Merge pull request #198 from cedwards/0_6_release_validation

updating release version

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,26 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: "[BUG]"
+labels: bug
+assignees: ''
+
+---
+
+**[MANDATORY] Describe the bug [MANDATORY]**
+A clear and concise description of what the bug is.
+
+**[MANDATORY] Bastille and FreeBSD version (paste ``bastille -v && freebsd-version -kru`` output)**
+
+**[MANDATORY] How did you install bastille? (port/pkg/git)**
+
+**[optional] Steps to reproduce?**
+
+**[optional] Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**[optional] Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**[optional]  Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Enhancement & Feature Request
+title: "[ENHANCEMENT]"
+labels: enhancement
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.gitignore

@@ -0,0 +1 @@
+docs/_build

AUTHORS.md

@@ -0,0 +1,36 @@
+# AUTHORS
+
+## Lead
+
+Christer Edwards [christer.edwards@gmail.com]  
+
+## Contributors (code)
+
+Barry McCormick  
+Brian Downs  
+Dave Cottlehuber  
+Giacomo Olgeni  
+JP Mens  
+Jose Rivera  
+Lars E.  
+Paul C.  
+Sven R.  
+
+### Special thanks
+Software doesn't happen in a vacuum. Thank you to the following people who may
+not be found in the commit history but have influenced Bastille's development
+in some way.
+
+Carlos Meza  
+Casandra Woodcox  
+Clint Savage  
+G. Clifford Williams  
+Jack Thomasson  
+Jun C Park  
+Justin Desilets  
+Larry Raab  
+Nate Taylor  
+Peter Czanik  
+Ryan Simpkins  
+Tim Gelter  
+Trevor Sharpe  

CODE-OF-CONDUCT.md

@@ -0,0 +1,74 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team lead at christer.edwards@gmail.com. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+

LICENSE

@@ -1,6 +1,6 @@
 BSD 3-Clause License
 
-Copyright (c) 2018, Christer Edwards
+Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

Makefile

@@ -0,0 +1,28 @@
+.PHONY: all
+all:
+	@echo "Nothing to be done. Please use make install or make uninstall"
+.PHONY: install
+install:
+	@echo "Installing Bastille"
+	@echo
+	@cp -av usr /
+	@echo
+	@echo "This method is for testing / development."
+
+.PHONY: uninstall
+uninstall:
+	@echo "Removing Bastille command"
+	@rm -vf /usr/local/bin/bastille
+	@echo
+	@echo "Removing Bastille sub-commands"
+	@rm -rvf /usr/local/share/bastille
+	@echo
+	@echo "removing man page"
+	@rm -rvf /usr/local/share/man/man1/bastille.1.gz
+	@echo
+	@echo "removing configuration file"
+	@rm -rvf /usr/local/etc/bastille/bastille.conf.sample
+	@echo
+	@echo "removing startup script"
+	@rm -vf /usr/local/etc/rc.d/bastille
+	@echo "You may need to manually remove /usr/local/etc/bastille/bastille.conf if it is no longer needed."

ROADMAP.md

@@ -0,0 +1,55 @@
+2020 Bastille Roadmap
+=====================
+
+1. Virtual Networking
+1. Bastille CI/CD
+1. Template Maturity & Consolidation
+1. Container Monitoring
+1. Bastille API
+
+Rough timeline and description below.
+
+Virtual Networking (Jan-Feb) ~ 0.6.x-beta
+-----------------------------------------
+VNET (Virtual Networking) will allow fully virtualized network stacks. This
+would bring the total network options to three (loopback, LAN, VNET). The
+anticipated design would use a bridge device connected to containers via epair
+interfaces.
+
+Bastille CI/CD (March-May) ~ 0.7.x-beta
+---------------------------------------
+While we have many of the templates validated by automatic CI/CD, we are not
+validating updates to Bastille itself. This automated validation of Pull
+Requests should be a priority early in the year with a full test suite designed
+to validate all expected uses of Bastille sub-commands.
+
+Template Maturity & Consolidation (June-Aug) ~ 0.8.x-beta
+---------------------------------------------------------
+Put the 101 templates found in GitHub's BastilleBSD-Templates repository into
+GitLab CI/CD pipeline until fully covered. This is a great place for community
+contribution. Templates are easy to create and verify and we'd love to
+replicate as much of the FreeBSD ports tree as possible!
+
+In addition, it would be nice to create a consolidated repository of curated
+templates similar in design to the FreeBSD ports tree. This would contain all
+templates in a single repository and mimick ports behavior where appropriate.
+
+Container Monitoring (Sept-Oct) ~ 0.9.x-beta
+--------------------------------------------
+The ability to monitor processes, services, mounts, sockets, etc from the host.
+Auto-remediation would be simple enough to define. Notifications would probably
+require a plugin system for methods/endpoints.
+
+Possible monitoring modules: ps, sockstat, pf, fstab
+
+Possible notification modules: pagerduty, slack, splunk, ELK, etc.
+
+Bastille API (Nov-Dec) ~ 1.0.x-beta
+-----------------------------------
+I have thoughts about a lightweight API for Bastille that would accept (json?)
+payloads of Bastille commands. The API should be lightweight just as Bastille
+is.
+
+The API is scheduled later in the roadmap because I want to have the other
+components stable before we implement an API on top of it. The addition of the
+API should match up with Bastille 1.0-stable.

docs/Makefile

@@ -0,0 +1,19 @@
+# Minimal makefile for Sphinx documentation
+#
+
+# You can set these variables from the command line.
+SPHINXOPTS    =
+SPHINXBUILD   = sphinx-build
+SOURCEDIR     = .
+BUILDDIR      = _build
+
+# Put it first so that "make" without argument is like "make help".
+help:
+	@$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
+
+.PHONY: help Makefile
+
+# Catch-all target: route all unknown targets to Sphinx using the new
+# "make mode" option.  $(O) is meant as a shortcut for $(SPHINXOPTS).
+%: Makefile
+	@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)

docs/chapters/installation.rst

@@ -0,0 +1,44 @@
+Installation
+============
+Bastille is available in the official FreeBSD ports tree at
+`sysutils/bastille`. Binary packages available in `quarterly` and `latest`
+repositories.
+
+Current version is `0.6.20200202`.
+
+To install from the FreeBSD package repository:
+
+* quarterly repository may be older version
+* latest repository will match recent ports
+
+
+PKG
+---
+
+.. code-block:: shell
+
+  pkg install bastille
+
+
+To install from source (don't worry, no compiling):
+
+ports
+-----
+
+.. code-block:: shell
+
+  make -C /usr/ports/sysutils/bastille install clean
+
+
+GIT
+---
+
+.. code-block:: shell
+
+  git clone https://github.com/BastilleBSD/bastille.git
+  cd bastille
+  make install
+
+This method will install the latest files from GitHub directly onto your
+system. It is verbose about the files it installs (for later removal), and also
+has a `make uninstall` target.

docs/chapters/jail-config.rst

@@ -0,0 +1,209 @@
+Note: FreeBSD introduced container technology twenty years ago, long before the
+industry standardized on the term "container". Internally, FreeBSD refers to
+these containers as "jails".
+
+jail.conf
+=========
+In this section we'll look at the default config for a new container. The
+defaults are sane for most applications, but if you want to tweak the settings
+here they are.
+
+A `jail.conf` template is used each time a new container is created. This
+template looks like this:
+
+.. code-block:: shell
+
+  {name} {
+    devfs_ruleset = 4;
+    enforce_statfs = 2;
+    exec.clean;
+    exec.consolelog = /usr/local/bastille/logs/{name}_console.log;
+    exec.start = '/bin/sh /etc/rc';
+    exec.stop = '/bin/sh /etc/rc.shutdown';
+    host.hostname = {name};
+    interface = {interface};
+    mount.devfs;
+    mount.fstab = /usr/local/bastille/jails/{name}/fstab;
+    path = /usr/local/bastille/jails/{name}/root;
+    securelevel = 2;
+
+    ip4.addr = x.x.x.x;
+    ip6 = disable;
+  }
+
+
+devfs_ruleset
+-------------
+.. code-block:: shell
+
+  devfs_ruleset
+    The number of the devfs ruleset that is enforced for mounting
+    devfs in this jail.  A value of zero (default) means no ruleset
+    is enforced.  Descendant jails inherit the parent jail's devfs
+    ruleset enforcement.  Mounting devfs inside a jail is possible
+    only if the allow.mount and allow.mount.devfs permissions are
+    effective and enforce_statfs is set to a value lower than 2.
+    Devfs rules and rulesets cannot be viewed or modified from inside
+    a jail.
+   
+    NOTE: It is important that only appropriate device nodes in devfs
+    be exposed to a jail; access to disk devices in the jail may
+    permit processes in the jail to bypass the jail sandboxing by
+    modifying files outside of the jail.  See devfs(8) for
+    information on how to use devfs rules to limit access to entries
+    in the per-jail devfs.  A simple devfs ruleset for jails is
+    available as ruleset #4 in /etc/defaults/devfs.rules.
+
+
+enforce_statfs
+--------------
+.. code-block:: shell
+
+  enforce_statfs
+    This determines what information processes in a jail are able to
+    get about mount points.  It affects the behaviour of the
+    following syscalls: statfs(2), fstatfs(2), getfsstat(2), and
+    fhstatfs(2) (as well as similar compatibility syscalls).  When
+    set to 0, all mount points are available without any
+    restrictions.  When set to 1, only mount points below the jail's
+    chroot directory are visible.  In addition to that, the path to
+    the jail's chroot directory is removed from the front of their
+    pathnames.  When set to 2 (default), above syscalls can operate
+    only on a mount-point where the jail's chroot directory is
+    located.
+
+
+exec.clean
+----------
+.. code-block:: shell
+
+  exec.clean
+    Run commands in a clean environment.  The environment is
+    discarded except for HOME, SHELL, TERM and USER.  HOME and SHELL
+    are set to the target login's default values.  USER is set to the
+    target login.  TERM is imported from the current environment.
+    The environment variables from the login class capability
+    database for the target login are also set.
+
+
+exec.consolelog
+---------------
+.. code-block:: shell
+
+  exec.consolelog
+    A file to direct command output (stdout and stderr) to.
+
+
+exec.start
+----------
+.. code-block:: shell
+
+  exec.start
+    Command(s) to run in the jail environment when a jail is created.
+    A typical command to run is "sh /etc/rc".
+
+
+exec.stop
+---------
+.. code-block:: shell
+
+  exec.stop
+    Command(s) to run in the jail environment before a jail is
+    removed, and after any exec.prestop commands have completed.  A
+    typical command to run is "sh /etc/rc.shutdown".
+
+
+host.hostname
+-------------
+.. code-block:: shell
+
+  host.hostname
+    The hostname of the jail.  Other similar parameters are
+    host.domainname, host.hostuuid and host.hostid.
+
+
+interface
+---------
+.. code-block:: shell
+
+  interface
+    A network interface to add the jail's IP addresses (ip4.addr and
+    ip6.addr) to.  An alias for each address will be added to the
+    interface before the jail is created, and will be removed from
+    the interface after the jail is removed.
+
+
+mount.devfs
+-----------
+.. code-block:: shell
+
+  mount.devfs
+    Mount a devfs(5) filesystem on the chrooted /dev directory, and
+    apply the ruleset in the devfs_ruleset parameter (or a default of
+    ruleset 4: devfsrules_jail) to restrict the devices visible
+    inside the jail.
+
+
+mount.fstab
+-----------
+.. code-block:: shell
+
+  mount.fstab
+    An fstab(5) format file containing filesystems to mount before
+    creating a jail.
+
+
+path
+----
+.. code-block:: shell
+
+  path
+    The directory which is to be the root of the jail.  Any commands
+    run inside the jail, either by jail or from jexec(8), are run
+    from this directory.
+
+
+securelevel
+-----------
+By default, Bastille containers run at `securelevel = 2;`. See below for the
+implications of kernel security levels and when they might be altered.
+
+Note: Bastille does not currently have any mechanism to automagically change
+securelevel settings. My recommendation is this only be altered manually on a
+case-by-case basis and that "Highly secure mode" is a sane default for most use
+cases.
+
+.. code-block:: shell
+
+  The kernel runs with five different security levels.  Any super-user
+  process can raise the level, but no process can lower it.  The security
+  levels are:
+   
+  -1    Permanently insecure mode - always run the system in insecure mode.
+        This is the default initial value.
+   
+  0     Insecure mode - immutable and append-only flags may be turned off.
+        All devices may be read or written subject to their permissions.
+   
+  1     Secure mode - the system immutable and system append-only flags may
+        not be turned off; disks for mounted file systems, /dev/mem and
+        /dev/kmem may not be opened for writing; /dev/io (if your platform
+        has it) may not be opened at all; kernel modules (see kld(4)) may
+        not be loaded or unloaded.  The kernel debugger may not be entered
+        using the debug.kdb.enter sysctl.  A panic or trap cannot be forced
+        using the debug.kdb.panic and other sysctl's.
+   
+  2     Highly secure mode - same as secure mode, plus disks may not be
+        opened for writing (except by mount(2)) whether mounted or not.
+        This level precludes tampering with file systems by unmounting
+        them, but also inhibits running newfs(8) while the system is multi-
+        user.
+   
+        In addition, kernel time changes are restricted to less than or
+        equal to one second.  Attempts to change the time by more than this
+        will log the message "Time adjustment clamped to +1 second".
+   
+  3     Network secure mode - same as highly secure mode, plus IP packet
+        filter rules (see ipfw(8), ipfirewall(4) and pfctl(8)) cannot be
+        changed and dummynet(4) or pf(4) configuration cannot be adjusted.
+

docs/chapters/networking.rst

@@ -0,0 +1,167 @@
+Network Requirements
+====================
+Here's the scenario. You've installed Bastille at home or in the cloud and want
+to get started putting applications in secure little containers, but how do I
+get these containers on the network?
+
+Bastille tries to be flexible about how to network containerized applications.
+The two most common methods are described here. Consider both options to decide
+which design work best for your needs. One of the methods works better across
+clouds while the other is simpler if used in local area networks.
+
+As you've probably seen, Bastille containers require certain information when
+they are created. An IP address has to be assigned to the container through
+which all network traffic will flow.
+
+When the container is started the IP address assigned at creation will be bound
+to a network interface. In FreeBSD these interfaces have different names, but
+look something like `em0`, `bge0`, `re0`, etc. On a virtual machine it may be
+`vtnet0`. You get the idea...
+
+**Note: if you are running in the cloud and only have a single public IP you
+may want the Public Network option. See below.**
+
+
+Local Area Network
+------------------
+I will cover the local area network (LAN) method first. This method is simpler
+to get going and works well in a home network (or similar) where adding alias
+IP addresses is no problem.
+
+Bastille allows you to define the interface you want the IP attached to when
+you create it. An example:
+
+.. code-block:: shell
+
+  bastille create alcatraz 12.1-RELEASE 192.168.1.50 em0
+
+When the `alcatraz` container is started it will add `192.168.1.50` as an IP
+alias to the `em0` interface. It will then simply be another member of the
+hosts network. Other networked systems (firewall permitting) should be able to
+reach services at that address.
+
+This method is the simplest. All you need to know is the name of your network
+interface and a free IP on your current network.
+
+(Bastille does try to verify that the interface name you provide it is a valid
+interface. This validation has not been exhaustively tested yet in Bastille's
+beta state.)
+
+
+Public Network
+--------------
+In this section I'll describe how to network containers in a public network
+such as a cloud hosting provider (AWS, digital ocean, vultr, etc)
+
+In the public cloud you don't often have access to multiple private IP
+addresses for your virtual machines. This means if you want to create multiple
+containers and assign them all IP addresses, you'll need to create a new
+network.
+
+What I recommend is creating a cloned loopback interface (`bastille0`) and
+assigning all the containers private (rfc1918) addresses on that interface. The
+setup I develop on and use Bastille day to day uses the `10.0.0.0/8` address
+range. I have the ability to use whatever address I want within that range
+because I've created my own private network. The host system then acts as the
+firewall, permitting and denying traffic as needed.
+
+I find this setup the most flexible across all types of networks. It can be
+used in public and private networks just the same and it allows me to keep
+containers off the network until I allow access.
+
+Having said all that here are instructions I used to configure the network with
+a private loopback interface and system firewall. The system firewall NATs
+traffic out of containers and can selectively redirect traffic into containers
+based on connection ports (ie; 80, 443, etc.)
+
+First, create the loopback interface:
+
+.. code-block:: shell
+
+  ishmael ~ # sysrc cloned_interfaces+=lo1
+  ishmael ~ # sysrc ifconfig_lo1_name="bastille0"
+  ishmael ~ # service netif cloneup
+
+Second, enable the firewall:
+
+.. code-block:: shell
+
+  ishmael ~ # sysrc pf_enable="YES"
+
+Create the firewall rules:
+
+/etc/pf.conf
+------------
+.. code-block:: shell
+
+  ext_if="vtnet0"
+  
+  set block-policy return
+  scrub in on $ext_if all fragment reassemble
+  set skip on lo
+
+  table <jails> persist
+  nat on $ext_if from <jails> to any -> ($ext_if)
+  
+  ## static rdr example
+  ## rdr pass inet proto tcp from any to any port {80, 443} -> 10.17.89.45
+
+  ## dynamic rdr anchor (see below)
+  rdr-anchor "rdr/*"
+  
+  block in all
+  pass out quick modulate state
+  antispoof for $ext_if inet
+  pass in inet proto tcp from any to any port ssh flags S/SA modulate state
+
+  # If you are using dynamic rdr also need to ensure that the external port
+  # range you are using is open
+  # pass in inet proto tcp any to any port <rdr-start>:<rdr-end>
+
+- Make sure to change the `ext_if` variable to match your host system interface.
+- Make sure to include the last line (`port ssh`) or you'll end up locked out.
+
+Note: if you have an existing firewall, the key lines for in/out traffic
+to containers are:
+
+.. code-block:: shell
+
+  nat on $ext_if from <jails> to any -> ($ext_if)
+  
+  ## static rdr example
+  ## rdr pass inet proto tcp from any to any port {80, 443} -> 10.17.89.45
+
+The `nat` routes traffic from the loopback interface to the external
+interface for outbound access.
+
+The `rdr pass ...` will redirect traffic from the host firewall on port X to
+the ip of Container Y. The example shown redirects web traffic (80 & 443) to the
+containers at `10.17.89.45`.
+
+  ## dynamic rdr anchor (see below)
+  rdr-anchor "rdr/*"
+
+The `rdr-anchor "rdr/*"` enables dynamic rdr rules to be setup using the 
+`bastille rdr` command at runtime - eg.
+
+  bastille rdr <jail> tcp 2001 22 # Redirects tcp port 2001 on host to 22 on jail
+  bastille rdr <jail> udp 2053 53 # Same for udp
+  bastille rdr <jail> list        # List dynamic rdr rules
+  bastille rdr <jail> clear       # Clear dynamic rdr rules
+
+  Note that if you are redirecting ports where the host is also listening
+  (eg. ssh) you should make sure that the host service is not listening on 
+  the cloned interface - eg. for ssh set sshd_flags in rc.conf
+
+  sshd_flags="-o ListenAddress=<hostname>"
+
+Finally, start up the firewall:
+
+.. code-block:: shell
+
+  ishmael ~ # service pf restart
+
+At this point you'll likely be disconnected from the host. Reconnect the
+ssh session and continue.
+
+This step only needs to be done once in order to prepare the host.

docs/chapters/subcommands/bootstrap.rst

@@ -0,0 +1,100 @@
+bootstrap
+=========
+
+The bootstrap sub-command is used to download and extract releases and
+templates for use with Bastille containers. A valid release is needed before
+containers can be created. Templates are optional but are managed in the same
+manner.
+
+Note: your mileage may vary with unsupported releases and releases newer
+than the host system likely will NOT work at all. Bastille tries to filter for
+valid release names. If you find it will not bootstrap a valid release, please
+let us know.
+
+In this document we will describe using the `bootstrap` sub-command with both
+releases and templates. We begin with releases.
+
+
+Releases
+========
+
+Example
+-------
+
+To `bootstrap` a release, run the bootstrap sub-command with the
+release version as the argument.
+
+.. code-block:: shell
+    
+  ishmael ~ # bastille bootstrap 11.3-RELEASE [update]
+  ishmael ~ # bastille bootstrap 12.0-RELEASE
+  ishmael ~ # bastille bootstrap 12.1-RELEASE
+
+This command will ensure the required directory structures are in place and
+download the requested release. For each requested release, `bootstrap` will
+download the base.txz. These files are verified (sha256 via MANIFEST file)
+before they are extracted for use.
+
+Tips
+----
+
+The `bootstrap` sub-command can now take (0.5.20191125+) an optional second
+argument of "update". If this argument is used, `bastille update` will be run
+immediately after the bootstrap, effectively bootstrapping and applying
+security patches and errata in one motion.
+
+Notes
+-----
+
+The bootstrap subcommand is generally only used once to prepare the system. The
+only other use case for the bootstrap command is when a new FreeBSD version is
+released and you want to start deploying containers on that version.
+
+To update a release as patches are made available, see the `bastille update`
+command.
+
+Downloaded artifacts are stored in the `bastille/cache/version` directory.
+"bootstrapped" releases are stored in `bastille/releases/version`.
+
+To manually bootstrap a release (aka bring your own archive), place your
+archive in bastille/cache/name and extract to bastille/releases/name. Your
+mileage may vary; let me know what happens.
+
+
+Templates
+=========
+
+Bastille aims to integrate container automation into the platform while
+maintaining a simple, uncomplicated design. Templates are git repositories with
+automation definitions for packages, services, file overlays, etc.
+
+To download one of these templates see the example below.
+
+Example
+-------
+
+.. code-block:: shell
+
+  ishmael ~ # bastille bootstrap https://gitlab.com/bastillebsd-templates/nginx
+  ishmael ~ # bastille bootstrap https://gitlab.com/bastillebsd-templates/mariadb-server
+  ishmael ~ # bastille bootstrap https://gitlab.com/bastillebsd-templates/python3
+
+Tips
+----
+See the documentation on templates for more information on how they work and
+how you can create or customize your own. Templates are a powerful part of
+Bastille and facilitate full container automation.
+
+Notes
+-----
+If you don't want to bother with git to use templates you can create them
+manually on the Bastille system and apply them.
+
+Templates are stored in `bastille/templates/namespace/name`. If you'd like to
+create a new template on your local system, simply create a new namespace
+within the templates directory and then one for the template. This namespacing
+allows users and groups to have templates without conflicting template names.
+
+Once you've created the directory structure you can begin filling it with
+template hooks. Once you have a minimum number of hooks (at least one) you can
+begin applying your template.

docs/chapters/subcommands/cmd.rst

@@ -0,0 +1,14 @@
+===
+cmd
+===
+
+To execute commands within the container you can use `bastille cmd`.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille cmd folsom 'ps -auxw'
+  [folsom]:
+  USER   PID %CPU %MEM   VSZ  RSS TT  STAT STARTED    TIME COMMAND
+  root 71464  0.0  0.0 14536 2000  -  IsJ   4:52PM 0:00.00 /usr/sbin/syslogd -ss
+  root 77447  0.0  0.0 16632 2140  -  SsJ   4:52PM 0:00.00 /usr/sbin/cron -J 60 -s
+  root 80591  0.0  0.0 18784 2340  1  R+J   4:53PM 0:00.00 ps -auxw

docs/chapters/subcommands/console.rst

@@ -0,0 +1,36 @@
+console
+=======
+
+This sub-command launches a login shell into the container. Default is password-less
+root login.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille console folsom
+  [folsom]:
+  FreeBSD 12.1-RELEASE-p1 GENERIC
+  
+  Welcome to FreeBSD!
+  
+  Release Notes, Errata: https://www.FreeBSD.org/releases/
+  Security Advisories:   https://www.FreeBSD.org/security/
+  FreeBSD Handbook:      https://www.FreeBSD.org/handbook/
+  FreeBSD FAQ:           https://www.FreeBSD.org/faq/
+  Questions List: https://lists.FreeBSD.org/mailman/listinfo/freebsd-questions/
+  FreeBSD Forums:        https://forums.FreeBSD.org/
+  
+  Documents installed with the system are in the /usr/local/share/doc/freebsd/
+  directory, or can be installed later with:  pkg install en-freebsd-doc
+  For other languages, replace "en" with a language code like de or fr.
+  
+  Show the version of FreeBSD installed:  freebsd-version ; uname -a
+  Please include that output and any error messages when posting questions.
+  Introduction to manual pages:  man man
+  FreeBSD directory layout:      man hier
+  
+  Edit /etc/motd to change this login announcement.
+  root@folsom:~ #
+
+At this point you are logged in to the container and have full shell access.  The
+system is yours to use and/or abuse as you like. Any changes made inside the
+container are limited to the container.

docs/chapters/subcommands/cp.rst

@@ -0,0 +1,21 @@
+cp
+==
+
+This command allows efficiently copying files from host to container(s).
+
+.. code-block:: shell
+
+  ishmael ~ # bastille cp ALL /tmp/resolv.conf-cf etc/resolv.conf
+  [bastion]:
+  
+  [unbound0]:
+  
+  [unbound1]:
+  
+  [squid]:
+  
+  [nginx]:
+  
+  [folsom]:
+
+Unless you see errors reported in the output the `cp` was successful.

