Merge remote-tracking branch 'remotes/upstream/pr/21' into bug3069

jail.yml

@@ -0,0 +1,7 @@
+---
+- name: Jail test
+  hosts: servicehosts
+  roles:
+      - { role: jail, name: jailtest.buildbot.net, ip_address: ['vtnet0|192.168.122.16'] }
+
+# vim:ft=yaml:nosi:noai:ts=2:sw=2

roles/jail/files/flavours/base/etc/make.conf

@@ -0,0 +1,6 @@
+WRKDIRPREFIX=/var/ports
+DISTDIR=/var/ports/distfiles
+PACKAGES=/var/ports/packages
+INDEXDIR=/var/ports
+
+OPTIONS_UNSET=DOCS EXAMPLES

roles/jail/files/flavours/base/etc/periodic.conf

@@ -0,0 +1,8 @@
+daily_output="/var/log/daily.log"
+weekly_output="/var/log/weekly.log"
+monthly_output="/var/log/monthly.log"
+daily_status_security_output="/var/log/daily_status_security.log"
+daily_status_network_enable="NO"
+daily_status_security_ipfwlimit_enable="NO"
+daily_status_security_ipfwdenied_enable="NO"
+weekly_whatis_enable="NO"       # our jails are read-only /usr

roles/jail/files/flavours/base/etc/rc.conf

@@ -0,0 +1,9 @@
+network_interfaces=""
+rpcbind_enable="NO"
+cron_flags="$cron_flags -J 15"
+syslogd_flags="-ss"
+sendmail_enable="NO"
+sendmail_submit_enable="NO"
+sendmail_outbound_enable="NO"
+sendmail_msp_queue_enable="NO"
+sshd_enable="NO"

roles/jail/files/flavours/base/ezjail.flavour

@@ -0,0 +1,7 @@
+#!/bin/sh
+#
+# BEFORE: DAEMON
+#
+# ezjail flavour base
+
+# Everything is configured via Ansible.

roles/jail/tasks/main.yml

@@ -0,0 +1,38 @@
+---
+- name: ezjail config
+  template:
+    src: ezjail.conf
+    dest: /usr/local/etc/ezjail.conf
+
+- name: Populate basejail
+  command: ezjail-admin install -p
+  args:
+    creates: /usr/local/jail/base
+
+- name: Create base flavour directories
+  file:
+    path: '/usr/local/jail/flavours/base/{{ item }}'
+    state: directory
+  with_items:
+      - etc
+
+- name: Set base flavour config
+  copy:
+    dest: '/usr/local/jail/flavours/{{ item }}'
+    src: 'flavours/{{ item }}'
+  with_items:
+    - base/ezjail.flavour
+    - base/etc/make.conf
+    - base/etc/periodic.conf
+    - base/etc/rc.conf
+
+- name: Install jail
+  command: ezjail-admin create -f base {{ name }} {{ ip_address|join(',') }}
+  args:
+    creates: '/usr/local/jail/{{ name }}'
+
+- name: Enable jails
+  lineinfile:
+    dest: /etc/rc.conf
+    line: 'jail_enable="YES"'
+    state: present

roles/jail/templates/ezjail.conf

@@ -0,0 +1,16 @@
+# {{ ansible_managed }}
+ezjail_jaildir=/usr/local/jail
+ezjail_jailtemplate=${ezjail_jaildir}/newjail
+ezjail_jailbase=${ezjail_jaildir}/base
+ezjail_sourcetree=/usr/src
+ezjail_ftphost=freebsd.isc.org
+ezjail_default_execute="/usr/bin/login -f root"
+ezjail_default_flavour="base"
+ezjail_archivedir=/usr/local/jail/archived
+
+# ezjail_uglyperlhack="YES"
+ezjail_mount_enable="NO"
+ezjail_devfs_enable="YES"
+ezjail_devfs_ruleset="devfsrules_jail"
+ezjail_procfs_enable="NO"
+ezjail_fdescfs_enable="NO"