Set the default branch in git to the default to suppress the warning.

ansible/playbook.yaml

@@ -73,25 +73,25 @@
     - sudo
     - doas
     - users
-    - package_manager
+    # - package_manager
-    - zfs
+    # - zfs
-    - zrepl
+    # - zrepl
-    - zsh
+    # - zsh
-    - network
+    # - network
-    - sshd
+    # - sshd
-    - base
+    # - base
     - firewall
-    - cpu
+    # - cpu
-    - ntp
+    # - ntp
-    - nvme
+    # - nvme
-    - hosts
+    # - hosts
-    - build
+    # - build
-    - devfs
+    # - devfs
-    - jail
+    # - jail
-    - bhyve
+    # - bhyve
-    - wireguard
+    # - wireguard
-    - plainmacs
+    # - plainmacs
-    - mrmanager
+    # - mrmanager
 
 - hosts: admin_git:public_dns
   vars:

ansible/roles/base/files/gitconfig_home

@@ -15,3 +15,5 @@
 	rebase = true
 [log]
 	date = local
+[init]
+	defaultBranch = master

ansible/roles/base/files/watch_freebsd

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+#
+# Imitate watch from linux
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+############## Setup #########################
+
+function cleanup {
+    switch_to_main_screen
+}
+for sig in EXIT INT QUIT HUP TERM; do
+  trap "set +e; cleanup; exit" "$sig"
+done
+
+############## Program #########################
+
+function main {
+    switch_to_alt_screen
+    while true; do
+        local output=$("$@")
+        clear
+        cat <<<"$output"
+        sleep 2
+    done
+}
+
+function switch_to_alt_screen {
+    # tput smcup
+    echo -e "\e[?1049h"
+    clear
+}
+
+function switch_to_main_screen {
+    # tput rmcup
+    echo -e "\e[?1049l"
+}
+
+main "$@"

ansible/roles/base/files/watch_linux

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#
+# Invoke watch
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+exec watch "$@"

ansible/roles/base/tasks/freebsd.yaml

@@ -94,6 +94,8 @@
   loop:
     - src: bemount.bash
       dest: /usr/local/bin/bemount
+    - src: watch_freebsd
+      dest: /usr/local/bin/ww
 
 - name: Install rc script
   copy:
@@ -121,4 +123,3 @@
     group: wheel
   loop:
     - disk_labels
-

ansible/roles/base/tasks/linux.yaml

@@ -37,3 +37,5 @@
   loop:
     - src: mount_disk_image
       dest: /usr/local/bin/mount_disk_image
+    - src: watch_linux
+      dest: /usr/local/bin/ww

ansible/roles/firewall/files/mrmanager_pf.conf

@@ -14,29 +14,52 @@ udp_pass_in = "{ 53 51820 51821 51822 }"
 
 # options
 set skip on lo
+set optimization conservative
+set block-policy return
+set fail-policy drop
+
+# normalization
+scrub in on $ext_if all fragment reassemble
+
+# translation
+
+# Evaluation order of the translation rules is dependent on the type
+# of the translation rules and of the direction of a packet.  binat
+# rules are always evaluated first.  Then either the rdr rules are
+# evaluated on an inbound packet or the nat rules on an outbound
+# packet.  Rules of the same type are evaluated in the same order in
+# which they appear in the ruleset.  The first matching rule decides
+# what action is taken.
 
 # redirections
-nat pass on lagg0 inet from $jail_nat_v4 to $not_jail_nat_v4 -> (lagg0)
+nat on $ext_if inet from ! ($ext_if) to ! ($ext_if) -> ($ext_if)
-nat pass on $not_ext_if inet from $jail_nat_v4 to 10.215.1.1 port 53 -> ($ext_if)
+rdr pass proto {tcp, udp} from any to 10.215.1.1 port 53 tag REDIREXTERNAL -> 1.1.1.1 port 53
-rdr pass on $not_ext_if proto {tcp, udp} from $jail_nat_v4 to 10.215.1.1 port 53 -> 1.1.1.1 port 53
 
-rdr pass on $ext_if inet proto tcp from $not_jail_nat_v4 to any port 6443 -> 10.215.1.204 port 6443
+rdr pass on $ext_if proto {tcp, udp} to ($ext_if) port 6443 -> 10.215.1.204 port 6443
-rdr pass on jail_nat inet proto tcp from $jail_nat_v4 to any port 6443 -> 10.215.1.204 port 6443
+rdr pass on jail_nat proto {tcp, udp} to ($ext_if) port 6443 tag REDIRINTERNAL -> 10.215.1.204 port 6443
-nat pass on $not_ext_if proto {tcp, udp} from $not_jail_nat_v4 to 10.215.1.204 port 6443 -> (jail_nat)
-nat pass on $not_ext_if proto {tcp, udp} from $jail_nat_v4 to 10.215.1.204 port 6443 -> (jail_nat)
 
