WIP: elastic, metabase

.gitea/workflows/publish.yml

@@ -22,12 +22,12 @@ jobs:
 #     - uses: actions/gitea-upload-artifact@v3
 #       with:
 #         path: /workspace/itik/bgwaf/seb4itik/byow/seb4itik-byow-0.1.2.tar.gz
-#     - name: Push artifacts
+      - name: Push artifacts
-#       run: |
+        run: |
-#         GITEA_REPO_OWNER=$(echo $GITEA_REPOSITORY | cut -d"/" -f1) && \
+          GITEA_REPO_OWNER=$(echo $GITEA_REPOSITORY | cut -d"/" -f1) && \
-#         GITEA_REPO_NAME=$(echo $GITEA_REPOSITORY | cut -d"/" -f2) && \
+          GITEA_REPO_NAME=$(echo $GITEA_REPOSITORY | cut -d"/" -f2) && \
-#         curl \
+          curl \
-#           -X PUT \
+            -X PUT \
-#           -H "Authorization: token ${{ secrets.CI_GITEA_PACKAGES_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.CI_GITEA_PACKAGES_TOKEN }}" \
-#           --upload-file seb4itik-byow-${VER}.tar.gz \
+            --upload-file seb4itik-byow-${VER}.tar.gz \
-#           $GITEA_SERVER_URL/api/packages/${GITEA_REPO_OWNER}/generic/${GITEA_REPO_NAME}/${GITEA_SHA}/seb4itik-byow-${VER}.tar.gz
+            $GITEA_SERVER_URL/api/packages/${GITEA_REPO_OWNER}/generic/${GITEA_REPO_NAME}/${GITEA_SHA}/seb4itik-byow-${VER}.tar.gz

.gitignore

@@ -1,4 +1,4 @@
-notes/
+/notes/
 .ansible/
 __pycache__/
 infra-*/

example/ansible/.gitignore

@@ -1,3 +1,4 @@
 /ca/
 /.vault_pass
 /ansible_local.env
+/known_hosts

example/ansible/ansible.cfg

@@ -5,4 +5,4 @@ vault_password_file = ./.vault_pass
 
 [ssh_connection]
 pipelining = True
-ssh_args = -o ControlMaster=auto -o ControlPersist=300s -o StrictHostKeyChecking=no
+ssh_args = -o ControlMaster=auto -o ControlPersist=300s -o StrictHostKeyChecking=no -o UserKnownHostsFile=./known_hosts

example/ansible/inventory/groups.yml

@@ -2,25 +2,6 @@ linux:
   vars:
     ansible_user: "root"
 
-debian13:
-  hosts:
-    bdd1:
-    nfs1:
-    waf1:
-#   waf2:
-#   waf3:
-    www1:
-    www2:
-    www3:
-#   www4:
-#   www5:
-  vars:
-    ansible_python_interpreter: "/usr/bin/python3.13"
-
-ubuntu2204lts:
-  vars:
-    ansible_python_interpreter: "/usr/bin/python3.10"
-
 ubuntu2404lts:
   vars:
     ansible_python_interpreter: "/usr/bin/python3.12"

example/ansible/play-config.yml

@@ -18,6 +18,7 @@
           - "IP:{{ ansible_default_ipv4.address }}"
     caddy_config_only: true
     caddy_consul: true
+    caddy_consul: true
     caddy_consul_delegate_to: "waf1"
     caddy_consul_admin_token: "{{ secrets.consul.bootstrap_secret }}"
     caddy_consul_aes_key: "{{ secrets.caddy.storage_consul_aes_key }}"

example/ansible/play-debug.yml

@@ -4,10 +4,8 @@
     - "vars/common.yml"
     - "vars/secrets.yml"
   vars:
+    caddy_debug: true
     caddy_config_only: true
-    caddy_log_debug: true
-    caddy_crowdsec: true
-    caddy_crowdsec_api_key: "{{ secrets.crowdsec.lapi_key }}"
     caddy_consul: true
     caddy_consul_delegate_to: "waf1"
     caddy_consul_admin_token: "{{ secrets.consul.bootstrap_secret }}"