docs/chapters/subcommands/create.rst

@@ -0,0 +1,32 @@
+create
+======
+
+Bastille create uses any available bootstrapped release to create a
+lightweight container system. To create a container simply provide a name,
+bootstrapped release and a private (rfc1918) IP address.
+
+- name
+- release
+- ip
+- interface (optional)
+
+.. code-block:: shell
+
+  ishmael ~ # bastille create folsom 11.3-RELEASE 10.17.89.10 [interface]
+  
+  RELEASE: 11.3-RELEASE.
+  NAME: folsom.
+  IP: 10.17.89.10.
+
+This command will create a 11.3-RELEASE container assigning the 10.17.89.10 ip
+address to the new system.
+
+I recommend using private (rfc1918) ip address ranges for your container.  These
+ranges include:
+
+- 10.0.0.0/8
+- 172.16.0.0/12
+- 192.168.0.0/16
+
+Bastille does its best to validate the submitted ip is valid. This has not been
+thouroughly tested--I generally use the 10/8 range.

docs/chapters/subcommands/destroy.rst

@@ -0,0 +1,18 @@
+destroy
+=======
+
+Containers can be destroyed and thrown away just as easily as they were
+created.  Note: containers must be stopped before destroyed.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille stop folsom
+  [folsom]:
+  folsom: removed
+
+.. code-block:: shell
+
+  ishmael ~ # bastille destroy folsom
+  Deleting Container: folsom.
+  Note: containers console logs not destroyed.
+  /usr/local/bastille/logs/folsom_console.log

docs/chapters/subcommands/htop.rst

@@ -0,0 +1,11 @@
+====
+htop
+====
+
+This one runs `htop` inside the container. 
+note: won't work if you don't have htop installed in the container.
+
+
+.. image:: ../../images/htop.png
+    :align: center
+    :alt: bastille htop container

docs/chapters/subcommands/index.rst

@@ -0,0 +1,24 @@
+Bastille sub-commands
+=====================
+
+.. toctree::
+   :maxdepth: 2
+   :caption: Contents:
+
+   bootstrap
+   cmd
+   console
+   cp
+   create
+   destroy
+   htop
+   pkg
+   restart
+   service
+   start
+   stop
+   sysrc
+   top
+   update
+   upgrade
+   verify

docs/chapters/subcommands/pkg.rst

@@ -0,0 +1,164 @@
+===
+pkg
+===
+
+To manage binary packages within the container use `bastille pkg`.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille pkg folsom 'install vim-console git-lite zsh'
+  [folsom]:
+  The package management tool is not yet installed on your system.
+  Do you want to fetch and install it now? [y/N]: y
+  Bootstrapping pkg from pkg+http://pkg.FreeBSD.org/FreeBSD:10:amd64/quarterly, please wait...
+  Verifying signature with trusted certificate pkg.freebsd.org.2013102301... done
+  [folsom] Installing pkg-1.10.5_5...
+  [folsom] Extracting pkg-1.10.5_5: 100%
+  Updating FreeBSD repository catalogue...
+  pkg: Repository FreeBSD load error: access repo file(/var/db/pkg/repo-FreeBSD.sqlite) failed: No such file or directory
+  [folsom] Fetching meta.txz: 100%    944 B   0.9kB/s    00:01
+  [folsom] Fetching packagesite.txz: 100%    6 MiB   3.4MB/s    00:02
+  Processing entries: 100%
+  FreeBSD repository update completed. 32550 packages processed.
+  All repositories are up to date.
+  Updating database digests format: 100%
+  The following 10 package(s) will be affected (of 0 checked):
+  
+  New packages to be INSTALLED:
+      vim-console: 8.1.0342
+      git-lite: 2.19.1
+      zsh: 5.6.2
+      expat: 2.2.6_1
+      curl: 7.61.1
+      libnghttp2: 1.33.0
+      ca_root_nss: 3.40
+      pcre: 8.42
+      gettext-runtime: 0.19.8.1_1
+      indexinfo: 0.3.1
+  
+  Number of packages to be installed: 10
+  
+  The process will require 77 MiB more space.
+  17 MiB to be downloaded.
+  
+  Proceed with this action? [y/N]: y
+  [folsom] [1/10] Fetching vim-console-8.1.0342.txz: 100%    5 MiB   5.8MB/s    00:01
+  [folsom] [2/10] Fetching git-lite-2.19.1.txz: 100%    4 MiB   2.1MB/s    00:02
+  [folsom] [3/10] Fetching zsh-5.6.2.txz: 100%    4 MiB   4.4MB/s    00:01
+  [folsom] [4/10] Fetching expat-2.2.6_1.txz: 100%  109 KiB 111.8kB/s    00:01
+  [folsom] [5/10] Fetching curl-7.61.1.txz: 100%    1 MiB   1.2MB/s    00:01
+  [folsom] [6/10] Fetching libnghttp2-1.33.0.txz: 100%  107 KiB 109.8kB/s    00:01
+  [folsom] [7/10] Fetching ca_root_nss-3.40.txz: 100%  287 KiB 294.3kB/s    00:01
+  [folsom] [8/10] Fetching pcre-8.42.txz: 100%    1 MiB   1.2MB/s    00:01
+  [folsom] [9/10] Fetching gettext-runtime-0.19.8.1_1.txz: 100%  148 KiB 151.3kB/s    00:01
+  [folsom] [10/10] Fetching indexinfo-0.3.1.txz: 100%    6 KiB   5.7kB/s    00:01
+  Checking integrity... done (0 conflicting)
+  [folsom] [1/10] Installing libnghttp2-1.33.0...
+  [folsom] [1/10] Extracting libnghttp2-1.33.0: 100%
+  [folsom] [2/10] Installing ca_root_nss-3.40...
+  [folsom] [2/10] Extracting ca_root_nss-3.40: 100%
+  [folsom] [3/10] Installing indexinfo-0.3.1...
+  [folsom] [3/10] Extracting indexinfo-0.3.1: 100%
+  [folsom] [4/10] Installing expat-2.2.6_1...
+  [folsom] [4/10] Extracting expat-2.2.6_1: 100%
+  [folsom] [5/10] Installing curl-7.61.1...
+  [folsom] [5/10] Extracting curl-7.61.1: 100%
+  [folsom] [6/10] Installing pcre-8.42...
+  [folsom] [6/10] Extracting pcre-8.42: 100%
+  [folsom] [7/10] Installing gettext-runtime-0.19.8.1_1...
+  [folsom] [7/10] Extracting gettext-runtime-0.19.8.1_1: 100%
+  [folsom] [8/10] Installing vim-console-8.1.0342...
+  [folsom] [8/10] Extracting vim-console-8.1.0342: 100%
+  [folsom] [9/10] Installing git-lite-2.19.1...
+  ===> Creating groups.
+  Creating group 'git_daemon' with gid '964'.
+  ===> Creating users
+  Creating user 'git_daemon' with uid '964'.
+  [folsom] [9/10] Extracting git-lite-2.19.1: 100%
+  [folsom] [10/10] Installing zsh-5.6.2...
+  [folsom] [10/10] Extracting zsh-5.6.2: 100%
+    
+
+The PKG sub-command can, of course, do more than just `install`. The
+expectation is that you can fully leverage the pkg manager. This means,
+`install`, `update`, `upgrade`, `audit`, `clean`, `autoremove`, etc., etc.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille pkg ALL upgrade
+  [bastion]:
+  Updating pkg.bastillebsd.org repository catalogue...
+  [bastion] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
+  [bastion] Fetching packagesite.txz: 100%  118 KiB 121.3kB/s    00:01
+  Processing entries: 100%
+  pkg.bastillebsd.org repository update completed. 493 packages processed.
+  All repositories are up to date.
+  Checking for upgrades (1 candidates): 100%
+  Processing candidates (1 candidates): 100%
+  Checking integrity... done (0 conflicting)
+  Your packages are up to date.
+  
+  [unbound0]:
+  Updating pkg.bastillebsd.org repository catalogue...
+  [unbound0] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
+  [unbound0] Fetching packagesite.txz: 100%  118 KiB 121.3kB/s    00:01
+  Processing entries: 100%
+  pkg.bastillebsd.org repository update completed. 493 packages processed.
+  All repositories are up to date.
+  Checking for upgrades (0 candidates): 100%
+  Processing candidates (0 candidates): 100%
+  Checking integrity... done (0 conflicting)
+  Your packages are up to date.
+  
+  [unbound1]:
+  Updating pkg.bastillebsd.org repository catalogue...
+  [unbound1] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
+  [unbound1] Fetching packagesite.txz: 100%  118 KiB 121.3kB/s    00:01
+  Processing entries: 100%
+  pkg.bastillebsd.org repository update completed. 493 packages processed.
+  All repositories are up to date.
+  Checking for upgrades (0 candidates): 100%
+  Processing candidates (0 candidates): 100%
+  Checking integrity... done (0 conflicting)
+  Your packages are up to date.
+  
+  [squid]:
+  Updating pkg.bastillebsd.org repository catalogue...
+  [squid] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
+  [squid] Fetching packagesite.txz: 100%  118 KiB 121.3kB/s    00:01
+  Processing entries: 100%
+  pkg.bastillebsd.org repository update completed. 493 packages processed.
+  All repositories are up to date.
+  Checking for upgrades (0 candidates): 100%
+  Processing candidates (0 candidates): 100%
+  Checking integrity... done (0 conflicting)
+  Your packages are up to date.
+  
+  [nginx]:
+  Updating pkg.bastillebsd.org repository catalogue...
+  [nginx] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
+  [nginx] Fetching packagesite.txz: 100%  118 KiB 121.3kB/s    00:01
+  Processing entries: 100%
+  pkg.bastillebsd.org repository update completed. 493 packages processed.
+  All repositories are up to date.
+  Checking for upgrades (1 candidates): 100%
+  Processing candidates (1 candidates): 100%
+  The following 1 package(s) will be affected (of 0 checked):
+  
+  Installed packages to be UPGRADED:
+      nginx-lite: 1.14.0_14,2 -> 1.14.1,2
+  
+  Number of packages to be upgraded: 1
+  
+  315 KiB to be downloaded.
+  
+  Proceed with this action? [y/N]: y
+  [nginx] [1/1] Fetching nginx-lite-1.14.1,2.txz: 100%  315 KiB 322.8kB/s    00:01
+  Checking integrity... done (0 conflicting)
+  [nginx] [1/1] Upgrading nginx-lite from 1.14.0_14,2 to 1.14.1,2...
+  ===> Creating groups.
+  Using existing group 'www'.
+  ===> Creating users
+  Using existing user 'www'.
+  [nginx] [1/1] Extracting nginx-lite-1.14.1,2: 100%
+  You may need to manually remove /usr/local/etc/nginx/nginx.conf if it is no longer needed.

docs/chapters/subcommands/rdr.rst

@@ -0,0 +1,28 @@
+===
+rdr
+===
+
+`bastille rdr` allows you to configure dynamic rdr rules for your containers
+without modifying pf.conf (assuming you are using the `bastille0` interface 
+for a private network and have enabled `rdr-anchor 'rdr/*'` in /etc/pf.conf 
+as described in the Networking section).
+
+Note: you need to be careful if host services are configured to run 
+on all interfaces as this will include the jail interface - you should 
+sepcify the interface they run on in rc.conf (or other config files)
+
+.. code-block:: shell
+
+    # bastille rdr --help
+    Usage: bastille rdr TARGET [clear] | [list] | [tcp <host_port> <jail_port>] | [udp <host_port> <jail_port>]
+    # bastille rdr dev1 tcp 2001 22
+    # bastille rdr dev1 list
+    rdr on em0 inet proto tcp from any to any port = 2001 -> 10.17.89.1 port 22
+    # bastille rdr dev1 udp 2053 53
+    # bastille rdr dev1 list
+    rdr on em0 inet proto tcp from any to any port = 2001 -> 10.17.89.1 port 22
+    rdr on em0 inet proto udp from any to any port = 2053 -> 10.17.89.1 port 53
+    # bastille rdr dev1 clear
+    nat cleared
+
+

docs/chapters/subcommands/restart.rst

@@ -0,0 +1,13 @@
+restart
+=======
+
+To restart a container you can use the `bastille restart` command.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille restart folsom
+  [folsom]:
+  folsom: removed
+  
+  [folsom]:
+  folsom: created

docs/chapters/subcommands/service.rst

@@ -0,0 +1,16 @@
+=======
+service
+=======
+
+The `service` sub-command allows for managing services within containers. This
+allows you to start, stop, restart, and otherwise interact with services
+running inside the containers.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille service web01 'nginx start'
+  ishmael ~ # bastille service db01 'mysql-server restart'
+  ishmael ~ # bastille service proxy 'nginx configtest'
+  ishmael ~ # bastille service proxy 'nginx enable'
+  ishmael ~ # bastille service proxy 'nginx disable'
+  ishmael ~ # bastille service proxy 'nginx delete'

docs/chapters/subcommands/start.rst

@@ -0,0 +1,10 @@
+start
+=====
+
+To start a container you can use the `bastille start` command.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille start folsom
+  [folsom]:
+  folsom: created

docs/chapters/subcommands/stop.rst

@@ -0,0 +1,10 @@
+stop
+====
+
+To stop a container you can use the `bastille stop` command.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille stop folsom
+  [folsom]:
+  folsom: removed

docs/chapters/subcommands/sysrc.rst

@@ -0,0 +1,14 @@
+=====
+sysrc
+=====
+
+The `sysrc` sub-command allows for safely editing system configuration files.
+In container terms, this allows us to toggle on/off services and options at startup.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille sysrc nginx nginx_enable="YES"
+  [nginx]:
+  nginx_enable: NO -> YES
+
+See `man sysrc(8)` for more info.

docs/chapters/subcommands/top.rst

@@ -0,0 +1,10 @@
+===
+top
+===
+
+This one runs `top` in that container. 
+
+
+.. image:: ../../images/top.png
+    :align: center
+    :alt: bastille top container

docs/chapters/subcommands/update.rst

@@ -0,0 +1,41 @@
+======
+update
+======
+
+The `update` command targets a release instead of a container. Because every container is
+based on a release, when the release is updated all the containers are automatically
+updated as well.
+
+If no updates are available, a message will be shown:
+
+.. code-block:: shell
+
+  ishmael ~ # bastille update 11.2-RELEASE
+  Looking up update.FreeBSD.org mirrors... 2 mirrors found.
+  Fetching metadata signature for 11.2-RELEASE from update4.freebsd.org... done.
+  Fetching metadata index... done.
+  Inspecting system... done.
+  Preparing to download files... done.
+  
+  No updates needed to update system to 11.2-RELEASE-p4.
+  No updates are available to install.
+
+
+The older the release, however, the more updates will be available:
+
+.. code-block:: shell
+
+  ishmael ~ # bastille update 10.4-RELEASE
+  Looking up update.FreeBSD.org mirrors... 2 mirrors found.
+  Fetching metadata signature for 10.4-RELEASE from update1.freebsd.org... done.
+  Fetching metadata index... done.
+  Fetching 2 metadata patches.. done.
+  Applying metadata patches... done.
+  Fetching 2 metadata files... done.
+  Inspecting system... done.
+  Preparing to download files... done.
+  
+  The following files will be added as part of updating to 10.4-RELEASE-p13:
+  ...[snip]...
+
+To be safe, you may want to restart any containers that have been updated live.

docs/chapters/subcommands/upgrade.rst

@@ -0,0 +1,11 @@
+=======
+upgrade
+=======
+
+This command lets you upgrade a release to a new release. Depending on the
+workflow this can be similar to a `bootstrap`.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille upgrade 11.2-RELEASE 12.0-RELEASE
+

docs/chapters/subcommands/verify.rst

@@ -0,0 +1,21 @@
+======
+verify
+======
+
+This command scans a bootstrapped release and validates that everything looks
+in order. This is not a 100% comprehensive check, but it compares the release
+against a "known good" index.
+
+If you see errors or issues here, consider deleting and re-bootstrapping
+the release.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille verify 11.2-RELEASE
+  Looking up update.FreeBSD.org mirrors... 2 mirrors found.
+  Fetching metadata signature for 11.2-RELEASE from update1.freebsd.org... done.
+  Fetching metadata index... done.
+  Fetching 1 metadata patches. done.
+  Applying metadata patches... done.
+  Fetching 1 metadata files... done.
+  Inspecting system... done.

docs/chapters/targeting.rst

@@ -0,0 +1,66 @@
+Targeting
+=========
+
+Bastille uses a `command-target-args` syntax, meaning that each command
+requires a target. Targets are usually containers, but can also be releases.
+
+Targeting a containers is done by providing the exact containers name.
+
+Targeting a release is done by providing the release name. (Note: do note
+include the `-pX` point-release version.)
+
+Bastille includes a pre-defined keyword ALL to target all running containers.
+
+In the future I would like to support more options, including globbing, lists
+and regular-expressions.
+
+Examples: Containers
+====================
+
+.. code-block:: shell
+
+  ishmael ~ # bastille ...
+
++-----------+--------+------------------+-------------------------------------------------------------+
+| command   | target | args             | description                                                 |
++===========+========+==================+=============================================================+
+| cmd       | ALL    | 'sockstat -4'    | execute `sockstat -4` in ALL containers (ip4 sockets)       |
++-----------+--------+-----+------------+-------------------------------------------------------------+ 
+| console   | mariadb02    | ---        | console (shell) access to mariadb02                         |
++----+------+----+---------+------------+--------------+----------------------------------------------+ 
+| pkg       | web01  | 'install nginx'  | install nginx package in web01 container                    |
++-----------+--------+------------------+-------------------------------------------------------------+
+| pkg       | ALL    | upgrade          | upgrade packages in ALL containers                          |
++-----------+--------+------------------+-------------------------------------------------------------+ 
+| pkg       | ALL    | audit            | (CVE) audit packages in ALL containers                      |
++-----------+--------+------------------+-------------------------------------------------------------+ 
+| sysrc     | web01  | nginx_enable=YES | execute `sysrc nginx_enable=YES` in web01 container         |
++-----------+--------+------------------+-------------------------------------------------------------+ 
+| template  | ALL    | username/base    | apply `username/base` template to ALL containers            |
++-----------+--------+------------------+-------------------------------------------------------------+ 
+| start     | web02  | ---              | start web02 container                                       |
++-----------+--------+-----+------------+-------------------------------------------------------------+ 
+| cp | bastion03 | /tmp/resolv.conf-cf etc/resolv.conf | copy host-path to container-path in bastion03|
++----+------+----+---+------------------+--------------+----------------------------------------------+ 
+| create    | folsom | 12.0-RELEASE 10.17.89.10        | create 12.0 container named `folsom` with IP |
++-----------+--------+------------------+--------------+----------------------------------------------+
+
+
+Examples: Releases
+==================
+
+.. code-block:: shell
+
+  ishmael ~ # bastille ...
+
++-----------+--------------+--------------+-------------------------------------------------------------+
+| command   | target       | args         | description                                                 |
++===========+==============+==============+=============================================================+
+| bootstrap | 12.0-RELEASE | ---          | bootstrap 12.0-RELEASE release                              |
++-----------+--------------+--------------+-------------------------------------------------------------+ 
+| update    | 11.3-RELEASE | ---          | update 11.2-RELEASE release                                 |
++-----------+--------------+--------------+-------------------------------------------------------------+ 
+| upgrade   | 11.2-RELEASE | 11.3-RELEASE | update 11.2-RELEASE release                                 |
++-----------+--------------+--------------+-------------------------------------------------------------+ 
+| verify    | 11.3-RELEASE | ---          | update 11.2-RELEASE release                                 |
++-----------+--------------+--------------+-------------------------------------------------------------+ 

docs/chapters/template.rst

@@ -0,0 +1,146 @@
+========
+Template
+========
+Looking for ready made CI/CD validated [Bastille
+Templates](https://gitlab.com/BastilleBSD-Templates)?
+
+Bastille supports a templating system allowing you to apply files, pkgs and
+execute commands inside the containers automatically.
+
+Currently supported template hooks are: `LIMITS`, `INCLUDE`, `PRE`, `FSTAB`,
+`PKG`, `OVERLAY`, `SYSRC`, `SERVICE`, `CMD`.
+Planned template hooks include: `PF`, `LOG`.
+
+Templates are created in `${bastille_prefix}/templates` and can leverage any of
+the template hooks. Simply create a new directory named after the template. eg;
+
+.. code-block:: shell
+
+  mkdir -p /usr/local/bastille/templates/username/base
+
+To leverage a template hook, create an UPPERCASE file in the root of the
+template directory named after the hook you want to execute. eg;
+
+.. code-block:: shell
+
+  echo "zsh vim-console git-lite htop" > /usr/local/bastille/templates/username/base/PKG
+  echo "/usr/bin/chsh -s /usr/local/bin/zsh" > /usr/local/bastille/templates/username/base/CMD
+  echo "usr" > /usr/local/bastille/templates/username/base/OVERLAY
+
+Template hooks are executed in specific order and require specific syntax to
+work as expected. This table outlines those requirements:
+
+
++---------+-------------------+-----------------------------------------+
+| HOOK    | format            | example                                 |
++=========+===================+=========================================+
+| LIMITS  | resource value    | memoryuse 1G                            |
++---------+-------------------+-----------------------------------------+
+| INCLUDE | template path/URL | http?://TEMPLATE_URL or project/path    |
++---------+-------------------+-----------------------------------------+
+| PRE     | /bin/sh command   | mkdir -p /usr/local/my_app/html         |
++---------+-------------------+-----------------------------------------+
+| FSTAB   | fstab syntax      | /host/path container/path nullfs ro 0 0 |
++---------+-------------------+-----------------------------------------+
+| PKG     | port/pkg name(s)  | vim-console zsh git-lite tree htop      |
++---------+-------------------+-----------------------------------------+
+| OVERLAY | path(s)           | etc root usr (one per line)             |
++---------+-------------------+-----------------------------------------+
+| SYSRC   | sysrc command(s)  | nginx_enable=YES                        |
++---------+-------------------+-----------------------------------------+
+| SERVICE | service command   | 'nginx start' OR 'postfix reload'       |
++---------+-------------------+-----------------------------------------+
+| CMD     | /bin/sh command   | /usr/bin/chsh -s /usr/local/bin/zsh     |
++---------+-------------------+-----------------------------------------+
+
+Note: SYSRC requires that NO quotes be used or that quotes (`"`) be escaped
+ie; (`\\"`)
+
+In addition to supporting template hooks, Bastille supports overlaying
+files into the container. This is done by placing the files in their full path,
+using the template directory as "/".
+
+An example here may help. Think of `bastille/templates/username/base`, our
+example template, as the root of our filesystem overlay. If you create an
+`etc/hosts` or `etc/resolv.conf` *inside* the base template directory, these
+can be overlayed into your container.
+
+Note: due to the way FreeBSD segregates user-space, the majority of your
+overlayed template files will be in `usr/local`. The few general
+exceptions are the `etc/hosts`, `etc/resolv.conf`, and
+`etc/rc.conf.local`.
+
+After populating `usr/local` with custom config files that your container will
+use, be sure to include `usr` in the template OVERLAY definition. eg;
+
+.. code-block:: shell
+
+  echo "usr" > /usr/local/bastille/templates/username/base/OVERLAY
+
+The above example "usr" will include anything under "usr" inside the template.
+You do not need to list individual files. Just include the top-level directory
+name. List these top-level directories one per line.
+
+Applying Templates
+------------------
+
+Containers must be running to apply templates.
+
+Bastille includes a `template` command. This command requires a target and a
+template name. As covered in the previous section, template names correspond to
+directory names in the `bastille/templates` directory.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille template ALL username/base
+  [proxy01]:
+  Copying files...
+  Copy complete.
+  Installing packages.
+  pkg already bootstrapped at /usr/local/sbin/pkg
+  vulnxml file up-to-date
+  0 problem(s) in the installed packages found.
+  Updating bastillebsd.org repository catalogue...
+  [cdn] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
+  [cdn] Fetching packagesite.txz: 100%  121 KiB 124.3kB/s    00:01
+  Processing entries: 100%
+  bastillebsd.org repository update completed. 499 packages processed.
+  All repositories are up to date.
+  Checking integrity... done (0 conflicting)
+  The most recent version of packages are already installed
+  Updating services.
+  cron_flags: -J 60 -> -J 60
+  sendmail_enable: NONE -> NONE
+  syslogd_flags: -ss -> -ss
+  Executing final command(s).
+  chsh: user information updated
+  Template Complete.
+  
+  [web01]:
+  Copying files...
+  Copy complete.
+  Installing packages.
+  pkg already bootstrapped at /usr/local/sbin/pkg
+  vulnxml file up-to-date
+  0 problem(s) in the installed packages found.
+  Updating pkg.bastillebsd.org repository catalogue...
+  [poudriere] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
+  [poudriere] Fetching packagesite.txz: 100%  121 KiB 124.3kB/s    00:01
+  Processing entries: 100%
+  pkg.bastillebsd.org repository update completed. 499 packages processed.
+  Updating bastillebsd.org repository catalogue...
+  [poudriere] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
+  [poudriere] Fetching packagesite.txz: 100%  121 KiB 124.3kB/s    00:01
+  Processing entries: 100%
+  bastillebsd.org repository update completed. 499 packages processed.
+  All repositories are up to date.
+  Checking integrity... done (0 conflicting)
+  The most recent version of packages are already installed
+  Updating services.
+  cron_flags: -J 60 -> -J 60
+  sendmail_enable: NONE -> NONE
+  syslogd_flags: -ss -> -ss
+  Executing final command(s).
+  chsh: user information updated
+  Template Complete.
+

docs/chapters/usage.rst

@@ -0,0 +1,37 @@
+Usage
+=====
+
+.. code-block:: shell
+
+    ishmael ~ # bastille -h
+    Bastille is an open-source system for automating deployment and management of
+    containerized applications on FreeBSD.
+    
+    Usage:
+      bastille command [ALL|glob] [args]
+    
+    Available Commands:
+      bootstrap   Bootstrap a FreeBSD release for container base.
+      cmd         Execute arbitrary command on targeted container(s).
+      console     Console into a running container.
+      cp          cp(1) files from host to targeted container(s).
+      create      Create a new thin container or a thick container if -T|--thick option specified.
+      destroy     Destroy a stopped container or a FreeBSD release.
+      help        Help about any command
+      htop        Interactive process viewer (requires htop).
+      list        List containers, releases, templates, or logs.
+      pkg         Manipulate binary packages within targeted container(s). See pkg(8).
+      restart     Restart a running container.
+      service     Manage services within targeted containers(s).
+      start       Start a stopped container.
+      stop        Stop a running container.
+      sysrc       Safely edit rc files within targeted container(s).
+      template    Apply file templates to targeted container(s).
+      top         Display and update information about the top(1) cpu processes.
+      update      Update container base -pX release.
+      upgrade     Upgrade container release to X.Y-RELEASE.
+      verify      Compare release against a "known good" index.
+      zfs         Manage (get|set) zfs attributes on targeted container(s).
+    
+    Use "bastille -v|--version" for version information.
+    Use "bastille command -h|--help" for more information about a command.

