From ae9be6373428471dd4c95f64741b990638c272c0 Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Mon, 6 Oct 2025 00:06:54 +0300
Subject: Work on networking

---
 tasks/jail_ingress.yml | 53 +++++++++++++++++++++++++++++++++++++++-----------
 tasks/jail_single.yml  |  3 +++
 tasks/network.yml      | 17 ----------------
 3 files changed, 45 insertions(+), 28 deletions(-)

(limited to 'tasks')

diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml
index 1a87722..d6db2f5 100644
--- a/tasks/jail_ingress.yml
+++ b/tasks/jail_ingress.yml
@@ -2,17 +2,9 @@
   loop:
     - { jail: ingress, package: nginx }
     - { jail: ingress, package: py311-certbot }
+    - { jail: ingress, package: py311-certbot-nginx }
   include_tasks: pkg_jail_install.yml
 
-- name: Configure nginx.conf
-  template:
-    src: usr_local_etc_nginx_nginx.conf.j2
-    dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf
-    owner: root
-    group: wheel
-    mode: "0644"
-  register: nginx_conf
-
 - name: Create static sites log dir
   file:
     path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }}
@@ -41,9 +33,19 @@
   loop: "{{ static_sites | map(attribute='site') | unique }}"
 
 #- name: Generate LetsEncrypt certs
-#  shell: jexec ingress certbot certonly --standalone -n -m jan@jantuomi.fi --agree-tos -d {{ item }}
+#  shell: jexec ingress certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ item }}
 #  loop: "{{ static_sites | selectattr('tls') | map(attribute='host') }}"
-#  when: nginx_conf.changed
+
+# It's important to run this after generating certs, because nginx.conf refers to files
+# generated by certbot. Certbot will fail validation if nginx.conf is configured too early.
+- name: Configure nginx.conf
+  template:
+    src: usr_local_etc_nginx_nginx.conf.j2
+    dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+  register: nginx_conf
 
 - name: Copy over static HTML
   ansible.posix.synchronize:
@@ -62,3 +64,32 @@
     service -j ingress nginx enable
     service -j ingress nginx onestart
   when: ingress_nginx_enabled.rc != 0
+
+- name: Configure hetzner-ddns
+  template:
+    src: usr_local_etc_rc.d_hetzner_ddns.j2
+    dest: /usr/local/jails/containers/ingress/usr/local/etc/rc.d/hetzner_ddns
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Install hetzner-ddns script
+  template:
+    src: usr_local_bin_hetzner_ddns.sh.j2
+    dest: /usr/local/jails/containers/ingress/usr/local/bin/hetzner_ddns.sh
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Set up hetzner_auth
+  template:
+    src: usr_local_etc_hetzner_auth.j2
+    dest: /usr/local/jails/containers/ingress/usr/local/etc/hetzner_auth
+    owner: root
+    group: wheel
+    mode: "0600"
+
+- name: Restart hetzner-ddns
+  shell: |
+    service -j ingress hetzner_ddns enable
+    service -j ingress hetzner_ddns restart
diff --git a/tasks/jail_single.yml b/tasks/jail_single.yml
index 9c5d1ee..9d539d0 100644
--- a/tasks/jail_single.yml
+++ b/tasks/jail_single.yml
@@ -8,6 +8,9 @@
   shell: zfs clone zroot/jails/templates/{{ jail_userland_version }}@base "zroot/jails/containers/{{ jail.name }}"
   when: check_jail_directory.rc != 0
 
+- name: Make resolv.conf immutable
+  shell: chflags schg /usr/local/jails/containers/{{ jail.name }}/etc/resolv.conf
+
 - name: "Check if jail {{ jail.name }} is running"
   shell: jls -j "{{ jail.name }}"
   failed_when: false
diff --git a/tasks/network.yml b/tasks/network.yml
index 15c4494..bf22044 100644
--- a/tasks/network.yml
+++ b/tasks/network.yml
@@ -66,20 +66,3 @@
 - name: Reload pf rules
   shell: pfctl -f /etc/pf.conf
   when: pf_conf.changed
-
-- name: Set up /usr/local/etc/do_dyndns_auth
-  template:
-    src: usr_local_etc_do_dyndns_auth.j2
-    dest: /usr/local/etc/do_dyndns_auth
-    owner: root
-    group: wheel
-    mode: "0600"
-
-- name: Set up /usr/local/bin/do_dyndns.sh
-  template:
-    src: usr_local_bin_do_dyndns.sh.j2
-    dest: /usr/local/bin/do_dyndns.sh
-    owner: root
-    group: wheel
-    mode: "0755"
-  register: do_dyndns_sh
-- 
cgit v1.3