example/ansible/play-main.yml

@@ -45,9 +45,7 @@
     - "vars/common.yml"
     - "vars/secrets.yml"
   vars:
-#   common_proxy_server: "{{ hostvars['proxy1'].ansible_default_ipv4.address }}:3128"
+    common_proxy_server: "{{ hostvars['proxy1'].ansible_default_ipv4.address }}:3128"
-    common_search_domains:
-      - "multipass"
     common_default_packages:
       - "net-tools"
       - "htop"
@@ -132,8 +130,6 @@
     unbound_stub_zones:
       - name: "{{ common.consul.datacenter }}.{{ common.consul.domain }}"
         stub_to: "127.0.0.1@8600"
-    caddy_crowdsec: true
-    caddy_crowdsec_api_key: "{{ secrets.crowdsec.lapi_key }}"
     caddy_consul: true
     caddy_consul_delegate_to: "waf1"
     caddy_consul_admin_token: "{{ secrets.consul.bootstrap_secret }}"
@@ -146,7 +142,6 @@
   roles:
     - "local_ca_certs"
     - "consul"
-    - "crowdsec"
     - "caddy"
 #   - "keepalived"
     - "unbound"
@@ -185,11 +180,11 @@
         owner: 1001
         group: 33
         clients:
-          - address: "www1.multipass"
+          - address: "www1"
             options: "rw,no_root_squash"
-          - address: "www2.multipass"
+          - address: "www2"
             options: "rw,no_root_squash"
-          - address: "www3.multipass"
+          - address: "www3"
             options: "rw,no_root_squash"
   roles:
     - "nfs_server"
@@ -205,7 +200,7 @@
   vars:
     nfs_client_mounts:
       - mount_point: "/var/www/wordpress"
-        server: "nfs1.multipass:/srv/wordpress"
+        server: "nfs1:/srv/wordpress"
         owner: 1001
         group: 33
     wordpress_create_master: "www1"
@@ -217,7 +212,7 @@
     wordpress_admin_email: "seb@itik.fr"
     wordpress_themes: ["twentytwentyfive"]
     wordpress_active_theme: "twentytwentyfive"
-    wordpress_db_host: "bdd1.multipass"
+    wordpress_db_host: "bdd1"
     wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}"
   roles:
     - "nfs_client"