docs/conf.py

@@ -0,0 +1,79 @@
+import os
+on_rtd = os.environ.get('READTHEDOCS') == 'True'
+if on_rtd:
+    html_theme = 'default'
+else:
+    html_theme = 'sphinx_rtd_theme'
+
+# -- Project information -----------------------------------------------------
+
+project = 'Bastille'
+copyright = '2018-2020, Christer Edwards'
+author = 'Christer Edwards'
+
+# The short X.Y version
+version = '0.6.20200202'
+# The full version, including alpha/beta/rc tags
+release = '0.6.20200202-beta'
+
+
+# -- General configuration ---------------------------------------------------
+
+extensions = [
+]
+
+templates_path = ['_templates']
+
+source_suffix = ['.rst', '.md']
+
+from recommonmark.parser import CommonMarkParser
+source_parsers = {
+    '.md': CommonMarkParser,
+}
+
+master_doc = 'index'
+language = None
+exclude_patterns = ['_build', 'Thumbs.db', '.DS_Store']
+pygments_style = None
+
+# -- Options for HTML output -------------------------------------------------
+
+html_static_path = ['_static']
+
+# -- Options for HTMLHelp output ---------------------------------------------
+
+htmlhelp_basename = 'Bastilledoc'
+
+
+# -- Options for LaTeX output ------------------------------------------------
+
+latex_elements = {
+}
+
+latex_documents = [
+    (master_doc, 'Bastille.tex', 'Bastille Documentation',
+     'Christer Edwards', 'manual'),
+]
+
+# -- Options for manual page output ------------------------------------------
+
+man_pages = [
+    (master_doc, 'bastille', 'Bastille Documentation',
+     [author], 1)
+]
+
+
+# -- Options for Texinfo output ----------------------------------------------
+
+texinfo_documents = [
+    (master_doc, 'Bastille', 'Bastille Documentation',
+     author, 'Bastille', 'Bastille is an open-source system for automating deployment and management of containerized applications on FreeBSD.',
+     'Miscellaneous'),
+]
+
+# -- Options for Epub output -------------------------------------------------
+
+epub_title = project
+
+# A list of files that should not be packed into the epub file.
+epub_exclude_files = ['search.html']

docs/copyright.rst

@@ -0,0 +1,8 @@
+=========
+Copyright
+=========
+
+This content is copyright Christer Edwards. All rights reserved.
+
+Duplication of this content without the express written permission of the
+author is not permitted.

docs/index.rst

@@ -0,0 +1,24 @@
+Bastille
+========
+
+Welcome to the official Bastille documentation. This collection of documents
+will outline installation and usage of Bastille.
+
+The latest version of this documentation can always be found at
+https://docs.bastillebsd.org.
+
+.. toctree::
+   :maxdepth: 2
+   :caption: Contents:
+
+   chapters/installation
+   chapters/networking
+   chapters/usage
+   chapters/targeting
+   chapters/subcommands/index
+   chapters/template
+   chapters/jail-config
+
+   copyright
+
+Note: this documentation is included with the source code in `docs`.

usr/local/bin/bastille

@@ -0,0 +1,160 @@
+#!/bin/sh
+#
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
+
+## root check first.
+bastille_root_check() {
+    if [ "$(id -u)" -ne 0 ]; then
+        ## so we can make it colorful
+        . /usr/local/share/bastille/colors.pre.sh
+
+        ## permission denied
+        echo -e "${COLOR_RED}Bastille: Permission Denied${COLOR_RESET}" 1>&2
+        echo -e "${COLOR_RED}root / sudo / doas required${COLOR_RESET}" 1>&2
+        exit 1
+    fi
+}
+
+bastille_root_check
+
+## we only load the config if root_check passes
+. /usr/local/etc/bastille/bastille.conf
+. /usr/local/share/bastille/colors.pre.sh
+
+## bastille_prefix should be 0750
+## this restricts file system access to privileged users
+bastille_perms_check() {
+    if [ -d "${bastille_prefix}" ]; then
+        BASTILLE_PREFIX_PERMS=$(stat -f "%Op" "${bastille_prefix}")
+        if [ "${BASTILLE_PREFIX_PERMS}" != 40750 ]; then
+            echo -e "${COLOR_RED}Insecure permissions on ${bastille_prefix}${COLOR_RESET}" 1>&2
+            echo -e "${COLOR_RED}Try: chmod 0750 ${bastille_prefix}${COLOR_RESET}" 1>&2
+            echo
+            exit 1
+        fi
+    fi
+}
+
+bastille_perms_check
+
+## we only load the config if root_check passes
+. /usr/local/etc/bastille/bastille.conf
+
+## version
+BASTILLE_VERSION="0.6.20200412"
+
+usage() {
+    cat << EOF
+Bastille is an open-source system for automating deployment and management of
+containerized applications on FreeBSD.
+
+Usage:
+  bastille command TARGET [args]
+
+Available Commands:
+  bootstrap   Bootstrap a FreeBSD release for container base.
+  cmd         Execute arbitrary command on targeted container(s).
+  clone       Clone an existing container.
+  console     Console into a running container.
+  convert     Convert a Thin container into a Thick container.
+  cp          cp(1) files from host to targeted container(s).
+  create      Create a new thin container or a thick container if -T|--thick option specified.
+  destroy     Destroy a stopped container or a FreeBSD release.
+  edit        Edit container configuration files (advanced).
+  export      Exports a specified container.
+  help        Help about any command.
+  htop        Interactive process viewer (requires htop).
+  import      Import a specified container.
+  list        List containers (running and stopped).
+  pkg         Manipulate binary packages within targeted container(s). See pkg(8).
+  rdr         Redirect host port to container port.
+  rename      Rename a container.
+  restart     Restart a running container.
+  service     Manage services within targeted container(s).
+  start       Start a stopped container.
+  stop        Stop a running container.
+  sysrc       Safely edit rc files within targeted container(s).
+  template    Apply file templates to targeted container(s).
+  top         Display and update information about the top(1) cpu processes.
+  update      Update container base -pX release.
+  upgrade     Upgrade container release to X.Y-RELEASE.
+  verify      Compare release against a "known good" index.
+  zfs         Manage (get|set) zfs attributes on targeted container(s).
+
+Use "bastille -v|--version" for version information.
+Use "bastille command -h|--help" for more information about a command.
+
+EOF
+    exit 1
+}
+
+[ $# -lt 1 ] && usage
+
+CMD=$1
+shift
+
+# Handle special-case commands first.
+case "${CMD}" in
+version|-v|--version)
+    echo -e "${COLOR_GREEN}${BASTILLE_VERSION}${COLOR_RESET}"
+    exit 0
+    ;;
+help|-h|--help)
+    usage
+    ;;
+esac
+
+# Filter out all non-commands
+case "${CMD}" in
+bootstrap|clone|cmd|console|convert|cp|create)
+    ;;
+destroy|edit|export|htop|import|limits|list)
+    ;;
+pkg|rdr|rename|restart|service|start|stop|sysrc)
+    ;;
+template|top|update|upgrade|verify|zfs)
+    ;;
+*)
+usage
+    ;;
+esac
+
+SCRIPTPATH="${bastille_sharedir}/${CMD}.sh"
+if [ -f "${SCRIPTPATH}" ]; then
+    : "${UMASK:=022}"
+    umask "${UMASK}"
+
+    : "${SH:=sh}"
+
+    exec "${SH}" "${SCRIPTPATH}" "$@"
+else
+    echo -e "${COLOR_RED}${SCRIPTPATH} not found.${COLOR_RESET}" 1>&2
+fi

usr/local/bin/bbsd-bootstrap

@@ -1,69 +0,0 @@
-#!/bin/sh
-
-if [ "$#" -lt 3 ]; then
-    echo "Required: '[activate|update|snapshot]', 'bastille', 'release'"
-    echo "Supported releases: '11.1-RELEASE', '10.4-RELEASE', '10.3-RELEASE'"
-    exit 1
-fi
-
-echo
-echo "###########################"
-echo "## args: $1      ##"
-echo "## args: $2      ##"
-echo "## args: $3  ##"
-echo "###########################"
-echo
-
-RELEASE="$3"
-PREFIX=/usr/local
-PLATFORM="${PREFIX}/$2"
-VALIDRELEASE=''
-
-if [ "${RELEASE}" == "11.1-RELEASE" -o "${RELEASE}" == "10.4-RELEASE" -o "${RELEASE}" == "10.3-RELEASE" ]; then
-    VALIDRELEASE="${RELEASE}"
-fi
-
-BASETXZPATH="${PLATFORM}/downloads/${RELEASE}/base.txz"
-UPSTREAMURL="https://download.freebsd.org/ftp/releases/amd64/${RELEASE}/base.txz"
-
-if [ "$1" == "activate" ]; then
-    if [ -d "/usr/local/bastille" ]; then
-        echo "Looks like you're already bootstrapped."
-        exit 1
-    else
-        /sbin/zfs create -o compression=lz4 -o atime=off -o mountpoint="${PLATFORM}" "zroot${PLATFORM}"
-        /sbin/zfs create -o compression=lz4 -o atime=off -o mountpoint="${PLATFORM}/downloads" "zroot${PLATFORM}/downloads"
-        /sbin/zfs create -o compression=lz4 -o atime=off -o mountpoint="${PLATFORM}/jails" "zroot${PLATFORM}/jails"
-        /sbin/zfs create -o compression=lz4 -o atime=off -o mountpoint="${PLATFORM}/logs" "zroot${PLATFORM}/logs"
-        /sbin/zfs create -o compression=lz4 -o atime=off -o mountpoint="${PLATFORM}/fstab" "zroot${PLATFORM}/fstab"
-        /sbin/zfs create -o compression=lz4 -o atime=off -o mountpoint="${PLATFORM}/releases" "zroot${PLATFORM}/releases"
-
-        ## create the downloads && releases ZFS volumes
-        if [ ! -z "${VALIDRELEASE}" ]; then
-            if [ ! -d "${PLATFORM}"/downloads/"${RELEASE}" ]; then
-                /sbin/zfs create zroot"${PLATFORM}"/downloads/"${RELEASE}"
-            fi
-            if [ ! -d "${PLATFORM}"/releases/"${RELEASE}" ]; then
-                /sbin/zfs create zroot"${PLATFORM}"/releases/"${RELEASE}"
-            fi
-        
-            ## fetch && untar base.txz
-            if [ ! -f "${BASETXZPATH}" ]; then
-                /usr/bin/fetch "${UPSTREAMURL}" -o "${PLATFORM}/downloads/${RELEASE}"
-                /usr/bin/tar -C "${PLATFORM}/releases/${RELEASE}" -xf "${PLATFORM}/downloads/${RELEASE}/base.txz"
-            fi
-
-            ## freebsd-update && snapshot
-            env PAGER=/bin/cat /usr/sbin/freebsd-update -b "${PLATFORM}/releases/${RELEASE}" fetch install
-            /sbin/zfs snapshot "zroot${PLATFORM}/releases/${RELEASE}@$(date +%F)"
-        fi
-    fi
-fi
-
-if [ "$1" == "update" ]; then
-    env PAGER=/bin/cat /usr/sbin/freebsd-update -b "${PLATFORM}/releases/${RELEASE}" fetch install
-fi
-
-if [ "$1" == "snapshot" ]; then
-    /sbin/zfs snapshot "zroot${PLATFORM}/releases/${RELEASE}@$(date +%F)"
-fi

usr/local/bin/bbsd-cmd

@@ -1,31 +0,0 @@
-#!/bin/sh
-#
-# basic cmd targeting and execution
-
-if [ $# -gt 2 ] || [ $# -lt 2 ]; then
-    echo "Usage: bbsd-cmd [glob|ALL] 'quoted command'"
-    exit 1
-fi
-
-if [ "$1" = 'ALL' ]; then
-    JAILS=$(jls -N | awk '!/JID/{print $1}')
-    echo "Targeting all containers."
-    echo
-    for jail in ${JAILS}; do
-        echo "${jail}:"
-        jexec ${jail} $2
-        echo
-    done
-fi
-
-if [ "$1" != 'ALL' ]; then
-    JAILS=$(jls -N | awk '!/JID/{print $1}' | grep "$1")
-    echo "Targeting specified containers."
-    echo "${JAILS}"
-    echo
-    for jail in ${JAILS}; do
-        echo "${jail}:"
-        jexec ${jail} $2
-        echo
-    done
-fi

usr/local/bin/bbsd-create

@@ -1,74 +0,0 @@
-#!/bin/sh -x
-#
-# create a new jail
-
-if [ $# -lt 3 ] || [ $# -gt 3 ]; then
-    echo "Required: name repo release."
-    exit 1
-fi
-
-NAME="$1"
-TEMPLATE="$2"
-RELEASE="$3"
-
-PREFIX=/usr/local
-BASTILLE=${PREFIX}/bastille
-JAIL_BASE=${BASTILLE}/jails/${NAME}
-
-JAIL_ROOT=${JAIL_BASE}/root
-JAIL_CONF=${JAIL_BASE}/jail.conf
-PKGS_CONF=${JAIL_BASE}/pkgs.conf
-JAIL_JID=${JAIL_BASE}/${jail}.jid
-JAIL_FSTAB="${BASTILLE}/fstab/${NAME}.fstab"
-BASEJAIL="${BASTILLE}/releases/${RELEASE}"
-
-## create zfs volume
-if [ ! -d ${JAIL_ROOT} ]; then
-    echo "Creating Jail Base..."
-    zfs create -o mountpoint=${JAIL_BASE}\
-               -o compression=lz4\
-               -o atime=off zroot"${JAIL_BASE}"\
-    && echo "Created ZFS volume for jail...[OK]." || echo "Failure: ZFS volume creation."
-fi
-
-## clone template into volume
-if [ $(find "${JAIL_BASE}" -empty) ]; then
-    echo "Cloning template..."
-    git clone "${TEMPLATE}" "${JAIL_BASE}" || echo "Template cloning failed; exiting"
-    echo "Cloning release contents..."
-    /bin/cp -an "${BASEJAIL}/etc" "${JAIL_ROOT}"
-    /bin/cp -an "${BASEJAIL}/root" "${JAIL_ROOT}"
-fi
-
-## create fstab; IMPORTANT that this goes before pkgs (below)
-if [ ! -f ${JAIL_FSTAB} ]; then
-    /bin/cat << EOF > ${JAIL_FSTAB}
-${BASEJAIL}/bin ${JAIL_ROOT}/bin nullfs ro 0 0
-${BASEJAIL}/boot ${JAIL_ROOT}/boot nullfs ro 0 0
-${BASEJAIL}/lib ${JAIL_ROOT}/lib nullfs ro 0 0
-${BASEJAIL}/libexec ${JAIL_ROOT}/libexec nullfs ro 0 0
-${BASEJAIL}/rescue ${JAIL_ROOT}/rescue nullfs ro 0 0
-${BASEJAIL}/sbin ${JAIL_ROOT}/sbin nullfs ro 0 0
-${BASEJAIL}/usr/bin ${JAIL_ROOT}/usr/bin nullfs ro 0 0
-${BASEJAIL}/usr/include ${JAIL_ROOT}/usr/include nullfs ro 0 0
-${BASEJAIL}/usr/lib ${JAIL_ROOT}/usr/lib nullfs ro 0 0
-${BASEJAIL}/usr/libexec ${JAIL_ROOT}/usr/libexec nullfs ro 0 0
-${BASEJAIL}/usr/sbin ${JAIL_ROOT}/usr/sbin nullfs ro 0 0
-${BASEJAIL}/usr/share ${JAIL_ROOT}/usr/share nullfs ro 0 0
-${BASEJAIL}/usr/libdata ${JAIL_ROOT}/usr/libdata nullfs ro 0 0
-EOF
-echo "Writing jail fstab (basejail)...[OK]"
-fi
-
-## install pkgs
-if [ -s ${PKGS_CONF} ]; then
-    echo "Starting jail; installing pkgs..."
-    jail -c -f "${JAIL_CONF}" -J "${JAIL_JID}" ${NAME}
-    pfctl -f /etc/pf.conf
-    pkg -j ${NAME} install -y $(cat ${PKGS_CONF})
-    jail -r -f "${JAIL_CONF}" ${NAME}
-    echo "Stopping jail; installation complete."
-elif [ ! -s ${PKGS_CONF} ]; then
-    echo "pkgs.conf appears empty; not installing anything."
-    echo "complete"
-fi

usr/local/bin/bbsd-destroy

@@ -1,40 +0,0 @@
-#!/bin/sh
-#
-# destroy an existing jail
-
-JAIL_NAME=$1
-JAIL_PATH=$2
-PREFIX=/usr/local
-JLS_NAME="/usr/sbin/jls name"
-JLS_PATH="/usr/sbin/jls path"
-PLATFORM=${PREFIX}/bastille
-FSTAB_PATH=${PLATFORM}/fstab/$1.fstab
-JAIL_PATH=${PLATFORM}/jails/$1
-
-if [ $# -lt 2 ]; then
-    echo "Required: name path."
-    return 1
-fi
-
-if [ ! -d ${JAIL_PATH} ]; then
-    echo "Path (${JAIL_PATH}) not found."
-    return 1
-fi
-
-if [ $(${JLS_NAME} | grep ${JAIL_NAME}) ]; then
-    echo "Jail is running."
-    echo "Stop jail first with bbsd-stop ${JAIL_NAME}."
-    return 1
-fi
-
-if [ $(${JLS_PATH} | grep ${JAIL_PATH}) ]; then
-    echo "Jail is running."
-    echo "Stop jail first with bbsd-stop ${JAIL_NAME}."
-    return 1
-fi
-
-if [ -d ${JAIL_PATH} ]; then
-    zfs destroy -r zroot${JAIL_PATH} || echo "Unable to destroy zroot${JAIL_PATH}."
-    rm -rf ${JAIL_PATH} || echo "Unable to delete ${JAIL_PATH}."
-    echo "Jail destroyed. RIP."
-fi

usr/local/bin/bbsd-init-repo

@@ -1,42 +0,0 @@
-#!/bin/sh
-# (christer.edwards@gmail.com)
-# initialize a Bastille repo
-
-if [ $# -lt 1 ] || [ $# -gt 1 ]; then
-    echo "Usage: bbsd-init-repo /path/to/repo"
-    return 1
-fi
-
-REPOPATH=$1
-
-RODIRS="root/bin root/boot root/dev root/lib\
-        root/libexec root/rescue root/sbin\
-        root/usr/bin root/usr/include root/usr/lib\
-        root/usr/libdata root/usr/libexec\
-        root/usr/sbin root/usr/share root/tmp"
-
-RWDIRS="root/etc root/root root/usr/local root/var"
-
-bbsd_init_repo()
-{
-    local _dir
-
-    for _dir in ${RWDIRS}; do
-        mkdir -p "${REPOPATH}"/"${_dir}"
-    done
-
-    for _dir in ${RODIRS}; do
-        mkdir -p "${REPOPATH}"/"${_dir}"
-        cat << EOF > "${_dir}"/.gitignore
-# Ignore everything in this directory
-# All directory contents will be lost
-*
-# Except this file
-!.gitignore
-EOF
-done
-
-chmod 1777 root/tmp
-}
-
-bbsd_init_repo

usr/local/bin/bbsd-login

@@ -1,11 +0,0 @@
-#!/bin/sh
-#
-# jexec $1 /usr/bin/login -f root
-
-if [ $# -eq 1 ]; then
-    jexec $1 /usr/bin/login -f root
-fi
-
-if [ $# -eq 2 ]; then
-    jexec $1 /usr/bin/login -f $2
-fi

usr/local/bin/bbsd-pkg

@@ -1,31 +0,0 @@
-#!/bin/sh
-#
-# execute $2 inside targeted jail(s)
-
-if [ $# -gt 2 ] || [ $# -lt 2 ]; then
-    echo "Usage: bbsd-pkg [glob|ALL] 'package command'."
-    exit 1
-fi
-
-if [ "$1" = 'ALL' ]; then
-    JAILS=$(jls -N | awk '!/JID/{print $1}')
-    echo "Targeting all containers."
-    echo
-    for i in ${JAILS}; do
-        echo "${i}:"
-        pkg -j "${i}" "$2"
-        echo
-    done
-fi
-
-if [ "$1" != 'ALL' ]; then
-    JAILS=$(jls -N | awk '!/JID/{print $1}' | grep "$1")
-    echo "Targeting specified containers."
-    echo "${JAILS}"
-    echo
-    for i in ${JAILS}; do
-        echo "${i}:"
-        pkg -j "${i}" "$2"
-        echo
-    done
-fi

usr/local/bin/bbsd-restart

@@ -1,35 +0,0 @@
-#!/bin/sh
-# (christer.edwards@gmail.com)
-# restart jail
-
-if [ $# -lt 1 ]; then
-    printf "Required: jail name(s)."
-    exit 1
-fi
-
-ARGS=$*
-
-for jail in ${ARGS}; do
-    PREFIX=/usr/local
-    PLATFORM=${PREFIX}/bastille
-    JAIL_BASE=${PLATFORM}/jails/${jail}
-
-    JAIL_ROOT=${JAIL_BASE}/root
-    JAIL_CONF=${JAIL_BASE}/jail.conf
-    PKGS_CONF=${JAIL_BASE}/pkgs.conf
-    JAIL_JID=${JAIL_BASE}/${jail}.jid
-
-    err_msg() {
-        printf "ERROR:\t$@\n"
-    }
-
-    if [ ! -d ${JAIL_ROOT} ]; then
-	err_msg "Jail (${jail}) does not exist(?)."
-
-        [ ! -f ${JAIL_CONF} ] && err_msg "jail.conf not found."
-        [ ! -f ${PKGS_CONF} ] && err_msg "pkgs.conf not found."
-    fi
-    if [ -d ${JAIL_ROOT} ]; then
-        jail -rc -f "${JAIL_CONF}" ${jail}
-    fi
-done

usr/local/bin/bbsd-start

@@ -1,35 +0,0 @@
-#!/bin/sh
-# (christer.edwards@gmail.com)
-# start jail
-
-if [ $# -lt 1 ]; then
-    printf "Required: jail name(s)."
-    exit 1
-fi
-
-ARGS=$*
-
-for jail in ${ARGS}; do
-    PREFIX=/usr/local
-    PLATFORM=${PREFIX}/bastille
-    JAIL_BASE=${PLATFORM}/jails/${jail}
-
-    JAIL_ROOT=${JAIL_BASE}/root
-    JAIL_CONF=${JAIL_BASE}/jail.conf
-    PKGS_CONF=${JAIL_BASE}/pkgs.conf
-    JAIL_JID=${JAIL_BASE}/${jail}.jid
-
-    err_msg() {
-        printf "ERROR:\t$@\n"
-    }
-
-    if [ ! -d ${JAIL_ROOT} ]; then
-	err_msg "Jail (${jail}) does not exist(?)."
-    elif [ -d ${JAIL_ROOT} ]; then
-        jail -c -f "${JAIL_CONF}" -J "${JAIL_JID}" ${jail}
-        pfctl -f /etc/pf.conf
-        #if [ -s ${PKGS_CONF} ]; then
-        #    pkg -j ${jail} install -y $(cat ${PKGS_CONF})
-        #fi
-    fi
-done

usr/local/bin/bbsd-stop

@@ -1,32 +0,0 @@
-#!/bin/sh
-# (christer.edwards@gmail.com)
-# stop jail
-
-if [ $# -lt 1 ]; then
-    printf "Required: jail name(s)."
-    exit 1
-fi
-
-ARGS=$*
-
-for jail in ${ARGS}; do
-    PREFIX=/usr/local
-    PLATFORM=${PREFIX}/bastille
-    JAIL_BASE=${PLATFORM}/jails/${jail}
-
-    JAIL_ROOT=${JAIL_BASE}/root
-    JAIL_CONF=${JAIL_BASE}/jail.conf
-    PKGS_CONF=${JAIL_BASE}/pkgs.conf
-    JAIL_JID=${JAIL_BASE}/${jail}.jid
-
-    err_msg() {
-        printf "ERROR:\t$@\n"
-    }
-
-    if [ ! -d ${JAIL_ROOT} ]; then
-        err_msg "Jail (${jail}) does not exist(?)."
-    fi
-    if [ -d ${JAIL_ROOT} ]; then
-        jail -r -f ${JAIL_CONF} ${jail}
-    fi
-done

usr/local/bin/bbsd-top

@@ -1,5 +0,0 @@
-#!/bin/sh
-#
-# run top inside a jail
-
-/usr/bin/top -J $1

usr/local/etc/bastille/bastille.conf.sample

@@ -0,0 +1,43 @@
+#####################
+## [ BastilleBSD ] ##
+#####################
+
+## default paths
+bastille_prefix=/usr/local/bastille                                   ## default: "/usr/local/bastille"
+bastille_backupsdir=${bastille_prefix}/backups                        ## default: ${bastille_prefix}/backups
+bastille_cachedir=${bastille_prefix}/cache                            ## default: ${bastille_prefix}/cache
+bastille_jailsdir=${bastille_prefix}/jails                            ## default: ${bastille_prefix}/jails
+bastille_logsdir=${bastille_prefix}/logs                              ## default: ${bastille_prefix}/logs
+bastille_releasesdir=${bastille_prefix}/releases                      ## default: ${bastille_prefix}/releases
+bastille_templatesdir=${bastille_prefix}/templates                    ## default: ${bastille_prefix}/templates
+
+## bastille scripts directory (assumed by bastille pkg)
+bastille_sharedir=/usr/local/share/bastille                           ## default: "/usr/local/share/bastille"
+
+## bootstrap archives (base, lib32, ports, src, test)
+bastille_bootstrap_archives="base"                                    ## default: "base"
+
+## default timezone
+bastille_tzdata="etc/UTC"                                             ## default: "etc/UTC"
+
+## default jail resolv.conf
+bastille_resolv_conf="/etc/resolv.conf"                               ## default: "/etc/resolv.conf"
+
+## bootstrap urls
+bastille_url_freebsd="http://ftp.freebsd.org/pub/FreeBSD/releases/"          ## default: "http://ftp.freebsd.org/pub/FreeBSD/releases/"
+bastille_url_hardenedbsd="http://installer.hardenedbsd.org/pub/hardenedbsd/" ## default: "https://installer.hardenedbsd.org/pub/HardenedBSD/releases/"
+
+## ZFS options
+bastille_zfs_enable=""                                                ## default: ""
+bastille_zfs_zpool=""                                                 ## default: ""
+bastille_zfs_prefix="bastille"                                        ## default: "${bastille_zfs_zpool}/bastille"
+bastille_zfs_options="-o compress=lz4 -o atime=off"                   ## default: "-o compress=lz4 -o atime=off"
+
+## Export/Import options
+bastille_compress_xz_options="-0 -v"                                  ## default "-0 -v"
+bastille_decompress_xz_options="-c -d -v"                             ## default "-c -d -v"
+
+## Networking
+bastille_network_loopback="bastille0"                                 ## default: "bastille0"
+bastille_network_shared=""                                            ## default: ""
+bastille_network_gateway=""                                           ## default: ""

usr/local/etc/rc.d/bastille

@@ -1,8 +1,6 @@
 #!/bin/sh
 
-# $FreeBSD: $
-#
-# Bastille startup script
+# Bastille jail startup script
 #
 # PROVIDE: bastille
 # REQUIRE: LOGIN
@@ -12,54 +10,52 @@
 #
 # bastille_enable (bool):          Set to NO by default.
 #               Set it to YES to enable bastille.
-# bastille_list (string):        Set to "" by default.
+# bastille_list (string):        Set to "ALL" by default.
 #               Space separated list of jails to start.
 #
 
