add crowdsec role, move config logs site -> global, remove caddy_ca_root, modularized Caddy build and config

seb4itik/byow/roles/caddy/defaults/main.yml

@@ -6,19 +6,37 @@ caddy_http_port: 80
 caddy_https_port: 443
 caddy_default_bind: null
 
+# Sotware versions
+caddy_go_version: "1.26.1"
+caddy_xcaddy_version: "0.4.5"
+caddy_version: "2.11.2"
+
 # If true, will not install software, just deploy Caddyfile and OWASP CRS
 # configuration files.
 caddy_config_only: false
 
-# Debug will go to /var/log/<caddy_my_name>/debug.log.
-caddy_debug: false
+# Log settings
+# If log_to_file is false, will log to journald.
+# If log_to_file is true, logs will go:
+# - for each site, in: /var/log/<caddy_my_name>/site_<sit.id>.log
+# - for WAF logs (Coraza), in /var/log/<caddy_my_name>/waf.log
+caddy_log_to_file: true
+caddy_log_format: "console"                # "console" or "json"
+caddy_log_debug: false                         # Debug will go to /var/log/<caddy_my_name>/debug.log
+
+# Paths
+caddy_binary: "/usr/local/bin/caddy_{{ caddy_my_name }}"  # Should begin by "caddy" for CrowdSec
+caddy_system_user: "{{ caddy_my_name }}"
+caddy_system_group: "{{ caddy_my_name }}"
+caddy_home_dir: "/opt/{{ caddy_my_name }}"
+caddy_config_dir: "/etc/{{ caddy_my_name }}"
+caddy_crs_plugins_dir: "{{ caddy_config_dir }}/crs-plugins"
+caddy_sites_dir: "{{ caddy_config_dir }}/sites"
+caddy_log_dir: "/var/log/{{ caddy_my_name }}"
 
 # Required for Let's Encrypt auto certificates.
 caddy_email: null
 
-# If a custom CA root have to be used.
-caddy_ca_root: null
-
 # For using a Consul cluster.
 caddy_consul: false
 caddy_consul_server: "{{ ansible_fqdn }}:8501"
@@ -33,32 +51,35 @@ caddy_consul_client_key: null          # Required
 
 # Accound id and license key are required if a site use Geoip filtering.
 # See: https://dev.maxmind.com/geoip/updating-databases/
-caddy_geoip_account_id: null    
-caddy_geoip_license_key: null
+caddy_geoip: false    
+caddy_geoip_account_id: null           # Required
+caddy_geoip_license_key: null          # Required
 caddy_geoip_edition_ids: "GeoLite2-ASN,GeoLite2-Country,GeoLite2-City"
-caddy_geoip_update_frequency: 86400   # In seconds
+caddy_geoip_update_frequency: 86400    # In seconds
 
-# Sotware versions
-caddy_version: "2.11.2"
-caddy_go_version: "1.26.1"
-caddy_xcaddy_version: "0.4.5"
+# CrowdSec
+caddy_crowdsec: false
+caddy_crowdsec_api_key: null           # Required
+caddy_crowdsec_api_url: "http://127.0.0.1:8080"
+caddy_crowdsec_ticker_interval: 15     # In seconds
+caddy_crowdsec_appsec_url: null        # "http://localhost:7422"
+caddy_crowdsec_streaming: true
+caddy_crowdsec_hard_fails: true
+
+# Rate Limit
+caddy_ratelimit: true
+
+# Bot barrier
+caddy_bot_barrier: false
+
+# Coraza
+caddy_coraza: true
 caddy_coraza_caddy_version: "v2@v2.2.0"  # Coraza v3.3.3
 # Different sites can use different versions of OWASP CRS
-caddy_owasp_crs_versions: ["4.24.1"]
-
-# Paths
-caddy_binary: "/usr/local/bin/{{ caddy_my_name }}"
-caddy_system_user: "{{ caddy_my_name }}"
-caddy_system_group: "{{ caddy_my_name }}"
-caddy_home_dir: "/opt/{{ caddy_my_name }}"
-caddy_config_dir: "/etc/{{ caddy_my_name }}"
-caddy_crs_plugins_dir: "{{ caddy_config_dir }}/crs-plugins"
-caddy_sites_dir: "{{ caddy_config_dir }}/sites"
-caddy_log_dir: "/var/log/{{ caddy_my_name }}"
-
+caddy_coraza_crs_versions: ["4.24.1"]
 # OWASP CRS plugins that can be actived per site.
 # Cf.: https://github.com/coreruleset/plugin-registry
-caddy_crs_plugins:
+caddy_coraza_crs_plugins:
   - name: "drupal-rule-exclusions"
     version: "1.0.0"
   - name: "wordpress-rule-exclusions"
@@ -87,6 +108,7 @@ caddy_sites: []
 #       strip_prefix: false  # Optionnal: default "false"
 #       addrs:               # Mandatory: upstreams
 #         - ""               # Mandatory: URL of the upstream, minimum 1 required
+#   ...                      # Site configuration directives (see caddy_global_sites_defaults in vars/main.yml)
 
