add crowdsec role, move config logs site -> global, remove caddy_ca_root, modularized Caddy build and config

seb4itik/byow/roles/caddy/tasks/caddy_config.yml

@@ -2,63 +2,63 @@
   ansible.builtin.set_fact:
     caddy_sites_defaults: "{{ caddy_global_sites_defaults | combine(caddy_my_sites_defaults) }}"
 
-- name: Create sites config directories
-  loop: "{{ caddy_sites }}"
-  ansible.builtin.file:
-    path: "{{ caddy_sites_dir }}/{{ item.id }}"
-    state: "directory"
-    group: "{{ caddy_system_group }}"
-    mode: "0750"
-
-- name: Generate sites coraza.conf config file
-  loop: "{{ caddy_sites }}"
-  loop_control:
-    loop_var: "site"
-  ansible.builtin.template:
-    src: "templates/coraza.conf"
-    dest: "{{ caddy_sites_dir }}/{{ site.id }}/coraza.conf"
-    group: "{{ caddy_system_group }}"
-    mode: "0640"
-  notify:
-    - "Restart Caddy"
-
-- name: Generate sites crs-setup config file
-  loop: "{{ caddy_sites }}"
-  loop_control:
-    loop_var: "site"
-  ansible.builtin.template:
-    src: "templates/crs-setup.conf"
-    dest: "{{ caddy_sites_dir }}/{{ site.id }}/crs-setup.conf"
-    group: "{{ caddy_system_group }}"
-    mode: "0640"
-  notify:
-    - "Restart Caddy"
-
-- name: Generate sites exclusions before request file
-  loop: "{{ caddy_sites }}"
-  loop_control:
-    loop_var: "site"
-  ansible.builtin.template:
-    src: "templates/exclusions-request-before.conf"
-    dest: "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-request-before.conf"
-    group: "{{ caddy_system_group }}"
-    mode: "0640"
-  notify:
-    - "Restart Caddy"
-
-- name: Generate sites exclusions after response file
-  loop: "{{ caddy_sites }}"
-  loop_control:
-    loop_var: "site"
-  ansible.builtin.template:
-    src: "templates/exclusions-response-after.conf"
-    dest: "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-response-after.conf"
-    group: "{{ caddy_system_group }}"
-    mode: "0640"
-  notify:
-    - "Restart Caddy"
+- name: Configure Caddy Coraza CRS
+  when: "caddy_coraza"
+  block:
+    - name: Create sites config directories
+      loop: "{{ caddy_sites }}"
+      ansible.builtin.file:
+        path: "{{ caddy_sites_dir }}/{{ item.id }}"
+        state: "directory"
+        group: "{{ caddy_system_group }}"
+        mode: "0750"
+    - name: Generate sites coraza.conf config file
+      loop: "{{ caddy_sites }}"
+      loop_control:
+        loop_var: "site"
+      ansible.builtin.template:
+        src: "templates/coraza.conf"
+        dest: "{{ caddy_sites_dir }}/{{ site.id }}/coraza.conf"
+        group: "{{ caddy_system_group }}"
+        mode: "0640"
+      notify:
+        - "Restart Caddy"
+    - name: Generate sites crs-setup config file
+      loop: "{{ caddy_sites }}"
+      loop_control:
+        loop_var: "site"
+      ansible.builtin.template:
+        src: "templates/crs-setup.conf"
+        dest: "{{ caddy_sites_dir }}/{{ site.id }}/crs-setup.conf"
+        group: "{{ caddy_system_group }}"
+        mode: "0640"
+      notify:
+        - "Restart Caddy"
+    - name: Generate sites exclusions before request file
+      loop: "{{ caddy_sites }}"
+      loop_control:
+        loop_var: "site"
+      ansible.builtin.template:
+        src: "templates/exclusions-request-before.conf"
+        dest: "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-request-before.conf"
+        group: "{{ caddy_system_group }}"
+        mode: "0640"
+      notify:
+        - "Restart Caddy"
+    - name: Generate sites exclusions after response file
+      loop: "{{ caddy_sites }}"
+      loop_control:
+        loop_var: "site"
+      ansible.builtin.template:
+        src: "templates/exclusions-response-after.conf"
+        dest: "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-response-after.conf"
+        group: "{{ caddy_system_group }}"
+        mode: "0640"
+      notify:
+        - "Restart Caddy"
 
