optimizations

example/tofu/infra.auto.tfvars

@@ -2,9 +2,15 @@ vms = {
   proxy1 = {
     disk = "20g"
   },
-  waf1 = {},
+  waf1 = {
-  waf2 = {},
+    cpus = 4
-  waf3 = {},
+  },
+  waf2 = {
+    cpus = 4
+  },
+  waf3 = {
+    cpus = 4
+  },
   sql1 = {},
   nfs1 = {},
   www1 = {},

seb4itik/byow/roles/caddy/defaults/main.yml

@@ -40,6 +40,8 @@ caddy_system_user: "{{ caddy_my_name }}"
 caddy_system_group: "{{ caddy_my_name }}"
 caddy_home_dir: "/opt/{{ caddy_my_name }}"
 caddy_config_dir: "/etc/{{ caddy_my_name }}"
+caddy_crs_plugins_dir: "{{ caddy_config_dir }}/crs-plugins"
+caddy_sites_dir: "{{ caddy_config_dir }}/sites"
 caddy_log_dir: "/var/log/{{ caddy_my_name }}"
 
 # OWASP CRS plugins that will can be actived per site.

seb4itik/byow/roles/caddy/handlers/main.yml

@@ -1,8 +1,8 @@
+- name: Reload systemd
+  ansible.builtin.service:
+    daemon_reload: true
+
 - name: Restart Caddy
   ansible.builtin.service:
     name: "{{ caddy_my_name }}"
     state: "restarted"
-
-# - name: Update GeoIP databases
-#   ansible.builtin.command:
-#     cmd: "/usr/bin/geoipupdate"

seb4itik/byow/roles/caddy/tasks/caddy_config.yml

@@ -5,7 +5,7 @@
 - name: Create sites config directories
   loop: "{{ caddy_sites }}"
   ansible.builtin.file:
-    path: "{{ caddy_config_dir }}/sites/{{ item.id }}"
+    path: "{{ caddy_sites_dir }}/{{ item.id }}"
     state: "directory"
     group: "{{ caddy_system_group }}"
     mode: "0750"
@@ -16,7 +16,7 @@
     loop_var: "site"
   ansible.builtin.template:
     src: "templates/coraza.conf"
-    dest: "{{ caddy_config_dir }}/sites/{{ site.id }}/coraza.conf"
+    dest: "{{ caddy_sites_dir }}/{{ site.id }}/coraza.conf"
     group: "{{ caddy_system_group }}"
     mode: "0640"
   notify:
@@ -28,7 +28,7 @@
     loop_var: "site"
   ansible.builtin.template:
     src: "templates/crs-setup.conf"
-    dest: "{{ caddy_config_dir }}/sites/{{ site.id }}/crs-setup.conf"
+    dest: "{{ caddy_sites_dir }}/{{ site.id }}/crs-setup.conf"
     group: "{{ caddy_system_group }}"
     mode: "0640"
   notify:
@@ -40,7 +40,7 @@
     loop_var: "site"
   ansible.builtin.template:
     src: "templates/exclusions-request-before.conf"
-    dest: "{{ caddy_config_dir }}/sites/{{ site.id }}/exclusions-request-before.conf"
+    dest: "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-request-before.conf"
     group: "{{ caddy_system_group }}"
     mode: "0640"
   notify:
@@ -52,7 +52,7 @@
     loop_var: "site"
   ansible.builtin.template:
     src: "templates/exclusions-response-after.conf"
-    dest: "{{ caddy_config_dir }}/sites/{{ site.id }}/exclusions-response-after.conf"
+    dest: "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-response-after.conf"
     group: "{{ caddy_system_group }}"
     mode: "0640"
   notify:
@@ -81,4 +81,3 @@
     name: "{{ caddy_my_name }}"
     state: "started"
     enabled: true
-    daemon_reload: true

seb4itik/byow/roles/caddy/tasks/caddy_install.yml

@@ -15,6 +15,9 @@
   ansible.builtin.unarchive:
     src: "https://go.dev/dl/go{{ caddy_go_version }}.linux-amd64.tar.gz"
     dest: "/usr/local/go-{{ caddy_go_version }}"
+    creates: "/usr/local/go-{{ caddy_go_version }}/bin/go"
+    extra_opts:
+      - "--strip-components=1"
     remote_src: true
 
