caddy: final integration with consul

seb4itik/byow/roles/caddy/tasks/caddy_config.yml

@@ -58,19 +58,19 @@
   notify:
     - "Restart Caddy"
 
-- name: Generate Caddyfile
-  ansible.builtin.template:
-    src: "templates/Caddyfile"
-    dest: "{{ caddy_config_dir }}/Caddyfile"
+- name: Copy bot barrier template
+  ansible.builtin.copy:
+    src: "files/bot_barrier_template.html"
+    dest: "{{ caddy_config_dir }}/bot_barrier_template.html"
     group: "{{ caddy_system_group }}"
     mode: "0640"
   notify:
     - "Restart Caddy"
 
-- name: Copy bot barrier template
-  ansible.builtin.copy:
-    src: "files/bot_barrier_template.html"
-    dest: "{{ caddy_config_dir }}/bot_barrier_template.html"
+- name: Generate Caddyfile
+  ansible.builtin.template:
+    src: "templates/Caddyfile"
+    dest: "{{ caddy_config_dir }}/Caddyfile"
     group: "{{ caddy_system_group }}"
     mode: "0640"
   notify:

seb4itik/byow/roles/caddy/tasks/caddy_consul.yml

@@ -0,0 +1,48 @@
+
+- name: Create consul policy for Caddy TLS and rate limit
+  delegate_to: "{{ caddy_consul_delegate_to }}"
+  run_once: true
+  community.general.consul_policy:
+    token: "{{ caddy_consul_admin_token }}"
+    name: "caddy"
+    rules: |
+      key_prefix "caddy-{{ caddy_my_name }}-tls" {
+        policy = "write"
+      }
+      key_prefix "caddy-{{ caddy_my_name }}-rl" {
+        policy = "write"
+      }
+      session_prefix "" {
+        policy = "write"
+      }
+      node_prefix "" {
+        policy = "read"
+      }
+      agent_prefix "" {
+        policy = "read"
+      }
+
+- name: Create/retrieve Consul Caddy accessor_id
+  ansible.builtin.shell:
+    executable: "/usr/bin/bash"
+    cmd: |
+      set -o pipefail
+      if test -f /root/.consul_caddy_accessor_id; then
+        echo OK
+      else
+        uuidgen > /root/.consul_caddy_accessor_id
+        echo CHANGED
+      fi
+      cat /root/.consul_caddy_accessor_id
+  register: "consul_out_caddy_accessor_id"
+  changed_when: "consul_out_caddy_accessor_id.stdout_lines[0] == 'CHANGED'"
+
+- name: Create/retrieve consul token
+  delegate_to: "{{ caddy_consul_delegate_to }}"
+  community.general.consul_token:
+    token: "{{ caddy_consul_admin_token }}"
+    accessor_id: "{{ consul_out_caddy_accessor_id.stdout_lines[1] }}"
+    description: "Caddy {{ caddy_my_name }} {{ ansible_fqdn }}"
+    policies:
+      - name: "caddy"
+  register: "caddy_out_consul_token"

seb4itik/byow/roles/caddy/tasks/main.yml

@@ -2,5 +2,9 @@
   when: "not(caddy_config_only)"
   ansible.builtin.include_tasks: "caddy_install.yml"
 
+- name: Configure Consul for Caddy
+  when: "caddy_consul"
+  ansible.builtin.include_tasks: "caddy_consul.yml"
+
 - name: Configure Caddy
   ansible.builtin.include_tasks: "caddy_config.yml"