 . /etc/rc.subr
 
 name=bastille
-rcvar=bastille_enable
-
-load_rc_config ${name}
+rcvar=${name}_enable
 
 : ${bastille_enable:=NO}
-: ${bastille_list:=""}
+: ${bastille_list:="ALL"}
 
-start_cmd=bastille_start
-stop_cmd=bastille_stop
-
-start_command="/usr/local/bin/bbsd-start"
-stop_command="/usr/local/bin/bbsd-stop"
+command=/usr/local/bin/${name}
+start_cmd="bastille_start"
+stop_cmd="bastille_stop"
+restart_cmd="bastille_stop && bastille_start"
 
 bastille_start()
 {
-    if [ ! -n "${bastille_list}" ]; then
-        echo "${bastille_list} is undefined"
+    if [ -z "${bastille_list}" ]; then
+        echo "bastille_list is undefined"
         return 1
     fi
 
     local _jail
 
     for _jail in ${bastille_list}; do
-        echo "Starting Bastille Jail: ${_jail}"
-        ${start_command} ${_jail}
+        echo "Starting Bastille Container: ${_jail}"
+        ${command} start ${_jail}
     done
 }
 
 bastille_stop()
 {
-    if [ ! -n "${bastille_list}" ]; then
-        echo "${bastille_list} is undefined"
+    if [ -z "${bastille_list}" ]; then
+        echo "bastille_list is undefined"
         return 1
     fi
 
     local _jail
 
     for _jail in ${bastille_list}; do
-        echo "Stopping Bastille Jail: ${_jail}"
-        ${stop_command} ${_jail}
+        echo "Stopping Bastille Container: ${_jail}"
+        ${command} stop ${_jail}
     done
 }
 
+load_rc_config ${name}
 run_rc_command "$1"

usr/local/share/bastille/bootstrap.sh

@@ -0,0 +1,408 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille bootstrap [release|template] [update].${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+# Validate ZFS parameters first.
+if [ "${bastille_zfs_enable}" = "YES" ]; then
+    ## check for the ZFS pool and bastille prefix
+    if [ -z "${bastille_zfs_zpool}" ]; then
+        echo -e "${COLOR_RED}ERROR: Missing ZFS parameters, see bastille_zfs_zpool.${COLOR_RESET}"
+        exit 1
+    elif [ -z "${bastille_zfs_prefix}" ]; then
+        echo -e "${COLOR_RED}ERROR: Missing ZFS parameters, see bastille_zfs_prefix.${COLOR_RESET}"
+        exit 1
+    elif ! zfs list "${bastille_zfs_zpool}" > /dev/null 2>&1; then
+        echo -e "${COLOR_RED}ERROR: ${bastille_zfs_zpool} is not a ZFS pool.${COLOR_RESET}"
+        exit 1
+    fi
+
+    ## check for the ZFS dataset prefix if already exist
+	if [ -d "/${bastille_zfs_zpool}/${bastille_zfs_prefix}" ]; then
+        if ! zfs list "${bastille_zfs_zpool}/${bastille_zfs_prefix}" > /dev/null 2>&1; then
+            echo -e "${COLOR_RED}ERROR: ${bastille_zfs_zpool}/${bastille_zfs_prefix} is not a ZFS dataset.${COLOR_RESET}"
+            exit 1
+        fi
+    fi
+fi
+
+validate_release_url() {
+    ## check upstream url, else warn user
+    if [ -n "${NAME_VERIFY}" ]; then
+        RELEASE="${NAME_VERIFY}"
+        if ! fetch -qo /dev/null "${UPSTREAM_URL}/MANIFEST" 2>/dev/null; then
+            echo -e "${COLOR_RED}Unable to fetch MANIFEST, See 'bootstrap urls'.${COLOR_RESET}"
+            exit 1
+        fi
+        echo -e "${COLOR_GREEN}Bootstrapping ${PLATFORM_OS} distfiles...${COLOR_RESET}"
+        bootstrap_directories
+        bootstrap_release
+    else
+        usage
+    fi
+}
+
+bootstrap_directories() {
+    ## ensure required directories are in place
+
+    ## ${bastille_prefix}
+    if [ ! -d "${bastille_prefix}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ];then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_prefix}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}"
+                chmod 0750 "${bastille_prefix}"
+            fi
+        else
+            mkdir -p "${bastille_prefix}"
+            chmod 0750 "${bastille_prefix}"
+        fi
+    fi
+
+    ## ${bastille_backupsdir}
+    if [ ! -d "${bastille_backupsdir}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ];then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_backupsdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/backups"
+                chmod 0750 "${bastille_backupsdir}"
+            fi
+        else
+            mkdir -p "${bastille_backupsdir}"
+            chmod 0750 "${bastille_backupsdir}"
+        fi
+    fi
+
+    ## ${bastille_cachedir}
+    if [ ! -d "${bastille_cachedir}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_cachedir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache"
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_cachedir}/${RELEASE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}"
+            fi
+        else
+            mkdir -p "${bastille_cachedir}/${RELEASE}"
+        fi
+    ## create subsequent cache/XX.X-RELEASE datasets
+    elif [ ! -d "${bastille_cachedir}/${RELEASE}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_cachedir}/${RELEASE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}"
+            fi
+        else
+            mkdir -p "${bastille_cachedir}/${RELEASE}"
+        fi
+    fi
+
+    ## ${bastille_jailsdir}
+    if [ ! -d "${bastille_jailsdir}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_jailsdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails"
+            fi
+        else
+            mkdir -p "${bastille_jailsdir}"
+        fi
+    fi
+
+    ## ${bastille_logsdir}
+    if [ ! -d "${bastille_logsdir}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_logsdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/logs"
+            fi
+        else
+            mkdir -p "${bastille_logsdir}"
+        fi
+    fi
+
+    ## ${bastille_templatesdir}
+    if [ ! -d "${bastille_templatesdir}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_templatesdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/templates"
+            fi
+        else
+            mkdir -p "${bastille_templatesdir}"
+        fi
+    fi
+
+    ## ${bastille_releasesdir}
+    if [ ! -d "${bastille_releasesdir}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_releasesdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases"
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_releasesdir}/${RELEASE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"
+            fi
+        else
+            mkdir -p "${bastille_releasesdir}/${RELEASE}"
+        fi
+
+    ## create subsequent releases/XX.X-RELEASE datasets
+    elif [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_releasesdir}/${RELEASE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"
+            fi
+       else
+           mkdir -p "${bastille_releasesdir}/${RELEASE}"
+       fi
+    fi
+}
+
+bootstrap_release() {
+    ## if release exists quit, else bootstrap additional distfiles
+    if [ -f "${bastille_releasesdir}/${RELEASE}/COPYRIGHT" ]; then
+        ## check distfiles list and skip existing cached files
+        bastille_bootstrap_archives=$(echo "${bastille_bootstrap_archives}" | sed "s/base//")
+        bastille_cached_files=$(ls "${bastille_cachedir}/${RELEASE}" | grep -v "MANIFEST" | tr -d ".txz")
+        for distfile in ${bastille_cached_files}; do
+            bastille_bootstrap_archives=$(echo "${bastille_bootstrap_archives}" | sed "s/${distfile}//")
+        done
+
+        ## check if release already bootstrapped, else continue bootstrapping
+        if [ -z "${bastille_bootstrap_archives}" ]; then
+            echo -e "${COLOR_RED}Bootstrap appears complete.${COLOR_RESET}"
+            exit 1
+        else
+            echo -e "${COLOR_GREEN}Bootstrapping additional distfiles...${COLOR_RESET}"
+        fi
+    fi
+
+    for _archive in ${bastille_bootstrap_archives}; do
+        ## check if the dist files already exists then extract
+        FETCH_VALIDATION="0"
+        if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
+            echo -e "${COLOR_GREEN}Extracting ${PLATFORM_OS} ${RELEASE} ${_archive}.txz.${COLOR_RESET}"
+            if /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${_archive}.txz"; then
+                ## silence motd at container login
+                touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin"
+                touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin"
+            else
+                echo -e "${COLOR_RED}Failed to extract ${_archive}.txz.${COLOR_RESET}"
+                exit 1
+            fi
+        else
+            ## get the manifest for dist files checksum validation
+            if [ ! -f "${bastille_cachedir}/${RELEASE}/MANIFEST" ]; then
+                fetch "${UPSTREAM_URL}/MANIFEST" -o "${bastille_cachedir}/${RELEASE}/MANIFEST" || FETCH_VALIDATION="1"
+            fi
+
+            if [ "${FETCH_VALIDATION}" -ne "0" ]; then
+                ## perform cleanup only for stale/empty directories on failure
+                if [ "${bastille_zfs_enable}" = "YES" ]; then
+                    if [ -n "${bastille_zfs_zpool}" ]; then
+                        if [ ! "$(ls -A "${bastille_cachedir}/${RELEASE}")" ]; then
+                            zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}"
+                        fi
+                        if [ ! "$(ls -A "${bastille_releasesdir}/${RELEASE}")" ]; then
+                            zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"
+                        fi
+                        fi
+                    fi
+                    if [ -d "${bastille_cachedir}/${RELEASE}" ]; then
+                        if [ ! "$(ls -A "${bastille_cachedir}/${RELEASE}")" ]; then
+                            rm -rf "${bastille_cachedir}/${RELEASE}"
+                        fi
+                    fi
+                    if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
+                        if [ ! "$(ls -A "${bastille_releasesdir}/${RELEASE}")" ]; then
+                            rm -rf "${bastille_releasesdir}/${RELEASE}"
+                        fi
+                    fi
+                    echo -e "${COLOR_RED}Bootstrap failed.${COLOR_RESET}"
+                    exit 1
+                fi
+
+                ## fetch for missing dist files
+                if [ ! -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
+                    fetch "${UPSTREAM_URL}/${_archive}.txz" -o "${bastille_cachedir}/${RELEASE}/${_archive}.txz"
+                    if [ "$?" -ne 0 ]; then
+                        ## alert only if unable to fetch additional dist files
+                        echo -e "${COLOR_RED}Failed to fetch ${_archive}.txz.${COLOR_RESET}"
+                    fi
+                fi
+
+                ## compare checksums on the fetched dist files
+                if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
+                    SHA256_DIST=$(grep -w "${_archive}.txz" "${bastille_cachedir}/${RELEASE}/MANIFEST" | awk '{print $2}')
+                    SHA256_FILE=$(sha256 -q "${bastille_cachedir}/${RELEASE}/${_archive}.txz")
+                    if [ "${SHA256_FILE}" != "${SHA256_DIST}" ]; then
+                        echo -e "${COLOR_RED}Failed validation for ${_archive}.txz, please retry bootstrap!${COLOR_RESET}"
+                        rm "${bastille_cachedir}/${RELEASE}/${_archive}.txz"
+                        exit 1
+                    else
+                        echo -e "${COLOR_GREEN}Validated checksum for ${RELEASE}:${_archive}.txz.${COLOR_RESET}"
+                        echo -e "${COLOR_GREEN}MANIFEST:${SHA256_DIST}${COLOR_RESET}"
+                        echo -e "${COLOR_GREEN}DOWNLOAD:${SHA256_FILE}${COLOR_RESET}"
+                    fi
+                fi
+
+                ## extract the fetched dist files
+                if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
+                    echo -e "${COLOR_GREEN}Extracting ${PLATFORM_OS} ${RELEASE} ${_archive}.txz.${COLOR_RESET}"
+                    if /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${_archive}.txz"; then
+                        ## silence motd at container login
+                        touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin"
+                        touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin"
+                    else
+                        echo -e "${COLOR_RED}Failed to extract ${_archive}.txz.${COLOR_RESET}"
+                        exit 1
+                    fi
+                fi
+        fi
+    done
+    echo
+
+    echo -e "${COLOR_GREEN}Bootstrap successful.${COLOR_RESET}"
+    echo -e "${COLOR_GREEN}See 'bastille --help' for available commands.${COLOR_RESET}"
+    echo
+}
+
+bootstrap_template() {
+
+    ## ${bastille_templatesdir}
+    if [ ! -d "${bastille_templatesdir}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_templatesdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/templates"
+            fi
+        else
+            mkdir -p "${bastille_templatesdir}"
+        fi
+    fi
+
+    ## define basic variables
+    _url=${BASTILLE_TEMPLATE_URL}
+    _user=${BASTILLE_TEMPLATE_USER}
+    _repo=${BASTILLE_TEMPLATE_REPO}
+    _template=${bastille_templatesdir}/${_user}/${_repo}
+
+    ## support for non-git
+    if [ ! -x "$(which git)" ]; then
+        echo -e "${COLOR_RED}Git not found.${COLOR_RESET}"
+        echo -e "${COLOR_RED}Not yet implemented.${COLOR_RESET}"
+        exit 1
+    elif [ -x "$(which git)" ]; then
+        if [ ! -d "${_template}/.git" ]; then
+            $(which git) clone "${_url}" "${_template}" ||\
+                echo -e "${COLOR_RED}Clone unsuccessful.${COLOR_RESET}"
+        elif [ -d "${_template}/.git" ]; then
+            cd "${_template}" && $(which git) pull ||\
+                echo -e "${COLOR_RED}Template update unsuccessful.${COLOR_RESET}"
+        fi
+    fi
+
+    bastille verify "${_user}/${_repo}"
+}
+
+HW_MACHINE=$(sysctl hw.machine | awk '{ print $2 }')
+HW_MACHINE_ARCH=$(sysctl hw.machine_arch | awk '{ print $2 }')
+RELEASE="${1}"
+
+## Filter sane release names
+case "${1}" in
+*-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2)
+    ## check for FreeBSD releases name
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]')
+    UPSTREAM_URL="${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_VERIFY}"
+    PLATFORM_OS="FreeBSD"
+    validate_release_url
+    ;;
+*-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
+    ## check for HardenedBSD releases name(previous infrastructure, keep for reference)
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
+    UPSTREAM_URL="${bastille_url_hardenedbsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/hardenedbsd-${NAME_VERIFY}"
+    PLATFORM_OS="HardenedBSD"
+    validate_release_url
+    ;;
+*-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*)
+    ## check for HardenedBSD(specific stable build releases)
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
+    NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/-build-[0-9]\{1,3\}//g')
+    NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/[0-9]\{1,2\}-stable-//g')
+    UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    PLATFORM_OS="HardenedBSD"
+    validate_release_url
+    ;;
+*-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST)
+    ## check for HardenedBSD(latest stable build release)
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
+    NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/-BUILD-LATEST//g')
+    NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/[0-9]\{1,2\}-stable-//g')
+    UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    PLATFORM_OS="HardenedBSD"
+    validate_release_url
+    ;;
+current-build-[0-9]*|CURRENT-BUILD-[0-9]*)
+    ## check for HardenedBSD(specific current build releases)
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g')
+    NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/current-.*/current/g')
+    NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/current-//g')
+    UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    PLATFORM_OS="HardenedBSD"
+    validate_release_url
+    ;;
+current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
+    ## check for HardenedBSD(latest current build release)
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
+    NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/current-.*/current/g')
+    NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/current-//g')
+    UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    PLATFORM_OS="HardenedBSD"
+    validate_release_url
+    ;;
+http?://github.com/*/*|http?://gitlab.com/*/*)
+    BASTILLE_TEMPLATE_URL=${1}
+    BASTILLE_TEMPLATE_USER=$(echo "${1}" | awk -F / '{ print $4 }')
+    BASTILLE_TEMPLATE_REPO=$(echo "${1}" | awk -F / '{ print $5 }')
+    bootstrap_template
+    ;;
+*)
+    usage
+    ;;
+esac
+
+case "${2}" in
+update)
+    bastille update "${RELEASE}"
+    ;;
+esac

usr/local/share/bastille/clone.sh

@@ -0,0 +1,217 @@
+#!/bin/sh
+#
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+#
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille clone [TARGET] [NEW_NAME] [IPADRESS].${COLOR_RESET}"
+    exit 1
+}
+
+error_notify() {
+    # Notify message on error and exit
+    echo -e "$*" >&2
+    exit 1
+}
+
+# Handle special-case commands first
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -ne 3 ]; then
+    usage
+fi
+
+TARGET="${1}"
+NEWNAME="${2}"
+IP="${3}"
+shift
+
+validate_ip() {
+    IPX_ADDR="ip4.addr"
+    IP6_MODE="disable"
+    ip6=$(echo "${IP}" | grep -E '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$))')
+    if [ -n "${ip6}" ]; then
+        echo -e "${COLOR_GREEN}Valid: (${ip6}).${COLOR_RESET}"
+        IPX_ADDR="ip6.addr"
+        IP6_MODE="new"
+    else
+        local IFS
+        if echo "${IP}" | grep -Eq '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$'; then
+            TEST_IP=$(echo "${IP}" | cut -d / -f1)
+            IFS=.
+            set ${TEST_IP}
+            for quad in 1 2 3 4; do
+                if eval [ \$$quad -gt 255 ]; then
+                    echo "Invalid: (${TEST_IP})"
+                    exit 1
+                fi
+            done
+            if ifconfig | grep -qw "${TEST_IP}"; then
+                echo -e "${COLOR_YELLOW}Warning: ip address already in use (${TEST_IP}).${COLOR_RESET}"
+            else
+                echo -e "${COLOR_GREEN}Valid: (${IP}).${COLOR_RESET}"
+            fi
+        else
+            echo -e "${COLOR_RED}Invalid: (${IP}).${COLOR_RESET}"
+            exit 1
+        fi
+    fi
+}
+
+update_jailconf() {
+    # Update jail.conf
+    JAIL_CONFIG="${bastille_jailsdir}/${NEWNAME}/jail.conf"
+    if [ -f "${JAIL_CONFIG}" ]; then
+        if ! grep -qw "path = ${bastille_jailsdir}/${NEWNAME}/root;" "${JAIL_CONFIG}"; then
+            sed -i '' "s|host.hostname = ${TARGET};|host.hostname = ${NEWNAME};|" "${JAIL_CONFIG}"
+            sed -i '' "s|exec.consolelog = .*;|exec.consolelog = ${bastille_logsdir}/${NEWNAME}_console.log;|" "${JAIL_CONFIG}"
+            sed -i '' "s|path = .*;|path = ${bastille_jailsdir}/${NEWNAME}/root;|" "${JAIL_CONFIG}"
+            sed -i '' "s|mount.fstab = .*;|mount.fstab = ${bastille_jailsdir}/${NEWNAME}/fstab;|" "${JAIL_CONFIG}"
+            sed -i '' "s|${TARGET} {|${NEWNAME} {|" "${JAIL_CONFIG}"
+            sed -i '' "s|${IPX_ADDR} = .*;|${IPX_ADDR} = ${IP};|" "${JAIL_CONFIG}"
+        fi
+    fi
+
+    if grep -qw "vnet;" "${JAIL_CONFIG}"; then
+        update_jailconf_vnet
+    fi
+}
+
+update_jailconf_vnet() {
+    bastille_jail_rc_conf="${bastille_jailsdir}/${NEWNAME}/root/etc/rc.conf"
+
+    # Determine number of containers and define an uniq_epair
+    local list_jails_num=$(bastille list jails | wc -l | awk '{print $1}')
+    local num_range=$(expr "${list_jails_num}" + 1)
+    jail_list=$(bastille list jail)
+    for _num in $(seq 0 "${num_range}"); do
+        if [ -n "${jail_list}" ]; then
+            if ! grep -q "e0b_bastille${_num}" "${bastille_jailsdir}"/*/jail.conf; then
+                uniq_epair="bastille${_num}"
+                sed -i '' "s|vnet.interface = e0b_bastille.*;|vnet.interface = e0b_${uniq_epair};|" "${JAIL_CONFIG}"
+                break
+            fi
+        fi
+    done
+
+    # Rename interface to new uniq_epair
+    sed -i '' "s|ifconfig_e0b_bastille.*_name|ifconfig_e0b_${uniq_epair}_name|" "${bastille_jail_rc_conf}"
+
+    # If 0.0.0.0 set DHCP, else set static IP address
+    if [ "${IP}" == "0.0.0.0" ]; then
+        sysrc -f "${bastille_jail_rc_conf}" ifconfig_vnet0="DHCP"
+    else
+        sysrc -f "${bastille_jail_rc_conf}" ifconfig_vnet0="inet ${IP}"
+    fi
+}
+
+update_fstab() {
+    # Update fstab to use the new name
+    FSTAB_CONFIG="${bastille_jailsdir}/${NEWNAME}/fstab"
+    if [ -f "${FSTAB_CONFIG}" ]; then
+        FSTAB_RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])|([0-9]{1,2}-stable-build-[0-9]{1,3})|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)|(current-BUILD-LATEST)' "${FSTAB_CONFIG}")
+        FSTAB_CURRENT=$(grep -w ".*/releases/.*/jails/${TARGET}/root/.bastille" "${FSTAB_CONFIG}")
+        FSTAB_NEWCONF="${bastille_releasesdir}/${FSTAB_RELEASE} ${bastille_jailsdir}/${NEWNAME}/root/.bastille nullfs ro 0 0"
+        if [ -n "${FSTAB_CURRENT}" ] && [ -n "${FSTAB_NEWCONF}" ]; then
+            # If both variables are set, update as needed
+            if ! grep -qw "${bastille_releasesdir}/${FSTAB_RELEASE}.*${bastille_jailsdir}/${NEWNAME}/root/.bastille" "${FSTAB_CONFIG}"; then
+                sed -i '' "s|${FSTAB_CURRENT}|${FSTAB_NEWCONF}|" "${FSTAB_CONFIG}"
+            fi
+        fi
+    fi
+}
+
+clone_jail() {
+    # Attempt container clone
+    if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
+        echo -e "${COLOR_GREEN}Attempting to clone '${TARGET}' to ${NEWNAME}...${COLOR_RESET}"
+        if ! [ -d "${bastille_jailsdir}/${NEWNAME}" ]; then
+            if [ "${bastille_zfs_enable}" = "YES" ]; then
+                if [ -n "${bastille_zfs_zpool}" ]; then
+                    # Replicate the existing container
+                    DATE=$(date +%F-%H%M%S)
+                    zfs snapshot -r "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@bastille_clone_${DATE}"
+                    zfs send -R "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@bastille_clone_${DATE}" | zfs recv "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NEWNAME}"
+
+                    # Cleanup source temporary snapshots
+                    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}/root@bastille_clone_${DATE}"
+                    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@bastille_clone_${DATE}"
+
+                    # Cleanup target temporary snapshots
+                    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NEWNAME}/root@bastille_clone_${DATE}"
+                    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NEWNAME}@bastille_clone_${DATE}"
+                fi
+            else
+                # Just clone the jail directory
+                # Check if container is running
+                if [ -n "$(jls name | awk "/^${TARGET}$/")" ]; then
+                    error_notify "${COLOR_RED}${TARGET} is running, See 'bastille stop ${TARGET}'.${COLOR_RESET}"
+                fi
+
+                # Perform container file copy(archive mode)
+                cp -a "${bastille_jailsdir}/${TARGET}" "${bastille_jailsdir}/${NEWNAME}"
+            fi
+        else
+            error_notify "${COLOR_RED}${NEWNAME} already exists.${COLOR_RESET}"
+        fi
+    else
+        error_notify "${COLOR_RED}${TARGET} not found. See bootstrap.${COLOR_RESET}"
+    fi
+
+    # Generate jail configuration files
+    update_jailconf
+    update_fstab
+
+    # Display the exist status
+    if [ "$?" -ne 0 ]; then
+        error_notify "${COLOR_RED}An error has occurred while attempting to clone '${TARGET}'.${COLOR_RESET}"
+    else
+        echo -e "${COLOR_GREEN}Cloned '${TARGET}' to '${NEWNAME}' successfully.${COLOR_RESET}"
+    fi
+}
+
+## don't allow for dots(.) in container names
+if echo "${NEWNAME}" | grep -q "[.]"; then
+    echo -e "${COLOR_RED}Container names may not contain a dot(.)!${COLOR_RESET}"
+    exit 1
+fi
+
+## check if ip address is valid
+if [ -n "${IP}" ]; then
+    validate_ip
+else
+    usage
+fi
+
+clone_jail

