# eplXa is host end (local network bridge), eplXb is jail end.
# The corresponding pubnet interface is epwX, but that's not created for all jails.
{{ jail.name }} {
  # STARTUP/LOGGING/VNET
  vnet;
  persist;
  exec.clean;
  exec.prestart     = "ifconfig epair{{ jail.num }}000 create || echo 'Failed to create epair{{ jail.num }}000'";
  exec.prestart    += "ifconfig epair{{ jail.num }}000a name epl{{ jail.num }}a";
  exec.prestart    += "ifconfig epair{{ jail.num }}000b name epl{{ jail.num }}b";
  exec.prestart    += "ifconfig brlan0 addm epl{{ jail.num }}a";
  {% if jail.name == "ingress" -%}
  exec.prestart    += "ifconfig epair{{ jail.num }}001 create || echo 'Failed to create epair{{ jail.num }}001'";
  exec.prestart    += "ifconfig epair{{ jail.num }}001a name epw1a";
  exec.prestart    += "ifconfig epair{{ jail.num }}001b name epw1b";
  exec.prestart    += "ifconfig brwan0 addm epw{{ jail.num }}a";
  {% endif %}

  exec.start        = "/bin/sh /etc/rc";

  exec.poststart    = "ifconfig epl{{ jail.num }}b vnet ${name}";
  exec.poststart   += "jexec ${name} ifconfig epl{{ jail.num }}b up";
  exec.poststart   += "ifconfig epl{{ jail.num }}a up";
  exec.poststart   += "jexec ${name} ifconfig epl{{ jail.num }}b 192.168.2.{{ jail.num }}/16";
  exec.poststart   += "jexec ${name} route delete default || echo 'No default route to delete'";
  {% if jail.name != "ingress" %}
  {% for ing in jails -%}
  {% if ing.name == "ingress" -%}
  exec.poststart   += "jexec ${name} route add default 192.168.2.{{ ing.num }} || echo 'Failed to add default route'";
  exec.poststart   += "jexec ${name} route add 10.6.210.0/24 192.168.0.1 || echo 'Failed to add Wireguard return route'";
  exec.poststart   += "mount -t nullfs /usr/local/jails/containers/goaccess/var/www/goaccess /usr/local/jails/containers/ingress/mnt/www_goaccess"
  {% endif %}
  {% endfor %}
  {% else %}
  exec.poststart   += "ifconfig epw{{ jail.num }}b vnet ${name}";
  exec.poststart   += "jexec ${name} ifconfig epw{{ jail.num }}b up";
  exec.poststart   += "ifconfig epw{{ jail.num }}a up";
  exec.poststart   += "jexec ${name} service dhclient restart epw{{ jail.num }}b";
  {% endif %}

  exec.stop         = "/bin/sh /etc/rc.shutdown";

  exec.poststop    += "ifconfig epl{{ jail.num }}a destroy";
  {% if jail.name == "ingress" -%}
  exec.poststop    += "ifconfig epw{{ jail.num }}a destroy";
  {% endif %}

  exec.consolelog   = "/var/log/jail_console_${name}.log";

  # PERMISSIONS
  allow.raw_sockets;
  exec.clean;
  mount.devfs;
  {%if jail.name == "postgres" -%}
  allow.sysvipc;
  devfs_ruleset = 5;
  {% elif jail.name == "ingress" -%}
  devfs_ruleset = 6;
  {% else %}
  devfs_ruleset = 4;
  {% endif %}

  # HOSTNAME/PATH
  host.hostname = "${name}";
  path = "/usr/local/jails/containers/${name}";
}