All my config files are located in /etc/jail.conf.d/jail_name.conf, for example chat.conf:
Code:
chat {
vnet;
host.hostname = "${name}.local";
exec.start = "/bin/sh /etc/rc";
exec.consolelog = "/var/log/jail_console_${name}.log";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.release = "ifconfig epair1a destroy";
allow.raw_sockets;
exec.clean;
mount.devfs;
path = "/usr/local/jails/containers/${name}";
}
Other jails such as mariadb and icinga2 are created in this way.
The interfaces are created in an rc.d script and assigned, for example:
Code:
#!/bin/sh
# PROVIDE: epairsetup
# REQUIRE: jail
# BEFORE: LOGIN
. /etc/rc.subr
name="epairsetup"
rcvar="epairsetup_enable"
start_cmd="${name}_start"
epairsetup_start() {
if ! ifconfig epair1 >/dev/null 2>&1; then
ifconfig epair1 create
ifconfig epair1a vnet caddy
ifconfig epair1b vnet chat
jexec caddy ifconfig epair1a 10.10.40.1/30 up
jexec chat ifconfig epair1b 10.10.40.2/30 up
fi
}
Only Caddy jail differs from others: caddy.conf:
Code:
caddy {
#ip4 = inherit;
#interface = vtnet0;
$epair_interface = "${name}_b";
vnet;
vnet.interface = $epair_interface;
exec.prestart = "
epair=\$(ifconfig epair create);
epair_base=\${epair%a};
ifconfig \${epair_base}a inet 10.10.30.1/30 up;
ifconfig \${epair_base}b name ${epair_interface};
";
host.hostname = "${name}.local";
exec.start = "/bin/sh /etc/rc";
exec.poststart = "jexec ${name} ifconfig ${epair_interface} inet 10.10.30.2/30 up; jexec ${name} route add default 10.10.30.1";
exec.consolelog = "/var/log/jail_console_${name}.log";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.release = "ifconfig ${epair_interface} destroy";
allow.raw_sockets;
exec.clean;
mount.devfs;
path = "/usr/local/jails/containers/${name}";
}
ifconfig host:
epair0a: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 02:2b:55:5a:10:0a
inet 10.10.30.1 netmask 0xfffffffc broadcast 10.10.30.3
ifconfig caddy:
epair0b: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 02:2b:55:5a:10:0b
inet 10.10.30.2 netmask 0xfffffffc broadcast 10.10.30.3
groups: epair
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
epair1a: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 02:e6:64:49:7f:0a
inet 10.10.40.1 netmask 0xfffffffc broadcast 10.10.40.3
groups: epair
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
epair3b: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 02:70:42:5b:ed:0b
inet 10.10.50.1 netmask 0xfffffffc broadcast 10.10.50.3
groups: epair
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
My initial idea was as follows: Request -> Host -> Cadyy -> chat like Mattermost.
So that each jail remains in a separate vnet. Isolated.
I think I'm trying to use the Caddy jail as a router, which isn't right.