usr/local/share/bastille/cmd.sh

@@ -0,0 +1,63 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille cmd TARGET command.${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -lt 2 ]; then
+    usage
+fi
+
+TARGET="${1}"
+shift
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+fi
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+fi
+
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    jexec -l "${_jail}" "$@"
+    echo
+done

usr/local/share/bastille/colors.pre.sh

@@ -0,0 +1,58 @@
+#!/bin/sh
+# 
+# Copyright (c) 2014-2015 Bryan Drewery <bdrewery@FreeBSD.org>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+
+COLOR_RESET="\033[0;0m"
+COLOR_BOLD="\033[1m"
+COLOR_UNDER="\033[4m"
+COLOR_BLINK="\033[5m"
+COLOR_INVERSE="\033[7m"
+
+COLOR_BLACK="\033[0;30m"
+COLOR_RED="\033[0;31m"
+COLOR_GREEN="\033[0;32m"
+COLOR_BROWN="\033[0;33m"
+COLOR_BLUE="\033[0;34m"
+COLOR_MAGENTA="\033[0;35m"
+COLOR_CYAN="\033[0;36m"
+COLOR_LIGHT_GRAY="\033[0;37m"
+
+COLOR_DARK_GRAY="\033[1;30m"
+COLOR_LIGHT_RED="\033[1;31m"
+COLOR_LIGHT_GREEN="\033[1;32m"
+COLOR_YELLOW="\033[1;33m"
+COLOR_LIGHT_BLUE="\033[1;34m"
+COLOR_LIGHT_MAGENTA="\033[1;35m"
+COLOR_LIGHT_CYAN="\033[1;36m"
+COLOR_WHITE="\033[1;37m"
+
+COLOR_BG_BLACK="\033[40m"
+COLOR_BG_RED="\033[41m"
+COLOR_BG_GREEN="\033[42m"
+COLOR_BG_BROWN="\033[43m"
+COLOR_BG_BLUE="\033[44m"
+COLOR_BG_MAGENTA="\033[45m"
+COLOR_BG_CYAN="\033[46m"
+COLOR_BG_LIGHT_GRAY="\033[47m"

usr/local/share/bastille/console.sh

@@ -0,0 +1,85 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille console TARGET [user]'.${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 2 ] || [ $# -lt 1 ]; then
+    usage
+fi
+
+TARGET="${1}"
+shift
+USER="${1}"
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+fi
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+fi
+
+validate_user() {
+    if jexec -l "${_jail}" id "${USER}" >/dev/null 2>&1; then
+        USER_SHELL="$(jexec -l "${_jail}" getent passwd "${USER}" | cut -d: -f7)"
+        if [ -n "${USER_SHELL}" ]; then
+            if jexec -l "${_jail}" grep -qwF "${USER_SHELL}" /etc/shells; then
+                jexec -l "${_jail}" /usr/bin/login -f "${USER}"
+            else
+                echo "Invalid shell for user ${USER}"
+            fi
+        else
+            echo "User ${USER} has no shell"
+        fi
+    else
+        echo "Unknown user ${USER}"
+    fi
+}
+
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    if [ -n "${USER}" ]; then
+        validate_user
+    else
+        jexec -l "${_jail}" /usr/bin/login -f root
+    fi
+    echo
+done

usr/local/share/bastille/convert.sh

@@ -0,0 +1,163 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille convert TARGET.${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 1 ] || [ $# -lt 1 ]; then
+    usage
+fi
+
+TARGET="${1}"
+shift
+
+error_notify()
+{
+    # Notify message on error and exit
+    echo -e "$*" >&2
+    exit 1
+}
+
+convert_symlinks() {
+    # Work with the symlinks, revert on first cp error
+    if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
+        # Retrieve old symlinks temporarily
+        for _link in ${SYMLINKS}; do
+            if [ -L "${_link}" ]; then
+                mv "${_link}" "${_link}.old"
+            fi
+        done
+
+        # Copy new files to destination jail
+        for _link in ${SYMLINKS}; do
+            if [ ! -d "${_link}" ]; then
+                if [ -d "${bastille_releasesdir}/${RELEASE}/${_link}" ]; then
+                    cp -a "${bastille_releasesdir}/${RELEASE}/${_link}" "${bastille_jailsdir}/${TARGET}/root/${_link}"
+                fi
+                if [ "$?" -ne 0 ]; then
+                    revert_convert
+                fi
+            fi
+        done
+
+        # Remove the old symlinks on success
+        for _link in ${SYMLINKS}; do
+            if [ -L "${_link}.old" ]; then
+                rm -r "${_link}.old"
+            fi
+        done
+    else
+        error_notify "${COLOR_RED}Release must be bootstrapped first, See 'bastille bootstrap'.${COLOR_RESET}"
+    fi
+}
+
+revert_convert() {
+    # Revert the conversion on first cp error
+    echo -e "${COLOR_RED}A problem has occurred while copying the files, reverting changes...${COLOR_RESET}"
+    for _link in ${SYMLINKS}; do
+        if [ -d "${_link}" ]; then
+            chflags -R noschg "${bastille_jailsdir}/${TARGET}/root/${_link}"
+            rm -rf "${bastille_jailsdir}/${TARGET}/root/${_link}"
+        fi
+    done
+
+    # Restore previous symlinks
+    for _link in ${SYMLINKS}; do
+        if [ -L "${_link}.old" ]; then
+            mv "${_link}.old" "${_link}"
+        fi
+    done
+    error_notify "${COLOR_GREEN}Changes for '${TARGET}' has been reverted.${COLOR_RESET}"
+}
+
+start_convert() {
+    # Attempt container conversion and handle some errors
+    if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
+        echo -e "${COLOR_GREEN}Converting '${TARGET}' into a thickjail, this may take a while...${COLOR_RESET}"
+
+        # Set some variables
+        RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])|([0-9]{1,2}-stable-build-[0-9]{1,3})|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)|(current-BUILD-LATEST)' "${bastille_jailsdir}/${TARGET}/fstab")
+        FSTABMOD=$(grep -w "${bastille_releasesdir}/${RELEASE} ${bastille_jailsdir}/${TARGET}/root/.bastille" "${bastille_jailsdir}/${TARGET}/fstab")
+        SYMLINKS="bin boot lib libexec rescue sbin usr/bin usr/include usr/lib usr/lib32 usr/libdata usr/libexec usr/ports usr/sbin usr/share usr/src"
+
+        if [ -n "${RELEASE}" ]; then
+            cd "${bastille_jailsdir}/${TARGET}/root"
+
+            # Work with the symlinks
+            convert_symlinks
+
+            # Comment the line containing .bastille and rename mountpoint
+            sed -i '' -E "s|${FSTABMOD}|# Converted from thin to thick container on $(date)|g" "${bastille_jailsdir}/${TARGET}/fstab"
+            mv "${bastille_jailsdir}/${TARGET}/root/.bastille" "${bastille_jailsdir}/${TARGET}/root/.bastille.old"
+
+            echo -e "${COLOR_GREEN}Conversion of '${TARGET}' completed successfully!${COLOR_RESET}"
+            exit 0
+        else
+            error_notify "${COLOR_RED}Can't determine release version, See 'bastille bootstrap'.${COLOR_RESET}"
+        fi
+    else
+        error_notify "${COLOR_RED}${TARGET} not found. See 'bastille create'.${COLOR_RESET}"
+    fi
+}
+
+# Check if container is running
+if [ -n "$(jls name | awk "/^${TARGET}$/")" ]; then
+    error_notify "${COLOR_RED}${TARGET} is running, See 'bastille stop'.${COLOR_RESET}"
+fi
+
+# Check if is a thin container
+if [ ! -d "${bastille_jailsdir}/${TARGET}/root/.bastille" ]; then
+    error_notify "${COLOR_RED}${TARGET} is not a thin container.${COLOR_RESET}"
+elif ! grep -qw ".bastille" "${bastille_jailsdir}/${TARGET}/fstab"; then
+    error_notify "${COLOR_RED}${TARGET} is not a thin container.${COLOR_RESET}"
+fi
+
+# Make sure the user agree with the conversion
+# Be interactive here since this cannot be easily undone
+while :; do
+    echo -e "${COLOR_RED}Warning: container conversion from thin to thick can't be undone!${COLOR_RESET}"
+    read -p "Do you really wish to convert '${TARGET}' into a thick container? [y/N]:" yn
+    case ${yn} in
+    [Yy]) start_convert;;
+    [Nn]) exit 0;;
+    esac
+done

usr/local/share/bastille/cp.sh

@@ -0,0 +1,66 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille cp TARGET HOST_PATH CONTAINER_PATH${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 3 ] || [ $# -lt 3 ]; then
+    usage
+fi
+
+TARGET="${1}"
+CPSOURCE="${2}"
+CPDEST="${3}"
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+fi
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+fi
+
+for _jail in ${JAILS}; do
+    bastille_jail_path="$(jls -j "${_jail}" path)"
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    cp -av "${CPSOURCE}" "${bastille_jail_path}/${CPDEST}"
+    echo
+done

usr/local/share/bastille/create.sh

@@ -0,0 +1,487 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille create [option] name release ip [interface].${COLOR_RESET}"
+    exit 1
+}
+
+running_jail() {
+    if [ -n "$(jls name | awk "/^${NAME}$/")" ]; then
+        echo -e "${COLOR_RED}A running jail matches name.${COLOR_RESET}"
+        exit 1
+    elif [ -d "${bastille_jailsdir}/${NAME}" ]; then
+        echo -e "${COLOR_RED}Jail: ${NAME} already created.${COLOR_RESET}"
+        exit 1
+    fi
+}
+
+validate_ip() {
+    IPX_ADDR="ip4.addr"
+    IP6_MODE="disable"
+    ip6=$(echo "${IP}" | grep -E '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$))')
+    if [ -n "${ip6}" ]; then
+        echo -e "${COLOR_GREEN}Valid: (${ip6}).${COLOR_RESET}"
+        IPX_ADDR="ip6.addr"
+        IP6_MODE="new"
+    else
+        local IFS
+        if echo "${IP}" | grep -Eq '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$'; then
+            TEST_IP=$(echo "${IP}" | cut -d / -f1)
+            IFS=.
+            set ${TEST_IP}
+            for quad in 1 2 3 4; do
+                if eval [ \$$quad -gt 255 ]; then
+                    echo "Invalid: (${TEST_IP})"
+                    exit 1
+                fi
+            done
+            if ifconfig | grep -qw "${TEST_IP}"; then
+                echo -e "${COLOR_YELLOW}Warning: ip address already in use (${TEST_IP}).${COLOR_RESET}"
+            else
+                echo -e "${COLOR_GREEN}Valid: (${IP}).${COLOR_RESET}"
+            fi
+        else
+            echo -e "${COLOR_RED}Invalid: (${IP}).${COLOR_RESET}"
+            exit 1
+        fi
+    fi
+}
+
+validate_netif() {
+    local LIST_INTERFACES=$(ifconfig -l)
+    if echo "${LIST_INTERFACES} VNET" | grep -qwo "${INTERFACE}"; then
+        echo -e "${COLOR_GREEN}Valid: (${INTERFACE}).${COLOR_RESET}"
+    else
+        echo -e "${COLOR_RED}Invalid: (${INTERFACE}).${COLOR_RESET}"
+        exit 1
+    fi
+}
+
+validate_netconf() {
+    if [ -n "${bastille_network_loopback}" ] && [ -n "${bastille_network_shared}" ]; then
+        echo -e "${COLOR_RED}Invalid network configuration.${COLOR_RESET}"
+        exit 1
+    fi
+}
+
+validate_release() {
+    ## check release name match, else show usage
+    if [ -n "${NAME_VERIFY}" ]; then
+        RELEASE="${NAME_VERIFY}"
+    else
+        usage
+    fi
+}
+
+generate_jail_conf() {
+    cat << EOF > "${bastille_jail_conf}"
+${NAME} {
+  devfs_ruleset = 4;
+  enforce_statfs = 2;
+  exec.clean;
+  exec.consolelog = ${bastille_jail_log};
+  exec.start = '/bin/sh /etc/rc';
+  exec.stop = '/bin/sh /etc/rc.shutdown';
+  host.hostname = ${NAME};
+  mount.devfs;
+  mount.fstab = ${bastille_jail_fstab};
+  path = ${bastille_jail_path};
+  securelevel = 2;
+
+  interface = ${bastille_jail_conf_interface};
+  ${IPX_ADDR} = ${IP};
+  ip6 = ${IP6_MODE};
+}
+EOF
+}
+
+generate_vnet_jail_conf() {
+    ## determine number of containers + 1
+    ## iterate num and grep all jail configs
+    ## define uniq_epair
+    local jail_list=$(bastille list jails)
+    if [ -n "${jail_list}" ]; then
+        local list_jails_num=$(echo "${jail_list}" | wc -l | awk '{print $1}')
+        local num_range=$(expr "${list_jails_num}" + 1)
+        for _num in $(seq 0 "${num_range}"); do
+            if ! grep -q "e0b_bastille${_num}" "${bastille_jailsdir}"/*/jail.conf; then
+                uniq_epair="bastille${_num}"
+                break
+            fi
+        done
+    else
+        uniq_epair="bastille0"
+    fi
+
+    ## generate config
+    cat << EOF > "${bastille_jail_conf}"
+${NAME} {
+  devfs_ruleset = 13;
+  enforce_statfs = 2;
+  exec.clean;
+  exec.consolelog = ${bastille_jail_log};
+  exec.start = '/bin/sh /etc/rc';
+  exec.stop = '/bin/sh /etc/rc.shutdown';
+  host.hostname = ${NAME};
+  mount.devfs;
+  mount.fstab = ${bastille_jail_fstab};
+  path = ${bastille_jail_path};
+  securelevel = 2;
+
+  vnet;
+  vnet.interface = e0b_${uniq_epair};
+  exec.prestart += "jib addm ${uniq_epair} ${INTERFACE}";
+  exec.poststop += "jib destroy ${uniq_epair}";
+}
+EOF
+}
+
+create_jail() {
+    bastille_jail_base="${bastille_jailsdir}/${NAME}/root/.bastille"  ## dir
+    bastille_jail_template="${bastille_jailsdir}/${NAME}/root/.template"  ## dir
+    bastille_jail_path="${bastille_jailsdir}/${NAME}/root"  ## dir
+    bastille_jail_fstab="${bastille_jailsdir}/${NAME}/fstab"  ## file
+    bastille_jail_conf="${bastille_jailsdir}/${NAME}/jail.conf"  ## file
+    bastille_jail_log="${bastille_logsdir}/${NAME}_console.log"  ## file
+    bastille_jail_rc_conf="${bastille_jailsdir}/${NAME}/root/etc/rc.conf" ## file
+    bastille_jail_resolv_conf="${bastille_jailsdir}/${NAME}/root/etc/resolv.conf" ## file
+
+    if [ ! -d "${bastille_jailsdir}/${NAME}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                ## create required zfs datasets, mountpoint inherited from system
+                zfs create ${bastille_zfs_options} "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}"
+                if [ -z "${THICK_JAIL}" ]; then
+                    zfs create ${bastille_zfs_options} "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root"
+                fi
+            fi
+        else
+            mkdir -p "${bastille_jailsdir}/${NAME}"
+        fi
+    fi
+
+    if [ ! -d "${bastille_jail_base}" ]; then
+        mkdir -p "${bastille_jail_base}"
+    fi
+
+    if [ ! -d "${bastille_jail_path}/usr/home" ]; then
+        mkdir -p "${bastille_jail_path}/usr/home"
+    fi
+
+    if [ ! -d "${bastille_jail_path}/usr/local" ]; then
+        mkdir -p "${bastille_jail_path}/usr/local"
+    fi
+
+    if [ ! -d "${bastille_jail_template}" ]; then
+        mkdir -p "${bastille_jail_template}"
+    fi
+
+    if [ ! -f "${bastille_jail_fstab}" ]; then
+        if [ -z "${THICK_JAIL}" ]; then
+            echo -e "${bastille_releasesdir}/${RELEASE} ${bastille_jail_base} nullfs ro 0 0" > "${bastille_jail_fstab}"
+        else
+            touch "${bastille_jail_fstab}"
+        fi
+    fi
+
+    if [ ! -f "${bastille_jail_conf}" ]; then
+        if [ -z "${bastille_network_loopback}" ] && [ -n "${bastille_network_shared}" ]; then
+            local bastille_jail_conf_interface=${bastille_network_shared}
+        fi
+        if [ -n "${bastille_network_loopback}" ] && [ -z "${bastille_network_shared}" ]; then
+            local bastille_jail_conf_interface=${bastille_network_loopback}
+        fi
+        if [ -n "${INTERFACE}" ]; then
+            local bastille_jail_conf_interface=${INTERFACE}
+        fi
+
+        ## generate the jail configuration file 
+        if [ -n "${VNET_JAIL}" ]; then
+            generate_vnet_jail_conf
+        else
+            generate_jail_conf
+        fi
+    fi
+
+    ## using relative paths here
+    ## MAKE SURE WE'RE IN THE RIGHT PLACE
+    cd "${bastille_jail_path}"
+    echo
+    echo -e "${COLOR_GREEN}NAME: ${NAME}.${COLOR_RESET}"
+    echo -e "${COLOR_GREEN}IP: ${IP}.${COLOR_RESET}"
+    if [ -n  "${INTERFACE}" ]; then
+        echo -e "${COLOR_GREEN}INTERFACE: ${INTERFACE}.${COLOR_RESET}"
+    fi
+    echo -e "${COLOR_GREEN}RELEASE: ${RELEASE}.${COLOR_RESET}"
+    echo
+
+    if [ -z "${THICK_JAIL}" ]; then
+        for _link in bin boot lib libexec rescue sbin usr/bin usr/include usr/lib usr/lib32 usr/libdata usr/libexec usr/sbin usr/share usr/src; do
+            ln -sf /.bastille/${_link} ${_link}
+        done
+    fi
+
+    ## link home properly
+    ln -s usr/home home
+
+    if [ -z "${THICK_JAIL}" ]; then
+        ## rw
+        ## copy only required files for thin jails
+        FILE_LIST=".cshrc .profile COPYRIGHT dev etc media mnt net proc root tmp var usr/obj usr/tests"
+        for files in ${FILE_LIST}; do
+            if [ -f "${bastille_releasesdir}/${RELEASE}/${files}" ] || [ -d "${bastille_releasesdir}/${RELEASE}/${files}" ]; then
+                cp -a "${bastille_releasesdir}/${RELEASE}/${files}" "${bastille_jail_path}/${files}"
+                if [ "$?" -ne 0 ]; then
+                    ## notify and clean stale files/directories
+                    echo -e "${COLOR_RED}Failed to copy release files, please retry create!${COLOR_RESET}"
+                    bastille destroy "${NAME}"
+                    exit 1
+                fi
+            fi
+        done
+    else
+        echo -e "${COLOR_GREEN}Creating a thickjail, this may take a while...${COLOR_RESET}"
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                ## perform release base replication
+
+                ## sane bastille zfs options 
+                ZFS_OPTIONS=$(echo ${bastille_zfs_options} | sed 's/-o//g')
+
+                ## take a temp snapshot of the base release
+                SNAP_NAME="bastille-$(date +%Y-%m-%d-%H%M%S)"
+                zfs snapshot "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"@"${SNAP_NAME}"
+
+                ## replicate the release base to the new thickjail and set the default mountpoint
+                zfs send -R "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"@"${SNAP_NAME}" | \
+                zfs receive "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root"
+                zfs set ${ZFS_OPTIONS} mountpoint=none "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root"
+                zfs inherit mountpoint "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root"
+
+                ## cleanup temp snapshots initially
+                zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"@"${SNAP_NAME}"
+                zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root"@"${SNAP_NAME}"
+
+                if [ "$?" -ne 0 ]; then
+                    ## notify and clean stale files/directories
+                    echo -e "${COLOR_RED}Failed release base replication, please retry create!${COLOR_RESET}"
+                    bastille destroy "${NAME}"
+                    exit 1
+                fi
+            fi
+        else
+            ## copy all files for thick jails
+            cp -a "${bastille_releasesdir}/${RELEASE}/" "${bastille_jail_path}"
+            if [ "$?" -ne 0 ]; then
+                ## notify and clean stale files/directories
+                echo -e "${COLOR_RED}Failed to copy release files, please retry create!${COLOR_RESET}"
+                bastille destroy "${NAME}"
+                exit 1
+            fi
+        fi
+    fi
+
+    ## rc.conf
+    ##  + syslogd_flags="-ss"
+    ##  + sendmail_none="NONE"
+    ##  + cron_flags="-J 60" ## cedwards 20181118
+    if [ ! -f "${bastille_jail_rc_conf}" ]; then
+        touch "${bastille_jail_rc_conf}"
+        sysrc -f "${bastille_jail_rc_conf}" syslogd_flags=-ss
+        sysrc -f "${bastille_jail_rc_conf}" sendmail_enable=NONE
+        sysrc -f "${bastille_jail_rc_conf}" cron_flags='-J 60'
+
+        ## VNET specific
+        if [ -n "${VNET_JAIL}" ]; then
+            ## rename interface to generic vnet0
+            uniq_epair=$(grep vnet.interface "${bastille_jailsdir}/${NAME}/jail.conf" | awk '{print $3}' | sed 's/;//')
+            /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" "ifconfig_${uniq_epair}_name"=vnet0
+
+            ## if 0.0.0.0 set DHCP
+            ## else set static address
+            if [ "${IP}" == "0.0.0.0" ]; then
+                /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" ifconfig_vnet0="DHCP"
+            else
+                /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" ifconfig_vnet0="inet ${IP}"
+                if [ -n "${bastille_network_gateway}" ]; then
+                    /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" defaultrouter="${bastille_network_gateway}"
+                else
+                    /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" defaultrouter="$(route show default | awk '/gateway/ {print $2}')"
+                fi
+            fi
+
+            ## VNET requires jib script
+            if [ ! "$(command -v jib)" ]; then
+                if [ -f /usr/share/examples/jails/jib ] && [ ! -f /usr/local/bin/jib ]; then
+                    install -m 0544 /usr/share/examples/jails/jib /usr/local/bin/jib
+                fi
+            fi
+        fi
+    fi
+
+    ## resolv.conf (default: copy from host)
+    if [ ! -f "${bastille_jail_resolv_conf}" ]; then
+        cp -L "${bastille_resolv_conf}" "${bastille_jail_resolv_conf}"
+    fi
+
+    ## TZ: configurable (default: etc/UTC)
+    ln -s "/usr/share/zoneinfo/${bastille_tzdata}" etc/localtime
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if echo "$3" | grep '@'; then
+    BASTILLE_JAIL_IP=$(echo "$3" | awk -F@ '{print $2}')
+    BASTILLE_JAIL_INTERFACES=$( echo "$3" | awk -F@ '{print $1}')
+fi
+
+## reset this options
+THICK_JAIL=""
+VNET_JAIL=""
+
+## handle combined options then shift
+if [ "${1}" = "-T" -o "${1}" = "--thick" -o "${1}" = "thick" ] && \
+    [ "${2}" = "-V" -o "${2}" = "--vnet" -o "${2}" = "vnet" ]; then
+    THICK_JAIL="1"
+    VNET_JAIL="1"
+    shift 2
+else
+    ## handle single options
+    case "${1}" in
+        -T|--thick|thick)
+            shift
+            THICK_JAIL="1"
+            ;;
+        -V|--vnet|vnet)
+            shift
+            VNET_JAIL="1"
+            ;;
+        -*)
+            echo -e "${COLOR_RED}Unknown Option.${COLOR_RESET}"
+            usage
+            ;;
+    esac
+fi
+
+NAME="$1"
+RELEASE="$2"
+IP="$3"
+INTERFACE="$4"
+
+if [ $# -gt 4 ] || [ $# -lt 3 ]; then
+    usage
+fi
+
+## don't allow for dots(.) in container names
+if echo "${NAME}" | grep -q "[.]"; then
+    echo -e "${COLOR_RED}Container names may not contain a dot(.)!${COLOR_RESET}"
+    exit 1
+fi
+
+## verify release
+case "${RELEASE}" in
+*-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2)
+    ## check for FreeBSD releases name
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]')
+    validate_release
+    ;;
+*-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
+    ## check for HardenedBSD releases name(previous infrastructure)
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
+    validate_release
+    ;;
+*-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*)
+    ## check for HardenedBSD(specific stable build releases)
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
+    validate_release
+    ;;
+*-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST)
+    ## check for HardenedBSD(latest stable build release)
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
+    validate_release
+    ;;
+current-build-[0-9]*|CURRENT-BUILD-[0-9]*)
+    ## check for HardenedBSD(specific current build releases)
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g')
+    validate_release
+    ;;
+current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
+    ## check for HardenedBSD(latest current build release)
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
+    validate_release
+    ;;
+*)
+    echo -e "${COLOR_RED}Unknown Release.${COLOR_RESET}"
+    usage
+    ;;
+esac
+
+## check for name/root/.bastille
+if [ -d "${bastille_jailsdir}/${NAME}/root/.bastille" ]; then
+    echo -e "${COLOR_RED}Jail: ${NAME} already created. ${NAME}/root/.bastille exists.${COLOR_RESET}"
+    exit 1
+fi
+
+## check for required release
+if [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then
+    echo -e "${COLOR_RED}Release must be bootstrapped first; see 'bastille bootstrap'.${COLOR_RESET}"
+    exit 1
+fi
+
+## check if a running jail matches name or already exist
+if [ -n "${NAME}" ]; then
+    running_jail
+fi
+
+## check if ip address is valid
+if [ -n "${IP}" ]; then
+    validate_ip
+else
+    usage
+fi
+
+## check if interface is valid
+if [ -n  "${INTERFACE}" ]; then
+    validate_netif
+    validate_netconf
+else
+    validate_netconf
+fi
+
+create_jail "${NAME}" "${RELEASE}" "${IP}" "${INTERFACE}"

