path: root/roles/jail/tasks/jail_setup.yml

# Host-side setup (runs on the jail host via SSH)
- name: "Check if {{ jail_name }} container exists"
  shell: "zfs list -o name | grep -Fxq 'zroot/jails/containers/{{ jail_name }}'"
  failed_when: false
  changed_when: false
  register: jail_exists
  delegate_to: "{{ jail_delegate_host }}"

- name: "Check {{ jail_name }} userland version"
  shell: "zfs get -H -o value origin zroot/jails/containers/{{ jail_name }}"
  register: jail_origin
  changed_when: false
  when: jail_exists.rc == 0
  delegate_to: "{{ jail_delegate_host }}"

# ZFS volume migration
- name: "Check ZFS volume state for {{ jail_name }}"
  shell: |
    if zfs list {{ item.name }} >/dev/null 2>&1; then
      echo "exists"
    elif [ -d "/usr/local/jails/containers/{{ jail_name }}{{ item.mountpoint }}" ] && \
         [ "$(ls -A /usr/local/jails/containers/{{ jail_name }}{{ item.mountpoint }})" ]; then
      echo "migrate"
    else
      echo "empty"
    fi
  loop: "{{ zfs | default([]) }}"
  loop_control:
    label: "{{ item.name }}"
  register: _zfs_volume_state
  changed_when: false
  delegate_to: "{{ jail_delegate_host }}"

- name: "*** VOLUME MIGRATION REQUIRED: {{ jail_name }} ***"
  pause:
    prompt: |

      ════════════════════════════════════════════════════════════════
        VOLUME MIGRATION: {{ jail_name }}
      ════════════════════════════════════════════════════════════════
        The following paths contain data that will be migrated
        to new ZFS volumes:
      {% for result in _zfs_volume_state.results | default([]) if result.stdout == 'migrate' %}
          - {{ result.item.mountpoint }} → {{ result.item.name }}
      {% endfor %}

        This will:
          1. Create ZFS volumes (staged)
          2. Stop the jail
          3. Copy existing data into the volumes
      ════════════════════════════════════════════════════════════════

      Press Enter to continue or Ctrl+C to abort
  when: (_zfs_volume_state.results | default([]) | selectattr('stdout', 'equalto', 'migrate') | list | length) > 0

- name: "Create new ZFS volumes (staged) for {{ jail_name }}"
  community.general.zfs:
    name: "{{ item.item.name }}"
    state: present
    extra_zfs_properties:
      mountpoint: "/usr/local/jails/volumes/.staging/{{ jail_name }}{{ item.item.mountpoint }}"
  loop: "{{ _zfs_volume_state.results | default([]) }}"
  loop_control:
    label: "{{ item.item.name }}"
  when: item.stdout == "migrate"
  delegate_to: "{{ jail_delegate_host }}"

- name: "Create staging mount points for {{ jail_name }}"
  file:
    path: "/usr/local/jails/volumes/.staging/{{ jail_name }}{{ item.item.mountpoint }}"
    state: directory
  loop: "{{ _zfs_volume_state.results | default([]) }}"
  loop_control:
    label: "{{ item.item.name }}"
  when: item.stdout == "migrate"
  delegate_to: "{{ jail_delegate_host }}"

- name: "Mount staged volumes for {{ jail_name }}"
  shell: "zfs mount {{ item.item.name }} || true"
  loop: "{{ _zfs_volume_state.results | default([]) }}"
  loop_control:
    label: "{{ item.item.name }}"
  when: item.stdout == "migrate"
  changed_when: false
  delegate_to: "{{ jail_delegate_host }}"

- name: "Stop {{ jail_name }} jail for volume migration"
  shell: "service jail stop {{ jail_name }} || true"
  when: (_zfs_volume_state.results | default([]) | selectattr('stdout', 'equalto', 'migrate') | list | length) > 0
  delegate_to: "{{ jail_delegate_host }}"

- name: "Copy data into staged volumes for {{ jail_name }}"
  shell: |
    cp -a "/usr/local/jails/containers/{{ jail_name }}{{ item.item.mountpoint }}/." \
          "/usr/local/jails/volumes/.staging/{{ jail_name }}{{ item.item.mountpoint }}/"
  loop: "{{ _zfs_volume_state.results | default([]) }}"
  loop_control:
    label: "{{ item.item.name }}"
  when: item.stdout == "migrate"
  delegate_to: "{{ jail_delegate_host }}"

