WIP

ansible/roles/waf_install/defaults/main.yml

@@ -2,10 +2,7 @@ waf_install_go_version: "1.25.5"
 waf_install_xcaddy_version: "0.4.5"
 waf_install_caddy_version: "2.10.2"
 waf_install_coraza_caddy_version: "2.1.0"  # Coraza v3.3.3
-waf_install_owasp_crs_version: "4.21.0"
-
-# Cluster mode (e.g. with consul)
-waf_install_cluster: false
+waf_install_owasp_crs_version: "4.22.0"
 
 # Cf.: https://github.com/coreruleset/plugin-registry
 waf_install_crs_plugins:
@@ -19,6 +16,7 @@ waf_install_crs_plugins:
     version: "1.0.0"
   - name: "phpmyadmin-rule-exclusions"
     version: "1.0.0"
+    has_after_config: true
   - name: "roundcube-rule-exclusions"
     version: "1.0.4"
     provider: "EsadCetiner"

ansible/roles/waf_install/tasks/install_plugin.yml

@@ -30,7 +30,15 @@
         group: "caddy"
         remote_src: true
       notify:
-        - "Reload Caddy"
+        - "Restart Caddy"
+
+    - name: Create after config {{ plugin.name }}
+      when: "not(plugin.has_after_config | default(false))"
+      ansible.builtin.copy:
+        content: ""
+        dest: "/etc/caddy/plugins/{{ plugin.name }}-after.conf"
+        mode: "0644"
+        group: "caddy"
 
     # FIXME: bad hack, why is it required?
     - name: Adjust /etc/caddy/plugins permissions

ansible/roles/waf_install/tasks/main.yml

@@ -30,20 +30,29 @@
     dest: "/usr/local/bin/go"
     state: "link"
 
-# FIXME: no .deb
+- name: Create xcaddy directory
+  ansible.builtin.file:
+    path: "/usr/local/xcaddy-{{ waf_install_xcaddy_version }}"
+    state: "directory"
+    mode: "0755"
+
 - name: Install xcaddy
-  when: |
-    'xcaddy' not in ansible_facts.packages
-    or ansible_facts.packages['xcaddy'][0]['version'] != waf_install_xcaddy_version
-  ansible.builtin.apt:
-    deb: "{{ waf_install_xcaddy_download }}/v{{ waf_install_xcaddy_version }}/xcaddy_{{ waf_install_xcaddy_version }}_linux_amd64.deb"
-    force: true
+  ansible.builtin.unarchive:
+    src: "{{ waf_install_xcaddy_download }}/v{{ waf_install_xcaddy_version }}/xcaddy_{{ waf_install_xcaddy_version }}_linux_amd64.tar.gz"
+    dest: "/usr/local/xcaddy-{{ waf_install_xcaddy_version }}"
+    remote_src: true
+
+- name: Link xcaddy
+  ansible.builtin.file:
+    src: "/usr/local/xcaddy-{{ waf_install_xcaddy_version }}/xcaddy"
+    dest: "/usr/local/bin/xcaddy"
+    state: "link"
 
 - name: Create Caddy build command
   ansible.builtin.set_fact:
     waf_install_build_command: >
       xcaddy build v{{ waf_install_caddy_version }}
-      {% if waf_install_cluster %}  --with github.com/pteich/caddy-tlsconsul{% endif %}
+      --with github.com/pteich/caddy-tlsconsul
       --with github.com/corazawaf/coraza-caddy/v2@v{{ waf_install_coraza_caddy_version }}
       --with github.com/mholt/caddy-ratelimit
       --with github.com/steffenbusch/caddy-bot-barrier