48 lines
1.4 KiB
YAML
48 lines
1.4 KiB
YAML
|
- name: Create consul policy for Caddy TLS and rate limit
|
||
|
|
delegate_to: "{{ caddy_consul_delegate_to }}"
|
||
|
|
run_once: true
|
||
|
|
community.general.consul_policy:
|
||
|
|
token: "{{ caddy_consul_admin_token }}"
|
||
|
|
name: "caddy"
|
||
|
|
rules: |
|
||
|
|
key_prefix "caddy-{{ caddy_my_name }}-tls" {
|
||
|
|
policy = "write"
|
||
|
|
}
|
||
|
|
key_prefix "caddy-{{ caddy_my_name }}-rl" {
|
||
|
|
policy = "write"
|
||
|
|
}
|
||
|
|
session_prefix "" {
|
||
|
|
policy = "write"
|
||
|
|
}
|
||
|
|
node_prefix "" {
|
||
|
|
policy = "read"
|
||
|
|
}
|
||
|
|
agent_prefix "" {
|
||
|
|
policy = "read"
|
||
|
|
}
|
||
|
|
|
||
|
|
- name: Create/retrieve Consul Caddy accessor_id
|
||
|
|
ansible.builtin.shell:
|
||
|
|
executable: "/usr/bin/bash"
|
||
|
|
cmd: |
|
||
|
|
set -o pipefail
|
||
|
|
if test -f /root/.consul_caddy_accessor_id; then
|
||
|
|
echo OK
|
||
|
|
else
|
||
|
|
uuidgen > /root/.consul_caddy_accessor_id
|
||
|
|
echo CHANGED
|
||
|
|
fi
|
||
|
|
cat /root/.consul_caddy_accessor_id
|
||
|
|
register: "consul_out_caddy_accessor_id"
|
||
|
|
changed_when: "consul_out_caddy_accessor_id.stdout_lines[0] == 'CHANGED'"
|
||
|
|
|
||
|
|
- name: Create/retrieve consul token
|
||
|
|
delegate_to: "{{ caddy_consul_delegate_to }}"
|
||
|
|
community.general.consul_token:
|
||
|
|
token: "{{ caddy_consul_admin_token }}"
|
||
|
|
accessor_id: "{{ consul_out_caddy_accessor_id.stdout_lines[1] }}"
|
||
|
|
description: "Caddy {{ caddy_my_name }} {{ ansible_fqdn }}"
|
||
|
|
policies:
|
||
|
|
- name: "caddy"
|
||
|
|
register: "caddy_out_consul_token"
|