From bbec8d35c590c6f4c0a67673a8db8090f86937fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=2E=20Nam=C3=A8che?= Date: Thu, 5 Feb 2026 09:53:38 +0300 Subject: [PATCH] optimizations --- example/tofu/infra.auto.tfvars | 12 +++- seb4itik/byow/roles/caddy/defaults/main.yml | 2 + seb4itik/byow/roles/caddy/handlers/main.yml | 8 +-- .../byow/roles/caddy/tasks/caddy_config.yml | 11 ++-- .../byow/roles/caddy/tasks/caddy_install.yml | 40 +++++++++++--- .../caddy/tasks/caddy_install_plugin.yml | 55 ------------------- seb4itik/byow/roles/caddy/templates/Caddyfile | 14 ++--- seb4itik/byow/roles/consul/tasks/main.yml | 1 + 8 files changed, 60 insertions(+), 83 deletions(-) delete mode 100644 seb4itik/byow/roles/caddy/tasks/caddy_install_plugin.yml diff --git a/example/tofu/infra.auto.tfvars b/example/tofu/infra.auto.tfvars index acb565b..9103dbf 100644 --- a/example/tofu/infra.auto.tfvars +++ b/example/tofu/infra.auto.tfvars @@ -2,9 +2,15 @@ vms = { proxy1 = { disk = "20g" }, - waf1 = {}, - waf2 = {}, - waf3 = {}, + waf1 = { + cpus = 4 + }, + waf2 = { + cpus = 4 + }, + waf3 = { + cpus = 4 + }, sql1 = {}, nfs1 = {}, www1 = {}, diff --git a/seb4itik/byow/roles/caddy/defaults/main.yml b/seb4itik/byow/roles/caddy/defaults/main.yml index 5e4e937..66bcef9 100644 --- a/seb4itik/byow/roles/caddy/defaults/main.yml +++ b/seb4itik/byow/roles/caddy/defaults/main.yml @@ -40,6 +40,8 @@ caddy_system_user: "{{ caddy_my_name }}" caddy_system_group: "{{ caddy_my_name }}" caddy_home_dir: "/opt/{{ caddy_my_name }}" caddy_config_dir: "/etc/{{ caddy_my_name }}" +caddy_crs_plugins_dir: "{{ caddy_config_dir }}/crs-plugins" +caddy_sites_dir: "{{ caddy_config_dir }}/sites" caddy_log_dir: "/var/log/{{ caddy_my_name }}" # OWASP CRS plugins that will can be actived per site. diff --git a/seb4itik/byow/roles/caddy/handlers/main.yml b/seb4itik/byow/roles/caddy/handlers/main.yml index f73f5cb..b9aa94d 100644 --- a/seb4itik/byow/roles/caddy/handlers/main.yml +++ b/seb4itik/byow/roles/caddy/handlers/main.yml @@ -1,8 +1,8 @@ +- name: Reload systemd + ansible.builtin.service: + daemon_reload: true + - name: Restart Caddy ansible.builtin.service: name: "{{ caddy_my_name }}" state: "restarted" - -# - name: Update GeoIP databases -# ansible.builtin.command: -# cmd: "/usr/bin/geoipupdate" diff --git a/seb4itik/byow/roles/caddy/tasks/caddy_config.yml b/seb4itik/byow/roles/caddy/tasks/caddy_config.yml index 13f359c..d299cf2 100644 --- a/seb4itik/byow/roles/caddy/tasks/caddy_config.yml +++ b/seb4itik/byow/roles/caddy/tasks/caddy_config.yml @@ -5,7 +5,7 @@ - name: Create sites config directories loop: "{{ caddy_sites }}" ansible.builtin.file: - path: "{{ caddy_config_dir }}/sites/{{ item.id }}" + path: "{{ caddy_sites_dir }}/{{ item.id }}" state: "directory" group: "{{ caddy_system_group }}" mode: "0750" @@ -16,7 +16,7 @@ loop_var: "site" ansible.builtin.template: src: "templates/coraza.conf" - dest: "{{ caddy_config_dir }}/sites/{{ site.id }}/coraza.conf" + dest: "{{ caddy_sites_dir }}/{{ site.id }}/coraza.conf" group: "{{ caddy_system_group }}" mode: "0640" notify: @@ -28,7 +28,7 @@ loop_var: "site" ansible.builtin.template: src: "templates/crs-setup.conf" - dest: "{{ caddy_config_dir }}/sites/{{ site.id }}/crs-setup.conf" + dest: "{{ caddy_sites_dir }}/{{ site.id }}/crs-setup.conf" group: "{{ caddy_system_group }}" mode: "0640" notify: @@ -40,7 +40,7 @@ loop_var: "site" ansible.builtin.template: src: "templates/exclusions-request-before.conf" - dest: "{{ caddy_config_dir }}/sites/{{ site.id }}/exclusions-request-before.conf" + dest: "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-request-before.conf" group: "{{ caddy_system_group }}" mode: "0640" notify: @@ -52,7 +52,7 @@ loop_var: "site" ansible.builtin.template: src: "templates/exclusions-response-after.conf" - dest: "{{ caddy_config_dir }}/sites/{{ site.id }}/exclusions-response-after.conf" + dest: "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-response-after.conf" group: "{{ caddy_system_group }}" mode: "0640" notify: @@ -81,4 +81,3 @@ name: "{{ caddy_my_name }}" state: "started" enabled: true - daemon_reload: true diff --git a/seb4itik/byow/roles/caddy/tasks/caddy_install.yml b/seb4itik/byow/roles/caddy/tasks/caddy_install.yml index 342d9aa..d25976d 100644 --- a/seb4itik/byow/roles/caddy/tasks/caddy_install.yml +++ b/seb4itik/byow/roles/caddy/tasks/caddy_install.yml @@ -15,6 +15,9 @@ ansible.builtin.unarchive: src: "https://go.dev/dl/go{{ caddy_go_version }}.linux-amd64.tar.gz" dest: "/usr/local/go-{{ caddy_go_version }}" + creates: "/usr/local/go-{{ caddy_go_version }}/bin/go" + extra_opts: + - "--strip-components=1" remote_src: true - name: Create xcaddy directory @@ -27,6 +30,7 @@ ansible.builtin.unarchive: src: "https://github.com/caddyserver/xcaddy/releases/download/v{{ caddy_xcaddy_version }}/xcaddy_{{ caddy_xcaddy_version }}_linux_amd64.tar.gz" dest: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}" + creates: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy" remote_src: true - name: Create Caddy build command @@ -44,8 +48,8 @@ ansible.builtin.copy: dest: "/usr/local/bin/.caddy.{{ caddy_my_name }}.build" content: > - XCADDY_WHICH_GO=/usr/local/go-{{ caddy_go_version }}/go/bin/go - {{ caddy_build_command }}" + XCADDY_WHICH_GO=/usr/local/go-{{ caddy_go_version }}/bin/go + {{ caddy_build_command }} mode: "0644" register: caddy_test_caddy_version @@ -53,7 +57,7 @@ # noqa: no-handler when: "caddy_test_caddy_version.changed" environment: - XCADDY_WHICH_GO: "/usr/local/go-{{ caddy_go_version }}/go/bin/go" + XCADDY_WHICH_GO: "/usr/local/go-{{ caddy_go_version }}/bin/go" ansible.builtin.command: cmd: "{{ caddy_build_command }}" creates: "{{ caddy_binary }}" @@ -83,8 +87,8 @@ mode: "{{ item.mode | default('0750') }}" loop: - path: "{{ caddy_config_dir }}" - - path: "{{ caddy_config_dir }}/crs-plugins" - - path: "{{ caddy_config_dir }}/sites" + - path: "{{ caddy_crs_plugins_dir }}" + - path: "{{ caddy_sites_dir }}" - path: "{{ caddy_log_dir }}" mode: "0770" - path: "{{ caddy_home_dir }}/geoip2" @@ -95,14 +99,33 @@ ansible.builtin.unarchive: src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ item }}.tar.gz" dest: "{{ caddy_config_dir }}" + creates: "{{ caddy_config_dir }}/coreruleset-{{ item }}/rules/" group: "{{ caddy_system_group }}" remote_src: true - name: Install plugins loop: "{{ caddy_crs_plugins }}" - loop_control: - loop_var: "plugin" - ansible.builtin.include_tasks: "caddy_install_plugin.yml" + ansible.builtin.unarchive: + src: "https://github.com/{{ item.provider | default('coreruleset') }}/{{ item.name }}-plugin/archive/refs/tags/v{{ item.version }}.tar.gz" + dest: "{{ caddy_crs_plugins_dir }}" + creates: "{{ caddy_crs_plugins_dir }}/{{ item.name }}-config.conf" + include: + - "*.conf" + extra_opts: + - "--strip-components=2" + - "--wildcards" + mode: "0644" + group: "{{ caddy_system_group }}" + remote_src: true + +- name: Create plugins after config + loop: "{{ caddy_crs_plugins }}" + when: "not(item.has_after_config | default(false))" + ansible.builtin.copy: + content: "" + dest: "{{ caddy_crs_plugins_dir }}/{{ item.name }}-after.conf" + mode: "0644" + group: "{{ caddy_system_group }}" - name: Deploy caddy service file ansible.builtin.template: @@ -110,4 +133,5 @@ dest: "/etc/systemd/system/{{ caddy_my_name }}.service" mode: "0644" notify: + - "Reload systemd" - "Restart Caddy" diff --git a/seb4itik/byow/roles/caddy/tasks/caddy_install_plugin.yml b/seb4itik/byow/roles/caddy/tasks/caddy_install_plugin.yml deleted file mode 100644 index c7dd0e8..0000000 --- a/seb4itik/byow/roles/caddy/tasks/caddy_install_plugin.yml +++ /dev/null @@ -1,55 +0,0 @@ -- name: Download plugin {{ plugin.name }} - ansible.builtin.get_url: - url: "https://github.com/{{ plugin.provider | default('coreruleset') }}/{{ plugin.name }}-plugin/archive/refs/tags/v{{ plugin.version }}.tar.gz" - dest: "/usr/local/src/" - mode: "0644" - register: "caddy_plugin_downloaded" - -- name: Deploy plugin {{ plugin.name }} - # noqa: no-handler - when: "caddy_plugin_downloaded.changed" - block: - - - name: Get temp dir {{ plugin.name }} - ansible.builtin.tempfile: - state: "directory" - register: "caddy_temp_plugin_dir" - - - name: Unarchive plugin {{ plugin.name }} - ansible.builtin.unarchive: - src: "/usr/local/src/{{ plugin.name }}-plugin-{{ plugin.version }}.tar.gz" - dest: "{{ caddy_temp_plugin_dir.path }}" - remote_src: true - - - name: Copy plugin files {{ plugin.name }} - ansible.builtin.copy: - src: "{{ caddy_temp_plugin_dir.path }}/{{ plugin.name }}-plugin-{{ plugin.version }}/plugins/" - dest: "{{ caddy_config_dir }}/crs-plugins/" - mode: "0644" -# directory_mode: "0750" - group: "{{ caddy_system_group }}" - remote_src: true - notify: - - "Restart Caddy" - - - name: Create after config {{ plugin.name }} - when: "not(plugin.has_after_config | default(false))" - ansible.builtin.copy: - content: "" - dest: "{{ caddy_config_dir }}/crs-plugins/{{ plugin.name }}-after.conf" - mode: "0644" - group: "{{ caddy_system_group }}" - - # FIXME: bad hack, why is it required? - - name: Adjust plugins diretory permissions - ansible.builtin.file: - path: "{{ caddy_config_dir }}/crs-plugins" - state: "directory" - group: "{{ caddy_system_group }}" - mode: "0750" - - - name: Delete temp dir {{ plugin.name }} - when: "caddy_temp_plugin_dir.path is defined" - ansible.builtin.file: - path: "{{ caddy_temp_plugin_dir.path }}" - state: "absent" diff --git a/seb4itik/byow/roles/caddy/templates/Caddyfile b/seb4itik/byow/roles/caddy/templates/Caddyfile index d0906a2..8ccac83 100644 --- a/seb4itik/byow/roles/caddy/templates/Caddyfile +++ b/seb4itik/byow/roles/caddy/templates/Caddyfile @@ -202,17 +202,17 @@ coraza_waf @not_whitelisted { load_owasp_crs directives ` - Include "{{ caddy_config_dir }}/sites/{{ site.id }}/coraza.conf" - Include "{{ caddy_config_dir }}/sites/{{ site.id }}/crs-setup.conf" + Include "{{ caddy_sites_dir }}/{{ site.id }}/coraza.conf" + Include "{{ caddy_sites_dir }}/{{ site.id }}/crs-setup.conf" {% for plugin in site.crs_plugins | default(caddy_sites_defaults.crs_plugins) %} - Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-config.conf" - Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-before.conf" + Include "{{ caddy_crs_plugins_dir }}/{{ plugin }}-config.conf" + Include "{{ caddy_crs_plugins_dir }}/{{ plugin }}-before.conf" {% endfor %} - Include "{{ caddy_config_dir }}/sites/{{ site.id }}/exclusions-request-before.conf" + Include "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-request-before.conf" Include "{{ caddy_config_dir }}/coreruleset-{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}/rules/*.conf" - Include "{{ caddy_config_dir }}/sites/{{ site.id }}/exclusions-response-after.conf" + Include "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-response-after.conf" {% for plugin in site.crs_plugins | default(caddy_sites_defaults.crs_plugins) %} - Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-after.conf" + Include "{{ caddy_crs_plugins_dir }}/{{ plugin }}-after.conf" {% endfor %} SecRuleEngine On ` diff --git a/seb4itik/byow/roles/consul/tasks/main.yml b/seb4itik/byow/roles/consul/tasks/main.yml index 73c3dbf..f875612 100644 --- a/seb4itik/byow/roles/consul/tasks/main.yml +++ b/seb4itik/byow/roles/consul/tasks/main.yml @@ -20,6 +20,7 @@ ansible.builtin.unarchive: src: "https://releases.hashicorp.com/consul/{{ consul_version }}/consul_{{ consul_version }}_linux_amd64.zip" dest: "/usr/local/consul-{{ consul_version }}" + creates: "/usr/local/consul-{{ consul_version }}/consul" remote_src: true notify: - "Restart Consul"