bgwaf/ansible/roles/waf_install/tasks/main.yml

- name: Remove packaged Go
  ansible.builtin.apt:
    name:
      - "golang"
    state: "absent"
    autoremove: true
    purge: true

- name: Install requirements
  ansible.builtin.apt:
    name:
      - "git"
      - "libnss3-tools"

- name: Create Go directory
  ansible.builtin.file:
    path: "/usr/local/go-{{ waf_install_go_version }}"
    state: "directory"
    mode: "0755"

- name: Install Go
  ansible.builtin.unarchive:
    src: "https://go.dev/dl/go{{ waf_install_go_version }}.linux-amd64.tar.gz"
    dest: "/usr/local/go-{{ waf_install_go_version }}"
    remote_src: true

- name: Link Go
  ansible.builtin.file:
    src: "/usr/local/go-{{ waf_install_go_version }}/go/bin/go"
    dest: "/usr/local/bin/go"
    state: "link"

- name: Create xcaddy directory
  ansible.builtin.file:
    path: "/usr/local/xcaddy-{{ waf_install_xcaddy_version }}"
    state: "directory"
    mode: "0755"

- name: Install xcaddy
  ansible.builtin.unarchive:
    src: "{{ waf_install_xcaddy_download }}/v{{ waf_install_xcaddy_version }}/xcaddy_{{ waf_install_xcaddy_version }}_linux_amd64.tar.gz"
    dest: "/usr/local/xcaddy-{{ waf_install_xcaddy_version }}"
    remote_src: true

- name: Link xcaddy
  ansible.builtin.file:
    src: "/usr/local/xcaddy-{{ waf_install_xcaddy_version }}/xcaddy"
    dest: "/usr/local/bin/xcaddy"
    state: "link"

- name: Create Caddy build command
  ansible.builtin.set_fact:
    waf_install_build_command: >
      xcaddy build v{{ waf_install_caddy_version }}
      --with github.com/pteich/caddy-tlsconsul
      --with github.com/corazawaf/coraza-caddy/v2@v{{ waf_install_coraza_caddy_version }}
      --with github.com/mholt/caddy-ratelimit
      --with github.com/steffenbusch/caddy-bot-barrier
      --output /usr/local/bin/caddy

- name: Test Caddy version
  ansible.builtin.copy:
    dest: "/usr/local/bin/.caddy.build"
    content: "{{ waf_install_build_command }}"
    mode: "0644"
  register: waf_install_test_caddy_version

- name: Build Caddy
  # noqa: no-handler
  when: "waf_install_test_caddy_version.changed"
  ansible.builtin.command:
    cmd: "{{ waf_install_build_command }}"
    creates: "/usr/local/bin/caddy"
  notify:
    - "Restart Caddy"

- name: Create caddy system group
  ansible.builtin.group:
    name: "caddy"
    system: true

- name: Create caddy system user
  ansible.builtin.user:
    name: "caddy"
    group: "caddy"
    groups: ["ssl-cert"]
    password: "!"
    system: true
    home: "/opt/caddy"

- name: Create caddy config directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: "directory"
    group: "caddy"
    mode: "0750"
  loop:
    - "/etc/caddy"
    - "/etc/caddy/plugins"
    - "/etc/caddy/sites"

- name: Create caddy log dir
  ansible.builtin.file:
    path: "/var/log/caddy"
    state: "directory"
    group: "caddy"
    mode: "0770"

- name: Install OWASP CRS
  ansible.builtin.unarchive:
    src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ waf_install_owasp_crs_version }}.tar.gz"
    dest: "/etc/caddy"
    group: "caddy"
    remote_src: true

- name: Install plugins
  loop: "{{ waf_install_crs_plugins }}"
  loop_control:
    loop_var: "plugin"
  ansible.builtin.include_tasks: "install_plugin.yml"

- name: Deploy caddy service file
  ansible.builtin.template:
    src: "templates/caddy.service"
    dest: "/etc/systemd/system/caddy.service"
    mode: "0644"
  notify:
    - "Restart Caddy"

- name: Enable Caddy
  ansible.builtin.service:
    name: "caddy"
    enabled: true
    daemon_reload: true