- name: "Set final mountpoint on migrated volumes for {{ jail_name }}"
  shell: |
    zfs unmount {{ item.item.name }} || true
    zfs set mountpoint="/usr/local/jails/containers/{{ jail_name }}{{ item.item.mountpoint }}" {{ item.item.name }}
  loop: "{{ _zfs_volume_state.results | default([]) }}"
  loop_control:
    label: "{{ item.item.name }}"
  when: item.stdout == "migrate"
  delegate_to: "{{ jail_delegate_host }}"

# Userland migration
- name: "*** USERLAND MIGRATION REQUIRED: {{ jail_name }} ***"
  pause:
    prompt: |

      ════════════════════════════════════════════════════════════════
        JAIL USERLAND MIGRATION: {{ jail_name }}
      ════════════════════════════════════════════════════════════════
        Current: {{ jail_origin.stdout | trim }}
        Target:  zroot/jails/templates/{{ userland }}@base

        This will:
          1. Stop the jail
          2. Rename existing dataset to *.old.<timestamp>
          3. Clone fresh from {{ userland }}
      ════════════════════════════════════════════════════════════════

      Press Enter to continue or Ctrl+C to abort
  when:
    - jail_exists.rc == 0
    - jail_origin.stdout is defined
    - "userland + '@base' not in jail_origin.stdout"

- name: "Stop {{ jail_name }} jail for userland migration"
  shell: "service jail stop {{ jail_name }} || true"
  when:
    - jail_exists.rc == 0
    - jail_origin.stdout is defined
    - "userland + '@base' not in jail_origin.stdout"
  delegate_to: "{{ jail_delegate_host }}"

- name: "Unmount any remaining mounts inside {{ jail_name }} container"
  shell: |
    mount | awk '$3 ~ "^/usr/local/jails/containers/{{ jail_name }}/" {print $3}' | sort -r | xargs -I{} umount -f {} 2>/dev/null || true
  when:
    - jail_exists.rc == 0
    - jail_origin.stdout is defined
    - "userland + '@base' not in jail_origin.stdout"
  delegate_to: "{{ jail_delegate_host }}"

- name: "Migrate {{ jail_name }} to {{ userland }}"
  shell: |
    zfs rename zroot/jails/containers/{{ jail_name }} zroot/jails/containers/{{ jail_name }}.old.$(date +%s)
  when:
    - jail_exists.rc == 0
    - jail_origin.stdout is defined
    - "userland + '@base' not in jail_origin.stdout"
  delegate_to: "{{ jail_delegate_host }}"

- name: "Clone {{ jail_name }} from template"
  shell: "zfs clone zroot/jails/templates/{{ userland }}@base zroot/jails/containers/{{ jail_name }}"
  when: jail_exists.rc != 0 or (jail_origin.stdout is defined and userland + '@base' not in jail_origin.stdout)
  delegate_to: "{{ jail_delegate_host }}"

# ZFS volume setup (for all volumes — existing, migrated, and new)
- name: "Ensure ZFS volumes exist for {{ jail_name }}"
  community.general.zfs:
    name: "{{ item.name }}"
    state: present
    extra_zfs_properties:
      mountpoint: "/usr/local/jails/containers/{{ jail_name }}{{ item.mountpoint }}"
  loop: "{{ zfs | default([]) }}"
  loop_control:
    label: "{{ item.name }}"
  delegate_to: "{{ jail_delegate_host }}"

- name: "Create mount points for ZFS volumes in {{ jail_name }}"
  file:
    path: "/usr/local/jails/containers/{{ jail_name }}{{ item.mountpoint }}"
    state: directory
    owner: "{{ item.owner | default('root') }}"
    group: "{{ item.group | default('wheel') }}"
    mode: "{{ item.mode | default('0755') }}"
  loop: "{{ zfs | default([]) }}"
  loop_control:
    label: "{{ item.mountpoint }}"
  delegate_to: "{{ jail_delegate_host }}"

- name: "Mount ZFS volumes for {{ jail_name }}"
  shell: "zfs mount {{ item.name }} || true"
  loop: "{{ zfs | default([]) }}"
  loop_control:
    label: "{{ item.name }}"
  changed_when: false
  delegate_to: "{{ jail_delegate_host }}"

# Container setup
- name: "Create directories for {{ jail_name }}"
  file:
    path: "/usr/local/jails/containers/{{ jail_name }}{{ item }}"
    state: directory
    owner: root
    group: wheel
    mode: "0755"
  loop: "{{ dirs | default([]) }}"
  delegate_to: "{{ jail_delegate_host }}"

