From f4504129f6a1bfce8fc81f69b0f90f340acb1d34 Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Thu, 9 Oct 2025 22:04:02 +0300
Subject: Add postgres jail conf

---
 playbook.yml               |  4 ++++
 tasks/jail_postgres.yml    | 10 ++++++++++
 templates/etc_jail.conf.j2 |  5 ++++-
 3 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 tasks/jail_postgres.yml

diff --git a/playbook.yml b/playbook.yml
index 1ee0817..4f32363 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -82,6 +82,10 @@
       tags: [jail_ingress]
       import_tasks: tasks/jail_ingress.yml
 
+    - name: Run postgres jail tasks
+      tags: [jail_postgres]
+      import_tasks: tasks/jail_postgres.yml
+
     - name: Run diddle jail tasks
       tags: [jail_diddle]
       import_tasks: tasks/jail_diddle.yml
diff --git a/tasks/jail_postgres.yml b/tasks/jail_postgres.yml
new file mode 100644
index 0000000..42cdacf
--- /dev/null
+++ b/tasks/jail_postgres.yml
@@ -0,0 +1,10 @@
+- name: Install packages inside jail
+  loop:
+    - { jail: postgres, package: postgresql18-server }
+  include_tasks: pkg_jail_install.yml
+
+- name: Enable postgresql service inside jail
+  shell: |
+    service -j postgres postgresql enable
+  changed_when: false
+# Run initdb and start manually, not managed by Ansible
diff --git a/templates/etc_jail.conf.j2 b/templates/etc_jail.conf.j2
index 0b8c18b..25955ce 100644
--- a/templates/etc_jail.conf.j2
+++ b/templates/etc_jail.conf.j2
@@ -32,10 +32,13 @@ path = "/usr/local/jails/containers/${name}";
 {% for jail in jails %}
 {{ jail.name }} {
   $num           = "{{ jail.num }}";
-  {% if jail.name == "ingress" %}
+  {% if jail.name == "ingress" -%}
   exec.poststart    = "jexec ${name} ifconfig ${epl}b 192.168.2.${num}/16 up";
   exec.poststart    = "jexec ${name} ifconfig epw1b up";
   exec.poststart   += "jexec ${name} service dhclient restart epw1b";
   {% endif %}
+  {%if jail.name == "postgres" -%}
+  allow.sysvipc;
+  {% endif %}
 }
 {% endfor %}
-- 
cgit v1.3