pb-iocage-template ¶

Synopsis ¶

This playbook creates iocage templates from the dictionary templates. For example,

templates:
  ansible_client:
    release: 14.1-RELEASE
    properties:
      ip4_addr: 'em0|10.1.0.199/24'
    dhclient: "{{ act_dhclient | dict2items }}"
    rcconf: "{{ act_rcconf | dict2items }}"

creates the template ansible_client

shell> iocage list -lt
+------+----------------+------+-------+----------+-----------------+-------------------+-----+----------+----------+
| JID  |      NAME      | BOOT | STATE |   TYPE   |     RELEASE     |        IP4        | IP6 | TEMPLATE | BASEJAIL |
+======+================+======+=======+==========+=================+===================+=====+==========+==========+
| None | ansible_client | off  | down  | template | 14.1-RELEASE-p6 | em0|10.1.0.199/24 | -   | -        | no       |
+------+----------------+------+-------+----------+-----------------+-------------------+-----+----------+----------+

Hint

Take a look at Index and search playbook pb-iocage-template.yml to see what examples are available.

Ansible Client Template variables ¶

A few variables are required to configure a template for Ansible clients. The below values will skip all configuration tasks

act_pkg: []
act_user: ''
act_pk: ''
act_sudo: false
act_rcconf: {}
act_dhclient: {}

act_pkg ¶

Install a list of packages. Below is the minimal list for an ansible client. Set the Python version to your needs

act_pkg:
  - security/sudo
  - lang/python311

Fit the list to your needs. Usually, you want to add gtar and other archivers. See the module ansible.builtin.unarchive. If you want to use the collection community.crypto add py-openssl

act_pkg:
  - lang/python311
  - security/sudo
  - archivers/gtar
  - security/py-openssl

Note

The module community.general.pkgng is jail-aware

jail: Pkg will execute in the given jail name or ID.

It seems that a short UUID doesn’t work as a name. Therefore, the ID of a jail is used
```
jail: "{{ iocage_jails[item.key]['jid'] }}"
```

act_user ¶

Create a user in the jail. Usually, this user will be used as a remote_user to connect to the jail.

act_user: admin

act_pk ¶

A path to a file comprising the public keys allowed to connect to the act_user at the jail.

act_pk: pk_admins.txt

Warning

The module ansible.posix.authorized_key, used in this task, is not jail-aware. The user act_user must exist on the iocage host. Otherwise, the module ansible.posix.authorized_key will crash.

act_sudo ¶

Add act_user to /root/usr/local/etc/sudoers

act_sudo: true

The below passwordless entry will be created

line: "{{ _act_user }} ALL=(ALL) NOPASSWD: ALL"

Note

See Understanding privilege escalation

act_rcconf ¶

Configure /root/etc/rc.conf

act_rcconf:
  iocage_enable: '"YES"'
  sshd_enable: '"YES"'

act_dhclient ¶

Create dhclient hooks

act_dhclient:
  dhclient-exit-hooks: |
    case "$reason" in
        "BOUND"|"REBIND"|"REBOOT"|"RENEW")
        echo $new_ip_address > /var/db/dhclient-hook.address.$interface
        ;;
    esac

Note

These hooks are needed to configure hooks_results in inventory plugin vbotka.freebsd.iocage
See man dhclient-script

The last tasks template.yml convert the jails to templates. If you start the play again the first tasks setup.yml will end the host(s) if all templates have already been created. If you want to reconfigure already created template set template=0 manually. For example,

shell> iocage set template=0 ansible_client

If a running jail is needed start it

shell> iocage start ansible_client

Then, use the playbook tags to execute selected tasks. For example, to install packages

shell> ansible-playbook pb-iocage-template.yml -t pkg

After the reconfiguration stop the jail and convert it to the template manually

shell> iocage stop ansible_client
shell> iocage set template=1 ansible_client

, or by the play

shell> ansible-playbook pb-iocage-template.yml -t stop,template