First version in Galaxy
This commit is contained in:
73
seb4itik/byow/roles/caddy/tasks/caddy_config.yml
Normal file
73
seb4itik/byow/roles/caddy/tasks/caddy_config.yml
Normal file
@@ -0,0 +1,73 @@
|
||||
- name: Create sites config directories
|
||||
loop: "{{ caddy_sites }}"
|
||||
ansible.builtin.file:
|
||||
path: "{{ caddy_config_dir }}/sites/{{ item.name }}"
|
||||
state: "directory"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0750"
|
||||
|
||||
- name: Generate sites coraza.conf config file
|
||||
loop: "{{ caddy_sites }}"
|
||||
loop_control:
|
||||
loop_var: "site"
|
||||
ansible.builtin.template:
|
||||
src: "templates/coraza.conf"
|
||||
dest: "{{ caddy_config_dir }}/sites/{{ site.name }}/coraza.conf"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0640"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Generate sites crs-setup config file
|
||||
loop: "{{ caddy_sites }}"
|
||||
loop_control:
|
||||
loop_var: "site"
|
||||
ansible.builtin.template:
|
||||
src: "templates/crs-setup.conf"
|
||||
dest: "{{ caddy_config_dir }}/sites/{{ site.name }}/crs-setup.conf"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0640"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Generate sites exclusions before request file
|
||||
loop: "{{ caddy_sites }}"
|
||||
loop_control:
|
||||
loop_var: "site"
|
||||
ansible.builtin.template:
|
||||
src: "templates/exclusions-request-before.conf"
|
||||
dest: "{{ caddy_config_dir }}/sites/{{ site.name }}/exclusions-request-before.conf"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0640"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Generate sites exclusions after response file
|
||||
loop: "{{ caddy_sites }}"
|
||||
loop_control:
|
||||
loop_var: "site"
|
||||
ansible.builtin.template:
|
||||
src: "templates/exclusions-response-after.conf"
|
||||
dest: "{{ caddy_config_dir }}/sites/{{ site.name }}/exclusions-response-after.conf"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0640"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Generate Caddyfile
|
||||
ansible.builtin.template:
|
||||
src: "templates/Caddyfile"
|
||||
dest: "{{ caddy_config_dir }}/Caddyfile"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0640"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Copy bot barrier template
|
||||
ansible.builtin.copy:
|
||||
src: "files/bot_barrier_template.html"
|
||||
dest: "{{ caddy_config_dir }}/bot_barrier_template.html"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0640"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
135
seb4itik/byow/roles/caddy/tasks/caddy_install.yml
Normal file
135
seb4itik/byow/roles/caddy/tasks/caddy_install.yml
Normal file
@@ -0,0 +1,135 @@
|
||||
- name: Remove packaged Go
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- "golang"
|
||||
state: "absent"
|
||||
autoremove: true
|
||||
purge: true
|
||||
|
||||
- name: Install requirements
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- "git"
|
||||
- "libnss3-tools"
|
||||
- "ssl-cert"
|
||||
|
||||
- name: Create Go directory
|
||||
ansible.builtin.file:
|
||||
path: "/usr/local/go-{{ caddy_go_version }}"
|
||||
state: "directory"
|
||||
mode: "0755"
|
||||
|
||||
- name: Install Go
|
||||
ansible.builtin.unarchive:
|
||||
src: "https://go.dev/dl/go{{ caddy_go_version }}.linux-amd64.tar.gz"
|
||||
dest: "/usr/local/go-{{ caddy_go_version }}"
|
||||
remote_src: true
|
||||
|
||||
- name: Link Go
|
||||
ansible.builtin.file:
|
||||
src: "/usr/local/go-{{ caddy_go_version }}/go/bin/go"
|
||||
dest: "/usr/local/bin/go"
|
||||
state: "link"
|
||||
|
||||
- name: Create xcaddy directory
|
||||
ansible.builtin.file:
|
||||
path: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
|
||||
state: "directory"
|
||||
mode: "0755"
|
||||
|
||||
- name: Install xcaddy
|
||||
ansible.builtin.unarchive:
|
||||
src: "{{ caddy_xcaddy_download }}/v{{ caddy_xcaddy_version }}/xcaddy_{{ caddy_xcaddy_version }}_linux_amd64.tar.gz"
|
||||
dest: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
|
||||
remote_src: true
|
||||
|
||||
- name: Link xcaddy
|
||||
ansible.builtin.file:
|
||||
src: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy"
|
||||
dest: "/usr/local/bin/xcaddy"
|
||||
state: "link"
|
||||
|
||||
- name: Create Caddy build command
|
||||
ansible.builtin.set_fact:
|
||||
caddy_build_command: >
|
||||
xcaddy build v{{ caddy_caddy_version }}
|
||||
--with github.com/pteich/caddy-tlsconsul
|
||||
--with github.com/corazawaf/coraza-caddy/v2@v{{ caddy_coraza_caddy_version }}
|
||||
--with github.com/mholt/caddy-ratelimit
|
||||
--with github.com/steffenbusch/caddy-bot-barrier
|
||||
--output /usr/local/bin/caddy
|
||||
|
||||
- name: Test Caddy version
|
||||
ansible.builtin.copy:
|
||||
dest: "/usr/local/bin/.caddy.build"
|
||||
content: "{{ caddy_build_command }}"
|
||||
mode: "0644"
|
||||
register: caddy_test_caddy_version
|
||||
|
||||
- name: Build Caddy
|
||||
# noqa: no-handler
|
||||
when: "caddy_test_caddy_version.changed"
|
||||
ansible.builtin.command:
|
||||
cmd: "{{ caddy_build_command }}"
|
||||
creates: "/usr/local/bin/caddy"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Create Caddy system group
|
||||
ansible.builtin.group:
|
||||
name: "{{ caddy_system_group }}"
|
||||
system: true
|
||||
|
||||
- name: Create Caddy system user
|
||||
ansible.builtin.user:
|
||||
name: "{{ caddy_system_user }}"
|
||||
group: "{{ caddy_system_group }}"
|
||||
groups: ["ssl-cert"]
|
||||
password: "!"
