WIP

ansible/roles/waf_install/tasks/install_plugin.yml

@@ -0,0 +1,47 @@
+- name: Download plugin {{ plugin.name }}
+  ansible.builtin.get_url:
+    url: "https://github.com/{{ plugin.provider | default('coreruleset') }}/{{ plugin.name }}-plugin/archive/refs/tags/v{{ plugin.version }}.tar.gz"
+    dest: "/usr/local/src/"
+    mode: "0644"
+  register: "waf_install_plugin_downloaded"
+
+- name: Deploy plugin {{ plugin.name }}
+  # noqa: no-handler
+  when: "waf_install_plugin_downloaded.changed"
+  block:
+
+    - name: Get temp dir {{ plugin.name }}
+      ansible.builtin.tempfile:
+        state: "directory"
+      register: "waf_install_temp_plugin_dir"
+
+    - name: Unarchive plugin {{ plugin.name }}
+      ansible.builtin.unarchive:
+        src: "/usr/local/src/{{ plugin.name }}-plugin-{{ plugin.version }}.tar.gz"
+        dest: "{{ waf_install_temp_plugin_dir.path }}"
+        remote_src: true
+
+    - name: Copy plugin files {{ plugin.name }}
+      ansible.builtin.copy:
+        src: "{{ waf_install_temp_plugin_dir.path }}/{{ plugin.name }}-plugin-{{ plugin.version }}/plugins/"
+        dest: "/etc/caddy/plugins/"
+        mode: "0644"
+#       directory_mode: "0750"
+        group: "caddy"
+        remote_src: true
+      notify:
+        - "Reload Caddy"
+
+    # FIXME: bad hack, why is it required?
+    - name: Adjust /etc/caddy/plugins permissions
+      ansible.builtin.file:
+        path: "/etc/caddy/plugins"
+        state: "directory"
+        group: "caddy"
+        mode: "0750"
+
+    - name: Delete temp dir {{ plugin.name }}
+      when: "waf_install_temp_plugin_dir.path is defined"
+      ansible.builtin.file:
+        path: "{{ waf_install_temp_plugin_dir.path }}"
+        state: "absent"