bgwaf/ansible/roles/waf_install/tasks/install_plugin.yml

- name: Download plugin {{ plugin.name }}
  ansible.builtin.get_url:
    url: "https://github.com/{{ plugin.provider | default('coreruleset') }}/{{ plugin.name }}-plugin/archive/refs/tags/v{{ plugin.version }}.tar.gz"
    dest: "/usr/local/src/"
    mode: "0644"
  register: "waf_install_plugin_downloaded"

- name: Deploy plugin {{ plugin.name }}
  # noqa: no-handler
  when: "waf_install_plugin_downloaded.changed"
  block:

    - name: Get temp dir {{ plugin.name }}
      ansible.builtin.tempfile:
        state: "directory"
      register: "waf_install_temp_plugin_dir"

    - name: Unarchive plugin {{ plugin.name }}
      ansible.builtin.unarchive:
        src: "/usr/local/src/{{ plugin.name }}-plugin-{{ plugin.version }}.tar.gz"
        dest: "{{ waf_install_temp_plugin_dir.path }}"
        remote_src: true

    - name: Copy plugin files {{ plugin.name }}
      ansible.builtin.copy:
        src: "{{ waf_install_temp_plugin_dir.path }}/{{ plugin.name }}-plugin-{{ plugin.version }}/plugins/"
        dest: "/etc/caddy/plugins/"
        mode: "0644"
#       directory_mode: "0750"
        group: "caddy"
        remote_src: true
      notify:
        - "Restart Caddy"

    - name: Create after config {{ plugin.name }}
      when: "not(plugin.has_after_config | default(false))"
      ansible.builtin.copy:
        content: ""
        dest: "/etc/caddy/plugins/{{ plugin.name }}-after.conf"
        mode: "0644"
        group: "caddy"

    # FIXME: bad hack, why is it required?
    - name: Adjust /etc/caddy/plugins permissions
      ansible.builtin.file:
        path: "/etc/caddy/plugins"
        state: "directory"
        group: "caddy"
        mode: "0750"

    - name: Delete temp dir {{ plugin.name }}
      when: "waf_install_temp_plugin_dir.path is defined"
      ansible.builtin.file:
        path: "{{ waf_install_temp_plugin_dir.path }}"
        state: "absent"