example/ansible/vars/secrets.yml

@@ -1,33 +1,29 @@
 $ANSIBLE_VAULT;1.1;AES256
-66313136343333353333666339316366663134303039333133376461333765383138663238376162
+64353736626438653965303633376231356361353433626432333862363638353937386635396430
-3739613236313832623963346565393630636562356239640a613634643365653264373338393737
+6339336333323062333732626539333761396234316535360a376361326263393431626638373165
-64626435636131666132646566393735653364353764366139616533393135366662353564636666
+34663632643038643630386331663035383738333364393636376137643037623939313136373665
-3139636566613065340a383931353561376339373730376633656537663435653764663139316665
+3238356630313039310a636661613764373133323033356339373334613331366337343935313334
-30666261313338656230323861633033323733346463326166323262613866323264663736633235
+30326631386562666336363735316234616339396633356633343339313562386530303863613331
-66313334343963316261613137363439633938383134656164323963636665376534653963346534
+30646638313535316433393361613461613932393933613932656362653666383638333739383831
-36383435323239666366653362373635306465316338303332656438333332623030333433643165
+64363266336438373635376663616432346464303365316564326536623133356264326462393537
-39333432616666353539653766656363373365373335643238373336653433646536313666393163
+38646261303962373465663266643139393366616133346662666331326539353635616662326138
-61653664626131343131376363316337373666396564646465333764353465393666636136646162
+64393163396339336231303765366130323530336433666361353161376536326465333438326337
-34336364303139343864303766393963313135343531366131633731633234623133353631636234
+64633731626636666430656335303431623663333464383138393231633435323338303862666634
-32626230393539343561393135386163363536376637376533356536356266613266613434396338
+33373664383663393637623735656338346566626431333964366637636431653461656363396463
-34343364356364356262346161653962313336656433346132623437626332366336643034326532
+65343033326433343863393865663236623133306663636237383532306137316534313436323137
-38346339333332303265353334386661353935623837633865373361313830613138613138323835
+66346630383133383430383263656137653462656665313664626366613135323463613737346261
-34656535383664373039333734396564623662363330643332646535386533376265343863626632
+32643833616135363066633632313863373563366362366534353762616162626239306135356164
-36636537393162373064323361376361306664363065633961363033313031313763613134353436
+31323631323939343763643964656330363133383437306236646466326266333964613162623666
-63366434363137346263653966323239613164363634613235656364663037386537386335666431
+61623139616466653438663065373635653162653461613131383531373632633235336332333935
-65363162623031633166613735393735333133626466313061396333306236393039383062326264
+30666430396634373563646439353563646536353966653635323932306261383863653137333766
-38343464636330326162653036326663383631613836656461303462333035636335326135303766
+39616564373330366230333562626435343934333331623761373336393937376562343433386334
-37323463666338323766393063633662343835393330326332616331373633663366393563303438
+31386663613031613835353662373138663835373235613462316232373533626439343631353632
-37666162633461313333623934633138663930623135663638386634626430346264633735333532
+36366133313862336336663134353935306661613935363331663136323930616361396431653439
-64623461613538343436306436626133383733393737393463306539383763663866346164306339
+37356666363331303637326663623561346236356266323731383632323835336362633362646237
-64303335303539306632306164613761343035306632303063393233633262333264333431333363
+31376230633165306135306537656434666630343865343333663762646361323462303031303935
-30373861636565363438346338376531346162303564653435373237636237366632323564646539
+36356132313934323235343436303032623461343630623464353663303138653566313938653635
-37383361356362653132653961376134663930363763326437306338623064623862336435373664
+36613037376430313966356237323362353862626139663339323834326637313636326534343031
-63393262323039616539626137396432613932633730316235396435396531366466616264393161
+37373664653361373064666362343165613063303336663330643064643331383432653333353330
-62323339393039323235383663663265643065626137636562656335343233313734366166336264
+38646535363835653039636531616632313130313963656435303739326530633434316237303562
-35633765316262633636323866633266653037326165646230326564323033613963316331346331
+66646631393563356136303537303563346537366633316437373231313265633133653431323031
-32346265386164376361303532343730343139393837343162666238633366643361353332376137
+33393937356430363739
-33633764323133316334323234353932363165636438656563353630373238376465643463656535
-30383337303861326433303137383539313536333465663063306137646264316438636665323263
-34383933666565333962363863313536653232363930306665336432373738353238666362353639
-37316136373639373233

example/tofu/infra.auto.tfvars

@@ -1,27 +1,21 @@
 vms = {
-# proxy1 = {
+  proxy1 = {
-#   disk = "20g"
+    disk = "20g"
-# },
+  },
   waf1 = {
     cpus = 4
   },
   waf2 = {
     cpus = 4
-    image = "22.04"
   },
   waf3 = {
     cpus = 4
-    image = "24.04"
   },
   bdd1 = {},
   nfs1 = {},
   www1 = {},
   www2 = {},
   www3 = {},
-  www4 = {
+  www4 = {},
-    image = "22.04"
+  www5 = {},
-  },
-  www5 = {
-    image = "24.04"
-  },
 }

example/tofu/variables.tf

@@ -4,6 +4,6 @@ variable "vms" {
     cpus   = optional(number, 2),
     memory = optional(string, "3g"),
     disk   = optional(string, "12g"),
-    image  = optional(string, "https://cloud.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2"),
+    image  = optional(string, "24.04"),
   }))
 }

seb4itik/byow/galaxy.yml

@@ -1,6 +1,6 @@
 namespace: "seb4itik"
 name: "byow"
-version: "0.3.4"
+version: "0.3.0"
 readme: "README.md"
 authors:
 - "S. Namèche <sebastien@itik.fr>"

seb4itik/byow/roles/caddy/defaults/main.yml

@@ -6,26 +6,45 @@ caddy_http_port: 80
 caddy_https_port: 443
 caddy_default_bind: null
 
