bgwaf/ansible/roles/caddy/tasks/caddy_install.yml

- name: Remove packaged Go
  ansible.builtin.apt:
    name:
      - "golang"
    state: "absent"
    autoremove: true
    purge: true

- name: Install requirements
  ansible.builtin.apt:
    name:
      - "git"
      - "libnss3-tools"
      - "ssl-cert"

- name: Create Go directory
  ansible.builtin.file:
    path: "/usr/local/go-{{ caddy_go_version }}"
    state: "directory"
    mode: "0755"

- name: Install Go
  ansible.builtin.unarchive:
    src: "https://go.dev/dl/go{{ caddy_go_version }}.linux-amd64.tar.gz"
    dest: "/usr/local/go-{{ caddy_go_version }}"
    remote_src: true

- name: Link Go
  ansible.builtin.file:
    src: "/usr/local/go-{{ caddy_go_version }}/go/bin/go"
    dest: "/usr/local/bin/go"
    state: "link"

- name: Create xcaddy directory
  ansible.builtin.file:
    path: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
    state: "directory"
    mode: "0755"

- name: Install xcaddy
  ansible.builtin.unarchive:
    src: "{{ caddy_xcaddy_download }}/v{{ caddy_xcaddy_version }}/xcaddy_{{ caddy_xcaddy_version }}_linux_amd64.tar.gz"
    dest: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
    remote_src: true

- name: Link xcaddy
  ansible.builtin.file:
    src: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy"
    dest: "/usr/local/bin/xcaddy"
    state: "link"

- name: Create Caddy build command
  ansible.builtin.set_fact:
    caddy_build_command: >
      xcaddy build v{{ caddy_caddy_version }}
      --with github.com/pteich/caddy-tlsconsul
      --with github.com/corazawaf/coraza-caddy/v2@v{{ caddy_coraza_caddy_version }}
      --with github.com/mholt/caddy-ratelimit
      --with github.com/steffenbusch/caddy-bot-barrier
      --output /usr/local/bin/caddy

- name: Test Caddy version
  ansible.builtin.copy:
    dest: "/usr/local/bin/.caddy.build"
    content: "{{ caddy_build_command }}"
    mode: "0644"
  register: caddy_test_caddy_version

- name: Build Caddy
  # noqa: no-handler
  when: "caddy_test_caddy_version.changed"
  ansible.builtin.command:
    cmd: "{{ caddy_build_command }}"
    creates: "/usr/local/bin/caddy"
  notify:
    - "Restart Caddy"

- name: Create Caddy system group
  ansible.builtin.group:
    name: "{{ caddy_system_group }}"
    system: true

- name: Create Caddy system user
  ansible.builtin.user:
    name: "{{ caddy_system_user }}"
    group: "{{ caddy_system_group }}"
    groups: ["ssl-cert"]
    password: "!"
    system: true
    home: "{{ caddy_home_dir }}"

- name: Create Caddy config directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: "directory"
    group: "{{ caddy_system_group }}"
    mode: "0750"
  loop:
    - "{{ caddy_config_dir }}"
    - "{{ caddy_config_dir }}/crs-plugins"
    - "{{ caddy_config_dir }}/sites"

- name: Create Caddy log dir
  ansible.builtin.file:
    path: "{{ caddy_log_dir }}"
    state: "directory"
    group: "{{ caddy_system_group }}"
    mode: "0770"

- name: Install OWASP CRS
  ansible.builtin.unarchive:
    src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ caddy_owasp_crs_version }}.tar.gz"
    dest: "{{ caddy_config_dir }}"
    group: "{{ caddy_system_group }}"
    remote_src: true

- name: Install plugins
  loop: "{{ caddy_crs_plugins }}"
  loop_control:
    loop_var: "plugin"
  ansible.builtin.include_tasks: "plugin_install.yml"

- name: Deploy caddy service file
  ansible.builtin.template:
    src: "templates/caddy.service"
    dest: "/etc/systemd/system/{{ caddy_system_user }}.service"
    mode: "0644"
  notify:
    - "Restart Caddy"

- name: Enable Caddy
  ansible.builtin.service:
    name: "{{ caddy_system_user }}"
    enabled: true
    daemon_reload: true