 
 # For overriding default global parameters. Will be merged with

seb4itik/byow/roles/caddy/handlers/main.yml

@@ -6,3 +6,8 @@
   ansible.builtin.service:
     name: "{{ caddy_my_name }}"
     state: "restarted"
+
+- name: Restart Crowdsec Securiy Engine
+  ansible.builtin.systemd_service:
+    name: "crowdsec"
+    state: "restarted"

seb4itik/byow/roles/caddy/tasks/caddy_config.yml

@@ -2,63 +2,63 @@
   ansible.builtin.set_fact:
     caddy_sites_defaults: "{{ caddy_global_sites_defaults | combine(caddy_my_sites_defaults) }}"
 
-- name: Create sites config directories
-  loop: "{{ caddy_sites }}"
-  ansible.builtin.file:
-    path: "{{ caddy_sites_dir }}/{{ item.id }}"
-    state: "directory"
-    group: "{{ caddy_system_group }}"
-    mode: "0750"
-
-- name: Generate sites coraza.conf config file
-  loop: "{{ caddy_sites }}"
-  loop_control:
-    loop_var: "site"
-  ansible.builtin.template:
-    src: "templates/coraza.conf"
-    dest: "{{ caddy_sites_dir }}/{{ site.id }}/coraza.conf"
-    group: "{{ caddy_system_group }}"
-    mode: "0640"
-  notify:
-    - "Restart Caddy"
-
-- name: Generate sites crs-setup config file
-  loop: "{{ caddy_sites }}"
-  loop_control:
-    loop_var: "site"
-  ansible.builtin.template:
-    src: "templates/crs-setup.conf"
-    dest: "{{ caddy_sites_dir }}/{{ site.id }}/crs-setup.conf"
-    group: "{{ caddy_system_group }}"
-    mode: "0640"
-  notify:
-    - "Restart Caddy"
-
-- name: Generate sites exclusions before request file
-  loop: "{{ caddy_sites }}"
-  loop_control:
-    loop_var: "site"
-  ansible.builtin.template:
-    src: "templates/exclusions-request-before.conf"
-    dest: "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-request-before.conf"
-    group: "{{ caddy_system_group }}"
-    mode: "0640"
-  notify:
-    - "Restart Caddy"
-
-- name: Generate sites exclusions after response file
-  loop: "{{ caddy_sites }}"
-  loop_control:
-    loop_var: "site"
-  ansible.builtin.template:
-    src: "templates/exclusions-response-after.conf"
-    dest: "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-response-after.conf"
-    group: "{{ caddy_system_group }}"
-    mode: "0640"
-  notify:
-    - "Restart Caddy"
+- name: Configure Caddy Coraza CRS
+  when: "caddy_coraza"
+  block:
+    - name: Create sites config directories
+      loop: "{{ caddy_sites }}"
+      ansible.builtin.file:
+        path: "{{ caddy_sites_dir }}/{{ item.id }}"
+        state: "directory"
+        group: "{{ caddy_system_group }}"
+        mode: "0750"
+    - name: Generate sites coraza.conf config file
+      loop: "{{ caddy_sites }}"
+      loop_control:
+        loop_var: "site"
+      ansible.builtin.template:
+        src: "templates/coraza.conf"
+        dest: "{{ caddy_sites_dir }}/{{ site.id }}/coraza.conf"
+        group: "{{ caddy_system_group }}"
+        mode: "0640"
+      notify:
+        - "Restart Caddy"
+    - name: Generate sites crs-setup config file
+      loop: "{{ caddy_sites }}"
+      loop_control:
+        loop_var: "site"
+      ansible.builtin.template:
+        src: "templates/crs-setup.conf"
+        dest: "{{ caddy_sites_dir }}/{{ site.id }}/crs-setup.conf"
+        group: "{{ caddy_system_group }}"
+        mode: "0640"
+      notify:
+        - "Restart Caddy"
+    - name: Generate sites exclusions before request file
+      loop: "{{ caddy_sites }}"
+      loop_control:
+        loop_var: "site"
+      ansible.builtin.template:
+        src: "templates/exclusions-request-before.conf"
+        dest: "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-request-before.conf"
+        group: "{{ caddy_system_group }}"
+        mode: "0640"
+      notify:
+        - "Restart Caddy"
+    - name: Generate sites exclusions after response file
+      loop: "{{ caddy_sites }}"
+      loop_control:
+        loop_var: "site"
+      ansible.builtin.template:
+        src: "templates/exclusions-response-after.conf"
+        dest: "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-response-after.conf"
+        group: "{{ caddy_system_group }}"
+        mode: "0640"
+      notify:
+        - "Restart Caddy"
 