-# Sotware versions
+# If true, will not install software, just deploy Caddy and OWASP CRS
-caddy_go_version: "1.26.1"
-caddy_xcaddy_version: "0.4.5"
-caddy_version: "2.11.2"
-
-# If true, will not install software, just deploy Caddyfile and OWASP CRS
 # configuration files.
 caddy_config_only: false
 
-# Log settings
+# Debug will go to /var/log/<caddy_my_name>/debug.log.
-# If log_to_file is false, will log to journald.
+caddy_debug: false
-# If log_to_file is true, logs will go:
+
-# - for each site, in: /var/log/<caddy_my_name>/site_<sit.id>.log
+# Required for Let's Encrypt auto certificates.
-# - for WAF logs (Coraza), in /var/log/<caddy_my_name>/waf.log
+caddy_email: null
-caddy_log_to_file: true
+
-caddy_log_format: "console"                # "console" or "json"
+# If a custom CA root have to be used.
-caddy_log_debug: false                         # Debug will go to /var/log/<caddy_my_name>/debug.log
+caddy_ca_root: null
+
+# For using a Consul cluster.
+caddy_consul: false
+caddy_consul_server: "{{ ansible_fqdn }}:8501"
+caddy_consul_delegate_to: null         # Required, Consul host for running Consul commands
+caddy_consul_admin_token: null         # Required
+caddy_consul_aes_key: null             # Required, 32 characters
+caddy_consul_client_cert: null         # Required
+caddy_consul_client_key: null          # Required
+
+# Accound id and license key are required if a site use Geoip filtering.
+# See: https://dev.maxmind.com/geoip/updating-databases/
+caddy_geoip_account_id: null    
+caddy_geoip_license_key: null
+caddy_geoip_edition_ids: "GeoLite2-ASN,GeoLite2-Country,GeoLite2-City"
+caddy_geoip_update_frequency: 86400   # In seconds
+
+# Sotware versions
+caddy_version: "2.10.2"
+caddy_go_version: "1.25.6"
+caddy_xcaddy_version: "0.4.5"
+caddy_coraza_caddy_version: "v2@v2.1.0"  # Coraza v3.3.3
+# Different sites can use different versions of OWASP CRS
+caddy_owasp_crs_versions: ["4.23.0"]
 
 # Paths
-caddy_binary: "/usr/local/sbin/caddy_{{ caddy_my_name }}"  # Should begin by "caddy" for CrowdSec
+caddy_binary: "/usr/local/bin/{{ caddy_my_name }}"
 caddy_system_user: "{{ caddy_my_name }}"
 caddy_system_group: "{{ caddy_my_name }}"
 caddy_home_dir: "/opt/{{ caddy_my_name }}"
@@ -34,52 +53,9 @@ caddy_crs_plugins_dir: "{{ caddy_config_dir }}/crs-plugins"
 caddy_sites_dir: "{{ caddy_config_dir }}/sites"
 caddy_log_dir: "/var/log/{{ caddy_my_name }}"
 