 - name: Create xcaddy directory
@@ -27,6 +30,7 @@
   ansible.builtin.unarchive:
     src: "https://github.com/caddyserver/xcaddy/releases/download/v{{ caddy_xcaddy_version }}/xcaddy_{{ caddy_xcaddy_version }}_linux_amd64.tar.gz"
     dest: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
+    creates: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy"
     remote_src: true
 
 - name: Create Caddy build command
@@ -44,8 +48,8 @@
   ansible.builtin.copy:
     dest: "/usr/local/bin/.caddy.{{ caddy_my_name }}.build"
     content: >
-      XCADDY_WHICH_GO=/usr/local/go-{{ caddy_go_version }}/go/bin/go
+      XCADDY_WHICH_GO=/usr/local/go-{{ caddy_go_version }}/bin/go
-      {{ caddy_build_command }}"
+      {{ caddy_build_command }}
     mode: "0644"
   register: caddy_test_caddy_version
 
@@ -53,7 +57,7 @@
   # noqa: no-handler
   when: "caddy_test_caddy_version.changed"
   environment:
-    XCADDY_WHICH_GO: "/usr/local/go-{{ caddy_go_version }}/go/bin/go"
+    XCADDY_WHICH_GO: "/usr/local/go-{{ caddy_go_version }}/bin/go"
   ansible.builtin.command:
     cmd: "{{ caddy_build_command }}"
     creates: "{{ caddy_binary }}"
@@ -83,8 +87,8 @@
     mode: "{{ item.mode | default('0750') }}"
   loop:
     - path: "{{ caddy_config_dir }}"
-    - path: "{{ caddy_config_dir }}/crs-plugins"
+    - path: "{{ caddy_crs_plugins_dir }}"
-    - path: "{{ caddy_config_dir }}/sites"
+    - path: "{{ caddy_sites_dir }}"
     - path: "{{ caddy_log_dir }}"
       mode: "0770"
     - path: "{{ caddy_home_dir }}/geoip2"
@@ -95,14 +99,33 @@
   ansible.builtin.unarchive:
     src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ item }}.tar.gz"
     dest: "{{ caddy_config_dir }}"
+    creates: "{{ caddy_config_dir }}/coreruleset-{{ item }}/rules/"
     group: "{{ caddy_system_group }}"
     remote_src: true
 
 - name: Install plugins
   loop: "{{ caddy_crs_plugins }}"
-  loop_control:
+  ansible.builtin.unarchive:
-    loop_var: "plugin"
+    src: "https://github.com/{{ item.provider | default('coreruleset') }}/{{ item.name }}-plugin/archive/refs/tags/v{{ item.version }}.tar.gz"
-  ansible.builtin.include_tasks: "caddy_install_plugin.yml"
+    dest: "{{ caddy_crs_plugins_dir }}"
+    creates: "{{ caddy_crs_plugins_dir }}/{{ item.name }}-config.conf"
+    include:
+      - "*.conf"
+    extra_opts:
+      - "--strip-components=2"
+      - "--wildcards"
+    mode: "0644"
+    group: "{{ caddy_system_group }}"
+    remote_src: true
+
+- name: Create plugins after config
+  loop: "{{ caddy_crs_plugins }}"
+  when: "not(item.has_after_config | default(false))"
+  ansible.builtin.copy:
+    content: ""
+    dest: "{{ caddy_crs_plugins_dir }}/{{ item.name }}-after.conf"
+    mode: "0644"
+    group: "{{ caddy_system_group }}"
 
 - name: Deploy caddy service file
   ansible.builtin.template:
@@ -110,4 +133,5 @@
     dest: "/etc/systemd/system/{{ caddy_my_name }}.service"
     mode: "0644"
   notify:
+    - "Reload systemd"
     - "Restart Caddy"

