From 5263aa814da9852294ea64c77af22a1cd2507fca Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Wed, 22 Oct 2025 22:45:15 +0300
Subject: Improvements

---
 tasks/jail_ingress.yml | 31 +++++++++++++++++++++++++++++++
 tasks/jails.yml        |  8 ++++++++
 2 files changed, 39 insertions(+)

(limited to 'tasks')

diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml
index 71d87fa..87dff41 100644
--- a/tasks/jail_ingress.yml
+++ b/tasks/jail_ingress.yml
@@ -6,6 +6,29 @@
     - { jail: ingress, package: goaccess }
   include_tasks: pkg_jail_install.yml
 
+- name: Configure pf.conf
+  template:
+    src: ingress/etc_pf.conf.j2
+    dest: /usr/local/jails/containers/ingress/etc/pf.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+
+- name: Enable gateway mode
+  shell: jexec ingress sysrc gateway_enable=YES && jexec ingress sysctl net.inet.ip.forwarding=1
+
+- name: Enable pf
+  shell: jexec ingress sysrc pf_enable=YES
+
+- name: Check if pf is running
+  shell: service -j ingress pf status
+  register: pf_status
+  changed_when: pf_status.rc != 0
+
+- name: Start pf
+  shell: service -j ingress pf start
+  when: pf_status.rc != 0
+
 - name: Generate LetsEncrypt certs
   shell: jexec ingress certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ item }}
   loop: "{{ ingress_routes | map(attribute='host') | unique }}"
@@ -59,6 +82,14 @@
     group: wheel
     mode: "0600"
 
+- name: Set up gen_goaccess.sh
+  template:
+    src: ingress/usr_local_bin_gen_goaccess.sh.j2
+    dest: /usr/local/jails/containers/ingress/usr/local/bin/gen_goaccess.sh
+    owner: root
+    group: wheel
+    mode: "0755"
+
 - name: Set up crontab
   template:
     src: ingress/etc_crontab.j2
diff --git a/tasks/jails.yml b/tasks/jails.yml
index 99eb938..fe94126 100644
--- a/tasks/jails.yml
+++ b/tasks/jails.yml
@@ -67,6 +67,14 @@
         group: wheel
         mode: "0644"
 
+    - name: Configure devfs.rules
+      template:
+        src: etc_devfs.rules.j2
+        dest: /etc/devfs.rules
+        owner: root
+        group: wheel
+        mode: "0644"
+
     - name: Configure individual jails
       loop: "{{ jails }}"
       loop_control:
-- 
cgit v1.3