add crowdsec role, move config logs site -> global, remove caddy_ca_root, modularized Caddy build and config

seb4itik/byow/roles/caddy/defaults/main.yml

@@ -6,19 +6,37 @@ caddy_http_port: 80
 caddy_https_port: 443
 caddy_default_bind: null
 
+# Sotware versions
+caddy_go_version: "1.26.1"
+caddy_xcaddy_version: "0.4.5"
+caddy_version: "2.11.2"
+
 # If true, will not install software, just deploy Caddyfile and OWASP CRS
 # configuration files.
 caddy_config_only: false
 
-# Debug will go to /var/log/<caddy_my_name>/debug.log.
-caddy_debug: false
+# Log settings
+# If log_to_file is false, will log to journald.
+# If log_to_file is true, logs will go:
+# - for each site, in: /var/log/<caddy_my_name>/site_<sit.id>.log
+# - for WAF logs (Coraza), in /var/log/<caddy_my_name>/waf.log
+caddy_log_to_file: true
+caddy_log_format: "console"                # "console" or "json"
+caddy_log_debug: false                         # Debug will go to /var/log/<caddy_my_name>/debug.log
+
+# Paths
+caddy_binary: "/usr/local/bin/caddy_{{ caddy_my_name }}"  # Should begin by "caddy" for CrowdSec
+caddy_system_user: "{{ caddy_my_name }}"
+caddy_system_group: "{{ caddy_my_name }}"
+caddy_home_dir: "/opt/{{ caddy_my_name }}"
+caddy_config_dir: "/etc/{{ caddy_my_name }}"
+caddy_crs_plugins_dir: "{{ caddy_config_dir }}/crs-plugins"
+caddy_sites_dir: "{{ caddy_config_dir }}/sites"
+caddy_log_dir: "/var/log/{{ caddy_my_name }}"
 
 # Required for Let's Encrypt auto certificates.
 caddy_email: null
 
-# If a custom CA root have to be used.
-caddy_ca_root: null
-
 # For using a Consul cluster.
 caddy_consul: false
 caddy_consul_server: "{{ ansible_fqdn }}:8501"
@@ -33,32 +51,35 @@ caddy_consul_client_key: null          # Required
 
 # Accound id and license key are required if a site use Geoip filtering.
 # See: https://dev.maxmind.com/geoip/updating-databases/
-caddy_geoip_account_id: null    
-caddy_geoip_license_key: null
+caddy_geoip: false    
+caddy_geoip_account_id: null           # Required
+caddy_geoip_license_key: null          # Required
 caddy_geoip_edition_ids: "GeoLite2-ASN,GeoLite2-Country,GeoLite2-City"
-caddy_geoip_update_frequency: 86400   # In seconds
+caddy_geoip_update_frequency: 86400    # In seconds
 
-# Sotware versions
-caddy_version: "2.11.2"
-caddy_go_version: "1.26.1"
-caddy_xcaddy_version: "0.4.5"
+# CrowdSec
+caddy_crowdsec: false
+caddy_crowdsec_api_key: null           # Required
+caddy_crowdsec_api_url: "http://127.0.0.1:8080"
+caddy_crowdsec_ticker_interval: 15     # In seconds
+caddy_crowdsec_appsec_url: null        # "http://localhost:7422"
+caddy_crowdsec_streaming: true
+caddy_crowdsec_hard_fails: true
+
+# Rate Limit
+caddy_ratelimit: true
+
+# Bot barrier
+caddy_bot_barrier: false
+
+# Coraza
+caddy_coraza: true
 caddy_coraza_caddy_version: "v2@v2.2.0"  # Coraza v3.3.3
 # Different sites can use different versions of OWASP CRS
-caddy_owasp_crs_versions: ["4.24.1"]
-
-# Paths
-caddy_binary: "/usr/local/bin/{{ caddy_my_name }}"
-caddy_system_user: "{{ caddy_my_name }}"
-caddy_system_group: "{{ caddy_my_name }}"
-caddy_home_dir: "/opt/{{ caddy_my_name }}"
-caddy_config_dir: "/etc/{{ caddy_my_name }}"
-caddy_crs_plugins_dir: "{{ caddy_config_dir }}/crs-plugins"
-caddy_sites_dir: "{{ caddy_config_dir }}/sites"
-caddy_log_dir: "/var/log/{{ caddy_my_name }}"
-
+caddy_coraza_crs_versions: ["4.24.1"]
 # OWASP CRS plugins that can be actived per site.
 # Cf.: https://github.com/coreruleset/plugin-registry
-caddy_crs_plugins:
+caddy_coraza_crs_plugins:
   - name: "drupal-rule-exclusions"
     version: "1.0.0"
   - name: "wordpress-rule-exclusions"
@@ -87,6 +108,7 @@ caddy_sites: []
 #       strip_prefix: false  # Optionnal: default "false"
 #       addrs:               # Mandatory: upstreams
 #         - ""               # Mandatory: URL of the upstream, minimum 1 required
+#   ...                      # Site configuration directives (see caddy_global_sites_defaults in vars/main.yml)
 
 
 # For overriding default global parameters. Will be merged with