bgwaf/seb4itik/byow/roles/caddy/tasks/caddy_install.yml

- name: Install requirements
  ansible.builtin.apt:
    name:
      - "git"
      - "libnss3-tools"
      - "ssl-cert"

- name: Create Go directory
  ansible.builtin.file:
    path: "/usr/local/go-{{ caddy_go_version }}"
    state: "directory"
    mode: "0755"

- name: Install Go
  ansible.builtin.unarchive:
    src: "https://go.dev/dl/go{{ caddy_go_version }}.linux-amd64.tar.gz"
    dest: "/usr/local/go-{{ caddy_go_version }}"
    remote_src: true

- name: Create xcaddy directory
  ansible.builtin.file:
    path: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
    state: "directory"
    mode: "0755"

- name: Install xcaddy
  ansible.builtin.unarchive:
    src: "https://github.com/caddyserver/xcaddy/releases/download/v{{ caddy_xcaddy_version }}/xcaddy_{{ caddy_xcaddy_version }}_linux_amd64.tar.gz"
    dest: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
    remote_src: true

- name: Create Caddy build command
  ansible.builtin.set_fact:
    caddy_build_command: >
      /usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy build v{{ caddy_version }}
      --with github.com/pteich/caddy-tlsconsul
      --with github.com/corazawaf/coraza-caddy/v2@v{{ caddy_coraza_caddy_version }}
      --with github.com/mholt/caddy-ratelimit
      --with github.com/steffenbusch/caddy-bot-barrier
      --output /usr/local/bin/{{ caddy_my_name }}

- name: Remember and test Caddy version
  ansible.builtin.copy:
    dest: "/usr/local/bin/.caddy.build"
    content: >
      XCADDY_WHICH_GO=/usr/local/go-{{ caddy_go_version }}/go/bin/go
      {{ caddy_build_command }}"
    mode: "0644"
  register: caddy_test_caddy_version

- name: Build Caddy
  # noqa: no-handler
  when: "caddy_test_caddy_version.changed"
  environment:
    XCADDY_WHICH_GO: "/usr/local/go-{{ caddy_go_version }}/go/bin/go"
  ansible.builtin.command:
    cmd: "{{ caddy_build_command }}"
    creates: "/usr/local/bin/{{ caddy_my_name }}"
  notify:
    - "Restart Caddy"

- name: Create Caddy system group
  ansible.builtin.group:
    name: "{{ caddy_system_group }}"
    system: true

- name: Create Caddy system user
  ansible.builtin.user:
    name: "{{ caddy_system_user }}"
    group: "{{ caddy_system_group }}"
    groups: ["ssl-cert"]
    password: "!"
    system: true
    home: "{{ caddy_home_dir }}"

- name: Create Caddy config directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: "directory"
    group: "{{ caddy_system_group }}"
    mode: "0750"
  loop:
    - "{{ caddy_config_dir }}"
    - "{{ caddy_config_dir }}/crs-plugins"
    - "{{ caddy_config_dir }}/sites"

- name: Create Caddy log dir
  ansible.builtin.file:
    path: "{{ caddy_log_dir }}"
    state: "directory"
    group: "{{ caddy_system_group }}"
    mode: "0770"

- name: Install OWASP CRS
  loop: "{{ caddy_owasp_crs_versions }}"
  ansible.builtin.unarchive:
    src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ item }}.tar.gz"
    dest: "{{ caddy_config_dir }}"
    group: "{{ caddy_system_group }}"
    remote_src: true

- name: Install plugins
  loop: "{{ caddy_crs_plugins }}"
  loop_control:
    loop_var: "plugin"
  ansible.builtin.include_tasks: "plugin_install.yml"

- name: Deploy caddy service file
  ansible.builtin.template:
    src: "templates/caddy.service"
    dest: "/etc/systemd/system/{{ caddy_my_name }}.service"
    mode: "0644"
  notify:
    - "Restart Caddy"