ansible/playbook.yaml

@@ -73,25 +73,25 @@
     - sudo
     - doas
     - users
-    # - package_manager
-    # - zfs
-    # - zrepl
-    # - zsh
-    # - network
-    # - sshd
-    # - base
+    - package_manager
+    - zfs
+    - zrepl
+    - zsh
+    - network
+    - sshd
+    - base
     - firewall
-    # - cpu
-    # - ntp
-    # - nvme
-    # - hosts
-    # - build
-    # - devfs
-    # - jail
-    # - bhyve
-    # - wireguard
-    # - plainmacs
-    # - mrmanager
+    - cpu
+    - ntp
+    - nvme
+    - hosts
+    - build
+    - devfs
+    - jail
+    - bhyve
+    - wireguard
+    - plainmacs
+    - mrmanager
 
 - hosts: admin_git:public_dns
   vars:

ansible/roles/base/files/gitconfig_home

@@ -15,5 +15,3 @@
 	rebase = true
 [log]
 	date = local
-[init]
-	defaultBranch = master

ansible/roles/base/files/watch_freebsd

@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-#
-# Imitate watch from linux
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-############## Setup #########################
-
-function cleanup {
-    switch_to_main_screen
-}
-for sig in EXIT INT QUIT HUP TERM; do
-  trap "set +e; cleanup; exit" "$sig"
-done
-
-############## Program #########################
-
-function main {
-    switch_to_alt_screen
-    while true; do
-        local output=$("$@")
-        clear
-        cat <<<"$output"
-        sleep 2
-    done
-}
-
-function switch_to_alt_screen {
-    # tput smcup
-    echo -e "\e[?1049h"
-    clear
-}
-
-function switch_to_main_screen {
-    # tput rmcup
-    echo -e "\e[?1049l"
-}
-
-main "$@"

ansible/roles/base/files/watch_linux

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-#
-# Invoke watch
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-exec watch "$@"

ansible/roles/base/tasks/freebsd.yaml

@@ -94,8 +94,6 @@
   loop:
     - src: bemount.bash
       dest: /usr/local/bin/bemount
-    - src: watch_freebsd
-      dest: /usr/local/bin/ww
 
 - name: Install rc script
   copy:
@@ -123,3 +121,4 @@
     group: wheel
   loop:
     - disk_labels
+

ansible/roles/base/tasks/linux.yaml

@@ -37,5 +37,3 @@
   loop:
     - src: mount_disk_image
       dest: /usr/local/bin/mount_disk_image
-    - src: watch_linux
-      dest: /usr/local/bin/ww

ansible/roles/firewall/files/mrmanager_pf.conf

@@ -14,52 +14,29 @@ udp_pass_in = "{ 53 51820 51821 51822 }"
 
 # options
 set skip on lo
-set optimization conservative
-set block-policy return
-set fail-policy drop
-
-# normalization
-scrub in on $ext_if all fragment reassemble
-
-# translation
-
-# Evaluation order of the translation rules is dependent on the type
-# of the translation rules and of the direction of a packet.  binat
-# rules are always evaluated first.  Then either the rdr rules are
-# evaluated on an inbound packet or the nat rules on an outbound
-# packet.  Rules of the same type are evaluated in the same order in
-# which they appear in the ruleset.  The first matching rule decides
-# what action is taken.
 
 # redirections
-nat on $ext_if inet from ! ($ext_if) to ! ($ext_if) -> ($ext_if)
-rdr pass proto {tcp, udp} from any to 10.215.1.1 port 53 tag REDIREXTERNAL -> 1.1.1.1 port 53
+nat pass on lagg0 inet from $jail_nat_v4 to $not_jail_nat_v4 -> (lagg0)
+nat pass on $not_ext_if inet from $jail_nat_v4 to 10.215.1.1 port 53 -> ($ext_if)
+rdr pass on $not_ext_if proto {tcp, udp} from $jail_nat_v4 to 10.215.1.1 port 53 -> 1.1.1.1 port 53
 
-rdr pass on $ext_if proto {tcp, udp} to ($ext_if) port 6443 -> 10.215.1.204 port 6443
-rdr pass on jail_nat proto {tcp, udp} to ($ext_if) port 6443 tag REDIRINTERNAL -> 10.215.1.204 port 6443
+rdr pass on $ext_if inet proto tcp from $not_jail_nat_v4 to any port 6443 -> 10.215.1.204 port 6443
+rdr pass on jail_nat inet proto tcp from $jail_nat_v4 to any port 6443 -> 10.215.1.204 port 6443
+nat pass on $not_ext_if proto {tcp, udp} from $not_jail_nat_v4 to 10.215.1.204 port 6443 -> (jail_nat)
+nat pass on $not_ext_if proto {tcp, udp} from $jail_nat_v4 to 10.215.1.204 port 6443 -> (jail_nat)
 
