From 2a9ca0577ecdbee8b5a4bc8886c112dbc4260eab Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 25 Aug 2026 21:23:04 -0500 Subject: new-app: configure jail mail relay and persist the jail's network alias Two provisioning gaps in new-app: - The jail's dma.conf inherited the base image's shared SMARTHOST/ PORT/AUTHPATH, but never got a per-app MAILNAME - without one, dma can misroute mail for recipients on the jail's own apex domain as local delivery. EnableMail appends a MAILNAME of .skiff.local, which can't collide with any real domain an app sends to or from. - A classic jail's ip4.addr is only a bind restriction, not a route, until something aliases it onto a host interface. jail.conf.tmpl never set jail(8)'s own `interface` parameter, so nothing ever created that alias - confirmed on skiff-freebsd, where the address had twice been made to work via an ad hoc `ifconfig alias` that didn't survive a reboot. Setting `interface` lets jail(8) manage the alias itself, including on every boot. --- internal/tmpl/jail.conf.tmpl | 1 + internal/tmpl/tmpl.go | 1 + 2 files changed, 2 insertions(+) (limited to 'internal/tmpl') diff --git a/internal/tmpl/jail.conf.tmpl b/internal/tmpl/jail.conf.tmpl index 446c8c8..c82b3a6 100644 --- a/internal/tmpl/jail.conf.tmpl +++ b/internal/tmpl/jail.conf.tmpl @@ -1,6 +1,7 @@ {{.Name}} { path = "{{.JailRoot}}"; host.hostname = "{{.Name}}.skiff.local"; + interface = "{{.Iface}}"; ip4.addr = "{{.IP}}"; exec.start = "/bin/sh /etc/rc"; exec.stop = "/bin/sh /etc/rc.shutdown"; diff --git a/internal/tmpl/tmpl.go b/internal/tmpl/tmpl.go index 68e917d..12baa70 100644 --- a/internal/tmpl/tmpl.go +++ b/internal/tmpl/tmpl.go @@ -37,6 +37,7 @@ type JailConfData struct { Name string JailRoot string IP string + Iface string } func JailConf(d JailConfData) (string, error) { return Render(jailConf, d) } -- cgit v1.3