From a8b7aaff8d89a0933a3abd70426dd2ec465425eb Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Wed, 24 Dec 2025 18:26:16 +0200
Subject: Refactor jail.conf.d template

---
 templates/jail_confs/_default.j2     |  5 +++++
 templates/jail_confs/_epl_network.j2 | 17 +++++++++++++++++
 templates/jail_confs/dl.j2           |  5 +++++
 templates/jail_confs/ingress.j2      | 15 +++++++++++++++
 templates/jail_confs/plex.j2         |  3 +++
 templates/jail_confs/postgres.j2     |  4 ++++
 6 files changed, 49 insertions(+)
 create mode 100644 templates/jail_confs/_default.j2
 create mode 100644 templates/jail_confs/_epl_network.j2
 create mode 100644 templates/jail_confs/dl.j2
 create mode 100644 templates/jail_confs/ingress.j2
 create mode 100644 templates/jail_confs/plex.j2
 create mode 100644 templates/jail_confs/postgres.j2

(limited to 'templates/jail_confs')

diff --git a/templates/jail_confs/_default.j2 b/templates/jail_confs/_default.j2
new file mode 100644
index 0000000..3a4e492
--- /dev/null
+++ b/templates/jail_confs/_default.j2
@@ -0,0 +1,5 @@
+devfs_ruleset = 4;
+
+{% include 'jail_confs/_epl_network.j2' %}
+
+exec.poststart   += "jexec ${name} route add default {{ ingress_ip }} || echo 'Failed to add default route'";
diff --git a/templates/jail_confs/_epl_network.j2 b/templates/jail_confs/_epl_network.j2
new file mode 100644
index 0000000..e80aebe
--- /dev/null
+++ b/templates/jail_confs/_epl_network.j2
@@ -0,0 +1,17 @@
+## _epl_network begin
+exec.prestart    += "ifconfig epair{{ jail.num }}000 create || echo 'Failed to create epair{{ jail.num }}000'";
+exec.prestart    += "ifconfig epair{{ jail.num }}000a name epl{{ jail.num }}a";
+exec.prestart    += "ifconfig epair{{ jail.num }}000b name epl{{ jail.num }}b";
+exec.prestart    += "ifconfig epl{{ jail.num }}b ether random";
+exec.prestart    += "ifconfig brlan0 addm epl{{ jail.num }}a";
+
+exec.poststart   += "ifconfig epl{{ jail.num }}b vnet ${name}";
+exec.poststart   += "jexec ${name} ifconfig epl{{ jail.num }}b up";
+exec.poststart   += "ifconfig epl{{ jail.num }}a up";
+exec.poststart   += "jexec ${name} ifconfig epl{{ jail.num }}b 192.168.2.{{ jail.num }}/16";
+exec.poststart   += "jexec ${name} route delete default || echo 'No default route to delete'";
+
+exec.poststart   += "jexec ${name} route add 10.6.210.0/24 {{ lan_ipv4_gateway }} || echo 'Failed to add Wireguard return route'";
+
+exec.poststop    += "ifconfig epl{{ jail.num }}a destroy";
+## _epl_network end
diff --git a/templates/jail_confs/dl.j2 b/templates/jail_confs/dl.j2
new file mode 100644
index 0000000..324906f
--- /dev/null
+++ b/templates/jail_confs/dl.j2
@@ -0,0 +1,5 @@
+{% include 'jail_confs/_epl_network.j2' %}
+devfs_ruleset = 4;
+allow.mlock;
+
+exec.poststart   += "jexec ${name} sh ~/random_tunnel.sh";
diff --git a/templates/jail_confs/ingress.j2 b/templates/jail_confs/ingress.j2
new file mode 100644
index 0000000..d6e4cad
--- /dev/null
+++ b/templates/jail_confs/ingress.j2
@@ -0,0 +1,15 @@
+devfs_ruleset = 6;
+
+{% include 'jail_confs/_epl_network.j2' %}
+
+exec.prestart    += "ifconfig epair{{ jail.num }}001 create || echo 'Failed to create epair{{ jail.num }}001'";
+exec.prestart    += "ifconfig epair{{ jail.num }}001a name epw1a";
+exec.prestart    += "ifconfig epair{{ jail.num }}001b name epw1b";
+exec.prestart    += "ifconfig brwan0 addm epw{{ jail.num }}a";
+
+exec.poststart   += "ifconfig epw{{ jail.num }}b vnet ${name}";
+exec.poststart   += "jexec ${name} ifconfig epw{{ jail.num }}b up";
+exec.poststart   += "ifconfig epw{{ jail.num }}a up";
+exec.poststart   += "jexec ${name} service dhclient restart epw{{ jail.num }}b";
+
+exec.poststop    += "ifconfig epw{{ jail.num }}a destroy";
diff --git a/templates/jail_confs/plex.j2 b/templates/jail_confs/plex.j2
new file mode 100644
index 0000000..fd91b58
--- /dev/null
+++ b/templates/jail_confs/plex.j2
@@ -0,0 +1,3 @@
+{% include 'jail_confs/_epl_network.j2' %}
+
+exec.poststart   += "jexec ${name} sh ~/start_plex.sh";
diff --git a/templates/jail_confs/postgres.j2 b/templates/jail_confs/postgres.j2
new file mode 100644
index 0000000..bb3d1f1
--- /dev/null
+++ b/templates/jail_confs/postgres.j2
@@ -0,0 +1,4 @@
+{% include 'jail_confs/_epl_network.j2' %}
+devfs_ruleset = 5;
+
+allow.sysvipc;
-- 
cgit v1.3