-# Required for Let's Encrypt auto certificates.
+# OWASP CRS plugins that will can be actived per site.
-caddy_email: null
-
-# For using a Consul cluster.
-caddy_consul: false
-caddy_consul_server: "{{ ansible_fqdn }}:8501"
-caddy_consul_delegate_to: null         # Required, Consul host for running Consul commands
-caddy_consul_admin_token: null         # Required
-caddy_consul_aes_key: null             # Required, 32 characters
-caddy_consul_client_cert: null         # Required, CN must be "server.<consul datacenter>.<consul domain>"
-                                       # At least, SANs must include:
-                                       #   - "DNS:server.<consul datacenter>.<consul domain>"
-                                       #   - "DNS:<host FQDN>" 
-caddy_consul_client_key: null          # Required
-
-# Accound id and license key are required if a site use Geoip filtering.
-# See: https://dev.maxmind.com/geoip/updating-databases/
-caddy_geoip: false    
-caddy_geoip_account_id: null           # Required
-caddy_geoip_license_key: null          # Required
-caddy_geoip_edition_ids: "GeoLite2-ASN,GeoLite2-Country,GeoLite2-City"
-caddy_geoip_update_frequency: 86400    # In seconds
-
-# CrowdSec
-caddy_crowdsec: false
-caddy_crowdsec_api_key: null           # Required
-caddy_crowdsec_api_url: "http://127.0.0.1:8080"
-caddy_crowdsec_ticker_interval: 15     # In seconds
-caddy_crowdsec_appsec_url: null        # "http://localhost:7422"
-caddy_crowdsec_streaming: true
-caddy_crowdsec_hard_fails: true
-
-# Rate Limit
-caddy_ratelimit: true
-
-# Bot barrier
-caddy_bot_barrier: false
-
-# Coraza
-caddy_coraza: true
-caddy_coraza_caddy_version: "v2@v2.2.0"  # Coraza v3.3.3
-# Different sites can use different versions of OWASP CRS
-caddy_coraza_crs_versions: ["4.24.1"]
-# OWASP CRS plugins that can be actived per site.
 # Cf.: https://github.com/coreruleset/plugin-registry
-caddy_coraza_crs_plugins:
+caddy_crs_plugins:
   - name: "drupal-rule-exclusions"
     version: "1.0.0"
   - name: "wordpress-rule-exclusions"
@@ -104,11 +80,9 @@ caddy_sites: []
 # - id: ""            # Mandatory: short id for the site (for site specific directories and files)
 #   name: ""          # Mandatory: canonical domain name
 #   paths:            # Mandatory: targets for the reverse proxy
-#     - path: "*"            # Optionnal: path of the request, default "*"
+#     - path: ""      # Optionnal: path of the request, default "*"
-#       strip_prefix: false  # Optionnal: default "false"
 #       addrs:        # Mandatory: upstreams
 #         - ""        # Mandatory: URL of the upstream, minimum 1 required
-#   ...                      # Site configuration directives (see caddy_global_sites_defaults in vars/main.yml)
 
 
 # For overriding default global parameters. Will be merged with

seb4itik/byow/roles/caddy/handlers/main.yml

@@ -6,8 +6,3 @@
   ansible.builtin.service:
     name: "{{ caddy_my_name }}"
     state: "restarted"
-
-- name: Restart Crowdsec Securiy Engine
-  ansible.builtin.systemd_service:
-    name: "crowdsec"
-    state: "restarted"

seb4itik/byow/roles/caddy/tasks/caddy_config.yml

@@ -2,10 +2,6 @@
   ansible.builtin.set_fact:
     caddy_sites_defaults: "{{ caddy_global_sites_defaults | combine(caddy_my_sites_defaults) }}"
 
-- name: Configure Caddy Coraza CRS
-  when: "caddy_coraza"
-  block:
-
 - name: Create sites config directories
   loop: "{{ caddy_sites }}"
   ansible.builtin.file:
@@ -62,9 +58,7 @@
   notify:
     - "Restart Caddy"
 
-# FIXME: Should per site
 - name: Copy bot barrier template
-  when: "caddy_bot_barrier"
   ansible.builtin.copy:
     src: "files/bot_barrier_template.html"
     dest: "{{ caddy_config_dir }}/bot_barrier_template.html"

seb4itik/byow/roles/caddy/tasks/caddy_crowdsec.yml

@@ -1,19 +0,0 @@
-- name: Get collections list
-  ansible.builtin.shell:
-    executable: "/usr/bin/bash"
-    cmd: |
-      set -o pipefail
-      cscli collection list --output=json |jq -r '.collections[] |.name'
-  register: "crowdsec_out_list_collections"
-  changed_when: false
-
-- name: Install collections
-  loop:
-    - "crowdsecurity/caddy"
-    - "barnoux/caddy-coraza"
-  when: "item not in crowdsec_out_list_collections.stdout_lines"
-  ansible.builtin.command:
-    cmd: "cscli collections install {{ item }}"
-  changed_when: true
-  notify:
-    - "Restart Crowdsec Securiy Engine"

seb4itik/byow/roles/caddy/tasks/caddy_install.yml

@@ -4,7 +4,6 @@
       - "git"
       - "libnss3-tools"
       - "ssl-cert"
-      - "jq"
 