usr/local/share/bastille/destroy.sh

@@ -0,0 +1,217 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille destroy [option] | [container|release]${COLOR_RESET}"
+    exit 1
+}
+
+destroy_jail() {
+    bastille_jail_base="${bastille_jailsdir}/${TARGET}"            ## dir
+    bastille_jail_log="${bastille_logsdir}/${TARGET}_console.log"  ## file
+
+    if [ "$(jls name | awk "/^${TARGET}$/")" ]; then
+        if [ "${FORCE}" = "1" ]; then
+            bastille stop "${TARGET}"
+        else
+            echo -e "${COLOR_RED}Jail running.${COLOR_RESET}"
+            echo -e "${COLOR_RED}See 'bastille stop ${TARGET}'.${COLOR_RESET}"
+            exit 1
+        fi
+    fi
+
+    if [ ! -d "${bastille_jail_base}" ]; then
+        echo -e "${COLOR_RED}Jail not found.${COLOR_RESET}"
+        exit 1
+    fi
+
+    if [ -d "${bastille_jail_base}" ]; then
+        echo -e "${COLOR_GREEN}Deleting Jail: ${TARGET}.${COLOR_RESET}"
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                if [ -n "${TARGET}" ]; then
+                    ## remove jail zfs dataset recursively
+                    zfs destroy -r "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}"
+                fi
+            fi
+        fi
+
+        if [ -d "${bastille_jail_base}" ]; then
+            ## removing all flags
+            chflags -R noschg "${bastille_jail_base}"
+
+            ## remove jail base
+            rm -rf "${bastille_jail_base}"
+        fi
+
+        ## archive jail log
+        if [ -f "${bastille_jail_log}" ]; then
+            mv "${bastille_jail_log}" "${bastille_jail_log}"-"$(date +%F)"
+            echo -e "${COLOR_GREEN}Note: jail console logs archived.${COLOR_RESET}"
+            echo -e "${COLOR_GREEN}${bastille_jail_log}-$(date +%F)${COLOR_RESET}"
+        fi
+
+        ## clear any active rdr rules
+        if [ ! -z "$(pfctl -a "rdr/${TARGET}" -Psn 2>/dev/null)" ]; then
+            echo -e "${COLOR_GREEN}Clearing RDR rules:${COLOR_RESET}"
+            pfctl -a "rdr/${TARGET}" -Fn
+        fi
+        echo
+    fi
+}
+
+destroy_rel() {
+    ## check release name match before destroy
+    if [ -n "${NAME_VERIFY}" ]; then
+        TARGET="${NAME_VERIFY}"
+    else
+        usage
+    fi
+
+    bastille_rel_base="${bastille_releasesdir}/${TARGET}"  ## dir
+
+    ## check if this release have containers child
+    BASE_HASCHILD="0"
+    if [ -d "${bastille_jailsdir}" ]; then
+        JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g")
+        for _jail in ${JAIL_LIST}; do
+            if grep -qwo "${TARGET}" "${bastille_jailsdir}/${_jail}/fstab" 2>/dev/null; then
+                echo -e "${COLOR_RED}Notice: (${_jail}) depends on ${TARGET} base.${COLOR_RESET}"
+                BASE_HASCHILD="1"
+            fi
+        done
+    fi
+
+    if [ ! -d "${bastille_rel_base}" ]; then
+        echo -e "${COLOR_RED}Release base not found.${COLOR_RESET}"
+        exit 1
+    else
+        if [ "${BASE_HASCHILD}" -eq "0" ]; then
+            echo -e "${COLOR_GREEN}Deleting base: ${TARGET}.${COLOR_RESET}"
+            if [ "${bastille_zfs_enable}" = "YES" ]; then
+                if [ -n "${bastille_zfs_zpool}" ]; then
+                    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${TARGET}"
+                    if [ "${FORCE}" = "1" ]; then
+                        if [ -d "${bastille_cachedir}/${TARGET}" ]; then
+                            zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${TARGET}"
+                        fi
+                    fi
+                fi
+            fi
+
+            if [ -d "${bastille_rel_base}" ]; then
+                ## removing all flags
+                chflags -R noschg "${bastille_rel_base}"
+
+                ## remove jail base
+                rm -rf "${bastille_rel_base}"
+            fi
+
+            if [ "${FORCE}" = "1" ]; then
+                ## remove cache on force
+                if [ -d "${bastille_cachedir}/${TARGET}" ]; then
+                    rm -rf "${bastille_cachedir}/${TARGET}"
+                fi
+            fi
+            echo
+        else
+            echo -e "${COLOR_RED}Cannot destroy base with containers child.${COLOR_RESET}"
+        fi
+    fi
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+## reset this options
+FORCE=""
+
+## handle additional options
+case "${1}" in
+    -f|--force|force)
+        FORCE="1"
+        shift
+        ;;
+    -*)
+        echo -e "${COLOR_RED}Unknown Option.${COLOR_RESET}"
+        usage
+        ;;
+esac
+
+TARGET="${1}"
+
+if [ $# -gt 1 ] || [ $# -lt 1 ]; then
+    usage
+fi
+
+## check what should we clean
+case "${TARGET}" in
+*-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2)
+    ## check for FreeBSD releases name
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]')
+    destroy_rel
+    ;;
+*-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
+    ## check for HardenedBSD releases name
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
+    destroy_rel
+    ;;
+*-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*)
+    ## check for HardenedBSD(specific stable build releases)
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
+    destroy_rel
+    ;;
+*-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST)
+    ## check for HardenedBSD(latest stable build release)
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
+    destroy_rel
+    ;;
+current-build-[0-9]*|CURRENT-BUILD-[0-9]*)
+    ## check for HardenedBSD(specific current build releases)
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g')
+    destroy_rel
+    ;;
+current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
+    ## check for HardenedBSD(latest current build release)
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(current-build-latest)$' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
+    destroy_rel
+    ;;
+*)
+    ## just destroy a jail
+    destroy_jail
+    ;;
+esac

usr/local/share/bastille/edit.sh

@@ -0,0 +1,72 @@
+#!/bin/sh
+#
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+#
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille edit TARGET [filename]${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 2 ] || [ $# -lt 1 ]; then
+    usage
+fi
+
+TARGET="${1}"
+if [ $# == 2 ]; then
+    TARGET_FILENAME="${2}"
+fi
+
+if [ -z "${EDITOR}" ]; then
+    EDITOR=vi
+fi
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(bastille list jails)
+fi
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(bastille list jails | awk "/^${TARGET}$/")
+fi
+
+for _jail in ${JAILS}; do
+    if [ -n "${TARGET_FILENAME}" ]; then
+        "${EDITOR}" "${bastille_jailsdir}/${_jail}/${TARGET_FILENAME}"
+    else
+        "${EDITOR}" "${bastille_jailsdir}/${_jail}/jail.conf"
+    fi
+done

usr/local/share/bastille/export.sh

@@ -0,0 +1,120 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille export TARGET.${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 1 ] || [ $# -lt 1 ]; then
+    usage
+fi
+
+TARGET="${1}"
+shift
+
+error_notify()
+{
+    # Notify message on error and exit
+    echo -e "$*" >&2
+    exit 1
+}
+
+jail_export()
+{
+    # Attempt to export the container
+    DATE=$(date +%F-%H%M%S)
+    if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                FILE_EXT="xz"
+                echo -e "${COLOR_GREEN}Exporting '${TARGET}' to a compressed .${FILE_EXT} archive.${COLOR_RESET}"
+                echo -e "${COLOR_GREEN}Sending zfs data stream...${COLOR_RESET}"
+                # Take a recursive temporary snapshot
+                zfs snapshot -r "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@bastille_export_${DATE}"
+
+                # Export the container recursively and cleanup temporary snapshots
+                zfs send -R "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@bastille_export_${DATE}" | \
+                xz ${bastille_compress_xz_options} > "${bastille_backupsdir}/${TARGET}_${DATE}.${FILE_EXT}"
+                zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}/root@bastille_export_${DATE}"
+                zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@bastille_export_${DATE}"
+            fi
+        else
+            # Create standard backup archive
+            FILE_EXT="txz"
+            echo -e "${COLOR_GREEN}Exporting '${TARGET}' to a compressed .${FILE_EXT} archive...${COLOR_RESET}"
+            cd "${bastille_jailsdir}" && tar -cf - "${TARGET}" | xz ${bastille_compress_xz_options} > "${bastille_backupsdir}/${TARGET}_${DATE}.${FILE_EXT}"
+        fi
+
+        if [ "$?" -ne 0 ]; then
+            error_notify "${COLOR_RED}Failed to export '${TARGET}' container.${COLOR_RESET}"
+        else
+            # Generate container checksum file
+            cd "${bastille_backupsdir}"
+            sha256 -q "${TARGET}_${DATE}.${FILE_EXT}" > "${TARGET}_${DATE}.sha256"
+            echo -e "${COLOR_GREEN}Exported '${bastille_backupsdir}/${TARGET}_${DATE}.${FILE_EXT}' successfully.${COLOR_RESET}"
+            exit 0
+        fi
+    else
+        error_notify "${COLOR_RED}Container '${TARGET}' does not exist.${COLOR_RESET}"
+    fi
+}
+
+# Check for user specified file location
+if echo "${TARGET}" | grep -q '\/'; then
+    GETDIR="${TARGET}"
+    TARGET=$(echo ${TARGET} | awk -F '\/' '{print $NF}')
+    bastille_backupsdir=$(echo ${GETDIR} | sed "s/${TARGET}//")
+fi
+
+# Check if backups directory/dataset exist
+if [ ! -d "${bastille_backupsdir}" ]; then
+    error_notify "${COLOR_RED}Backups directory/dataset does not exist, See 'bastille bootstrap'.${COLOR_RESET}"
+fi
+
+# Check if is a ZFS system
+if [ "${bastille_zfs_enable}" != "YES" ]; then
+    # Check if container is running and ask for stop in UFS systems
+    if [ -n "$(jls name | awk "/^${TARGET}$/")" ]; then
+        error_notify "${COLOR_RED}${TARGET} is running, See 'bastille stop'.${COLOR_RESET}"
+    fi
+fi
+
+jail_export

usr/local/share/bastille/htop.sh

@@ -0,0 +1,69 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille htop TARGET${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 1 ] || [ $# -lt 1 ]; then
+    usage
+fi
+
+TARGET="${1}"
+shift
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+fi
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+fi
+
+for _jail in ${JAILS}; do
+    bastille_jail_path=$(jls -j "${_jail}" path)
+    if [ ! -x "${bastille_jail_path}/usr/local/bin/htop" ]; then
+        echo -e "${COLOR_RED}htop not found on ${_jail}.${COLOR_RESET}"
+    elif [ -x "${bastille_jail_path}/usr/local/bin/htop" ]; then
+        echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+        jexec -l ${_jail} /usr/local/bin/htop
+    fi
+    echo -e "${COLOR_RESET}"
+done

