WIP

ansible/roles/waf_install/tasks/main.yml

@@ -0,0 +1,125 @@
+- name: Remove packaged Go
+  ansible.builtin.apt:
+    name:
+      - "golang"
+    state: "absent"
+    autoremove: true
+    purge: true
+
+- name: Install requirements
+  ansible.builtin.apt:
+    name:
+      - "git"
+      - "libnss3-tools"
+
+- name: Create Go directory
+  ansible.builtin.file:
+    path: "/usr/local/go-{{ waf_install_go_version }}"
+    state: "directory"
+    mode: "0755"
+
+- name: Install Go
+  ansible.builtin.unarchive:
+    src: "https://go.dev/dl/go{{ waf_install_go_version }}.linux-amd64.tar.gz"
+    dest: "/usr/local/go-{{ waf_install_go_version }}"
+    remote_src: true
+
+- name: Link Go
+  ansible.builtin.file:
+    src: "/usr/local/go-{{ waf_install_go_version }}/go/bin/go"
+    dest: "/usr/local/bin/go"
+    state: "link"
+
+# FIXME: no .deb
+- name: Install xcaddy
+  when: |
+    'xcaddy' not in ansible_facts.packages
+    or ansible_facts.packages['xcaddy'][0]['version'] != waf_install_xcaddy_version
+  ansible.builtin.apt:
+    deb: "{{ waf_install_xcaddy_download }}/v{{ waf_install_xcaddy_version }}/xcaddy_{{ waf_install_xcaddy_version }}_linux_amd64.deb"
+    force: true
+
+- name: Create Caddy build command
+  ansible.builtin.set_fact:
+    waf_install_build_command: >
+      xcaddy build v{{ waf_install_caddy_version }}
+      {% if waf_install_cluster %}  --with github.com/pteich/caddy-tlsconsul{% endif %}
+      --with github.com/corazawaf/coraza-caddy/v2@v{{ waf_install_coraza_caddy_version }}
+      --with github.com/mholt/caddy-ratelimit
+      --with github.com/steffenbusch/caddy-bot-barrier
+      --output /usr/local/bin/caddy
+
+- name: Test Caddy version
+  ansible.builtin.copy:
+    dest: "/usr/local/bin/.caddy.build"
+    content: "{{ waf_install_build_command }}"
+    mode: "0644"
+  register: waf_install_test_caddy_version
+
+- name: Build Caddy
+  # noqa: no-handler
+  when: "waf_install_test_caddy_version.changed"
+  ansible.builtin.command:
+    cmd: "{{ waf_install_build_command }}"
+    creates: "/usr/local/bin/caddy"
+  notify:
+    - "Restart Caddy"
+
+- name: Create caddy system group
+  ansible.builtin.group:
+    name: "caddy"
+    system: true
+
+- name: Create caddy system user
+  ansible.builtin.user:
+    name: "caddy"
+    group: "caddy"
+    groups: ["ssl-cert"]
+    password: "!"
+    system: true
+    home: "/opt/caddy"
+
+- name: Create caddy config directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: "directory"
+    group: "caddy"
+    mode: "0750"
+  loop:
+    - "/etc/caddy"
+    - "/etc/caddy/plugins"
+    - "/etc/caddy/sites"
+
+- name: Create caddy log dir
+  ansible.builtin.file:
+    path: "/var/log/caddy"
+    state: "directory"
+    group: "caddy"
+    mode: "0770"
+
+- name: Install OWASP CRS
+  ansible.builtin.unarchive:
+    src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ waf_install_owasp_crs_version }}.tar.gz"
+    dest: "/etc/caddy"
+    group: "caddy"
+    remote_src: true
+
+- name: Install plugins
+  loop: "{{ waf_install_crs_plugins }}"
+  loop_control:
+    loop_var: "plugin"
+  ansible.builtin.include_tasks: "install_plugin.yml"
+
+- name: Deploy caddy service file
+  ansible.builtin.template:
+    src: "templates/caddy.service"
+    dest: "/etc/systemd/system/caddy.service"
+    mode: "0644"
+  notify:
+    - "Restart Caddy"
+
+- name: Enable Caddy
+  ansible.builtin.service:
+    name: "caddy"
+    enabled: true
+    daemon_reload: true