 - name: Create Go directory
   ansible.builtin.file:
@@ -38,31 +37,16 @@
   ansible.builtin.set_fact:
     caddy_build_command: >
       /usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy build v{{ caddy_version }}
-      {% if caddy_coraza %}
-      --with github.com/corazawaf/coraza-caddy/{{ caddy_coraza_caddy_version }}
-      {% endif %}
-      {% if caddy_ratelimit %}
-      --with github.com/mholt/caddy-ratelimit
-      {% endif %}
-      {% if caddy_consul %}
       --with github.com/pteich/caddy-tlsconsul
-      {% endif %}
+      --with github.com/corazawaf/coraza-caddy/{{ caddy_coraza_caddy_version }}
-      {% if caddy_bot_barrier %}
+      --with github.com/mholt/caddy-ratelimit
       --with github.com/steffenbusch/caddy-bot-barrier
-      {% endif %}
-      {% if caddy_geoip %}
       --with github.com/zhangjiayin/caddy-geoip2
-      {% endif %}
-      {% if caddy_crowdsec %}
-      --with github.com/hslatman/caddy-crowdsec-bouncer/http
-      --with github.com/hslatman/caddy-crowdsec-bouncer/layer4
-      --with github.com/hslatman/caddy-crowdsec-bouncer/appsec
-      {% endif %}
       --output {{ caddy_binary }}
 
 - name: Remember and test Caddy version
   ansible.builtin.copy:
-    dest: "{{ caddy_binary }}.build"
+    dest: "/usr/local/bin/.caddy.{{ caddy_my_name }}.build"
     content: >
       XCADDY_WHICH_GO=/usr/local/go-{{ caddy_go_version }}/bin/go
       {{ caddy_build_command }}
@@ -76,6 +60,7 @@
     XCADDY_WHICH_GO: "/usr/local/go-{{ caddy_go_version }}/bin/go"
   ansible.builtin.command:
     cmd: "{{ caddy_build_command }}"
+    creates: "{{ caddy_binary }}"
   notify:
     - "Restart Caddy"
 
@@ -111,8 +96,7 @@
       owner: "{{ caddy_system_user }}"
 
 - name: Install OWASP CRS
-  when: "caddy_coraza"
+  loop: "{{ caddy_owasp_crs_versions }}"
-  loop: "{{ caddy_coraza_crs_versions }}"
   ansible.builtin.unarchive:
     src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ item }}.tar.gz"
     dest: "{{ caddy_config_dir }}"
@@ -120,9 +104,8 @@
     group: "{{ caddy_system_group }}"
     remote_src: true
 
-- name: Install CRS plugins
+- name: Install plugins
-  when: "caddy_coraza"
+  loop: "{{ caddy_crs_plugins }}"
-  loop: "{{ caddy_coraza_crs_plugins }}"
   ansible.builtin.unarchive:
     src: "https://github.com/{{ item.provider | default('coreruleset') }}/{{ item.name }}-plugin/archive/refs/tags/v{{ item.version }}.tar.gz"
     dest: "{{ caddy_crs_plugins_dir }}"
@@ -136,9 +119,9 @@
     group: "{{ caddy_system_group }}"
     remote_src: true
 
