From a8b7aaff8d89a0933a3abd70426dd2ec465425eb Mon Sep 17 00:00:00 2001 From: Jan Tuomi Date: Wed, 24 Dec 2025 18:26:16 +0200 Subject: Refactor jail.conf.d template --- templates/etc_jail.conf.d_[jailname].conf.j2 | 76 ++++++++-------------------- templates/jail_confs/_default.j2 | 5 ++ templates/jail_confs/_epl_network.j2 | 17 +++++++ templates/jail_confs/dl.j2 | 5 ++ templates/jail_confs/ingress.j2 | 15 ++++++ templates/jail_confs/plex.j2 | 3 ++ templates/jail_confs/postgres.j2 | 4 ++ 7 files changed, 70 insertions(+), 55 deletions(-) create mode 100644 templates/jail_confs/_default.j2 create mode 100644 templates/jail_confs/_epl_network.j2 create mode 100644 templates/jail_confs/dl.j2 create mode 100644 templates/jail_confs/ingress.j2 create mode 100644 templates/jail_confs/plex.j2 create mode 100644 templates/jail_confs/postgres.j2 (limited to 'templates') diff --git a/templates/etc_jail.conf.d_[jailname].conf.j2 b/templates/etc_jail.conf.d_[jailname].conf.j2 index d87439c..df10f47 100644 --- a/templates/etc_jail.conf.d_[jailname].conf.j2 +++ b/templates/etc_jail.conf.d_[jailname].conf.j2 @@ -5,53 +5,13 @@ vnet; persist; exec.clean; - exec.prestart = "ifconfig epair{{ jail.num }}000 create || echo 'Failed to create epair{{ jail.num }}000'"; - exec.prestart += "ifconfig epair{{ jail.num }}000a name epl{{ jail.num }}a"; - exec.prestart += "ifconfig epair{{ jail.num }}000b name epl{{ jail.num }}b"; - exec.prestart += "ifconfig epl{{ jail.num }}b ether random"; - exec.prestart += "ifconfig brlan0 addm epl{{ jail.num }}a"; - {% if jail.name == "ingress" -%} - exec.prestart += "ifconfig epair{{ jail.num }}001 create || echo 'Failed to create epair{{ jail.num }}001'"; - exec.prestart += "ifconfig epair{{ jail.num }}001a name epw1a"; - exec.prestart += "ifconfig epair{{ jail.num }}001b name epw1b"; - exec.prestart += "ifconfig brwan0 addm epw{{ jail.num }}a"; - {% endif %} + exec.prestart = ""; exec.start = "/bin/sh /etc/rc"; - - exec.poststart = "ifconfig epl{{ jail.num }}b vnet ${name}"; - exec.poststart += "jexec ${name} ifconfig epl{{ jail.num }}b up"; - exec.poststart += "ifconfig epl{{ jail.num }}a up"; - exec.poststart += "jexec ${name} ifconfig epl{{ jail.num }}b 192.168.2.{{ jail.num }}/16"; - exec.poststart += "jexec ${name} route delete default || echo 'No default route to delete'"; - {% if jail.name != "ingress" %} - {% for ing in jails -%} - {% if ing.name == "ingress" -%} - exec.poststart += "jexec ${name} route add default 192.168.2.{{ ing.num }} || echo 'Failed to add default route'"; - exec.poststart += "jexec ${name} route add 10.6.210.0/24 192.168.0.1 || echo 'Failed to add Wireguard return route'"; - {% endif %} - {% endfor %} - {% else %} - exec.poststart += "ifconfig epw{{ jail.num }}b vnet ${name}"; - exec.poststart += "jexec ${name} ifconfig epw{{ jail.num }}b up"; - exec.poststart += "ifconfig epw{{ jail.num }}a up"; - exec.poststart += "jexec ${name} service dhclient restart epw{{ jail.num }}b"; - exec.poststart += "mount -t nullfs /usr/local/jails/containers/goaccess/var/www/goaccess /usr/local/jails/containers/ingress/mnt/www_goaccess"; - {% endif %} - - {% if jail.name == "dl" -%} - exec.poststart += "jexec ${name} sh ~/random_tunnel.sh"; - {% elif jail.name == "plex" -%} - exec.poststart += "jexec ${name} sh ~/start_plex.sh"; - {% endif %} - + exec.poststart = ""; + exec.prestop = ""; exec.stop = "/bin/sh /etc/rc.shutdown"; - - exec.poststop += "ifconfig epl{{ jail.num }}a destroy"; - {% if jail.name == "ingress" -%} - exec.poststop += "ifconfig epw{{ jail.num }}a destroy"; - exec.poststop += "umount /usr/local/jails/containers/ingress/mnt/www_goaccess"; - {% endif %} + exec.poststop = ""; exec.consolelog = "/var/log/jail_console_${name}.log"; @@ -59,19 +19,25 @@ allow.raw_sockets; exec.clean; mount.devfs; - {%if jail.name == "postgres" -%} - allow.sysvipc; - devfs_ruleset = 5; - {% elif jail.name == "ingress" -%} - devfs_ruleset = 6; - {% elif jail.name == "dl" -%} - devfs_ruleset = 4; - allow.mlock; - {% else %} - devfs_ruleset = 4; - {% endif %} # HOSTNAME/PATH host.hostname = "${name}"; path = "/usr/local/jails/containers/${name}"; + + # JAIL-SPECIFIC CONFIGURATION +{% set t = lookup( + 'ansible.builtin.first_found', + { + 'files': [ + 'jail_confs/' ~ jail.name ~ '.j2', + 'jail_confs/_default.j2', + ], + 'paths': [ playbook_dir ~ '/templates' ] + }, + errors='ignore' +) %} + +{% if t %} +{{ lookup('ansible.builtin.template', t) | indent(2, true) }} +{% endif %} } diff --git a/templates/jail_confs/_default.j2 b/templates/jail_confs/_default.j2 new file mode 100644 index 0000000..3a4e492 --- /dev/null +++ b/templates/jail_confs/_default.j2 @@ -0,0 +1,5 @@ +devfs_ruleset = 4; + +{% include 'jail_confs/_epl_network.j2' %} + +exec.poststart += "jexec ${name} route add default {{ ingress_ip }} || echo 'Failed to add default route'"; diff --git a/templates/jail_confs/_epl_network.j2 b/templates/jail_confs/_epl_network.j2 new file mode 100644 index 0000000..e80aebe --- /dev/null +++ b/templates/jail_confs/_epl_network.j2 @@ -0,0 +1,17 @@ +## _epl_network begin +exec.prestart += "ifconfig epair{{ jail.num }}000 create || echo 'Failed to create epair{{ jail.num }}000'"; +exec.prestart += "ifconfig epair{{ jail.num }}000a name epl{{ jail.num }}a"; +exec.prestart += "ifconfig epair{{ jail.num }}000b name epl{{ jail.num }}b"; +exec.prestart += "ifconfig epl{{ jail.num }}b ether random"; +exec.prestart += "ifconfig brlan0 addm epl{{ jail.num }}a"; + +exec.poststart += "ifconfig epl{{ jail.num }}b vnet ${name}"; +exec.poststart += "jexec ${name} ifconfig epl{{ jail.num }}b up"; +exec.poststart += "ifconfig epl{{ jail.num }}a up"; +exec.poststart += "jexec ${name} ifconfig epl{{ jail.num }}b 192.168.2.{{ jail.num }}/16"; +exec.poststart += "jexec ${name} route delete default || echo 'No default route to delete'"; + +exec.poststart += "jexec ${name} route add 10.6.210.0/24 {{ lan_ipv4_gateway }} || echo 'Failed to add Wireguard return route'"; + +exec.poststop += "ifconfig epl{{ jail.num }}a destroy"; +## _epl_network end diff --git a/templates/jail_confs/dl.j2 b/templates/jail_confs/dl.j2 new file mode 100644 index 0000000..324906f --- /dev/null +++ b/templates/jail_confs/dl.j2 @@ -0,0 +1,5 @@ +{% include 'jail_confs/_epl_network.j2' %} +devfs_ruleset = 4; +allow.mlock; + +exec.poststart += "jexec ${name} sh ~/random_tunnel.sh"; diff --git a/templates/jail_confs/ingress.j2 b/templates/jail_confs/ingress.j2 new file mode 100644 index 0000000..d6e4cad --- /dev/null +++ b/templates/jail_confs/ingress.j2 @@ -0,0 +1,15 @@ +devfs_ruleset = 6; + +{% include 'jail_confs/_epl_network.j2' %} + +exec.prestart += "ifconfig epair{{ jail.num }}001 create || echo 'Failed to create epair{{ jail.num }}001'"; +exec.prestart += "ifconfig epair{{ jail.num }}001a name epw1a"; +exec.prestart += "ifconfig epair{{ jail.num }}001b name epw1b"; +exec.prestart += "ifconfig brwan0 addm epw{{ jail.num }}a"; + +exec.poststart += "ifconfig epw{{ jail.num }}b vnet ${name}"; +exec.poststart += "jexec ${name} ifconfig epw{{ jail.num }}b up"; +exec.poststart += "ifconfig epw{{ jail.num }}a up"; +exec.poststart += "jexec ${name} service dhclient restart epw{{ jail.num }}b"; + +exec.poststop += "ifconfig epw{{ jail.num }}a destroy"; diff --git a/templates/jail_confs/plex.j2 b/templates/jail_confs/plex.j2 new file mode 100644 index 0000000..fd91b58 --- /dev/null +++ b/templates/jail_confs/plex.j2 @@ -0,0 +1,3 @@ +{% include 'jail_confs/_epl_network.j2' %} + +exec.poststart += "jexec ${name} sh ~/start_plex.sh"; diff --git a/templates/jail_confs/postgres.j2 b/templates/jail_confs/postgres.j2 new file mode 100644 index 0000000..bb3d1f1 --- /dev/null +++ b/templates/jail_confs/postgres.j2 @@ -0,0 +1,4 @@ +{% include 'jail_confs/_epl_network.j2' %} +devfs_ruleset = 5; + +allow.sysvipc; -- cgit v1.3