 - name: Copy bot barrier template
+  when: "caddy_bot_barrier"
   ansible.builtin.copy:
     src: "files/bot_barrier_template.html"
     dest: "{{ caddy_config_dir }}/bot_barrier_template.html"

seb4itik/byow/roles/caddy/tasks/caddy_crowdsec.yml

@@ -0,0 +1,19 @@
+- name: Get collections list
+  ansible.builtin.shell:
+    executable: "/usr/bin/bash"
+    cmd: |
+      set -o pipefail
+      cscli collection list --output=json |jq -r '.collections[] |.name'
+  register: "crowdsec_out_list_collections"
+  changed_when: false
+
+- name: Install collections
+  loop:
+    - "crowdsecurity/caddy"
+    - "barnoux/caddy-coraza"
+  when: "item not in crowdsec_out_list_collections.stdout_lines"
+  ansible.builtin.command:
+    cmd: "cscli collections install {{ item }}"
+  changed_when: true
+  notify:
+    - "Restart Crowdsec Securiy Engine"

seb4itik/byow/roles/caddy/tasks/caddy_install.yml

@@ -37,11 +37,26 @@
   ansible.builtin.set_fact:
     caddy_build_command: >
       /usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy build v{{ caddy_version }}
-      --with github.com/pteich/caddy-tlsconsul
+      {% if caddy_coraza %}
       --with github.com/corazawaf/coraza-caddy/{{ caddy_coraza_caddy_version }}
+      {% endif %}
+      {% if caddy_ratelimit %}
       --with github.com/mholt/caddy-ratelimit
+      {% endif %}
+      {% if caddy_consul %}
+      --with github.com/pteich/caddy-tlsconsul
+      {% endif %}
+      {% if caddy_bot_barrier %}
       --with github.com/steffenbusch/caddy-bot-barrier
+      {% endif %}
+      {% if caddy_geoip %}
       --with github.com/zhangjiayin/caddy-geoip2
+      {% endif %}
+      {% if caddy_crowdsec %}
+      --with github.com/hslatman/caddy-crowdsec-bouncer/http
+      --with github.com/hslatman/caddy-crowdsec-bouncer/layer4
+      --with github.com/hslatman/caddy-crowdsec-bouncer/appsec
+      {% endif %}
       --output {{ caddy_binary }}
 
 - name: Remember and test Caddy version
@@ -95,7 +110,8 @@
       owner: "{{ caddy_system_user }}"
 
 - name: Install OWASP CRS
-  loop: "{{ caddy_owasp_crs_versions }}"
+  when: "caddy_coraza"
+  loop: "{{ caddy_coraza_crs_versions }}"
   ansible.builtin.unarchive:
     src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ item }}.tar.gz"
     dest: "{{ caddy_config_dir }}"
@@ -103,8 +119,9 @@
     group: "{{ caddy_system_group }}"
     remote_src: true
 
-- name: Install plugins
-  loop: "{{ caddy_crs_plugins }}"
+- name: Install CRS plugins
+  when: "caddy_coraza"
+  loop: "{{ caddy_coraza_crs_plugins }}"
   ansible.builtin.unarchive:
     src: "https://github.com/{{ item.provider | default('coreruleset') }}/{{ item.name }}-plugin/archive/refs/tags/v{{ item.version }}.tar.gz"
     dest: "{{ caddy_crs_plugins_dir }}"
@@ -118,9 +135,9 @@
     group: "{{ caddy_system_group }}"
     remote_src: true
 
-- name: Create plugins after config
-  loop: "{{ caddy_crs_plugins }}"
-  when: "not(item.has_after_config | default(false))"
+- name: Create CRS plugins after config
+  loop: "{{ caddy_coraza_crs_plugins }}"
+  when: "caddy_coraza and not(item.has_after_config | default(false))"
   ansible.builtin.copy:
     content: ""
     dest: "{{ caddy_crs_plugins_dir }}/{{ item.name }}-after.conf"

seb4itik/byow/roles/caddy/tasks/main.yml

@@ -6,5 +6,9 @@
   when: "caddy_consul"
   ansible.builtin.include_tasks: "caddy_consul.yml"
 
