caddy: final integration with consul

seb4itik/byow/roles/caddy/defaults/main.yml

@@ -19,6 +19,16 @@ caddy_email: null
 # If a custom CA root have to be used.
 caddy_ca_root: null
 
+# For using a Consul cluster.
+caddy_consul: false
+caddy_consul_delegate_to: null         # Required
+caddy_consul_admin_token: null         # Required
+caddy_consul_aes_key: null             # Required, 32 characters
+caddy_consul_server: "127.0.0.1:8500"
+# FIXME: SSL connexion doesn't work
+# caddy_consul_client_cert: "/etc/ssl/certs/server.lab.itik.fr.crt"
+# caddy_consul_client_key: "/etc/ssl/private/server.lab.itik.fr.key"
+
 # Accound id and license key are required if a site use Geoip filtering.
 # See: https://dev.maxmind.com/geoip/updating-databases/
 caddy_geoip_account_id: null    

seb4itik/byow/roles/caddy/tasks/caddy_config.yml

@@ -58,19 +58,19 @@
   notify:
     - "Restart Caddy"
 
-- name: Generate Caddyfile
-  ansible.builtin.template:
-    src: "templates/Caddyfile"
-    dest: "{{ caddy_config_dir }}/Caddyfile"
+- name: Copy bot barrier template
+  ansible.builtin.copy:
+    src: "files/bot_barrier_template.html"
+    dest: "{{ caddy_config_dir }}/bot_barrier_template.html"
     group: "{{ caddy_system_group }}"
     mode: "0640"
   notify:
     - "Restart Caddy"
 
-- name: Copy bot barrier template
-  ansible.builtin.copy:
-    src: "files/bot_barrier_template.html"
-    dest: "{{ caddy_config_dir }}/bot_barrier_template.html"
+- name: Generate Caddyfile
+  ansible.builtin.template:
+    src: "templates/Caddyfile"
+    dest: "{{ caddy_config_dir }}/Caddyfile"
     group: "{{ caddy_system_group }}"
     mode: "0640"
   notify:

seb4itik/byow/roles/caddy/tasks/caddy_consul.yml

@@ -0,0 +1,48 @@
+
+- name: Create consul policy for Caddy TLS and rate limit
+  delegate_to: "{{ caddy_consul_delegate_to }}"
+  run_once: true
+  community.general.consul_policy:
+    token: "{{ caddy_consul_admin_token }}"
+    name: "caddy"
+    rules: |
+      key_prefix "caddy-{{ caddy_my_name }}-tls" {
+        policy = "write"
+      }
+      key_prefix "caddy-{{ caddy_my_name }}-rl" {
+        policy = "write"
+      }
+      session_prefix "" {
+        policy = "write"
+      }
+      node_prefix "" {
+        policy = "read"
+      }
+      agent_prefix "" {
+        policy = "read"
+      }
+
+- name: Create/retrieve Consul Caddy accessor_id
+  ansible.builtin.shell:
+    executable: "/usr/bin/bash"
+    cmd: |
+      set -o pipefail
+      if test -f /root/.consul_caddy_accessor_id; then
+        echo OK
+      else
+        uuidgen > /root/.consul_caddy_accessor_id
+        echo CHANGED
+      fi
+      cat /root/.consul_caddy_accessor_id
+  register: "consul_out_caddy_accessor_id"
+  changed_when: "consul_out_caddy_accessor_id.stdout_lines[0] == 'CHANGED'"
+
+- name: Create/retrieve consul token
+  delegate_to: "{{ caddy_consul_delegate_to }}"
+  community.general.consul_token:
+    token: "{{ caddy_consul_admin_token }}"
+    accessor_id: "{{ consul_out_caddy_accessor_id.stdout_lines[1] }}"
+    description: "Caddy {{ caddy_my_name }} {{ ansible_fqdn }}"
+    policies:
+      - name: "caddy"
+  register: "caddy_out_consul_token"

seb4itik/byow/roles/caddy/tasks/main.yml

@@ -2,5 +2,9 @@
   when: "not(caddy_config_only)"
   ansible.builtin.include_tasks: "caddy_install.yml"
 
+- name: Configure Consul for Caddy
+  when: "caddy_consul"
+  ansible.builtin.include_tasks: "caddy_consul.yml"
+
 - name: Configure Caddy
   ansible.builtin.include_tasks: "caddy_config.yml"

seb4itik/byow/roles/caddy/templates/Caddyfile

@@ -9,6 +9,19 @@
   admin off
   persist_config off
 
+{% if caddy_consul %}
+  storage consul {
+    address      "{{ caddy_consul_server }}"
+    token        "{{ caddy_out_consul_token.token.SecretID }}"
+    timeout      10
+    prefix       "caddy-{{ caddy_my_name }}-tls"
+    value_prefix "{{ caddy_my_name }}"
+    aes_key      "{{ caddy_consul_aes_key }}"
+    tls_enabled  "false"
+    tls_insecure "false"
+  }
+{% endif %}
+
 {% if caddy_geoip_account_id != None and caddy_geoip_license_key != None %}
   geoip2 {
     accountId         "{{ caddy_geoip_account_id }}"
@@ -189,7 +202,20 @@
 
 {% if site.rate_limit | default(caddy_sites_defaults.rate_limit) %}
   rate_limit @not_whitelisted {
-#   distributed
+{% if caddy_consul %}
+    distributed
+    storage consul {
+      address      "{{ caddy_consul_server }}"
+      token        "{{ caddy_out_consul_token.token.SecretID }}"
+      timeout      10
+      prefix       "caddy-{{ caddy_my_name }}-rl"
+      value_prefix "{{ caddy_my_name }}"
+      aes_key      "{{ caddy_consul_aes_key }}"
+      tls_enabled  "false"
+      tls_insecure "false"
+  }
+{%  endif %}
+    log_key
     zone remote_ip {
       key {remote.ip}
       events {{ site.rate_limit_events | default(caddy_sites_defaults.rate_limit_events) }}

seb4itik/byow/roles/caddy/templates/caddy.service

@@ -17,6 +17,10 @@ AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
 StandardOutput=journal
 StandardError=journal
 SyslogIdentifier={{ caddy_my_name }}
+{#
+# FIXME: SSL connexion doesn't work
+# Environment="CONSUL_CLIENT_CERT={{ caddy_consul_client_cert }}" "CONSUL_CLIENT_KEY={{ caddy_consul_client_key }}"
+#}
 
 [Install]
 WantedBy=multi-user.target