seb4itik/byow/roles/caddy/tasks/caddy_install_plugin.yml

@@ -1,55 +0,0 @@
-- name: Download plugin {{ plugin.name }}
-  ansible.builtin.get_url:
-    url: "https://github.com/{{ plugin.provider | default('coreruleset') }}/{{ plugin.name }}-plugin/archive/refs/tags/v{{ plugin.version }}.tar.gz"
-    dest: "/usr/local/src/"
-    mode: "0644"
-  register: "caddy_plugin_downloaded"
-
-- name: Deploy plugin {{ plugin.name }}
-  # noqa: no-handler
-  when: "caddy_plugin_downloaded.changed"
-  block:
-
-    - name: Get temp dir {{ plugin.name }}
-      ansible.builtin.tempfile:
-        state: "directory"
-      register: "caddy_temp_plugin_dir"
-
-    - name: Unarchive plugin {{ plugin.name }}
-      ansible.builtin.unarchive:
-        src: "/usr/local/src/{{ plugin.name }}-plugin-{{ plugin.version }}.tar.gz"
-        dest: "{{ caddy_temp_plugin_dir.path }}"
-        remote_src: true
-
-    - name: Copy plugin files {{ plugin.name }}
-      ansible.builtin.copy:
-        src: "{{ caddy_temp_plugin_dir.path }}/{{ plugin.name }}-plugin-{{ plugin.version }}/plugins/"
-        dest: "{{ caddy_config_dir }}/crs-plugins/"
-        mode: "0644"
-#       directory_mode: "0750"
-        group: "{{ caddy_system_group }}"
-        remote_src: true
-      notify:
-        - "Restart Caddy"
-
-    - name: Create after config {{ plugin.name }}
-      when: "not(plugin.has_after_config | default(false))"
-      ansible.builtin.copy:
-        content: ""
-        dest: "{{ caddy_config_dir }}/crs-plugins/{{ plugin.name }}-after.conf"
-        mode: "0644"
-        group: "{{ caddy_system_group }}"
-
-    # FIXME: bad hack, why is it required?
-    - name: Adjust plugins diretory permissions
-      ansible.builtin.file:
-        path: "{{ caddy_config_dir }}/crs-plugins"
-        state: "directory"
-        group: "{{ caddy_system_group }}"
-        mode: "0750"
-
-    - name: Delete temp dir {{ plugin.name }}
-      when: "caddy_temp_plugin_dir.path is defined"
-      ansible.builtin.file:
-        path: "{{ caddy_temp_plugin_dir.path }}"
-        state: "absent"

seb4itik/byow/roles/caddy/templates/Caddyfile

@@ -202,17 +202,17 @@
   coraza_waf @not_whitelisted {
     load_owasp_crs
     directives `
-      Include "{{ caddy_config_dir }}/sites/{{ site.id }}/coraza.conf"
+      Include "{{ caddy_sites_dir }}/{{ site.id }}/coraza.conf"
-      Include "{{ caddy_config_dir }}/sites/{{ site.id }}/crs-setup.conf"
+      Include "{{ caddy_sites_dir }}/{{ site.id }}/crs-setup.conf"
 {% for plugin in site.crs_plugins | default(caddy_sites_defaults.crs_plugins) %}
-      Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-config.conf"
+      Include "{{ caddy_crs_plugins_dir }}/{{ plugin }}-config.conf"
-      Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-before.conf"
+      Include "{{ caddy_crs_plugins_dir }}/{{ plugin }}-before.conf"
 {% endfor %}
-      Include "{{ caddy_config_dir }}/sites/{{ site.id }}/exclusions-request-before.conf"
+      Include "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-request-before.conf"
       Include "{{ caddy_config_dir }}/coreruleset-{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}/rules/*.conf"
-      Include "{{ caddy_config_dir }}/sites/{{ site.id }}/exclusions-response-after.conf"
+      Include "{{ caddy_sites_dir }}/{{ site.id }}/exclusions-response-after.conf"
 {% for plugin in site.crs_plugins | default(caddy_sites_defaults.crs_plugins) %}
-      Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-after.conf"
+      Include "{{ caddy_crs_plugins_dir }}/{{ plugin }}-after.conf"
 {% endfor %}
       SecRuleEngine On
     `

seb4itik/byow/roles/consul/tasks/main.yml

@@ -20,6 +20,7 @@
   ansible.builtin.unarchive:
     src: "https://releases.hashicorp.com/consul/{{ consul_version }}/consul_{{ consul_version }}_linux_amd64.zip"
     dest: "/usr/local/consul-{{ consul_version }}"
+    creates: "/usr/local/consul-{{ consul_version }}/consul"
     remote_src: true
   notify:
     - "Restart Consul"