-rdr pass on $ext_if inet proto tcp from $not_jail_nat_v4 to $not_jail_nat_v4 port 65099 -> 10.215.1.210 port 22
+rdr pass on $ext_if proto {tcp, udp} to ($ext_if) port 19993 -> 10.215.1.204 port 19993
-rdr pass on jail_nat inet proto tcp from $jail_nat_v4 to $not_jail_nat_v4 port 65099 -> 10.215.1.210 port 22
+rdr pass on jail_nat proto {tcp, udp} to ($ext_if) port 19993 tag REDIRINTERNAL -> 10.215.1.204 port 19993
-# nat pass on $not_ext_if proto {tcp, udp} from $not_jail_nat_v4 to 10.215.1.210 port 65099 -> (jail_nat)
+
-# nat pass on $not_ext_if proto {tcp, udp} from $jail_nat_v4 to 10.215.1.210 port 65099 -> (lagg0)
+rdr pass proto {tcp, udp} from $not_jail_nat_v4 to ($ext_if) port 65099 -> 10.215.1.210 port 22
+rdr pass proto {tcp, udp} from $jail_nat_v4 to ($ext_if) port 65099 tag REDIRINTERNAL -> 10.215.1.210 port 22
 
 rdr pass proto {tcp, udp} from $not_jail_nat_v4 to ($ext_if) port 53 -> 10.215.1.211 port 53
 rdr pass proto {tcp, udp} from $jail_nat_v4 to ($ext_if) port 53 tag REDIRINTERNAL -> 10.215.1.211 port 53
-nat pass proto {tcp, udp} tagged REDIRINTERNAL -> (jail_nat)
+
+nat pass tagged REDIRINTERNAL -> (jail_nat)
+nat pass tagged REDIREXTERNAL -> ($ext_if)
 
 # filtering
 block log all
-pass out on $ext_if
+pass quick proto {icmp, icmp6} all
+pass out quick on $ext_if
+# We pass on the interfaces listed in allow rather than skipping on
+# them because changes to pass rules will update when running a
+# `service pf reload` but interfaces that we `skip` will not update (I
+# forget if its from adding, removing, or both. TODO: test to figure
+# it out). Also skipped interfaces are not subject to nat/rdr rules.
+pass quick on $allow
 
 # Single interface kubernetes cluster is working with the following run on mrmanager:
 #   doas route add -host 74.80.180.139 -interface jail_nat
@@ -47,17 +70,8 @@ pass quick from any to $pub_k8s
 
 pass in on jail_nat
 # Allow traffic from my machine to the jails/virtual machines
-pass out on jail_nat from $jail_nat_v4
+pass out on jail_nat from (jail_nat:network)
 
-# We pass on the interfaces listed in allow rather than skipping on
-# them because changes to pass rules will update when running a
-# `service pf reload` but interfaces that we `skip` will not update (I
-# forget if its from adding, removing, or both. TODO: test to figure
-# it out). Also skipped interfaces are not subject to nat/rdr rules.
-pass quick on $allow
-
-pass on $ext_if proto icmp all
-pass on $ext_if proto icmp6 all
 
 pass in on $ext_if proto tcp to any port $tcp_pass_in
 pass in on $ext_if proto udp to any port $udp_pass_in

ansible/roles/kubernetes/tasks/linux.yaml

@@ -7,6 +7,7 @@
   loop:
     - kubeswitch
     - flux-scm
+    - kubectl-minio
 
 - name: Update cache
   when: buildaur.changed
@@ -23,4 +24,5 @@
       - kubectx
       - kubeswitch
       - flux-scm
+      - kubectl-minio
     state: present

ansible/roles/latex/tasks/linux.yaml

@@ -1,5 +1,5 @@
 - name: Install packages
   package:
     name:
-      - texlive-most
+      - texlive
     state: present

ansible/roles/mrmanager/files/lockd_rc.conf

@@ -0,0 +1 @@
+rpc_lockd_enable="YES"

ansible/roles/mrmanager/files/mountd_rc.conf

@@ -0,0 +1 @@
+mountd_enable="YES"

ansible/roles/mrmanager/files/nfsd_rc.conf

@@ -0,0 +1 @@
+nfs_server_enable="YES"

ansible/roles/mrmanager/files/rpcbind_rc.conf

@@ -0,0 +1 @@
+rpcbind_enable="YES"

ansible/roles/mrmanager/files/statd_rc.conf

@@ -0,0 +1 @@
+rpc_statd_enable="YES"

ansible/roles/mrmanager/tasks/freebsd.yaml

@@ -7,3 +7,35 @@
   loop:
     - name: net.link.ether.inet.proxyall
       value: "1"
+
+- name: Install service configuration
+  copy:
+    src: "files/{{ item }}_rc.conf"
+    dest: "/etc/rc.conf.d/{{ item }}"
+    mode: 0644
+    owner: root
+    group: wheel
+  loop:
+    - nfsd
+    - mountd
+    - lockd
+    - statd
+    - rpcbind
+
+- name: Create zfs datasets
+  zfs:
+    name: zdata/k8spersistent
+    state: present
+    extra_zfs_properties:
+      sharenfs: "-network 10.215.1.0/24,-alldirs,-maproot=root:root"
+      mountpoint: /k8spersistent
+
+- name: Update ownership
+  file:
+    name: "{{ item }}"
+    state: directory
+    mode: 0777
+    owner: root
+    group: wheel
+  loop:
+    - /k8spersistent