caddy: versions bump

seb4itik/byow/roles/caddy/defaults/main.yml

@@ -7,9 +7,9 @@ caddy_https_port: 443
 caddy_default_bind: null
 
 # Sotware versions
-caddy_go_version: "1.26.1"
+caddy_go_version: "1.26.3"
 caddy_xcaddy_version: "0.4.5"
-caddy_version: "2.11.2"
+caddy_version: "2.11.3"
 
 # If true, will not install software, just deploy Caddyfile and OWASP CRS
 # configuration files.
@@ -74,29 +74,40 @@ caddy_bot_barrier: false
 
 # Coraza
 caddy_coraza: true
-caddy_coraza_caddy_version: "v2@v2.2.0"  # Coraza v3.3.3
+caddy_coraza_caddy_version: "v2@v2.5.0"  # Coraza v3.7.0
 # Different sites can use different versions of OWASP CRS
-caddy_coraza_crs_versions: ["4.24.1"]
+caddy_coraza_crs_versions: [
+  "4.25.0",  # LTS
+  "4.26.0"
+]
 # OWASP CRS plugins that can be actived per site.
 # Cf.: https://github.com/coreruleset/plugin-registry
+# FIXME: https://github.com/coreruleset/referer-hardening-plugin
 caddy_coraza_crs_plugins:
-  - name: "drupal-rule-exclusions"
+  - name: "cpanel-rule-exclusions"
     version: "1.0.0"
-  - name: "wordpress-rule-exclusions"
-    version: "1.2.0"
-  - name: "nextcloud-rule-exclusions"
-    version: "1.5.0"
   - name: "dokuwiki-rule-exclusions"
     version: "1.0.0"
-  - name: "phpmyadmin-rule-exclusions"
+  - name: "drupal-rule-exclusions"
+    version: "1.0.0"
+  - name: "google-oauth2"
+    version: "1.0.0"
+  - name: "nextcloud-rule-exclusions"
+    version: "1.6.0"
+  - name: "phpbb-rule-exclusions"
+    version: "1.1.0"
+  - name: "plausible-rule-exclusions"
     version: "1.0.0"
-    has_after_config: true
   - name: "roundcube-rule-exclusions"
     version: "1.0.4"
     provider: "EsadCetiner"
   - name: "sogo-rule-exclusions"
     version: "1.0.4"
     provider: "EsadCetiner"
+  - name: "wordpress-rule-exclusions"
+    version: "1.2.0"
+  - name: "xenforo-rule-exclusions"
+    version: "1.0.0"
 
 
 # Sites

seb4itik/byow/roles/caddy/vars/main.yml

@@ -280,7 +280,7 @@ caddy_global_sites_defaults:
 
   # corazawaf/coraza-caddy
   crs: true
-  crs_version: "4.24.1"
+  crs_version: "4.25.0"   # LTS
   crs_log_only: false
   crs_plugins: []
   crs_exceptions:

seb4itik/byow/roles/consul/defaults/main.yml

@@ -12,7 +12,7 @@ consul_ui_secret_id: null         # Generate with "uuidgen"
 
 # Defaults.
 consul_domain: "consul"
-consul_version: "1.22.3"
+consul_version: "1.22.7"
 consul_client_addr: "127.0.0.1"
 consul_bind_addr: "{{ ansible_default_ipv4.address }}"
 consul_default_check_interval: "15s"