WIP

ansible/roles/waf_config/defaults/main.yml

@@ -1,5 +1,5 @@
 # Defaults
-waf_config_owasp_crs_version: "4.21.0"
+waf_config_owasp_crs_version: "4.22.0"
 
 # Required unless not site.custom_cert
 waf_config_email: null
@@ -22,8 +22,6 @@ waf_config_sites: []
 #     - ""
 #   aliases:
 #     - ""
-#   plugins:     FIXME:TODO
-#     - ""
 #   exceptions:
 #     before_request:
 #       - ""
@@ -35,6 +33,7 @@ waf_config_defaults:
   custom_cert: true
   custom_cert_file: ""
   custom_key_file: ""
+  plugins: []
 
   rate_events: 1000
   rate_window: "1m"

ansible/roles/waf_config/handlers/main.yml

@@ -1,4 +1,4 @@
-- name: Reload Caddy
+- name: Restart Caddy
   ansible.builtin.service:
     name: "caddy"
-    state: "reloaded"
+    state: "restarted"

ansible/roles/waf_config/tasks/main.yml

@@ -1,9 +1,7 @@
 - name: Create sites config directories
   loop: "{{ waf_config_sites }}"
-  loop_control:
-    loop_var: "site"
   ansible.builtin.file:
-    path: "/etc/caddy/sites/{{ site.name }}"
+    path: "/etc/caddy/sites/{{ item.name }}"
     state: "directory"
     group: "caddy"
     mode: "0750"
@@ -18,7 +16,7 @@
     group: "caddy"
     mode: "0640"
   notify:
-    - "Reload Caddy"
+    - "Restart Caddy"
 
 - name: Generate sites crs-setup config file
   loop: "{{ waf_config_sites }}"
@@ -30,7 +28,7 @@
     group: "caddy"
     mode: "0640"
   notify:
-    - "Reload Caddy"
+    - "Restart Caddy"
 
 - name: Generate sites exclusions before request file
   loop: "{{ waf_config_sites }}"
@@ -42,7 +40,7 @@
     group: "caddy"
     mode: "0640"
   notify:
-    - "Reload Caddy"
+    - "Restart Caddy"
 
 - name: Generate sites exclusions after response file
   loop: "{{ waf_config_sites }}"
@@ -54,7 +52,7 @@
     group: "caddy"
     mode: "0640"
   notify:
-    - "Reload Caddy"
+    - "Restart Caddy"
 
 - name: Generate Caddyfile
   ansible.builtin.template:
@@ -63,7 +61,7 @@
     group: "caddy"
     mode: "0640"
   notify:
-    - "Reload Caddy"
+    - "Restart Caddy"
 
 - name: Copy bot barrier template
   ansible.builtin.copy:
@@ -72,4 +70,4 @@
     group: "caddy"
     mode: "0640"
   notify:
-    - "Reload Caddy"
+    - "Restart Caddy"

ansible/roles/waf_config/templates/Caddyfile

@@ -103,12 +103,16 @@
     directives `
       Include "/etc/caddy/sites/{{ site.name }}/coraza.conf"
       Include "/etc/caddy/sites/{{ site.name }}/crs-setup.conf"
-      Include "/etc/caddy/plugins/*-config.conf"
-      Include "/etc/caddy/plugins/*-before.conf"
+{% for plugin in site.plugins | default(waf_config_defaults.plugins) %}
+      Include "/etc/caddy/plugins/{{ plugin }}-config.conf"
+      Include "/etc/caddy/plugins/{{ plugin }}-before.conf"
+{% endfor %}
       Include "/etc/caddy/sites/{{ site.name }}/exclusions-request-before.conf"
       Include "/etc/caddy/coreruleset-{{ waf_config_owasp_crs_version }}/rules/*.conf"
       Include "/etc/caddy/sites/{{ site.name }}/exclusions-response-after.conf"
-      Include "/etc/caddy/plugins/*-after.conf"
+{% for plugin in site.plugins | default(waf_config_defaults.plugins) %}
+      Include "/etc/caddy/plugins/{{ plugin }}-after.conf"
+{% endfor %}
       SecRuleEngine On
     `
   }