-mbstring
+  - php82-opcache
+  - php82-pdo
+  - php82-pdo_sqlite
+  - php82-phar
+  - php82-posix
+  - php82-session
+  - php82-simplexml
+  - php82-sqlite3
+  - php82-tokenizer
+  - php82-xml
+  - php82-xmlreader
+  - php82-xmlwriter
+  - php82-zip
+  - php82-extensions
+
+files:
+  - src: usr_local_etc_nginx_nginx.conf
+    dest: /usr/local/etc/nginx/nginx.conf
+  - src: usr_local_etc_php_fpm.d_www.conf
+    dest: /usr/local/etc/php-fpm.d/www.conf
+
+services:
+  - nginx
+  - php_fpm
diff --git a/roles/jails/14_freshrss/tasks/main.yml b/roles/jails/14_freshrss/tasks/main.yml
index 2abdaff..9cc08fc 100644
--- a/roles/jails/14_freshrss/tasks/main.yml
+++ b/roles/jails/14_freshrss/tasks/main.yml
@@ -1,2 +1,40 @@
 - import_role:
     name: jail
+    tasks_from: jail_setup
+
+- name: Download FreshRSS
+  shell: |
+    if [ ! -f /usr/local/FreshRSS/constants.php ]; then
+      fetch -qo /tmp/freshrss.tar.gz https://github.com/FreshRSS/FreshRSS/archive/refs/heads/edge.tar.gz
+      tar -xf /tmp/freshrss.tar.gz --strip-components=1 -C /usr/local/FreshRSS
+      rm -f /tmp/freshrss.tar.gz
+    fi
+  register: _freshrss_download
+  changed_when: "'constants.php' not in _freshrss_download.cmd"
+
+- name: Set FreshRSS data ownership
+  file:
+    path: /usr/local/FreshRSS/data
+    state: directory
+    owner: www
+    group: www
+    recurse: true
+
+- name: Create php-fpm socket directory
+  file:
+    path: /var/run/php
+    state: directory
+    owner: www
+    group: www
+    mode: "0755"
+
+- name: Symlink FreshRSS public to webroot
+  file:
+    src: /usr/local/FreshRSS/p
+    dest: /var/www
+    state: link
+    force: true
+
+- import_role:
+    name: jail
+    tasks_from: jail_launch
diff --git a/roles/jails/14_freshrss/templates/usr_local_etc_nginx_nginx.conf b/roles/jails/14_freshrss/templates/usr_local_etc_nginx_nginx.conf
new file mode 100644
index 0000000..f486e13
--- /dev/null
+++ b/roles/jails/14_freshrss/templates/usr_local_etc_nginx_nginx.conf
@@ -0,0 +1,44 @@
+worker_processes auto;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    sendfile on;
+    keepalive_timeout 65;
+
+    server {
+        listen 80;
+        server_name freshrss.jan.systems;
+
+        root /var/www;
+        index index.php index.html index.htm;
+
+        access_log /var/log/freshrss.access.log;
+        error_log  /var/log/freshrss.error.log;
+
+        location = /api/pshb.php { deny all; }
+        location ^~ /api/pshb.php/ { deny all; }
+
+        location / {
+            try_files $uri $uri/ /index.php?$query_string;
+        }
+
+        location ~ ^.+?\.php(/.*)?$ {
+            try_files $fastcgi_script_name =404;
+
+            fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
+            fastcgi_split_path_info ^(.+\.php)(/.*)$;
+
+            set $path_info $fastcgi_path_info;
+            fastcgi_param PATH_INFO $path_info;
+
+            include fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        }
+    }
+}
diff --git a/roles/jails/14_freshrss/templates/usr_local_etc_php_fpm.d_www.conf b/roles/jails/14_freshrss/templates/usr_local_etc_php_fpm.d_www.conf
new file mode 100644
index 0000000..351470c
--- /dev/null
+++ b/roles/jails/14_freshrss/templates/usr_local_etc_php_fpm.d_www.conf
@@ -0,0 +1,14 @@
+[www]
+user = www
+group = www
+
+listen = /var/run/php/php8.2-fpm.sock
+listen.owner = www
+listen.group = www
+listen.mode = 0660
+
+pm = dynamic
+pm.max_children = 5
+pm.start_servers = 2
+pm.min_spare_servers = 1
+pm.max_spare_servers = 3
-- 
cgit v1.3