bgwaf/ansible/play-main.yml

- name: Gather facts (implicit) and packages facts
  hosts: all
  tasks:
    - name: Gather packages facts
      ansible.builtin.package_facts:
  tags:
    - "always"

- name: Create local CA
  hosts: all
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    local_ca_common_name: "Lab CA"
    local_ca_passphrase: "{{ secrets.ca.passphrase }}"
    local_ca_country_name: "{{ common.certificates.country_name }}"
    local_ca_locality_name: "{{ common.certificates.locality_name }}"
    local_ca_organization_name: "{{ common.certificates.organization_name }}"
    local_ca_email_address: "{{ common.certificates.email_address }}"
  roles:
    - "local_ca"
  tags:
    - "local_ca"

- name: Proxy server
  hosts: proxy
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    squid_authorized_networks:
      - "{{ ansible_default_ipv4.network }}/24"
  roles:
    - "squid"
  tags:
    - "proxy"

- name: Common
  hosts: all
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    common_proxy_server: "{{ hostvars['proxy1'].ansible_default_ipv4.address }}:3128"
  roles:
    - "common"
  tags:
    - "common"

- name: HTTP Servers
  hosts: www
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  roles:
    - "www"
  tags:
    - "www"

- name: Web Application Firewalls (install)
  hosts: waf
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
    certs_default_country_name: "{{ common.certificates.country_name }}"
    certs_default_locality_name: "{{ common.certificates.locality_name }}"
    certs_default_organization_name: "{{ common.certificates.organization_name }}"
    certs_default_email_address: "{{ common.certificates.email_address }}"
    certs_list:
      # Consul
      - cn: "server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
        domains:
          - "DNS:server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
      # Sites
      - cn: "test.lab"
        domains:
          - "DNS:test.lab"
          - "DNS:{{ ansible_fqdn }}"
          - "DNS:{{ ansible_hostname }}"
          - "IP:{{ ansible_default_ipv4.address }}"
    consul_domain: "{{ common.consul.domain }}"
    consul_datacenter: "{{ common.consul.datacenter }}"
    consul_secret_key: "{{ secrets.consul.secret_key }}"
    consul_nodes:
      - "waf1"
      - "waf2"
      - "waf3"
    # FIXME: -> Cady modules
    waf_install_cluster: true
    vip_script_user: "caddy"
    vip_monitored_process: "caddy"
    vip_vrrp_password: "{{ secrets.keepalived.secret }}"
    vip_vrrp_ips:
      - master: "waf1"
        virtual_router_id: 11
        addr: "{{ {{ ansible_default_ipv4.address }} | split('.')[0-3] | join('.') }}.250"
      - master: "waf2"
        virtual_router_id: 12
        addr: "{{ {{ ansible_default_ipv4.address }} | split('.')[0-3] | join('.') }}.251"
      - master: "waf3"
        virtual_router_id: 13
        addr: "{{ {{ ansible_default_ipv4.address }} | split('.')[0-3] | join('.') }}.252"
    waf_config_sites: "{{ common.sites }}"
  roles:
    - "certs"
    - "consul"
    - "waf_install"
    - "vip"
    - "waf_config"
  tags:
    - "waf"