+- name: Configure CrowdSec for Caddy
+  when: "caddy_crowdsec"
+  ansible.builtin.include_tasks: "caddy_crowdsec.yml"
+
 - name: Configure Caddy
   ansible.builtin.include_tasks: "caddy_config.yml"

seb4itik/byow/roles/caddy/templates/Caddyfile

@@ -1,31 +1,38 @@
 {
   http_port {{ caddy_http_port }}
   https_port {{ caddy_https_port }}
+  admin off
+  persist_config off
 {% if caddy_default_bind != None %}
   default_bind {{ caddy_default_bind }}
 {% endif %}
+{% if caddy_crowdsec %}
+  order crowdsec first
+{% endif %}
+{% if caddy_geoip %}
   order geoip2_vars first
+{% endif %}
+{% if caddy_coraza %}
   order coraza_waf first
-  admin off
-  persist_config off
+{% endif %}
 
 {% if caddy_consul %}
   storage consul {
     address      "{{ caddy_consul_server }}"
-    token        "{{ caddy_out_consul_token.token.SecretID }}"
+    token        "{{ caddy_out_consul_token.token.SecretID | mandatory }}"
     timeout      10
     prefix       "caddy-{{ caddy_my_name }}-tls"
     value_prefix "{{ caddy_my_name }}"
-    aes_key      "{{ caddy_consul_aes_key }}"
+    aes_key      "{{ caddy_consul_aes_key | mandatory }}"
     tls_enabled  "true"
     tls_insecure "false"
   }
 {% endif %}
 
-{% if caddy_geoip_account_id != None and caddy_geoip_license_key != None %}
+{% if caddy_geoip %}
   geoip2 {
-    accountId         "{{ caddy_geoip_account_id }}"
-    licenseKey        "{{ caddy_geoip_license_key }}"
+    accountId         "{{ caddy_geoip_account_id | mandatory }}"
+    licenseKey        "{{ caddy_geoip_license_key | mandatory }}"
     databaseDirectory "{{ caddy_home_dir }}/geoip2"
     lockFile          "{{ caddy_home_dir }}/geoip2/.geoip2.lock"
     editionID         "{{ caddy_geoip_edition_ids }}"
@@ -38,32 +45,48 @@
   email "{{ caddy_email }}"
 {% endif %}
 
-{% if caddy_ca_root | default(None) != None %}
-  tls {
-    ca_root "{{ caddy_ca_root }}"
-  }
-{% endif %}
-
-{% if caddy_debug %}
-  log {
-    format json
-    level DEBUG
-    output file {{ caddy_log_dir }}/debug.log
+{% if caddy_crowdsec %}
+  crowdsec {
+    api_key {{ caddy_crowdsec_api_key | mandatory }}
+    api_url {{ caddy_crowdsec_api_url }}
+    ticker_interval {{ caddy_crowdsec_ticker_interval }}s
+{% if caddy_crowdsec_appsec_url != None %}
+    appsec_url {{ caddy_crowdsec_appsec_url }}
+{% endif %}
+{% if not caddy_crowdsec_streaming %}
+    disable_streaming
+{% endif %}
+{% if caddy_crowdsec_hard_fails %}
+    enable_hard_fails
+{% endif %}
   }
 {% endif %}
 
+{% if caddy_coraza %}
   log waf {
-    format {{ caddy_sites_defaults.log_format }}
     include "http.handlers.waf"
+    format {{ caddy_log_format }}
     format append {
       waf_id {{ caddy_my_name }}
     }
-{% if caddy_sites_defaults.log_to_file %}
+{% if caddy_log_to_file %}
     output file {{ caddy_log_dir }}/waf.log
 {% else %}
     output stdout
 {% endif %}
   }
+{% endif %}
+
+{% if caddy_log_debug %}
+  log {
+    level DEBUG
+    format {{ caddy_log_format }}
+    format append {
+      waf_id {{ caddy_my_name }}
+    }
+    output file {{ caddy_log_dir }}/debug.log
+  }
+{% endif %}
 }
 
 # 0=origin, 1=methods, 2=headers, 3=allow credentials, 4=max age, 5=vary, 6=expose headers
@@ -105,7 +128,7 @@
 
 {% for site in caddy_sites %}
 
-{% if (site.site_redirect_from_aliases | default(caddy_sites_defaults.site_redirect_from_aliases)) and (site.site_aliases | default([]) | length) > 0 %}
+{% if (site.site_aliases_redirect | default(caddy_sites_defaults.site_aliases_redirect)) and (site.site_aliases | default([]) | length) > 0 %}
 {{ site.site_aliases | join(', ') }} {
   redir https://{{ site.name }}{uri}
 }
@@ -117,6 +140,10 @@
 {{ site.name }} {
   encode gzip zstd
 