usr/local/share/bastille/import.sh

@@ -0,0 +1,493 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille import file [option].${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 2 ] || [ $# -lt 1 ]; then
+    usage
+fi
+
+TARGET="${1}"
+OPTION="${2}"
+shift
+
+error_notify() {
+    # Notify message on error and exit
+    echo -e "$*" >&2
+    exit 1
+}
+
+validate_archive() {
+    # Compare checksums on the target archive
+    # Skip validation for unsupported archives
+    if [ "${FILE_EXT}" != ".tar.gz" ] && [ "${FILE_EXT}" != ".tar" ]; then
+        if [ -f "${bastille_backupsdir}/${TARGET}" ]; then
+            if [ -f "${bastille_backupsdir}/${FILE_TRIM}.sha256" ]; then
+                echo -e "${COLOR_GREEN}Validating file: ${TARGET}...${COLOR_RESET}"
+                SHA256_DIST=$(cat "${bastille_backupsdir}/${FILE_TRIM}.sha256")
+                SHA256_FILE=$(sha256 -q "${bastille_backupsdir}/${TARGET}")
+                if [ "${SHA256_FILE}" != "${SHA256_DIST}" ]; then
+                    error_notify "${COLOR_RED}Failed validation for ${TARGET}.${COLOR_RESET}"
+                else
+                    echo -e "${COLOR_GREEN}File validation successful!${COLOR_RESET}"
+                fi
+            else
+                # Check if user opt to force import
+                if [ "${OPTION}" = "-f" -o "${OPTION}" = "force" ]; then
+                    echo -e "${COLOR_YELLOW}Warning: Skipping archive validation!${COLOR_RESET}"
+                else
+                    error_notify "${COLOR_RED}Checksum file not found, See 'bastille import TARGET -f'${COLOR_RESET}"
+                fi
+            fi
+        fi
+    else
+        echo -e "${COLOR_YELLOW}Warning: Skipping archive validation!${COLOR_RESET}"
+    fi
+}
+
+update_zfsmount() {
+    # Update the mountpoint property on the received zfs data stream
+    OLD_ZFS_MOUNTPOINT=$(zfs get -H mountpoint "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root" | awk '{print $3}')
+    NEW_ZFS_MOUNTPOINT="${bastille_jailsdir}/${TARGET_TRIM}/root"
+    if [ "${NEW_ZFS_MOUNTPOINT}" != "${OLD_ZFS_MOUNTPOINT}" ]; then
+        echo -e "${COLOR_GREEN}Updating zfs mountpoint...${COLOR_RESET}"
+        zfs set mountpoint="${bastille_jailsdir}/${TARGET_TRIM}/root" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root"
+    fi
+
+    # Mount new container ZFS datasets
+    if ! zfs mount | grep -qw "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}$"; then
+        zfs mount "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}"
+    fi
+    if ! zfs mount | grep -qw "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root$"; then
+        zfs mount "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root"
+    fi
+}
+
+update_jailconf() {
+    # Update jail.conf paths
+    JAIL_CONFIG="${bastille_jailsdir}/${TARGET_TRIM}/jail.conf"
+    if [ -f "${JAIL_CONFIG}" ]; then
+        if ! grep -qw "path = ${bastille_jailsdir}/${TARGET_TRIM}/root;" "${JAIL_CONFIG}"; then
+            echo -e "${COLOR_GREEN}Updating jail.conf...${COLOR_RESET}"
+            sed -i '' "s|exec.consolelog.*= .*;|exec.consolelog = ${bastille_logsdir}/${TARGET_TRIM}_console.log;|" "${JAIL_CONFIG}"
+            sed -i '' "s|path.*= .*;|path = ${bastille_jailsdir}/${TARGET_TRIM}/root;|" "${JAIL_CONFIG}"
+            sed -i '' "s|mount.fstab.*= .*;|mount.fstab = ${bastille_jailsdir}/${TARGET_TRIM}/fstab;|" "${JAIL_CONFIG}"
+        fi
+    fi
+}
+
+update_fstab() {
+    # Update fstab .bastille mountpoint on thin containers only
+    # Set some variables
+    FSTAB_CONFIG="${bastille_jailsdir}/${TARGET_TRIM}/fstab"
+    FSTAB_RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])|([0-9]{1,2}-stable-build-[0-9]{1,3})|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)|(current-BUILD-LATEST)' "${FSTAB_CONFIG}")
+    FSTAB_CURRENT=$(grep -w ".*/releases/.*/jails/${TARGET_TRIM}/root/.bastille" "${FSTAB_CONFIG}")
+    FSTAB_NEWCONF="${bastille_releasesdir}/${FSTAB_RELEASE} ${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille nullfs ro 0 0"
+    if [ -n "${FSTAB_CURRENT}" ] && [ -n "${FSTAB_NEWCONF}" ]; then
+        # If both variables are set, compare and update as needed
+        if ! grep -qw "${bastille_releasesdir}/${FSTAB_RELEASE}.*${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille" "${FSTAB_CONFIG}"; then
+            echo -e "${COLOR_GREEN}Updating fstab...${COLOR_RESET}"
+            sed -i '' "s|${FSTAB_CURRENT}|${FSTAB_NEWCONF}|" "${FSTAB_CONFIG}"
+        fi
+    fi
+}
+
+generate_config() {
+    # Attempt to read previous config file and set required variables accordingly
+    # If we can't get a valid interface, fallback to lo1 and warn user
+    echo -e "${COLOR_GREEN}Generating jail.conf...${COLOR_RESET}"
+
+    if [ "${FILE_EXT}" = ".zip" ]; then
+        # Gather some bits from foreign/iocage config files
+        JSON_CONFIG="${bastille_jailsdir}/${TARGET_TRIM}/config.json"
+        if [ -n "${JSON_CONFIG}" ]; then
+            IPV4_CONFIG=$(grep -wo '\"ip4_addr\": \".*\"' "${JSON_CONFIG}" | tr -d '" ' | sed 's/ip4_addr://')
+            IPV6_CONFIG=$(grep -wo '\"ip6_addr\": \".*\"' "${JSON_CONFIG}" | tr -d '" ' | sed 's/ip6_addr://')
+        fi
+    elif [ "${FILE_EXT}" = ".tar.gz" ]; then
+        # Gather some bits from foreign/ezjail config files
+        PROP_CONFIG="${bastille_jailsdir}/${TARGET_TRIM}/prop.ezjail-${FILE_TRIM}-*"
+        if [ -n "${PROP_CONFIG}" ]; then
+            IPVX_CONFIG=$(grep -wo "jail_${TARGET_TRIM}_ip=.*" ${PROP_CONFIG} | tr -d '" ' | sed "s/jail_${TARGET_TRIM}_ip=//")
+        fi
+    fi
+
+    # If there are multiple IP/NIC let the user configure network
+    if [ -n "${IPV4_CONFIG}" ]; then
+        if ! echo "${IPV4_CONFIG}" | grep -q '.*,.*'; then
+            NETIF_CONFIG=$(echo "${IPV4_CONFIG}" | grep '.*|' | sed 's/|.*//g')
+            if [ -z "${NETIF_CONFIG}" ]; then
+                config_netif
+            fi
+            IPX_ADDR="ip4.addr"
+            IP_CONFIG="${IPV4_CONFIG}"
+            IP6_MODE="disable"
+        fi
+    elif [ -n "${IPV6_CONFIG}" ]; then
+        if ! echo "${IPV6_CONFIG}" | grep -q '.*,.*'; then
+            NETIF_CONFIG=$(echo "${IPV6_CONFIG}" | grep '.*|' | sed 's/|.*//g')
+            if [ -z "${NETIF_CONFIG}" ]; then
+                config_netif
+            fi
+            IPX_ADDR="ip6.addr"
+            IP_CONFIG="${IPV6_CONFIG}"
+            IP6_MODE="new"
+        fi
+    elif [ -n "${IPVX_CONFIG}" ]; then
+        if ! echo "${IPVX_CONFIG}" | grep -q '.*,.*'; then
+            NETIF_CONFIG=$(echo "${IPVX_CONFIG}" | grep '.*|' | sed 's/|.*//g')
+            if [ -z "${NETIF_CONFIG}" ]; then
+                config_netif
+            fi
+            IPX_ADDR="ip4.addr"
+            IP_CONFIG="${IPVX_CONFIG}"
+            IP6_MODE="disable"
+            if echo "${IPVX_CONFIG}" | sed 's/.*|//' | grep -Eq '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$))'; then
+                IPX_ADDR="ip6.addr"
+                IP6_MODE="new"
+            fi
+        fi
+    fi
+
+    # Let the user configure network manually
+    if [ -z "${NETIF_CONFIG}" ]; then
+        NETIF_CONFIG="lo1"
+        IPX_ADDR="ip4.addr"
+        IP_CONFIG="-"
+        IP6_MODE="disable"
+        echo -e "${COLOR_YELLOW}Warning: See 'bastille edit ${TARGET_TRIM} jail.conf' for manual network configuration${COLOR_RESET}"
+    fi
+
+    if [ "${FILE_EXT}" = ".tar.gz" ]; then
+        CONFIG_RELEASE=$(echo ${PROP_CONFIG} | grep -o '[0-9]\{2\}\.[0-9]_RELEASE' | sed 's/_/-/g')
+        if [ -z "${CONFIG_RELEASE}" ]; then
+            # Fallback to host version
+            CONFIG_RELEASE=$(freebsd-version | sed 's/\-[pP].*//')
+            echo -e "${COLOR_YELLOW}Warning: ${CONFIG_RELEASE} was set by default!${COLOR_RESET}"
+        fi
+        mkdir "${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille"
+        echo "${bastille_releasesdir}/${CONFIG_RELEASE} ${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille nullfs ro 0 0" \
+        >> "${bastille_jailsdir}/${TARGET_TRIM}/fstab"
+
+        # Work with the symlinks
+        cd "${bastille_jailsdir}/${TARGET_TRIM}/root"
+        update_symlinks
+    else
+        # Generate new empty fstab file
+        touch "${bastille_jailsdir}/${TARGET_TRIM}/fstab"
+    fi
+
+    # Generate a basic jail configuration file on foreign imports
+    cat << EOF > "${bastille_jailsdir}/${TARGET_TRIM}/jail.conf"
+${TARGET_TRIM} {
+  devfs_ruleset = 4;
+  enforce_statfs = 2;
+  exec.clean;
+  exec.consolelog = ${bastille_logsdir}/${TARGET_TRIM}_console.log;
+  exec.start = '/bin/sh /etc/rc';
+  exec.stop = '/bin/sh /etc/rc.shutdown';
+  host.hostname = ${TARGET_TRIM};
+  mount.devfs;
+  mount.fstab = ${bastille_jailsdir}/${TARGET_TRIM}/fstab;
+  path = ${bastille_jailsdir}/${TARGET_TRIM}/root;
+  securelevel = 2;
+
+  interface = ${NETIF_CONFIG};
+  ${IPX_ADDR} = ${IP_CONFIG};
+  ip6 = ${IP6_MODE};
+}
+EOF
+}
+
+update_config() {
+    # Update an existing jail configuration
+    # The config on select archives does not provide a clear way to determine
+    # the base release, so lets try to get it from the base/COPYRIGHT file,
+    # otherwise warn user and fallback to host system release
+    CONFIG_RELEASE=$(grep -wo 'releng/[0-9]\{2\}.[0-9]/COPYRIGHT' "${bastille_jailsdir}/${TARGET_TRIM}/root/COPYRIGHT" | sed 's|releng/||;s|/COPYRIGHT|-RELEASE|')
+    if [ -z "${CONFIG_RELEASE}" ]; then
+        # Fallback to host version
+        CONFIG_RELEASE=$(freebsd-version | sed 's/\-[pP].*//')
+        echo -e "${COLOR_YELLOW}Warning: ${CONFIG_RELEASE} was set by default!${COLOR_RESET}"
+    fi
+    mkdir "${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille"
+    echo "${bastille_releasesdir}/${CONFIG_RELEASE} ${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille nullfs ro 0 0" \
+    >> "${bastille_jailsdir}/${TARGET_TRIM}/fstab"
+
+    # Work with the symlinks
+    cd "${bastille_jailsdir}/${TARGET_TRIM}/root"
+    update_symlinks
+}
+
+workout_components() {
+    if [ "${FILE_EXT}" = ".tar" ]; then
+        # Workaround to determine the tarball path/components before extract(assumes path/jails/target)
+        JAIL_PATH=$(tar -tvf ${bastille_backupsdir}/${TARGET} | grep -wo "/.*/jails/${TARGET_TRIM}" | tail -n1)
+        JAIL_DIRS=$(echo ${JAIL_PATH} | grep -o '/' | wc -l)
+        DIRS_PLUS=$(expr ${JAIL_DIRS} + 1)
+
+        # Workaround to determine the jail.conf path before extract(assumes path/qjail.config/target)
+        JAIL_CONF=$(tar -tvf ${bastille_backupsdir}/${TARGET} | grep -wo "/.*/qjail.config/${TARGET_TRIM}")
+        CONF_TRIM=$(echo ${JAIL_CONF} | grep -o '/' | wc -l)
+    fi
+}
+
+config_netif() {
+    # Get interface from bastille configuration
+    if [ -n "${bastille_network_loopback}" ]; then
+        NETIF_CONFIG="${bastille_network_loopback}"
+    elif [ -n "${bastille_network_shared}" ]; then
+        NETIF_CONFIG="${bastille_network_shared}"
+    else
+        NETIF_CONFIG=
+    fi
+}
+
+update_symlinks() {
+    # Work with the symlinks
+    SYMLINKS="bin boot lib libexec rescue sbin usr/bin usr/include usr/lib usr/lib32 usr/libdata usr/libexec usr/ports usr/sbin usr/share usr/src"
+
+    # Just warn user to bootstrap the release if missing
+    if [ ! -d "${bastille_releasesdir}/${CONFIG_RELEASE}" ]; then
+        echo -e "${COLOR_YELLOW}Warning: ${CONFIG_RELEASE} must be bootstrapped, See 'bastille bootstrap'.${COLOR_RESET}"
+    fi
+
+    # Update old symlinks
+    echo -e "${COLOR_GREEN}Updating symlinks...${COLOR_RESET}"
+    for _link in ${SYMLINKS}; do
+        if [ -L "${_link}" ]; then
+            ln -sf /.bastille/${_link} ${_link}
+        fi
+    done
+}
+
+create_zfs_datasets() {
+    # Prepare the ZFS environment and restore from file
+    echo -e "${COLOR_GREEN}Importing '${TARGET_TRIM}' from foreign compressed ${FILE_EXT} archive.${COLOR_RESET}"
+    echo -e "${COLOR_GREEN}Preparing zfs environment...${COLOR_RESET}"
+
+    # Create required ZFS datasets, mountpoint inherited from system
+    zfs create ${bastille_zfs_options} "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}"
+    zfs create ${bastille_zfs_options} "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root"
+}
+
+remove_zfs_datasets() {
+    # Perform cleanup on failure
+    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root"
+    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}"
+    error_notify "${COLOR_RED}Failed to extract files from '${TARGET}' archive.${COLOR_RESET}"
+}
+
+jail_import() {
+    # Attempt to import container from file
+    FILE_TRIM=$(echo "${TARGET}" | sed 's/\.xz//g;s/\.txz//g;s/\.zip//g;s/\.tar\.gz//g;s/\.tar//g')
+    FILE_EXT=$(echo "${TARGET}" | sed "s/${FILE_TRIM}//g")
+    validate_archive
+    if [ -d "${bastille_jailsdir}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                if [ "${FILE_EXT}" = ".xz" ]; then
+                    # Import from compressed xz on ZFS systems
+                    echo -e "${COLOR_GREEN}Importing '${TARGET_TRIM}' from compressed ${FILE_EXT} archive.${COLOR_RESET}"
+                    echo -e "${COLOR_GREEN}Receiving zfs data stream...${COLOR_RESET}"
+                    xz ${bastille_decompress_xz_options} "${bastille_backupsdir}/${TARGET}" | \
+                    zfs receive -u "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}"
+
+                    # Update ZFS mountpoint property if required
+                    update_zfsmount
+
+                elif [ "${FILE_EXT}" = ".txz" ]; then
+                    # Prepare the ZFS environment and restore from existing .txz file
+                    create_zfs_datasets
+
+                    # Extract required files to the new datasets
+                    echo -e "${COLOR_GREEN}Extracting files from '${TARGET}' archive...${COLOR_RESET}"
+                    tar --exclude='root' -Jxf "${bastille_backupsdir}/${TARGET}" --strip-components 1 -C "${bastille_jailsdir}/${TARGET_TRIM}"
+                    tar -Jxf "${bastille_backupsdir}/${TARGET}" --strip-components 2 -C "${bastille_jailsdir}/${TARGET_TRIM}/root" "${TARGET_TRIM}/root"
+                    if [ "$?" -ne 0 ]; then
+                        remove_zfs_datasets
+                    fi
+                elif [ "${FILE_EXT}" = ".zip" ]; then
+                    # Attempt to import a foreign/iocage container
+                    echo -e "${COLOR_GREEN}Importing '${TARGET_TRIM}' from foreign compressed ${FILE_EXT} archive.${COLOR_RESET}"
+                    # Sane bastille zfs options
+                    ZFS_OPTIONS=$(echo ${bastille_zfs_options} | sed 's/-o//g')
+
+                    # Extract required files from the zip archive
+                    cd "${bastille_backupsdir}" && unzip -j "${TARGET}"
+                    if [ "$?" -ne 0 ]; then
+                        error_notify "${COLOR_RED}Failed to extract files from '${TARGET}' archive.${COLOR_RESET}"
+                        rm -f "${FILE_TRIM}" "${FILE_TRIM}_root"
+                    fi
+                    echo -e "${COLOR_GREEN}Receiving zfs data stream...${COLOR_RESET}"
+                    zfs receive -u "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}" < "${FILE_TRIM}"
+                    zfs set ${ZFS_OPTIONS} "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}"
+                    zfs receive -u "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root" < "${FILE_TRIM}_root"
+
+                    # Update ZFS mountpoint property if required
+                    update_zfsmount
+
+                    # Keep old configuration files for user reference
+                    if [ -f "${bastille_jailsdir}/${TARGET_TRIM}/fstab" ]; then
+                        mv "${bastille_jailsdir}/${TARGET_TRIM}/fstab" "${bastille_jailsdir}/${TARGET_TRIM}/fstab.old"
+                    fi
+
+                    # Cleanup unwanted files
+                    rm -f "${FILE_TRIM}" "${FILE_TRIM}_root"
+
+                    # Generate fstab and jail.conf files
+                    generate_config
+                elif [ "${FILE_EXT}" = ".tar.gz" ]; then
+                    # Attempt to import a foreign/ezjail container
+                    # Prepare the ZFS environment and restore from existing .tar.gz file
+                    create_zfs_datasets
+
+                    # Extract required files to the new datasets
+                    echo -e "${COLOR_GREEN}Extracting files from '${TARGET}' archive...${COLOR_RESET}"
+                    tar --exclude='ezjail/' -xf "${bastille_backupsdir}/${TARGET}" -C "${bastille_jailsdir}/${TARGET_TRIM}"
+                    tar -xf "${bastille_backupsdir}/${TARGET}" --strip-components 1 -C "${bastille_jailsdir}/${TARGET_TRIM}/root"
+                    if [ "$?" -ne 0 ]; then
+                        remove_zfs_datasets
+                    else
+                        generate_config
+                    fi
+                elif [ "${FILE_EXT}" = ".tar" ]; then
+                    # Attempt to import a foreign/qjail container
+                    # Prepare the ZFS environment and restore from existing .tar file
+                    create_zfs_datasets
+                    workout_components
+
+                    # Extract required files to the new datasets
+                    echo -e "${COLOR_GREEN}Extracting files from '${TARGET}' archive...${COLOR_RESET}"
+                    tar -xf "${bastille_backupsdir}/${TARGET}" --strip-components "${CONF_TRIM}" -C "${bastille_jailsdir}/${TARGET_TRIM}" "${JAIL_CONF}"
+                    tar -xf "${bastille_backupsdir}/${TARGET}" --strip-components "${DIRS_PLUS}" -C "${bastille_jailsdir}/${TARGET_TRIM}/root" "${JAIL_PATH}"
+                    if [ -f "${bastille_jailsdir}/${TARGET_TRIM}/${TARGET_TRIM}" ]; then
+                        mv "${bastille_jailsdir}/${TARGET_TRIM}/${TARGET_TRIM}" "${bastille_jailsdir}/${TARGET_TRIM}/jail.conf"
+                    fi
+
+                    if [ "$?" -ne 0 ]; then
+                        remove_zfs_datasets
+                    else
+                        update_config
+                    fi
+                else
+                    error_notify "${COLOR_RED}Unknown archive format.${COLOR_RESET}"
+                fi
+            fi
+        else
+            # Import from standard supported archives on UFS systems
+            if [ "${FILE_EXT}" = ".txz" ]; then
+                echo -e "${COLOR_GREEN}Extracting files from '${TARGET}' archive...${COLOR_RESET}"
+                tar -Jxf  "${bastille_backupsdir}/${TARGET}" -C "${bastille_jailsdir}"
+            elif [ "${FILE_EXT}" = ".tar.gz" ]; then
+                # Attempt to import/configure foreign/ezjail container
+                echo -e "${COLOR_GREEN}Extracting files from '${TARGET}' archive...${COLOR_RESET}"
+                mkdir "${bastille_jailsdir}/${TARGET_TRIM}"
+                tar -xf "${bastille_backupsdir}/${TARGET}" -C "${bastille_jailsdir}/${TARGET_TRIM}"
+                mv "${bastille_jailsdir}/${TARGET_TRIM}/ezjail" "${bastille_jailsdir}/${TARGET_TRIM}/root"
+                generate_config
+            elif [ "${FILE_EXT}" = ".tar" ]; then
+                # Attempt to import/configure foreign/qjail container
+                echo -e "${COLOR_GREEN}Extracting files from '${TARGET}' archive...${COLOR_RESET}"
+                mkdir -p "${bastille_jailsdir}/${TARGET_TRIM}/root"
+                workout_components
+                tar -xf "${bastille_backupsdir}/${TARGET}" --strip-components "${CONF_TRIM}" -C "${bastille_jailsdir}/${TARGET_TRIM}" "${JAIL_CONF}"
+                tar -xf "${bastille_backupsdir}/${TARGET}" --strip-components "${DIRS_PLUS}" -C "${bastille_jailsdir}/${TARGET_TRIM}/root" "${JAIL_PATH}"
+                if [ -f "${bastille_jailsdir}/${TARGET_TRIM}/${TARGET_TRIM}" ]; then
+                    mv "${bastille_jailsdir}/${TARGET_TRIM}/${TARGET_TRIM}" "${bastille_jailsdir}/${TARGET_TRIM}/jail.conf"
+                fi
+                update_config
+            else
+                error_notify "${COLOR_RED}Unsupported archive format.${COLOR_RESET}"
+            fi
+        fi
+
+        if [ "$?" -ne 0 ]; then
+            error_notify "${COLOR_RED}Failed to import from '${TARGET}' archive.${COLOR_RESET}"
+        else
+            # Update the jail.conf and fstab if required
+            # This is required on foreign imports only
+            update_jailconf
+            update_fstab
+            echo -e "${COLOR_GREEN}Container '${TARGET_TRIM}' imported successfully.${COLOR_RESET}"
+            exit 0
+        fi
+    else
+        error_notify "${COLOR_RED}Jails directory/dataset does not exist, See 'bastille bootstrap'.${COLOR_RESET}"
+    fi
+}
+
+# Check for user specified file location
+if echo "${TARGET}" | grep -q '\/'; then
+    GETDIR="${TARGET}"
+    TARGET=$(echo ${TARGET} | awk -F '\/' '{print $NF}')
+    bastille_backupsdir=$(echo ${GETDIR} | sed "s/${TARGET}//")
+fi
+
+# Check if backups directory/dataset exist
+if [ ! -d "${bastille_backupsdir}" ]; then
+    error_notify "${COLOR_RED}Backups directory/dataset does not exist, See 'bastille bootstrap'.${COLOR_RESET}"
+fi
+
+# Check if archive exist then trim archive name
+if [ -f "${bastille_backupsdir}/${TARGET}" ]; then
+    # Filter unsupported/unknown archives 
+    if echo "${TARGET}" | grep -q '_[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}-[0-9]\{6\}.xz$\|_[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}-[0-9]\{6\}.txz$\|_[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}.zip$\|-[0-9]\{12\}.[0-9]\{2\}.tar.gz$\|@[0-9]\{12\}.[0-9]\{2\}.tar$'; then
+        if ls "${bastille_backupsdir}" | awk "/^${TARGET}$/" >/dev/null; then
+            TARGET_TRIM=$(echo "${TARGET}" | sed "s/_[0-9]*-[0-9]*-[0-9]*-[0-9]*.xz//;s/_[0-9]*-[0-9]*-[0-9]*-[0-9]*.txz//;s/_[0-9]*-[0-9]*-[0-9]*.zip//;s/-[0-9]\{12\}.[0-9]\{2\}.tar.gz//;s/@[0-9]\{12\}.[0-9]\{2\}.tar//")
+        fi
+    else
+        error_notify "${COLOR_RED}Unrecognized archive name.${COLOR_RESET}"
+    fi
+else
+    error_notify "${COLOR_RED}Archive '${TARGET}' not found.${COLOR_RESET}"
+fi
+
+# Check if a running jail matches name or already exist
+if [ -n "$(jls name | awk "/^${TARGET_TRIM}$/")" ]; then
+    error_notify "${COLOR_RED}A running jail matches name.${COLOR_RESET}"
+elif [ -d "${bastille_jailsdir}/${TARGET_TRIM}" ]; then
+    error_notify "${COLOR_RED}Container: ${TARGET_TRIM} already exist.${COLOR_RESET}"
+fi
+
+jail_import

usr/local/share/bastille/limits.sh

@@ -0,0 +1,74 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# Ressource limits added by Sven R github.com/hackacad
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille limits TARGET option value${COLOR_RESET}"
+    echo -e "Example: bastille limits JAILNAME memoryuse 1G"
+    exit 1
+}
+
+RACCT_ENABLE=$(sysctl -n kern.racct.enable)
+if [ "${RACCT_ENABLE}" != '1' ]; then
+    echo "Racct not enabled. Append 'kern.racct.enable=1' to /boot/loader.conf and reboot"
+fi
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -lt 2 ]; then
+    usage
+fi
+
+TARGET="${1}"
+OPTION="${2}"
+VALUE="${3}"
+shift
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+fi
+
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+fi
+
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    echo -e "${TYPE} ${VALUE}"
+    rctl -a jail:"${_jail}":"${OPTION}":deny="${VALUE}/jail"
+    echo -e "${COLOR_RESET}"
+done

usr/local/share/bastille/list.sh

@@ -0,0 +1,91 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille list [-j] [release|template|(jail|container)|log|limit|(import|export|backup)].${COLOR_RESET}"
+    exit 1
+}
+
+if [ $# -eq 0 ]; then
+   jls -N
+fi
+
+if [ "$1" == "-j" ]; then
+    jls -N --libxo json
+    exit 0
+fi
+
+if [ $# -gt 0 ]; then
+    # Handle special-case commands first.
+    case "$1" in
+    help|-h|--help)
+        usage
+        ;;
+    release|releases)
+        if [ -d "${bastille_releasesdir}" ]; then
+            REL_LIST=$(ls "${bastille_releasesdir}" | sed "s/\n//g")
+            for _REL in ${REL_LIST}; do
+                if [ -f "${bastille_releasesdir}/${_REL}/root/.profile" ]; then
+                    echo "${_REL}"
+                fi
+            done
+        fi
+        ;;
+    template|templates)
+        find "${bastille_templatesdir}" -type d -maxdepth 2
+        ;;
+    jail|jails|container|containers)
+        if [ -d "${bastille_jailsdir}" ]; then
+            JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g")
+            for _JAIL in ${JAIL_LIST}; do
+                if [ -f "${bastille_jailsdir}/${_JAIL}/jail.conf" ]; then
+                    echo "${_JAIL}"
+                fi
+            done
+        fi
+        ;;
+    log|logs)
+        find "${bastille_logsdir}" -type f -maxdepth 1
+        ;;
+    limit|limits)
+        rctl -h jail:
+        ;;
+    import|imports|export|exports|backup|backups)
+        ls "${bastille_backupsdir}" | grep -Ev "*.sha256"
+    exit 0
+    ;;
+    *)
+        usage
+        ;;
+    esac
+fi

usr/local/share/bastille/pkg.sh

@@ -0,0 +1,63 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille pkg TARGET command [args]${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -lt 2 ]; then
+    usage
+fi
+
+TARGET="${1}"
+shift
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+fi
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+fi
+
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    jexec -l "${_jail}" /usr/sbin/pkg "$@"
+    echo
+done

usr/local/share/bastille/rdr.sh

@@ -0,0 +1,115 @@
+#!/bin/sh
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille rdr TARGET [clear] | [list] | [tcp <host_port> <jail_port>] | [udp <host_port> <jail_port>]${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -lt 2 ]; then
+    usage
+fi
+
+TARGET="${1}"
+shift
+
+# Can only redirect to single jail
+if [ "${TARGET}" = 'ALL' ]; then
+    echo -e "${COLOR_RED}Can only redirect to single jail${COLOR_RESET}"
+    exit 1
+fi
+
+# Check jail name valid
+JAIL_NAME=$(jls -j "${TARGET}" name 2>/dev/null)
+if [ -z "${JAIL_NAME}" ]; then
+    echo -e "${COLOR_RED}Jail not found: ${TARGET}${COLOR_RESET}"
+    exit 1
+fi
+
+# Check jail ip4 address valid
+JAIL_IP=$(jls -j "${TARGET}" ip4.addr 2>/dev/null)
+if [ -z "${JAIL_IP}" -o "${JAIL_IP}" = "-" ]; then
+    echo -e "${COLOR_RED}Jail IP not found: ${TARGET}${COLOR_RESET}"
+    exit 1
+fi
+
+# Check rdr-anchor is setup in pf.conf
+if ! (pfctl -sn | grep rdr-anchor | grep 'rdr/\*' >/dev/null); then
+    echo -e "${COLOR_RED}rdr-anchor not found in pf.conf${COLOR_RESET}"
+    exit 1
+fi
+
+# Check ext_if is setup in pf.conf
+EXT_IF=$(grep '^[[:space:]]*ext_if[[:space:]]*=' /etc/pf.conf)
+if [ -z "${JAIL_NAME}" ]; then
+    echo -e "${COLOR_RED}ext_if not defined in pf.conf${COLOR_RESET}"
+    exit 1
+fi
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        list)
+            pfctl -a "rdr/${JAIL_NAME}" -Psn 2>/dev/null
+            shift
+            ;;
+        clear)
+            pfctl -a "rdr/${JAIL_NAME}" -Fn
+            shift
+            ;;
+        tcp)
+            if [ $# -lt 3 ]; then
+                usage
+            fi
+            ( pfctl -a "rdr/${JAIL_NAME}" -Psn; 
+              printf '%s\nrdr on $ext_if inet proto tcp to port %d -> %s port %d\n' "$EXT_IF" "$2" "$JAIL_IP" "$3" ) \
+                  | pfctl -a "rdr/${JAIL_NAME}" -f-
+            shift 3
+            ;;
+        udp)
+            if [ $# -lt 3 ]; then
+                usage
+            fi
+            ( pfctl -a "rdr/${JAIL_NAME}" -Psn; 
+              printf '%s\nrdr on $ext_if inet proto udp to port %d -> %s port %d\n' "$EXT_IF" "$2" "$JAIL_IP" "$3" ) \
+                  | pfctl -a "rdr/${JAIL_NAME}" -f-
+            shift 3
+            ;;
+        *)
+            usage
+            ;;
+    esac
+done

usr/local/share/bastille/rename.sh

@@ -0,0 +1,133 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille rename [TARGET] [NEW_NAME].${COLOR_RESET}"
+    exit 1
+}
+
+error_notify() {
+    # Notify message on error and exit
+    echo -e "$*" >&2
+    exit 1
+}
+
+# Handle special-case commands first
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 2 ] || [ $# -lt 2 ]; then
+    usage
+fi
+
+TARGET="${1}"
+NEWNAME="${2}"
+shift
+
+if echo "${NEWNAME}" | grep -q "[.]"; then
+    echo -e "${COLOR_RED}Container names may not contain a dot(.)!${COLOR_RESET}"
+    exit 1
+fi
+
+update_jailconf() {
+    # Update jail.conf
+    JAIL_CONFIG="${bastille_jailsdir}/${NEWNAME}/jail.conf"
+    if [ -f "${JAIL_CONFIG}" ]; then
+        if ! grep -qw "path = ${bastille_jailsdir}/${NEWNAME}/root;" "${JAIL_CONFIG}"; then
+            sed -i '' "s|host.hostname = ${TARGET};|host.hostname = ${NEWNAME};|" "${JAIL_CONFIG}"
+            sed -i '' "s|exec.consolelog = .*;|exec.consolelog = ${bastille_logsdir}/${NEWNAME}_console.log;|" "${JAIL_CONFIG}"
+            sed -i '' "s|path = .*;|path = ${bastille_jailsdir}/${NEWNAME}/root;|" "${JAIL_CONFIG}"
+            sed -i '' "s|mount.fstab = .*;|mount.fstab = ${bastille_jailsdir}/${NEWNAME}/fstab;|" "${JAIL_CONFIG}"
+            sed -i '' "s|${TARGET} {|${NEWNAME} {|" "${JAIL_CONFIG}"
+        fi
+    fi
+}
+
+update_fstab() {
+    # Update fstab to use the new name
+    FSTAB_CONFIG="${bastille_jailsdir}/${NEWNAME}/fstab"
+    if [ -f "${FSTAB_CONFIG}" ]; then
+        FSTAB_RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])|([0-9]{1,2}-stable-build-[0-9]{1,3})|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)|(current-BUILD-LATEST)' "${FSTAB_CONFIG}")
+        FSTAB_CURRENT=$(grep -w ".*/releases/.*/jails/${TARGET}/root/.bastille" "${FSTAB_CONFIG}")
+        FSTAB_NEWCONF="${bastille_releasesdir}/${FSTAB_RELEASE} ${bastille_jailsdir}/${NEWNAME}/root/.bastille nullfs ro 0 0"
+        if [ -n "${FSTAB_CURRENT}" ] && [ -n "${FSTAB_NEWCONF}" ]; then
+            # If both variables are set, update as needed
+            if ! grep -qw "${bastille_releasesdir}/${FSTAB_RELEASE}.*${bastille_jailsdir}/${NEWNAME}/root/.bastille" "${FSTAB_CONFIG}"; then
+                sed -i '' "s|${FSTAB_CURRENT}|${FSTAB_NEWCONF}|" "${FSTAB_CONFIG}"
+            fi
+        fi
+    fi
+}
+
+change_name() {
+    # Attempt container name change
+    if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
+        echo -e "${COLOR_GREEN}Attempting to rename '${TARGET}' to ${NEWNAME}...${COLOR_RESET}"
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
+                # Rename ZFS dataset and mount points accordingly
+                zfs rename "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NEWNAME}"
+                zfs set mountpoint="${bastille_jailsdir}/${NEWNAME}/root" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NEWNAME}/root"
+            fi
+        else
+            # Just rename the jail directory
+            mv "${bastille_jailsdir}/${TARGET}" "${bastille_jailsdir}/${NEWNAME}"
+        fi
+    else
+        error_notify "${COLOR_RED}${TARGET} not found. See bootstrap.${COLOR_RESET}"
+    fi
+
+    # Update jail configuration files accordingly
+    update_jailconf
+    update_fstab
+
+    # Remove the old jail directory if exist
+    if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
+        rm -r "${bastille_jailsdir}/${TARGET}"
+    fi
+    if [ "$?" -ne 0 ]; then
+        error_notify "${COLOR_RED}An error has occurred while attempting to rename '${TARGET}'.${COLOR_RESET}"
+    else
+        echo -e "${COLOR_GREEN}Renamed '${TARGET}' to '${NEWNAME}' successfully.${COLOR_RESET}"
+    fi
+}
+
+# Check if container is running
+if [ -n "$(jls name | awk "/^${TARGET}$/")" ]; then
+    error_notify "${COLOR_RED}${TARGET} is running, See 'bastille stop'.${COLOR_RESET}"
+fi
+
+change_name

usr/local/share/bastille/restart.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+bastille stop "$@"
+bastille start "$@"

usr/local/share/bastille/service.sh

@@ -0,0 +1,64 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille service TARGET service_name action${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -lt 2 ]; then
+    usage
+fi
+
+TARGET=$1
+shift
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+fi
+
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+fi
+
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    jexec -l "${_jail}" /usr/sbin/service "$@"
+    echo
+done