-- name: Create CRS plugins after config
+- name: Create plugins after config
-  loop: "{{ caddy_coraza_crs_plugins }}"
+  loop: "{{ caddy_crs_plugins }}"
-  when: "caddy_coraza and not(item.has_after_config | default(false))"
+  when: "not(item.has_after_config | default(false))"
   ansible.builtin.copy:
     content: ""
     dest: "{{ caddy_crs_plugins_dir }}/{{ item.name }}-after.conf"

seb4itik/byow/roles/caddy/tasks/main.yml

@@ -6,9 +6,5 @@
   when: "caddy_consul"
   ansible.builtin.include_tasks: "caddy_consul.yml"
 
-- name: Configure CrowdSec for Caddy
-  when: "caddy_crowdsec"
-  ansible.builtin.include_tasks: "caddy_crowdsec.yml"
-
 - name: Configure Caddy
   ansible.builtin.include_tasks: "caddy_config.yml"

seb4itik/byow/roles/caddy/templates/Caddyfile

@@ -1,40 +1,31 @@
 {
   http_port {{ caddy_http_port }}
   https_port {{ caddy_https_port }}
-  admin off
-  persist_config off
 {% if caddy_default_bind != None %}
   default_bind {{ caddy_default_bind }}
 {% endif %}
-{% if caddy_crowdsec %}
-  order crowdsec first
-{% endif %}
-{% if caddy_geoip %}
   order geoip2_vars first
-{% endif %}
-{% if caddy_coraza %}
   order coraza_waf first
-{% endif %}
+  admin off
+  persist_config off
 
 {% if caddy_consul %}
-  # See: https://github.com/pteich/caddy-tlsconsul
   storage consul {
     address      "{{ caddy_consul_server }}"
-    token        "{{ caddy_out_consul_token.token.SecretID | mandatory }}"
+    token        "{{ caddy_out_consul_token.token.SecretID }}"
     timeout      10
     prefix       "caddy-{{ caddy_my_name }}-tls"
     value_prefix "{{ caddy_my_name }}"
-    aes_key      "{{ caddy_consul_aes_key | mandatory }}"
+    aes_key      "{{ caddy_consul_aes_key }}"
     tls_enabled  "true"
     tls_insecure "false"
   }
 {% endif %}
 
-{% if caddy_geoip %}
+{% if caddy_geoip_account_id != None and caddy_geoip_license_key != None %}
-  # See: https://github.com/zhangjiayin/caddy-geoip2
   geoip2 {
-    accountId         "{{ caddy_geoip_account_id | mandatory }}"
+    accountId         "{{ caddy_geoip_account_id }}"
-    licenseKey        "{{ caddy_geoip_license_key | mandatory }}"
+    licenseKey        "{{ caddy_geoip_license_key }}"
     databaseDirectory "{{ caddy_home_dir }}/geoip2"
     lockFile          "{{ caddy_home_dir }}/geoip2/.geoip2.lock"
     editionID         "{{ caddy_geoip_edition_ids }}"
@@ -47,49 +38,32 @@
   email "{{ caddy_email }}"
 {% endif %}
 
-{% if caddy_crowdsec %}
+{% if caddy_ca_root | default(None) != None %}
-  # See: https://github.com/hslatman/caddy-crowdsec-bouncer
+  tls {
-  crowdsec {
+    ca_root "{{ caddy_ca_root }}"
-    api_key {{ caddy_crowdsec_api_key | mandatory }}
+  }
-    api_url {{ caddy_crowdsec_api_url }}
+{% endif %}
-    ticker_interval {{ caddy_crowdsec_ticker_interval }}s
+
-{% if caddy_crowdsec_appsec_url != None %}
+{% if caddy_debug %}
-    appsec_url {{ caddy_crowdsec_appsec_url }}
+  log {
-{% endif %}
+    format json
-{% if not caddy_crowdsec_streaming %}
+    level DEBUG
-    disable_streaming
+    output file {{ caddy_log_dir }}/debug.log
-{% endif %}
-{% if caddy_crowdsec_hard_fails %}
-    enable_hard_fails
-{% endif %}
   }
 {% endif %}
 