-rdr pass on $ext_if proto {tcp, udp} to ($ext_if) port 19993 -> 10.215.1.204 port 19993
-rdr pass on jail_nat proto {tcp, udp} to ($ext_if) port 19993 tag REDIRINTERNAL -> 10.215.1.204 port 19993
-
-rdr pass proto {tcp, udp} from $not_jail_nat_v4 to ($ext_if) port 65099 -> 10.215.1.210 port 22
-rdr pass proto {tcp, udp} from $jail_nat_v4 to ($ext_if) port 65099 tag REDIRINTERNAL -> 10.215.1.210 port 22
+rdr pass on $ext_if inet proto tcp from $not_jail_nat_v4 to $not_jail_nat_v4 port 65099 -> 10.215.1.210 port 22
+rdr pass on jail_nat inet proto tcp from $jail_nat_v4 to $not_jail_nat_v4 port 65099 -> 10.215.1.210 port 22
+# nat pass on $not_ext_if proto {tcp, udp} from $not_jail_nat_v4 to 10.215.1.210 port 65099 -> (jail_nat)
+# nat pass on $not_ext_if proto {tcp, udp} from $jail_nat_v4 to 10.215.1.210 port 65099 -> (lagg0)
 
 rdr pass proto {tcp, udp} from $not_jail_nat_v4 to ($ext_if) port 53 -> 10.215.1.211 port 53
 rdr pass proto {tcp, udp} from $jail_nat_v4 to ($ext_if) port 53 tag REDIRINTERNAL -> 10.215.1.211 port 53
-
-nat pass tagged REDIRINTERNAL -> (jail_nat)
-nat pass tagged REDIREXTERNAL -> ($ext_if)
+nat pass proto {tcp, udp} tagged REDIRINTERNAL -> (jail_nat)
 
 # filtering
 block log all
-pass quick proto {icmp, icmp6} all
-pass out quick on $ext_if
-# We pass on the interfaces listed in allow rather than skipping on
-# them because changes to pass rules will update when running a
-# `service pf reload` but interfaces that we `skip` will not update (I
-# forget if its from adding, removing, or both. TODO: test to figure
-# it out). Also skipped interfaces are not subject to nat/rdr rules.
-pass quick on $allow
+pass out on $ext_if
 
 # Single interface kubernetes cluster is working with the following run on mrmanager:
 #   doas route add -host 74.80.180.139 -interface jail_nat
@@ -70,8 +47,17 @@ pass quick from any to $pub_k8s
 
 pass in on jail_nat
 # Allow traffic from my machine to the jails/virtual machines
-pass out on jail_nat from (jail_nat:network)
+pass out on jail_nat from $jail_nat_v4
 
+# We pass on the interfaces listed in allow rather than skipping on
+# them because changes to pass rules will update when running a
+# `service pf reload` but interfaces that we `skip` will not update (I
+# forget if its from adding, removing, or both. TODO: test to figure
+# it out). Also skipped interfaces are not subject to nat/rdr rules.
+pass quick on $allow
+
+pass on $ext_if proto icmp all
+pass on $ext_if proto icmp6 all
 
 pass in on $ext_if proto tcp to any port $tcp_pass_in
 pass in on $ext_if proto udp to any port $udp_pass_in

ansible/roles/kubernetes/tasks/linux.yaml

@@ -7,7 +7,6 @@
   loop:
     - kubeswitch
     - flux-scm
-    - kubectl-minio
 
 - name: Update cache
   when: buildaur.changed
@@ -24,5 +23,4 @@
       - kubectx
       - kubeswitch
       - flux-scm
-      - kubectl-minio
     state: present

ansible/roles/latex/tasks/linux.yaml

@@ -1,5 +1,5 @@
 - name: Install packages
   package:
     name:
-      - texlive
+      - texlive-most
     state: present

ansible/roles/mrmanager/files/lockd_rc.conf

@@ -1 +0,0 @@
-rpc_lockd_enable="YES"

ansible/roles/mrmanager/files/mountd_rc.conf

@@ -1 +0,0 @@
-mountd_enable="YES"

ansible/roles/mrmanager/files/nfsd_rc.conf

@@ -1 +0,0 @@
-nfs_server_enable="YES"

ansible/roles/mrmanager/files/rpcbind_rc.conf

@@ -1 +0,0 @@
-rpcbind_enable="YES"

ansible/roles/mrmanager/files/statd_rc.conf

@@ -1 +0,0 @@
-rpc_statd_enable="YES"

ansible/roles/mrmanager/tasks/freebsd.yaml

@@ -7,35 +7,3 @@
   loop:
     - name: net.link.ether.inet.proxyall
       value: "1"
-
-- name: Install service configuration
-  copy:
-    src: "files/{{ item }}_rc.conf"
-    dest: "/etc/rc.conf.d/{{ item }}"
-    mode: 0644
-    owner: root
-    group: wheel
-  loop:
-    - nfsd
-    - mountd
-    - lockd
-    - statd
-    - rpcbind
-
-- name: Create zfs datasets
-  zfs:
-    name: zdata/k8spersistent
-    state: present
-    extra_zfs_properties:
-      sharenfs: "-network 10.215.1.0/24,-alldirs,-maproot=root:root"
-      mountpoint: /k8spersistent
-
-- name: Update ownership
-  file:
-    name: "{{ item }}"
-    state: directory
-    mode: 0777
-    owner: root
-    group: wheel
-  loop:
-    - /k8spersistent