 - name: Copy bot barrier template
+  when: "caddy_bot_barrier"
   ansible.builtin.copy:
     src: "files/bot_barrier_template.html"
     dest: "{{ caddy_config_dir }}/bot_barrier_template.html"

seb4itik/byow/roles/caddy/tasks/caddy_crowdsec.yml

@@ -0,0 +1,19 @@
+- name: Get collections list
+  ansible.builtin.shell:
+    executable: "/usr/bin/bash"
+    cmd: |
+      set -o pipefail
+      cscli collection list --output=json |jq -r '.collections[] |.name'
+  register: "crowdsec_out_list_collections"
+  changed_when: false
+
+- name: Install collections
+  loop:
+    - "crowdsecurity/caddy"
+    - "barnoux/caddy-coraza"
+  when: "item not in crowdsec_out_list_collections.stdout_lines"
+  ansible.builtin.command:
+    cmd: "cscli collections install {{ item }}"
+  changed_when: true
+  notify:
+    - "Restart Crowdsec Securiy Engine"

seb4itik/byow/roles/caddy/tasks/caddy_install.yml

@@ -37,11 +37,26 @@
   ansible.builtin.set_fact:
     caddy_build_command: >
       /usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy build v{{ caddy_version }}
-      --with github.com/pteich/caddy-tlsconsul
+      {% if caddy_coraza %}
       --with github.com/corazawaf/coraza-caddy/{{ caddy_coraza_caddy_version }}
+      {% endif %}
+      {% if caddy_ratelimit %}
       --with github.com/mholt/caddy-ratelimit
+      {% endif %}
+      {% if caddy_consul %}
+      --with github.com/pteich/caddy-tlsconsul
+      {% endif %}
+      {% if caddy_bot_barrier %}
       --with github.com/steffenbusch/caddy-bot-barrier
+      {% endif %}
+      {% if caddy_geoip %}
       --with github.com/zhangjiayin/caddy-geoip2
+      {% endif %}
+      {% if caddy_crowdsec %}
+      --with github.com/hslatman/caddy-crowdsec-bouncer/http
+      --with github.com/hslatman/caddy-crowdsec-bouncer/layer4
+      --with github.com/hslatman/caddy-crowdsec-bouncer/appsec
+      {% endif %}
       --output {{ caddy_binary }}
 
 - name: Remember and test Caddy version
@@ -95,7 +110,8 @@
       owner: "{{ caddy_system_user }}"
 
 - name: Install OWASP CRS
-  loop: "{{ caddy_owasp_crs_versions }}"
+  when: "caddy_coraza"
+  loop: "{{ caddy_coraza_crs_versions }}"
   ansible.builtin.unarchive:
     src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ item }}.tar.gz"
     dest: "{{ caddy_config_dir }}"
@@ -103,8 +119,9 @@
     group: "{{ caddy_system_group }}"
     remote_src: true
 
-- name: Install plugins
-  loop: "{{ caddy_crs_plugins }}"
+- name: Install CRS plugins
+  when: "caddy_coraza"
+  loop: "{{ caddy_coraza_crs_plugins }}"
   ansible.builtin.unarchive:
     src: "https://github.com/{{ item.provider | default('coreruleset') }}/{{ item.name }}-plugin/archive/refs/tags/v{{ item.version }}.tar.gz"
     dest: "{{ caddy_crs_plugins_dir }}"
@@ -118,9 +135,9 @@
     group: "{{ caddy_system_group }}"
     remote_src: true
 
-- name: Create plugins after config
-  loop: "{{ caddy_crs_plugins }}"
-  when: "not(item.has_after_config | default(false))"
+- name: Create CRS plugins after config
+  loop: "{{ caddy_coraza_crs_plugins }}"
+  when: "caddy_coraza and not(item.has_after_config | default(false))"
   ansible.builtin.copy:
     content: ""
     dest: "{{ caddy_crs_plugins_dir }}/{{ item.name }}-after.conf"

seb4itik/byow/roles/caddy/tasks/main.yml

@@ -6,5 +6,9 @@
   when: "caddy_consul"
   ansible.builtin.include_tasks: "caddy_consul.yml"
 
+- name: Configure CrowdSec for Caddy
+  when: "caddy_crowdsec"
+  ansible.builtin.include_tasks: "caddy_crowdsec.yml"
+
 - name: Configure Caddy
   ansible.builtin.include_tasks: "caddy_config.yml"