templates/etc_jail.conf.d_[jailname].conf.j2


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

# eplXa is host end (local network bridge), eplXb is jail end.
# The corresponding pubnet interface is epwX, but that's not created for all jails.
{{ jail.name }} {
  # STARTUP/LOGGING/VNET
  vnet;
  vnet.interface    = "epl{{ jail.num }}b";
  persist;
  exec.prestart    += "ifconfig epair{{ jail.num }} create || echo 'Failed to create epair{{ jail.num }}'";
  exec.prestart    += "ifconfig epair{{ jail.num }}a name epl{{ jail.num }}a";
  exec.prestart    += "ifconfig epair{{ jail.num }}b name epl{{ jail.num }}b";
  exec.prestart    += "ifconfig epl{{ jail.num }}a up";
  exec.prestart    += "ifconfig brlan0 addm epl{{ jail.num }}a";
  exec.clean;
  exec.start        = "/bin/sh /etc/rc";
  exec.poststart    = "jexec ${name} ifconfig epl{{ jail.num }}b 192.168.2.{{ jail.num }}/16 up";
  exec.poststart   += "ifconfig epl{{ jail.num }}a up";
  exec.poststart   += "jexec ${name} route add default 192.168.0.1 || echo 'Failed to add default route'";
  {% if jail.name == "ingress" -%}
  exec.poststart   += "jexec ${name} ifconfig epw{{ jail.num }}b up";
  exec.poststart   += "jexec ${name} service dhclient restart epw{{ jail.num }}b";
  {% endif %}

  exec.stop         = "/bin/sh /etc/rc.shutdown";
  exec.poststop    += "ifconfig epl{{ jail.num }}b -vnet $name"; # workaround to bug 238326: move epl{{ jail.num }}b from the jail to the host when stopping jail services
  exec.poststop    += "ifconfig epl{{ jail.num }}b destroy";     # and then destroy the pair by destroying one end of it
  exec.consolelog   = "/var/log/jail_console_${name}.log";

  # PERMISSIONS
  allow.raw_sockets;
  exec.clean;
  mount.devfs;
  {%if jail.name == "postgres" -%}
  allow.sysvipc;
  {% endif %}

  # HOSTNAME/PATH
  host.hostname = "${name}";
  path = "/usr/local/jails/containers/${name}";
}