|
||||
system: true
|
||||
home: "{{ caddy_home_dir }}"
|
||||
|
||||
- name: Create Caddy config directories
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: "directory"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0750"
|
||||
loop:
|
||||
- "{{ caddy_config_dir }}"
|
||||
- "{{ caddy_config_dir }}/crs-plugins"
|
||||
- "{{ caddy_config_dir }}/sites"
|
||||
|
||||
- name: Create Caddy log dir
|
||||
ansible.builtin.file:
|
||||
path: "{{ caddy_log_dir }}"
|
||||
state: "directory"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0770"
|
||||
|
||||
- name: Install OWASP CRS
|
||||
ansible.builtin.unarchive:
|
||||
src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ caddy_owasp_crs_version }}.tar.gz"
|
||||
dest: "{{ caddy_config_dir }}"
|
||||
group: "{{ caddy_system_group }}"
|
||||
remote_src: true
|
||||
|
||||
- name: Install plugins
|
||||
loop: "{{ caddy_crs_plugins }}"
|
||||
loop_control:
|
||||
loop_var: "plugin"
|
||||
ansible.builtin.include_tasks: "plugin_install.yml"
|
||||
|
||||
- name: Deploy caddy service file
|
||||
ansible.builtin.template:
|
||||
src: "templates/caddy.service"
|
||||
dest: "/etc/systemd/system/{{ caddy_system_user }}.service"
|
||||
mode: "0644"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Enable Caddy
|
||||
ansible.builtin.service:
|
||||
name: "{{ caddy_system_user }}"
|
||||
enabled: true
|
||||
daemon_reload: true
|
||||
6
seb4itik/byow/roles/caddy/tasks/main.yml
Normal file
6
seb4itik/byow/roles/caddy/tasks/main.yml
Normal file
@@ -0,0 +1,6 @@
|
||||
- name: Install Caddy
|
||||
when: "not(caddy_config_only)"
|
||||
ansible.builtin.include_tasks: "caddy_install.yml"
|
||||
|
||||
- name: Config Caddy
|
||||
ansible.builtin.include_tasks: "caddy_config.yml"
|
||||
55
seb4itik/byow/roles/caddy/tasks/plugin_install.yml
Normal file
55
seb4itik/byow/roles/caddy/tasks/plugin_install.yml
Normal file
@@ -0,0 +1,55 @@
|
||||
- name: Download plugin {{ plugin.name }}
|
||||
ansible.builtin.get_url:
|
||||
url: "https://github.com/{{ plugin.provider | default('coreruleset') }}/{{ plugin.name }}-plugin/archive/refs/tags/v{{ plugin.version }}.tar.gz"
|
||||
dest: "/usr/local/src/"
|
||||
mode: "0644"
|
||||
register: "caddy_plugin_downloaded"
|
||||
|
||||
- name: Deploy plugin {{ plugin.name }}
|
||||
# noqa: no-handler
|
||||
when: "caddy_plugin_downloaded.changed"
|
||||
block:
|
||||
|
||||
- name: Get temp dir {{ plugin.name }}
|
||||
ansible.builtin.tempfile:
|
||||
state: "directory"
|
||||
register: "caddy_temp_plugin_dir"
|
||||
|
||||
- name: Unarchive plugin {{ plugin.name }}
|
||||
ansible.builtin.unarchive:
|
||||
src: "/usr/local/src/{{ plugin.name }}-plugin-{{ plugin.version }}.tar.gz"
|
||||
dest: "{{ caddy_temp_plugin_dir.path }}"
|
||||
remote_src: true
|
||||
|
||||
- name: Copy plugin files {{ plugin.name }}
|
||||
ansible.builtin.copy:
|
||||
src: "{{ caddy_temp_plugin_dir.path }}/{{ plugin.name }}-plugin-{{ plugin.version }}/plugins/"
|
||||
dest: "{{ caddy_config_dir }}/crs-plugins/"
|
||||
mode: "0644"
|
||||
# directory_mode: "0750"
|
||||
group: "{{ caddy_system_group }}"
|
||||
remote_src: true
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Create after config {{ plugin.name }}
|
||||
when: "not(plugin.has_after_config | default(false))"
|
||||
ansible.builtin.copy:
|
||||
content: ""
|
||||
dest: "{{ caddy_config_dir }}/crs-plugins/{{ plugin.name }}-after.conf"
|
||||
mode: "0644"
|
||||
group: "{{ caddy_system_group }}"
|
||||
|
||||
# FIXME: bad hack, why is it required?
|
||||
- name: Adjust plugins diretory permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ caddy_config_dir }}/crs-plugins"
|
||||
state: "directory"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0750"
|
||||
|
||||
- name: Delete temp dir {{ plugin.name }}
|
||||
when: "caddy_temp_plugin_dir.path is defined"
|
||||
ansible.builtin.file:
|
||||
path: "{{ caddy_temp_plugin_dir.path }}"
|
||||
state: "absent"
|
||||
Reference in New Issue
Block a user