add crowdsec role, move config logs site -> global, remove caddy_ca_root, modularized Caddy build and config

seb4itik/byow/roles/caddy/templates/Caddyfile

@@ -1,31 +1,38 @@
 {
   http_port {{ caddy_http_port }}
   https_port {{ caddy_https_port }}
+  admin off
+  persist_config off
 {% if caddy_default_bind != None %}
   default_bind {{ caddy_default_bind }}
 {% endif %}
+{% if caddy_crowdsec %}
+  order crowdsec first
+{% endif %}
+{% if caddy_geoip %}
   order geoip2_vars first
+{% endif %}
+{% if caddy_coraza %}
   order coraza_waf first
-  admin off
-  persist_config off
+{% endif %}
 
 {% if caddy_consul %}
   storage consul {
     address      "{{ caddy_consul_server }}"
-    token        "{{ caddy_out_consul_token.token.SecretID }}"
+    token        "{{ caddy_out_consul_token.token.SecretID | mandatory }}"
     timeout      10
     prefix       "caddy-{{ caddy_my_name }}-tls"
     value_prefix "{{ caddy_my_name }}"
-    aes_key      "{{ caddy_consul_aes_key }}"
+    aes_key      "{{ caddy_consul_aes_key | mandatory }}"
     tls_enabled  "true"
     tls_insecure "false"
   }
 {% endif %}
 
-{% if caddy_geoip_account_id != None and caddy_geoip_license_key != None %}
+{% if caddy_geoip %}
   geoip2 {
-    accountId         "{{ caddy_geoip_account_id }}"
-    licenseKey        "{{ caddy_geoip_license_key }}"
+    accountId         "{{ caddy_geoip_account_id | mandatory }}"
+    licenseKey        "{{ caddy_geoip_license_key | mandatory }}"
     databaseDirectory "{{ caddy_home_dir }}/geoip2"
     lockFile          "{{ caddy_home_dir }}/geoip2/.geoip2.lock"
     editionID         "{{ caddy_geoip_edition_ids }}"
@@ -38,32 +45,48 @@
   email "{{ caddy_email }}"
 {% endif %}
 
-{% if caddy_ca_root | default(None) != None %}
-  tls {
-    ca_root "{{ caddy_ca_root }}"
-  }
-{% endif %}
-
-{% if caddy_debug %}
-  log {
-    format json
-    level DEBUG
-    output file {{ caddy_log_dir }}/debug.log
+{% if caddy_crowdsec %}
+  crowdsec {
+    api_key {{ caddy_crowdsec_api_key | mandatory }}
+    api_url {{ caddy_crowdsec_api_url }}
+    ticker_interval {{ caddy_crowdsec_ticker_interval }}s
+{% if caddy_crowdsec_appsec_url != None %}
+    appsec_url {{ caddy_crowdsec_appsec_url }}
+{% endif %}
+{% if not caddy_crowdsec_streaming %}
+    disable_streaming
+{% endif %}
+{% if caddy_crowdsec_hard_fails %}
+    enable_hard_fails
+{% endif %}
   }
 {% endif %}
 
+{% if caddy_coraza %}
   log waf {
-    format {{ caddy_sites_defaults.log_format }}
     include "http.handlers.waf"
+    format {{ caddy_log_format }}
     format append {
       waf_id {{ caddy_my_name }}
     }
-{% if caddy_sites_defaults.log_to_file %}
+{% if caddy_log_to_file %}
     output file {{ caddy_log_dir }}/waf.log
 {% else %}
     output stdout
 {% endif %}
   }
+{% endif %}
+
+{% if caddy_log_debug %}
+  log {
+    level DEBUG
+    format {{ caddy_log_format }}
+    format append {
+      waf_id {{ caddy_my_name }}
+    }
+    output file {{ caddy_log_dir }}/debug.log
+  }
+{% endif %}
 }
 
 # 0=origin, 1=methods, 2=headers, 3=allow credentials, 4=max age, 5=vary, 6=expose headers
@@ -105,7 +128,7 @@
 
 {% for site in caddy_sites %}
 
-{% if (site.site_redirect_from_aliases | default(caddy_sites_defaults.site_redirect_from_aliases)) and (site.site_aliases | default([]) | length) > 0 %}
+{% if (site.site_aliases_redirect | default(caddy_sites_defaults.site_aliases_redirect)) and (site.site_aliases | default([]) | length) > 0 %}
 {{ site.site_aliases | join(', ') }} {
   redir https://{{ site.name }}{uri}
 }
@@ -117,6 +140,10 @@
 {{ site.name }} {
   encode gzip zstd
 
+{% if caddy_crowdsec and site.crowdsec | default(caddy_sites_defaults.crowdsec) %}
+  crowdsec
+{% endif %}
+
 {% for path in site.paths %}
   handle{% if path.strip_prefix | default(false) %}_path{% endif %} {{ path.path | default('*') }} {
     reverse_proxy {
@@ -161,7 +188,7 @@
   respond @blocked "Access Denied" 403
 {% endif %}
 
-{% if site.geoip | default(caddy_sites_defaults.geoip) %}
+{% if caddy_geoip and site.geoip | default(caddy_sites_defaults.geoip) %}
   geoip2_vars strict
   @geofilter expression {{ site.geoip_filter_expression | default(caddy_sites_defaults.geoip_filter_expression) }}
   respond @geofilter "Access Denied" 403
@@ -203,7 +230,7 @@
 {% endfor %}
   }
 
-{% if site.rate_limit | default(caddy_sites_defaults.rate_limit) %}
+{% if caddy_ratelimit and site.rate_limit | default(caddy_sites_defaults.rate_limit) %}
   rate_limit @not_whitelisted {
 {% if caddy_consul %}
     distributed
@@ -216,7 +243,7 @@
       aes_key      "{{ caddy_consul_aes_key }}"
       tls_enabled  "true"
       tls_insecure "false"
-  }
+    }
 {%  endif %}
     log_key
     zone remote_ip {
@@ -227,7 +254,7 @@
   }
 {% endif %}
 
-{% if site.crs | default(caddy_sites_defaults.crs) %}
+{% if caddy_coraza and site.crs | default(caddy_sites_defaults.crs) %}
   coraza_waf @not_whitelisted {
     load_owasp_crs
     directives `
@@ -261,7 +288,7 @@
   import cors-deny
 {% endif %}
 
-{% if site.bot_barrier | default(caddy_sites_defaults.bot_barrier) %}
+{% if caddy_bot_barrier and site.bot_barrier | default(caddy_sites_defaults.bot_barrier) %}
   bot_barrier @not_whitelisted {
      secret {{ site.bot_barrier_secret | default(caddy_sites_defaults.bot_barrier_secret) | mandatory }}
      complexity {{ site.bot_barrier_complexity | default(caddy_sites_defaults.bot_barrier_complexity) }}
@@ -303,12 +330,12 @@
   }
 
   log {
-    format {{ site.log_format | default(caddy_sites_defaults.log_format) }}
     level INFO
+    format {{ caddy_log_format }}
     format append {
       waf_id {{ caddy_my_name }}
     }
-{% if site.log_to_file | default(caddy_sites_defaults.log_to_file) %}
+{% if caddy_log_to_file %}
     output file {{ caddy_log_dir }}/site_{{ site.id }}.log
 {% else %}
     output stdout