bgwaf/seb4itik/byow/roles/caddy/tasks/caddy_install.yml

- name: Install requirements
  ansible.builtin.package:
    name:
      - "git"
      - "libnss3-tools"
      - "ssl-cert"

- name: Create Go directory
  ansible.builtin.file:
    path: "/usr/local/go-{{ caddy_go_version }}"
    state: "directory"
    mode: "0755"

- name: Install Go
  ansible.builtin.unarchive:
    src: "https://go.dev/dl/go{{ caddy_go_version }}.linux-amd64.tar.gz"
    dest: "/usr/local/go-{{ caddy_go_version }}"
    creates: "/usr/local/go-{{ caddy_go_version }}/bin/go"
    extra_opts:
      - "--strip-components=1"
    remote_src: true

- name: Create xcaddy directory
  ansible.builtin.file:
    path: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
    state: "directory"
    mode: "0755"

- name: Install xcaddy
  ansible.builtin.unarchive:
    src: "https://github.com/caddyserver/xcaddy/releases/download/v{{ caddy_xcaddy_version }}/xcaddy_{{ caddy_xcaddy_version }}_linux_amd64.tar.gz"
    dest: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
    creates: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy"
    remote_src: true

- name: Create Caddy build command
  ansible.builtin.set_fact:
    caddy_build_command: >
      /usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy build v{{ caddy_version }}
      --with github.com/pteich/caddy-tlsconsul
      --with github.com/corazawaf/coraza-caddy/{{ caddy_coraza_caddy_version }}
      --with github.com/mholt/caddy-ratelimit
      --with github.com/steffenbusch/caddy-bot-barrier
      --with github.com/zhangjiayin/caddy-geoip2
      --output {{ caddy_binary }}

- name: Remember and test Caddy version
  ansible.builtin.copy:
    dest: "/usr/local/bin/.caddy.{{ caddy_my_name }}.build"
    content: >
      XCADDY_WHICH_GO=/usr/local/go-{{ caddy_go_version }}/bin/go
      {{ caddy_build_command }}
    mode: "0644"
  register: caddy_test_caddy_version

- name: Build Caddy
  # noqa: no-handler
  when: "caddy_test_caddy_version.changed"
  environment:
    XCADDY_WHICH_GO: "/usr/local/go-{{ caddy_go_version }}/bin/go"
  ansible.builtin.command:
    cmd: "{{ caddy_build_command }}"
    creates: "{{ caddy_binary }}"
  notify:
    - "Restart Caddy"

- name: Create Caddy system group
  ansible.builtin.group:
    name: "{{ caddy_system_group }}"
    system: true

- name: Create Caddy system user
  ansible.builtin.user:
    name: "{{ caddy_system_user }}"
    group: "{{ caddy_system_group }}"
    groups: ["ssl-cert"]
    password: "!"
    system: true
    shell: "/usr/sbin/nologin"
    home: "{{ caddy_home_dir }}"

- name: Create Caddy directories
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: "directory"
    owner: "{{ item.owner | default('root') }}"
    group: "{{ caddy_system_group }}"
    mode: "{{ item.mode | default('0750') }}"
  loop:
    - path: "{{ caddy_config_dir }}"
    - path: "{{ caddy_crs_plugins_dir }}"
    - path: "{{ caddy_sites_dir }}"
    - path: "{{ caddy_log_dir }}"
      mode: "0770"
    - path: "{{ caddy_home_dir }}/geoip2"
      owner: "{{ caddy_system_user }}"

- name: Install OWASP CRS
  loop: "{{ caddy_owasp_crs_versions }}"
  ansible.builtin.unarchive:
    src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ item }}.tar.gz"
    dest: "{{ caddy_config_dir }}"
    creates: "{{ caddy_config_dir }}/coreruleset-{{ item }}/rules/"
    group: "{{ caddy_system_group }}"
    remote_src: true

- name: Install plugins
  loop: "{{ caddy_crs_plugins }}"
  ansible.builtin.unarchive:
    src: "https://github.com/{{ item.provider | default('coreruleset') }}/{{ item.name }}-plugin/archive/refs/tags/v{{ item.version }}.tar.gz"
    dest: "{{ caddy_crs_plugins_dir }}"
    creates: "{{ caddy_crs_plugins_dir }}/{{ item.name }}-config.conf"
    include:
      - "*.conf"
    extra_opts:
      - "--strip-components=2"
      - "--wildcards"
    mode: "0644"
    group: "{{ caddy_system_group }}"
    remote_src: true

- name: Create plugins after config
  loop: "{{ caddy_crs_plugins }}"
  when: "not(item.has_after_config | default(false))"
  ansible.builtin.copy:
    content: ""
    dest: "{{ caddy_crs_plugins_dir }}/{{ item.name }}-after.conf"
    mode: "0644"
    group: "{{ caddy_system_group }}"

- name: Deploy caddy service file
  ansible.builtin.template:
    src: "templates/caddy.service"
    dest: "/etc/systemd/system/{{ caddy_my_name }}.service"
    mode: "0644"
  notify:
    - "Reload systemd"
    - "Restart Caddy"