- name: "Create mount point sources for {{ jail_name }}"
  file:
    path: "{{ item.src }}"
    state: directory
  loop: "{{ nullfs | default([]) }}"
  loop_control:
    label: "{{ item.src }}"
  delegate_to: "{{ jail_delegate_host }}"

- name: "Create mount point destinations for {{ jail_name }}"
  file:
    path: "/usr/local/jails/containers/{{ jail_name }}{{ item.dst }}"
    state: directory
    owner: root
    group: wheel
    mode: "0755"
  loop: "{{ nullfs | default([]) }}"
  loop_control:
    label: "{{ item.dst }}"
  delegate_to: "{{ jail_delegate_host }}"

- name: "Deploy jail.conf.d/{{ jail_name }}.conf"
  template:
    src: jail_conf.j2
    dest: "/etc/jail.conf.d/{{ jail_name }}.conf"
    owner: root
    group: wheel
    mode: "0644"
  vars:
    jail:
      name: "{{ jail_name }}"
      num: "{{ jail_num }}"
      ip: "{{ jail_lan_cidr | ipv4_nth_cidr(jail_num | int + jail_lan_offset | int) }}"
      devfs_ruleset: "{{ devfs_ruleset | default(4) }}"
      options: "{{ jail_conf_options | default([]) }}"
      default_route: "{{ not no_default_route | default(false) }}"
      exec_prestart: "{{ exec_prestart | default([]) }}"
      exec_start: "{{ exec_start | default([]) }}"
      exec_poststart: "{{ exec_poststart | default([]) }}"
      exec_prestop: "{{ exec_prestop | default([]) }}"
      exec_stop: "{{ exec_stop | default([]) }}"
      exec_poststop: "{{ exec_poststop | default([]) }}"
      mounts: "{{ nullfs | default([]) }}"
  delegate_to: "{{ jail_delegate_host }}"

- name: "Start {{ jail_name }} jail"
  shell: "service jail start {{ jail_name }}"
  register: jail_start
  failed_when: "jail_start.rc != 0 and 'already exists' not in jail_start.stdout"
  changed_when: "'already exists' not in jail_start.stdout"
  delegate_to: "{{ jail_delegate_host }}"

# In-jail provisioning
- name: Create pkg repos directory
  file:
    path: /usr/local/etc/pkg/repos
    state: directory
    owner: root
    group: wheel
    mode: "0755"

- name: Configure poudriere repo in jail
  copy:
    content: |
      poudriere: {
        url: "http://{{ hostvars[jail_delegate_host]['poudriere_repo_ip'] }}/packages",
        enabled: no,
        priority: 100
      }
    dest: /usr/local/etc/pkg/repos/poudriere.conf
    owner: root
    group: wheel
    mode: "0644"

- name: Install packages
  shell: "pkg install -y {{ pkg | join(' ') }}"
  environment:
    ASSUME_ALWAYS_YES: "yes"
  when: pkg is defined and pkg | length > 0
  register: pkg_result
  changed_when: "'Number of packages to be installed' in pkg_result.stdout"

- name: Install packages from poudriere
  shell: "pkg install -y -r poudriere {{ pkg_custom | join(' ') }}"
  when: pkg_custom is defined and pkg_custom | length > 0
  register: pkg_custom_result
  changed_when: "'Installing' in pkg_custom_result.stdout"

- name: Create parent directories for files
  file:
    path: "{{ item.dest | dirname }}"
    state: directory
    owner: root
    group: wheel
    mode: "0755"
  loop: "{{ files | default([]) }}"
  loop_control:
    label: "{{ item.dest | dirname }}"
  when: files is defined

- name: Deploy files
  template:
    src: "{{ jail_role_dir }}/templates/{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: "{{ item.owner | default('root') }}"
    group: "{{ item.group | default('wheel') }}"
    mode: "{{ item.mode | default('0644') }}"
  loop: "{{ files | default([]) }}"
  loop_control:
    label: "{{ item.dest }}"
  when: files is defined
  notify: Restart jail services

- name: Enable services
  community.general.sysrc:
    name: "{{ item }}_enable"
    value: "YES"
  loop: "{{ services | default([]) }}"

- name: Set sysrc values
  community.general.sysrc:
    name: "{{ item.name }}"
    value: "{{ item.value }}"
  loop: "{{ sysrc | default([]) }}"
  when: sysrc is defined

- name: Set sysctl values
  sysctl:
    name: "{{ item.name }}"
    value: "{{ item.value }}"
    state: present
  loop: "{{ sysctl | default([]) }}"
  when: sysctl is defined