bgwaf/seb4itik/byow/roles/caddy/tasks/plugin_install.yml

- name: Download plugin {{ plugin.name }}
  ansible.builtin.get_url:
    url: "https://github.com/{{ plugin.provider | default('coreruleset') }}/{{ plugin.name }}-plugin/archive/refs/tags/v{{ plugin.version }}.tar.gz"
    dest: "/usr/local/src/"
    mode: "0644"
  register: "caddy_plugin_downloaded"

- name: Deploy plugin {{ plugin.name }}
  # noqa: no-handler
  when: "caddy_plugin_downloaded.changed"
  block:

    - name: Get temp dir {{ plugin.name }}
      ansible.builtin.tempfile:
        state: "directory"
      register: "caddy_temp_plugin_dir"

    - name: Unarchive plugin {{ plugin.name }}
      ansible.builtin.unarchive:
        src: "/usr/local/src/{{ plugin.name }}-plugin-{{ plugin.version }}.tar.gz"
        dest: "{{ caddy_temp_plugin_dir.path }}"
        remote_src: true

    - name: Copy plugin files {{ plugin.name }}
      ansible.builtin.copy:
        src: "{{ caddy_temp_plugin_dir.path }}/{{ plugin.name }}-plugin-{{ plugin.version }}/plugins/"
        dest: "{{ caddy_config_dir }}/crs-plugins/"
        mode: "0644"
#       directory_mode: "0750"
        group: "{{ caddy_system_group }}"
        remote_src: true
      notify:
        - "Restart Caddy"

    - name: Create after config {{ plugin.name }}
      when: "not(plugin.has_after_config | default(false))"
      ansible.builtin.copy:
        content: ""
        dest: "{{ caddy_config_dir }}/crs-plugins/{{ plugin.name }}-after.conf"
        mode: "0644"
        group: "{{ caddy_system_group }}"

    # FIXME: bad hack, why is it required?
    - name: Adjust plugins diretory permissions
      ansible.builtin.file:
        path: "{{ caddy_config_dir }}/crs-plugins"
        state: "directory"
        group: "{{ caddy_system_group }}"
        mode: "0750"

    - name: Delete temp dir {{ plugin.name }}
      when: "caddy_temp_plugin_dir.path is defined"
      ansible.builtin.file:
        path: "{{ caddy_temp_plugin_dir.path }}"
        state: "absent"