WIP

2026-01-20 17:40:16 +03:00
parent cda556eec6
commit b78da80550
83 changed files with 108 additions and 82 deletions
--- a/roles/caddy/tasks/caddy_install.yml
+++ b/roles/caddy/tasks/caddy_install.yml
@@ -0,0 +1,135 @@
+- name: Remove packaged Go
+  ansible.builtin.apt:
+    name:
+      - "golang"
+    state: "absent"
+    autoremove: true
+    purge: true
+
+- name: Install requirements
+  ansible.builtin.apt:
+    name:
+      - "git"
+      - "libnss3-tools"
+      - "ssl-cert"
+
+- name: Create Go directory
+  ansible.builtin.file:
+    path: "/usr/local/go-{{ caddy_go_version }}"
+    state: "directory"
+    mode: "0755"
+
+- name: Install Go
+  ansible.builtin.unarchive:
+    src: "https://go.dev/dl/go{{ caddy_go_version }}.linux-amd64.tar.gz"
+    dest: "/usr/local/go-{{ caddy_go_version }}"
+    remote_src: true
+
+- name: Link Go
+  ansible.builtin.file:
+    src: "/usr/local/go-{{ caddy_go_version }}/go/bin/go"
+    dest: "/usr/local/bin/go"
+    state: "link"
+
+- name: Create xcaddy directory
+  ansible.builtin.file:
+    path: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
+    state: "directory"
+    mode: "0755"
+
+- name: Install xcaddy
+  ansible.builtin.unarchive:
+    src: "{{ caddy_xcaddy_download }}/v{{ caddy_xcaddy_version }}/xcaddy_{{ caddy_xcaddy_version }}_linux_amd64.tar.gz"
+    dest: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
+    remote_src: true
+
+- name: Link xcaddy
+  ansible.builtin.file:
+    src: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy"
+    dest: "/usr/local/bin/xcaddy"
+    state: "link"
+
+- name: Create Caddy build command
+  ansible.builtin.set_fact:
+    caddy_build_command: >
+      xcaddy build v{{ caddy_caddy_version }}
+      --with github.com/pteich/caddy-tlsconsul
+      --with github.com/corazawaf/coraza-caddy/v2@v{{ caddy_coraza_caddy_version }}
+      --with github.com/mholt/caddy-ratelimit
+      --with github.com/steffenbusch/caddy-bot-barrier
+      --output /usr/local/bin/caddy
+
+- name: Test Caddy version
+  ansible.builtin.copy:
+    dest: "/usr/local/bin/.caddy.build"
+    content: "{{ caddy_build_command }}"
+    mode: "0644"
+  register: caddy_test_caddy_version
+
+- name: Build Caddy
+  # noqa: no-handler
+  when: "caddy_test_caddy_version.changed"
+  ansible.builtin.command:
+    cmd: "{{ caddy_build_command }}"
+    creates: "/usr/local/bin/caddy"
+  notify:
+    - "Restart Caddy"
+
+- name: Create Caddy system group
+  ansible.builtin.group:
+    name: "{{ caddy_system_group }}"
+    system: true
+
+- name: Create Caddy system user
+  ansible.builtin.user:
+    name: "{{ caddy_system_user }}"
+    group: "{{ caddy_system_group }}"
+    groups: ["ssl-cert"]
+    password: "!"
+    system: true
+    home: "{{ caddy_home_dir }}"
+
+- name: Create Caddy config directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: "directory"
+    group: "{{ caddy_system_group }}"
+    mode: "0750"
+  loop:
+    - "{{ caddy_config_dir }}"
+    - "{{ caddy_config_dir }}/crs-plugins"
+    - "{{ caddy_config_dir }}/sites"
+
+- name: Create Caddy log dir
+  ansible.builtin.file:
+    path: "{{ caddy_log_dir }}"
+    state: "directory"
+    group: "{{ caddy_system_group }}"
+    mode: "0770"
+
+- name: Install OWASP CRS
+  ansible.builtin.unarchive:
+    src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ caddy_owasp_crs_version }}.tar.gz"
+    dest: "{{ caddy_config_dir }}"
+    group: "{{ caddy_system_group }}"
+    remote_src: true
+
+- name: Install plugins
+  loop: "{{ caddy_crs_plugins }}"
+  loop_control:
+    loop_var: "plugin"
+  ansible.builtin.include_tasks: "plugin_install.yml"
+
+- name: Deploy caddy service file
+  ansible.builtin.template:
+    src: "templates/caddy.service"
+    dest: "/etc/systemd/system/{{ caddy_system_user }}.service"
+    mode: "0644"
+  notify:
+    - "Restart Caddy"
+
+- name: Enable Caddy
+  ansible.builtin.service:
+    name: "{{ caddy_system_user }}"
+    enabled: true
+    daemon_reload: true