usr/local/share/bastille/start.sh

@@ -0,0 +1,97 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille start TARGET${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 1 ] || [ $# -lt 1 ]; then
+    usage
+fi
+
+TARGET="${1}"
+shift
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(bastille list jails)
+fi
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(bastille list jails | awk "/^${TARGET}$/")
+    ## check if exist
+    if [ ! -d "${bastille_jailsdir}/${TARGET}" ]; then
+        echo -e "${COLOR_RED}[${TARGET}]: Not found.${COLOR_RESET}"
+    fi
+fi
+
+for _jail in ${JAILS}; do
+    ## test if running
+    if [ "$(jls name | awk "/^${_jail}$/")" ]; then
+        echo -e "${COLOR_RED}[${_jail}]: Already started.${COLOR_RESET}"
+
+    ## test if not running
+    elif [ ! "$(jls name | awk "/^${_jail}$/")" ]; then
+        ## warn if matching configured (but not online) ip4.addr, ignore if there's no ip4.addr entry
+        ip=$(grep 'ip4.addr' "${bastille_jailsdir}/${_jail}/jail.conf" | awk '{print $3}' | sed 's/\;//g')
+        if [ -n "${ip}" ]; then
+            if ifconfig | grep -w "${ip}" >/dev/null; then
+                echo -e "${COLOR_RED}Error: IP address (${ip}) already in use.${COLOR_RESET}"
+                exit 1
+            fi
+        fi
+
+        ## start the container
+        echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+        jail -f "${bastille_jailsdir}/${_jail}/jail.conf" -c "${_jail}"
+
+        ## add rctl limits
+        if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
+            while read _limits; do
+                rctl -a "${_limits}"
+            done < "${bastille_jailsdir}/${_jail}/rctl.conf"
+        fi
+
+        ## add ip4.addr to firewall table:jails
+        if [ ! -z "${bastille_network_loopback}" ]; then
+            pfctl -q -t jails -T add "$(jls -j "${_jail}" ip4.addr)"
+        fi
+    fi
+    echo
+done

usr/local/share/bastille/stop.sh

@@ -0,0 +1,86 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille stop TARGET${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 1 ] || [ $# -lt 1 ]; then
+    usage
+fi
+
+TARGET="${1}"
+shift
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+fi
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+    ## check if exist or not running
+    if [ ! -d "${bastille_jailsdir}/${TARGET}" ]; then
+        echo -e "${COLOR_RED}[${TARGET}]: Not found.${COLOR_RESET}"
+    elif [ ! "$(jls name | awk "/^${TARGET}$/")" ]; then
+        echo -e "${COLOR_RED}[${TARGET}]: Not started.${COLOR_RESET}"
+    fi
+fi
+
+for _jail in ${JAILS}; do
+    ## test if running
+    if [ "$(jls name | awk "/^${_jail}$/")" ]; then
+        ## remove ip4.addr from firewall table:jails
+        if [ -n "${bastille_network_loopback}" ]; then
+            pfctl -q -t jails -T delete "$(jls -j "${_jail}" ip4.addr)"
+        fi
+
+        ## remove rctl limits
+        if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
+            while read _limits; do
+                rctl -r "${_limits}"
+            done < "${bastille_jailsdir}/${_jail}/rctl.conf"
+        fi
+
+        ## stop container
+        echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+        jail -f "${bastille_jailsdir}/${_jail}/jail.conf" -r "${_jail}"
+    fi
+    echo
+done

usr/local/share/bastille/sysrc.sh

@@ -0,0 +1,64 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille sysrc TARGET args${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -lt 2 ]; then
+    usage
+fi
+
+TARGET="${1}"
+shift
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+fi
+
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+fi
+
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    jexec -l "${_jail}" /usr/sbin/sysrc "$@"
+    echo -e "${COLOR_RESET}"
+done

usr/local/share/bastille/template.sh

@@ -0,0 +1,285 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+bastille_usage() {
+    echo -e "${COLOR_RED}Usage: bastille template TARGET project/template.${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    bastille_usage
+    ;;
+esac
+
+if [ $# -gt 2 ] || [ $# -lt 2 ]; then
+    bastille_usage
+fi
+
+TARGET="${1}"
+shift
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+fi
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+fi
+
+TEMPLATE="${1}"
+shift
+
+if [ ! -d "${bastille_templatesdir}/${TEMPLATE}" ]; then
+    echo -e "${COLOR_RED}${TEMPLATE} not found.${COLOR_RESET}"
+    exit 1
+fi
+
+if [ -z "${JAILS}" ]; then
+    echo -e "${COLOR_RED}Container ${TARGET} is not running.${COLOR_RESET}"
+    exit 1
+fi
+
+## global variables
+bastille_template=${bastille_templatesdir}/${TEMPLATE}
+for _jail in ${JAILS}; do
+    ## jail-specific variables. 
+    bastille_jail_path=$(jls -j "${_jail}" path)
+
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+
+    ## TARGET
+    if [ -s "${bastille_template}/TARGET" ]; then
+        if grep -qw "${_jail}" "${bastille_template}/TARGET"; then
+            echo -e "${COLOR_GREEN}TARGET: !${_jail}.${COLOR_RESET}"
+            echo
+            continue
+        fi
+    if ! grep -Eq "(^|\b)(${_jail}|ALL)($|\b)" "${bastille_template}/TARGET"; then
+            echo -e "${COLOR_GREEN}TARGET: ?${_jail}.${COLOR_RESET}"
+            echo
+            continue
+        fi
+    fi
+
+    ## LIMITS (RCTL)
+    if [ -s "${bastille_template}/LIMITS" ]; then
+        echo -e "${COLOR_GREEN}[${_jail}]:LIMITS -- START${COLOR_RESET}"
+        RACCT_ENABLE=$(sysctl -n kern.racct.enable)
+        if [ "${RACCT_ENABLE}" != '1' ]; then
+            echo "Racct not enabled. Append 'kern.racct.enable=1' to /boot/loader.conf and reboot"
+            continue
+        fi
+        while read _limits; do
+            ## define the key and value
+            _limit_key=$(echo "${_limits}" | awk '{print $1}')
+            _limit_value=$(echo "${_limits}" | awk '{print $2}')
+            _rctl_rule="jail:${_jail}:${_limit_key}:deny=${_limit_value}/jail"
+
+            ## if entry doesn't exist, add; else show existing entry
+            if ! grep -qs "${_rctl_rule}" "${bastille_jailsdir}/${_jail}/rctl.conf"; then
+                echo "${_rctl_rule}" >> "${bastille_jailsdir}/${_jail}/rctl.conf"
+                echo "${_limits}"
+            else
+                echo "${_limits}"
+            fi
+
+            ## apply limits to system
+            rctl -a "${_rctl_rule}" || exit 1
+        done < "${bastille_template}/LIMITS"
+        echo -e "${COLOR_GREEN}[${_jail}]:LIMITS -- END${COLOR_RESET}"
+        echo
+    fi
+
+    ## INCLUDE
+    if [ -s "${bastille_template}/INCLUDE" ]; then
+        echo -e "${COLOR_GREEN}[${_jail}]:INCLUDE -- START${COLOR_RESET}"
+        while read _include; do
+            echo
+            echo -e "${COLOR_GREEN}INCLUDE: ${_include}${COLOR_RESET}"
+            echo -e "${COLOR_GREEN}Bootstrapping ${_include}...${COLOR_RESET}"
+
+            case ${_include} in
+                http?://github.com/*/*|http?://gitlab.com/*/*)
+                    bastille bootstrap "${_include}"
+                ;;
+                */*)
+                    BASTILLE_TEMPLATE_USER=$(echo "${_include}" | awk -F / '{ print $1 }')
+                    BASTILLE_TEMPLATE_REPO=$(echo "${_include}" | awk -F / '{ print $2 }')
+                    bastille template "${_jail}" "${BASTILLE_TEMPLATE_USER}/${BASTILLE_TEMPLATE_REPO}"
+                ;;
+                *)
+                    echo -e "${COLOR_RED}Template INCLUDE content not recognized.${COLOR_RESET}"
+                    exit 1
+            ;;
+            esac
+
+            echo
+            echo -e "${COLOR_GREEN}Applying ${_include}...${COLOR_RESET}"
+            BASTILLE_TEMPLATE_PROJECT=$(echo "${_include}" | awk -F / '{ print $4}')
+            BASTILLE_TEMPLATE_REPO=$(echo "${_include}" | awk -F / '{ print $5}')
+            bastille template "${_jail}" "${BASTILLE_TEMPLATE_PROJECT}/${BASTILLE_TEMPLATE_REPO}"
+        done < "${bastille_template}/INCLUDE"
+        echo -e "${COLOR_GREEN}[${_jail}]:INCLUDE -- END${COLOR_RESET}"
+        echo
+    fi
+
+    ## PRE
+    if [ -s "${bastille_template}/PRE" ]; then
+        echo -e "${COLOR_GREEN}[${_jail}]:PRE -- START${COLOR_RESET}"
+        jexec -l "${_jail}" /bin/sh < "${bastille_template}/PRE" || exit 1
+        echo -e "${COLOR_GREEN}[${_jail}]:PRE -- END${COLOR_RESET}"
+        echo
+    fi
+
+    ## FSTAB
+    if [ -s "${bastille_template}/FSTAB" ]; then
+        echo -e "${COLOR_GREEN}[${_jail}]:FSTAB -- START${COLOR_RESET}"
+        while read _fstab; do
+            ## assign needed variables
+            _hostpath=$(echo "${_fstab}" | awk '{print $1}')
+            _jailpath=$(echo "${_fstab}" | awk '{print $2}')
+            _type=$(echo "${_fstab}" | awk '{print $3}')
+            _perms=$(echo "${_fstab}" | awk '{print $4}')
+            _checks=$(echo "${_fstab}" | awk '{print $5" "$6}')
+
+            ## if any variables are empty, bail out
+            if [ -z "${_hostpath}" ] || [ -z "${_jailpath}" ] || [ -z "${_type}" ] || [ -z "${_perms}" ] || [ -z "${_checks}" ]; then
+                echo -e "${COLOR_RED}FSTAB format not recognized.${COLOR_RESET}"
+                echo -e "${COLOR_YELLOW}Format: /host/path jail/path nullfs ro 0 0${COLOR_RESET}"
+                echo -e "${COLOR_YELLOW}Read: ${_fstab}${COLOR_RESET}"
+                exit 1
+            fi
+            ## if host path doesn't exist or type is not "nullfs"
+            if [ ! -d "${_hostpath}" ] || [ "${_type}" != "nullfs" ]; then
+                echo -e "${COLOR_RED}Detected invalid host path or incorrect mount type in FSTAB.${COLOR_RESET}"
+                echo -e "${COLOR_YELLOW}Format: /host/path jail/path nullfs ro 0 0${COLOR_RESET}"
+                echo -e "${COLOR_YELLOW}Read: ${_fstab}${COLOR_RESET}"
+                exit 1
+            fi
+            ## if mount permissions are not "ro" or "rw"
+            if [ "${_perms}" != "ro" ] && [ "${_perms}" != "rw" ]; then
+                echo -e "${COLOR_RED}Detected invalid mount permissions in FSTAB.${COLOR_RESET}"
+                echo -e "${COLOR_YELLOW}Format: /host/path jail/path nullfs ro 0 0${COLOR_RESET}"
+                echo -e "${COLOR_YELLOW}Read: ${_fstab}${COLOR_RESET}"
+                exit 1
+            fi
+            ## if check & pass are not "0 0 - 1 1"; bail out
+            if [ "${_checks}" != "0 0" ] && [ "${_checks}" != "1 0" ] && [ "${_checks}" != "0 1" ] && [ "${_checks}" != "1 1" ]; then
+                echo -e "${COLOR_RED}Detected invalid fstab options in FSTAB.${COLOR_RESET}"
+                echo -e "${COLOR_YELLOW}Format: /host/path jail/path nullfs ro 0 0${COLOR_RESET}"
+                echo -e "${COLOR_YELLOW}Read: ${_fstab}${COLOR_RESET}"
+                exit 1
+            fi
+
+            ## aggregate variables into FSTAB entry
+            _fstab_entry="${_hostpath} ${bastille_jailsdir}/${_jail}/root/${_jailpath} ${_type} ${_perms} ${_checks}"
+
+            ## if entry doesn't exist, add; else show existing entry
+            if ! grep -q "${_jailpath}" "${bastille_jailsdir}/${_jail}/fstab"; then
+                echo "${_fstab_entry}" >> "${bastille_jailsdir}/${_jail}/fstab"
+                echo "Added: ${_fstab_entry}"
+            else
+                grep "${_jailpath}" "${bastille_jailsdir}/${_jail}/fstab"
+            fi
+        done < "${bastille_template}/FSTAB"
+        mount -F "${bastille_jailsdir}/${_jail}/fstab" -a
+        echo -e "${COLOR_GREEN}[${_jail}]:FSTAB -- END${COLOR_RESET}"
+        echo
+    fi
+
+    ## PF
+    if [ -s "${bastille_template}/PF" ]; then
+        echo -e "${COLOR_GREEN}NOT YET IMPLEMENTED.${COLOR_RESET}"
+    fi
+
+    ## PKG (bootstrap + pkg)
+    if [ -s "${bastille_template}/PKG" ]; then
+        echo -e "${COLOR_GREEN}[${_jail}]:PKG -- START${COLOR_RESET}"
+        jexec -l "${_jail}" env ASSUME_ALWAYS_YES=YES /usr/sbin/pkg bootstrap || exit 1
+        jexec -l "${_jail}" env ASSUME_ALWAYS_YES=YES /usr/sbin/pkg install $(cat "${bastille_template}/PKG") || exit 1
+        jexec -l "${_jail}" env ASSUME_ALWAYS_YES=YES /usr/sbin/pkg audit -F
+        echo -e "${COLOR_GREEN}[${_jail}]:PKG -- END${COLOR_RESET}"
+        echo
+    fi
+
+    ## CONFIG / OVERLAY
+    if [ -s "${bastille_template}/OVERLAY" ]; then
+        echo -e "${COLOR_GREEN}[${_jail}]:OVERLAY -- START${COLOR_RESET}"
+        while read _dir; do
+            cp -av "${bastille_template}/${_dir}" "${bastille_jail_path}" || exit 1
+        done < "${bastille_template}/OVERLAY"
+        echo -e "${COLOR_GREEN}[${_jail}]:OVERLAY -- END${COLOR_RESET}"
+        echo
+    fi
+    if [ -s "${bastille_template}/CONFIG" ]; then
+        echo -e "${COLOR_YELLOW}CONFIG deprecated; rename to OVERLAY.${COLOR_RESET}"
+        echo -e "${COLOR_GREEN}[${_jail}]:CONFIG -- START${COLOR_RESET}"
+        while read _dir; do
+            cp -av "${bastille_template}/${_dir}" "${bastille_jail_path}" || exit 1
+        done < "${bastille_template}/CONFIG"
+        echo -e "${COLOR_GREEN}[${_jail}]:CONFIG -- END${COLOR_RESET}"
+        echo
+    fi
+
+    ## SYSRC
+    if [ -s "${bastille_template}/SYSRC" ]; then
+        echo -e "${COLOR_GREEN}[${_jail}]:SYSRC -- START${COLOR_RESET}"
+        while read _sysrc; do
+            jexec -l "${_jail}" /usr/sbin/sysrc "${_sysrc}" || exit 1
+        done < "${bastille_template}/SYSRC"
+        echo -e "${COLOR_GREEN}[${_jail}]:SYSRC -- END${COLOR_RESET}"
+        echo
+    fi
+
+    ## SERVICE
+    if [ -s "${bastille_template}/SERVICE" ]; then
+        echo -e "${COLOR_GREEN}[${_jail}]:SERVICE -- START${COLOR_RESET}"
+        while read _service; do
+            jexec -l "${_jail}" /usr/sbin/service "${_service}" || exit 1
+        done < "${bastille_template}/SERVICE"
+        echo -e "${COLOR_GREEN}[${_jail}]:SERVICE -- END${COLOR_RESET}"
+        echo
+    fi
+
+    ## CMD
+    if [ -s "${bastille_template}/CMD" ]; then
+        echo -e "${COLOR_GREEN}[${_jail}]:CMD -- START${COLOR_RESET}"
+        jexec -l "${_jail}" /bin/sh < "${bastille_template}/CMD" || exit 1
+        echo -e "${COLOR_GREEN}[${_jail}]:CMD -- END${COLOR_RESET}"
+        echo
+    fi
+
+    echo -e "${COLOR_GREEN}Template Complete.${COLOR_RESET}"
+    echo
+done

usr/local/share/bastille/top.sh

@@ -0,0 +1,64 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille top TARGET${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 1 ] || [ $# -lt 1 ]; then
+    usage
+fi
+
+TARGET="${1}"
+shift
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+fi
+
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+fi
+
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    jexec -l "${_jail}" /usr/bin/top
+    echo -e "${COLOR_RESET}"
+done

usr/local/share/bastille/update.sh

@@ -0,0 +1,88 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille update [release|container].${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 1 ] || [ $# -lt 1 ]; then
+    usage
+fi
+
+TARGET="${1}"
+shift
+
+if freebsd-version | grep -qi HBSD; then
+    echo -e "${COLOR_RED}Not yet supported on HardenedBSD.${COLOR_RESET}"
+    exit 1
+fi
+
+if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
+    if ! grep -qw ".bastille" "${bastille_jailsdir}/${TARGET}/fstab"; then
+            if [ "$(jls name | awk "/^${TARGET}$/")" ]; then
+                # Update a thick container.
+                CURRENT_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)
+                if [ -z "${CURRENT_VERSION}" ]; then
+                    echo -e "${COLOR_RED}Can't determine '${TARGET}' version.${COLOR_RESET}"
+                    exit 1
+                else
+                    env PAGER="/bin/cat" freebsd-update --not-running-from-cron -b "${bastille_jailsdir}/${TARGET}/root" \
+                    fetch install --currently-running "${CURRENT_VERSION}"
+                fi
+            else
+                echo -e "${COLOR_RED}${TARGET} is not running.${COLOR_RESET}"
+                echo -e "${COLOR_RED}See 'bastille start ${TARGET}'.${COLOR_RESET}"
+                exit 1
+            fi
+    else
+        echo -e "${COLOR_RED}${TARGET} is not a thick container.${COLOR_RESET}"
+        exit 1
+    fi
+else
+    if [ -d "${bastille_releasesdir}/${TARGET}" ]; then
+        # Update container base(affects child containers).
+        env PAGER="/bin/cat" freebsd-update --not-running-from-cron -b "${bastille_releasesdir}/${TARGET}" \
+        fetch install --currently-running "${TARGET}"
+    else
+        echo -e "${COLOR_RED}${TARGET} not found. See bootstrap.${COLOR_RESET}"
+        exit 1
+    fi
+fi

usr/local/share/bastille/upgrade.sh

@@ -0,0 +1,65 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille upgrade release newrelease.${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 2 ] || [ $# -lt 2 ]; then
+    usage
+fi
+
+RELEASE="$1"
+shift
+NEWRELEASE="$1"
+
+if freebsd-version | grep -qi HBSD; then
+    echo -e "${COLOR_RED}Not yet supported on HardenedBSD.${COLOR_RESET}"
+    exit 1
+fi
+
+
+if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
+    freebsd-update -b "${bastille_releasesdir}/${RELEASE}" -r "${NEWRELEASE}" upgrade
+else
+    echo -e "${COLOR_RED}${RELEASE} not found. See bootstrap.${COLOR_RESET}"
+    exit 1
+fi

usr/local/share/bastille/verify.sh

@@ -0,0 +1,162 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+bastille_usage() {
+    echo -e "${COLOR_RED}Usage: bastille verify [release|template].${COLOR_RESET}"
+    exit 1
+}
+
+verify_release() {
+    if freebsd-version | grep -qi HBSD; then
+        echo -e "${COLOR_RED}Not yet supported on HardenedBSD.${COLOR_RESET}"
+        exit 1
+    fi
+
+    if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
+        freebsd-update -b "${bastille_releasesdir}/${RELEASE}" --currently-running "${RELEASE}" IDS
+    else
+        echo -e "${COLOR_RED}${RELEASE} not found. See bootstrap.${COLOR_RESET}"
+        exit 1
+    fi
+}
+
+verify_template() {
+    _template_path=${bastille_templatesdir}/${BASTILLE_TEMPLATE}
+    _hook_validate=0
+
+    for _hook in TARGET INCLUDE PRE OVERLAY FSTAB PF PKG SYSRC SERVICE CMD; do
+        _path=${_template_path}/${_hook}
+        if [ -s "${_path}" ]; then
+            _hook_validate=$((_hook_validate+1))
+            echo -e "${COLOR_GREEN}Detected ${_hook} hook.${COLOR_RESET}"
+
+            ## line count must match newline count
+            if [ $(wc -l "${_path}" | awk '{print $1}') -ne $(grep -c $'\n' "${_path}") ]; then
+                echo -e "${COLOR_GREEN}[${_hook}]:${COLOR_RESET}"
+                echo -e "${COLOR_RED}${BASTILLE_TEMPLATE}:${_hook} [failed].${COLOR_RESET}"
+                echo -e "${COLOR_RED}Line numbers don't match line breaks.${COLOR_RESET}"
+                echo
+                echo -e "${COLOR_RED}Template validation failed.${COLOR_RESET}"
+                exit 1
+
+            ## if INCLUDE; recursive verify
+            elif [ ${_hook} = 'INCLUDE' ]; then
+                echo -e "${COLOR_GREEN}[${_hook}]:${COLOR_RESET}"
+                cat "${_path}"
+                echo
+                while read _include; do
+                    echo -e "${COLOR_GREEN}[${_hook}]:[${_include}]:${COLOR_RESET}"
+
+                    case ${_include} in
+                        http?://github.com/*/*|http?://gitlab.com/*/*)
+                            bastille bootstrap "${_include}"
+                        ;;
+                        */*)
+                            BASTILLE_TEMPLATE_USER=$(echo "${_include}" | awk -F / '{ print $1 }')
+                            BASTILLE_TEMPLATE_REPO=$(echo "${_include}" | awk -F / '{ print $2 }')
+                            bastille verify "${BASTILLE_TEMPLATE_USER}/${BASTILLE_TEMPLATE_REPO}"
+                        ;;
+                        *)
+                            echo -e "${COLOR_RED}Template INCLUDE content not recognized.${COLOR_RESET}"
+                            exit 1
+                    ;;
+                    esac
+                done < "${_path}"
+
+            ## if tree; tree -a bastille_template/_dir
+            elif [ ${_hook} = 'OVERLAY' ]; then
+                echo -e "${COLOR_GREEN}[${_hook}]:${COLOR_RESET}"
+                cat "${_path}"
+                echo
+                while read _dir; do
+                    echo -e "${COLOR_GREEN}[${_hook}]:[${_dir}]:${COLOR_RESET}"
+                        if [ -x /usr/local/bin/tree ]; then
+                            /usr/local/bin/tree -a "${_template_path}/${_dir}"
+                        else
+                           find "${_template_path}/${_dir}" -print | sed -e 's;[^/]*/;|___;g;s;___|; |;g'
+                        fi
+                    echo
+                done < "${_path}"
+            else
+                echo -e "${COLOR_GREEN}[${_hook}]:${COLOR_RESET}"
+                cat "${_path}"
+                echo
+            fi
+        fi
+    done
+
+    ## remove bad templates
+    if [ ${_hook_validate} -lt 1 ]; then
+        echo -e "${COLOR_RED}No valid template hooks found.${COLOR_RESET}"
+        echo -e "${COLOR_RED}Template discarded.${COLOR_RESET}"
+        rm -rf "${bastille_template}"
+        exit 1
+    fi
+
+    ## if validated; ready to use
+    if [ ${_hook_validate} -gt 0 ]; then
+        echo -e "${COLOR_GREEN}Template ready to use.${COLOR_RESET}"
+    fi
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    bastille_usage
+    ;;
+esac
+
+if [ $# -gt 1 ] || [ $# -lt 1 ]; then
+    bastille_usage
+fi
+
+case "$1" in
+*-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2)
+    RELEASE=$1
+    verify_release
+    ;;
+*-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
+    RELEASE=$1
+    verify_release
+    ;;
+http?*)
+    bastille_usage
+    ;;
+*/*)
+    BASTILLE_TEMPLATE=$1
+    verify_template
+    ;;
+*)
+    bastille_usage
+    ;;
+esac

usr/local/share/bastille/zfs.sh

@@ -0,0 +1,123 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille zfs TARGET [set|get|snap] [key=value|date]'${COLOR_RESET}"
+    exit 1
+}
+
+zfs_snapshot() {
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    zfs snapshot -r "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}"@"${TAG}"
+    echo
+done
+}
+
+zfs_set_value() {
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    zfs "${ATTRIBUTE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}"
+    echo
+done
+}
+
+zfs_get_value() {
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    zfs get "${ATTRIBUTE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}"
+    echo
+done
+}
+
+zfs_disk_usage() {
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    zfs list -t all -o name,used,avail,refer,mountpoint,compress,ratio -r "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}"
+    echo
+done
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+## check ZFS enabled
+if [ ! "${bastille_zfs_enable}" = "YES" ]; then
+    echo -e "${COLOR_RED}ZFS not enabled.${COLOR_RESET}"
+    exit 1
+fi
+
+## check zpool defined
+if [ -z "${bastille_zfs_zpool}" ]; then
+    echo -e "${COLOR_RED}ZFS zpool not defined.${COLOR_RESET}"
+    exit 1
+fi
+
+if [ $# -lt 2 ]; then
+    usage
+fi
+
+TARGET="${1}"
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+fi
+
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+fi
+
+case "$2" in
+set)
+    ATTRIBUTE=$3
+    JAILS=${JAILS}
+    zfs_set_value
+    ;;
+get)
+    ATTRIBUTE=$3
+    JAILS=${JAILS}
+    zfs_get_value
+    ;;
+snap|snapshot)
+    TAG=$3
+    JAILS=${JAILS}
+    zfs_snapshot
+    ;;
+df|usage)
+    zfs_disk_usage
+    ;;
+esac