add comments, add *_add and *_del variables, add active and passive checks, change geoip2 db dir

seb4itik/byow/roles/caddy/defaults/main.yml

@@ -1,36 +1,48 @@
-# Defaults
-caddy_config_only: false
-caddy_debug: false
+# Several instances of the WAF can be deployed onto the same host if their
+# names are different and they bind to different ports/interfaces. These
+# instances may use different versions of Go, xcaddy, Caddy, and Coraza.
+caddy_my_name: "mywaf"
 caddy_http_port: 80
 caddy_https_port: 443
 caddy_default_bind: ""
 
+# If true, will not install software, just deploy Caddy and OWASP CRS
+# configuration files.
+caddy_config_only: false
+
+# Debug will go to /var/log/<caddy_my_name>/debug.log.
+caddy_debug: false
+
+# Required for Let's Encrypt auto certificates.
+caddy_email: null
+
+# If a custom CA root have to be used.
+caddy_ca_root: null
+
+# Accound id and license key are required if a site use Geoip filtering.
+# See: https://dev.maxmind.com/geoip/updating-databases/
+caddy_geoip_account_id: null    
+caddy_geoip_license_key: null
+caddy_geoip_edition_ids: "GeoLite2-ASN,GeoLite2-Country,GeoLite2-City"
+caddy_geoip_update_frequency: 86400   # In seconds
+
+# Sotware versions
 caddy_version: "2.10.2"
 caddy_go_version: "1.25.6"
 caddy_xcaddy_version: "0.4.5"
-caddy_coraza_caddy_version: "2.1.0"  # Coraza v3.3.3
+caddy_coraza_caddy_version: "v2@v2.1.0"  # Coraza v3.3.3
+# Different sites can use different versions of OWASP CRS
 caddy_owasp_crs_versions: ["4.22.0"]
 
-caddy_my_name: "mywaf"
+# Paths
+caddy_binary: "/usr/local/bin/{{ caddy_my_name }}"
 caddy_system_user: "{{ caddy_my_name }}"
 caddy_system_group: "{{ caddy_my_name }}"
 caddy_home_dir: "/opt/{{ caddy_my_name }}"
 caddy_config_dir: "/etc/{{ caddy_my_name }}"
 caddy_log_dir: "/var/log/{{ caddy_my_name }}"
 
-# Required for Let's Encrypt auto certificates
-caddy_email: null
-
-# If a custom CA root have to be used
-caddy_ca_root: null
-
-# See: https://dev.maxmind.com/geoip/updating-databases/
-caddy_geoip_account_id: null
-caddy_geoip_license_key: null
-caddy_geoip_edition_ids: "GeoLite2-ASN,GeoLite2-Country,GeoLite2-City"
-caddy_geoip_update_frequency: 86400   # In seconds
-
-
+# OWASP CRS plugins that will can be actived per site.
 # Cf.: https://github.com/coreruleset/plugin-registry
 caddy_crs_plugins:
   - name: "drupal-rule-exclusions"
@@ -52,15 +64,16 @@ caddy_crs_plugins:
     provider: "EsadCetiner"
 
 
-# For each site, mandatories parameters
+# Sites
 caddy_sites: []
-# - id: ""
-#   name: ""
-#   paths:
-#     - path: ""  (default "*")
-#       addrs:    (minimum 1 required)
-#         - ""
+# - id: ""            # Mandatory: short id for the site (for site specific directories and files)
+#   name: ""          # Mandatory: canonical domain name
+#   paths:            # Mandatory: targets for the reverse proxy
+#     - path: ""      # Optionnal: path of the request, default "*"
+#       addrs:        # Mandatory: upstreams
+#         - ""        # Mandatory: URL of the upstream, minimum 1 required
 
 
-# Will be merged with caddy_global_sites_defaults
+# For overriding default global parameters. Will be merged with
+# caddy_global_sites_defaults (in vars/main.yml).
 caddy_my_sites_defaults: {}