+{% if caddy_crowdsec and site.crowdsec | default(caddy_sites_defaults.crowdsec) %}
+  crowdsec
+{% endif %}
+
 {% for path in site.paths %}
   handle{% if path.strip_prefix | default(false) %}_path{% endif %} {{ path.path | default('*') }} {
     reverse_proxy {
@@ -161,7 +188,7 @@
   respond @blocked "Access Denied" 403
 {% endif %}
 
-{% if site.geoip | default(caddy_sites_defaults.geoip) %}
+{% if caddy_geoip and site.geoip | default(caddy_sites_defaults.geoip) %}
   geoip2_vars strict
   @geofilter expression {{ site.geoip_filter_expression | default(caddy_sites_defaults.geoip_filter_expression) }}
   respond @geofilter "Access Denied" 403
@@ -203,7 +230,7 @@
 {% endfor %}
   }
 
-{% if site.rate_limit | default(caddy_sites_defaults.rate_limit) %}
+{% if caddy_ratelimit and site.rate_limit | default(caddy_sites_defaults.rate_limit) %}
   rate_limit @not_whitelisted {
 {% if caddy_consul %}
     distributed
@@ -216,7 +243,7 @@
       aes_key      "{{ caddy_consul_aes_key }}"
       tls_enabled  "true"
       tls_insecure "false"
-  }
+    }
 {%  endif %}
     log_key
     zone remote_ip {
@@ -227,7 +254,7 @@
   }
 {% endif %}
 
-{% if site.crs | default(caddy_sites_defaults.crs) %}
+{% if caddy_coraza and site.crs | default(caddy_sites_defaults.crs) %}
   coraza_waf @not_whitelisted {
     load_owasp_crs
     directives `
@@ -261,7 +288,7 @@
   import cors-deny
 {% endif %}
 
-{% if site.bot_barrier | default(caddy_sites_defaults.bot_barrier) %}
+{% if caddy_bot_barrier and site.bot_barrier | default(caddy_sites_defaults.bot_barrier) %}
   bot_barrier @not_whitelisted {
      secret {{ site.bot_barrier_secret | default(caddy_sites_defaults.bot_barrier_secret) | mandatory }}
      complexity {{ site.bot_barrier_complexity | default(caddy_sites_defaults.bot_barrier_complexity) }}
@@ -303,12 +330,12 @@
   }
 
   log {
-    format {{ site.log_format | default(caddy_sites_defaults.log_format) }}
     level INFO
+    format {{ caddy_log_format }}
     format append {
       waf_id {{ caddy_my_name }}
     }
-{% if site.log_to_file | default(caddy_sites_defaults.log_to_file) %}
+{% if caddy_log_to_file %}
     output file {{ caddy_log_dir }}/site_{{ site.id }}.log
 {% else %}
     output stdout

seb4itik/byow/roles/caddy/vars/main.yml

@@ -1,16 +1,9 @@
 # Sites default parameter values
 caddy_global_sites_defaults:
 
-  # Site settings
+  # Site aliases
+  site_aliases_redirect: true
   site_aliases: []
-  site_redirect_from_aliases: true
-
-  # Log settings
-  # If log_to_file is true, logs will go:
-  # - for each site, in: /var/log/<caddy_my_name>/site_<site id>.log
-  # - for WAF logs (Coraza), in /var/log/<caddy_my_name>/waf.log
-  log_to_file: false
-  log_format: "json"
 
   # Proxy settings
   # See: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#lb_policy
@@ -90,6 +83,7 @@ caddy_global_sites_defaults:
     - "Content-Length"
     - "Content-Range"
 
+  # Security headers
   header: true
 
   # Security headers
@@ -274,12 +268,12 @@ caddy_global_sites_defaults:
       value: "🍷"
 
   # caddy-ratelimit
-  rate_limit: true
+  rate_limit: "{{ caddy_ratelimit }}"
   rate_limit_events: 1000
   rate_limit_window: "1m"
 
   # steffenbusch/caddy-bot-barrier
-  bot_barrier: false
+  bot_barrier: "{{ caddy_bot_barrier }}"
   bot_barrier_secret: null    # Required
   bot_barrier_complexity: 18
   bot_barrier_valid_for: "60m"
@@ -471,3 +465,5 @@ caddy_global_sites_defaults:
   geoip: false
   geoip_debug: false
   geoip_filter_expression: '{geoip2.country_code} == "UNK"'
+
+  crowdsec: "{{ caddy_crowdsec }}"