caddy: final integration with consul

seb4itik/byow/roles/caddy/tasks/caddy_consul.yml

@@ -0,0 +1,48 @@
+
+- name: Create consul policy for Caddy TLS and rate limit
+  delegate_to: "{{ caddy_consul_delegate_to }}"
+  run_once: true
+  community.general.consul_policy:
+    token: "{{ caddy_consul_admin_token }}"
+    name: "caddy"
+    rules: |
+      key_prefix "caddy-{{ caddy_my_name }}-tls" {
+        policy = "write"
+      }
+      key_prefix "caddy-{{ caddy_my_name }}-rl" {
+        policy = "write"
+      }
+      session_prefix "" {
+        policy = "write"
+      }
+      node_prefix "" {
+        policy = "read"
+      }
+      agent_prefix "" {
+        policy = "read"
+      }
+
+- name: Create/retrieve Consul Caddy accessor_id
+  ansible.builtin.shell:
+    executable: "/usr/bin/bash"
+    cmd: |
+      set -o pipefail
+      if test -f /root/.consul_caddy_accessor_id; then
+        echo OK
+      else
+        uuidgen > /root/.consul_caddy_accessor_id
+        echo CHANGED
+      fi
+      cat /root/.consul_caddy_accessor_id
+  register: "consul_out_caddy_accessor_id"
+  changed_when: "consul_out_caddy_accessor_id.stdout_lines[0] == 'CHANGED'"
+
+- name: Create/retrieve consul token
+  delegate_to: "{{ caddy_consul_delegate_to }}"
+  community.general.consul_token:
+    token: "{{ caddy_consul_admin_token }}"
+    accessor_id: "{{ consul_out_caddy_accessor_id.stdout_lines[1] }}"
+    description: "Caddy {{ caddy_my_name }} {{ ansible_fqdn }}"
+    policies:
+      - name: "caddy"
+  register: "caddy_out_consul_token"