-{% if caddy_coraza %}
   log waf {
+    format {{ caddy_sites_defaults.log_format }}
     include "http.handlers.waf"
-    format {{ caddy_log_format }}
     format append {
       waf_id {{ caddy_my_name }}
     }
-{% if caddy_log_to_file %}
+{% if caddy_sites_defaults.log_to_file %}
     output file {{ caddy_log_dir }}/waf.log
 {% else %}
     output stdout
 {% endif %}
   }
-{% endif %}
-
-{% if caddy_log_debug %}
-  log {
-    level DEBUG
-    format {{ caddy_log_format }}
-    format append {
-      waf_id {{ caddy_my_name }}
-    }
-    output file {{ caddy_log_dir }}/debug.log
-  }
-{% endif %}
 }
 
 # 0=origin, 1=methods, 2=headers, 3=allow credentials, 4=max age, 5=vary, 6=expose headers
@@ -131,7 +105,7 @@
 
 {% for site in caddy_sites %}
 
-{% if (site.site_aliases_redirect | default(caddy_sites_defaults.site_aliases_redirect)) and (site.site_aliases | default([]) | length) > 0 %}
+{% if (site.site_redirect_from_aliases | default(caddy_sites_defaults.site_redirect_from_aliases)) and (site.site_aliases | default([]) | length) > 0 %}
 {{ site.site_aliases | join(', ') }} {
   redir https://{{ site.name }}{uri}
 }
@@ -143,12 +117,8 @@
 {{ site.name }} {
   encode gzip zstd
 
-{% if caddy_crowdsec and site.crowdsec | default(caddy_sites_defaults.crowdsec) %}
-  crowdsec
-{% endif %}
-
 {% for path in site.paths %}
-  handle{% if path.strip_prefix | default(false) %}_path{% endif %} {{ path.path | default('*') }} {
+  handle {{ path.path | default('*') }} {
     reverse_proxy {
       to {{ path.addrs | join(' ') }}
       header_up X-Real-IP {remote}
@@ -178,7 +148,7 @@
   }
 {% endfor %}
 
-{% if site.custom_cert | default (caddy_sites_defaults.custom_cert) %}
+{% if site.custom_cert | default (false) %}
   tls {{ site.custom_cert_file }} {{ site.custom_cert_key_file }}
 {% endif %}
 
@@ -191,7 +161,7 @@
   respond @blocked "Access Denied" 403
 {% endif %}
 
-{% if caddy_geoip and site.geoip | default(caddy_sites_defaults.geoip) %}
+{% if site.geoip | default(caddy_sites_defaults.geoip) %}
   geoip2_vars strict
   @geofilter expression {{ site.geoip_filter_expression | default(caddy_sites_defaults.geoip_filter_expression) }}
   respond @geofilter "Access Denied" 403
@@ -233,8 +203,7 @@
 {% endfor %}
   }
 
-{% if caddy_ratelimit and site.rate_limit | default(caddy_sites_defaults.rate_limit) %}
+{% if site.rate_limit | default(caddy_sites_defaults.rate_limit) %}
-  # See: https://github.com/mholt/caddy-ratelimit
   rate_limit @not_whitelisted {
 {% if caddy_consul %}
     distributed
@@ -258,7 +227,7 @@
   }
 {% endif %}
 
-{% if caddy_coraza and site.crs | default(caddy_sites_defaults.crs) %}
+{% if site.crs | default(caddy_sites_defaults.crs) %}
   coraza_waf @not_whitelisted {
     load_owasp_crs
     directives `
@@ -292,8 +261,7 @@
   import cors-deny
 {% endif %}
 
-{% if caddy_bot_barrier and site.bot_barrier | default(caddy_sites_defaults.bot_barrier) %}
+{% if site.bot_barrier | default(caddy_sites_defaults.bot_barrier) %}
-  # See: https://github.com/steffenbusch/caddy-bot-barrier
   bot_barrier @not_whitelisted {
      secret {{ site.bot_barrier_secret | default(caddy_sites_defaults.bot_barrier_secret) | mandatory }}
      complexity {{ site.bot_barrier_complexity | default(caddy_sites_defaults.bot_barrier_complexity) }}
@@ -305,7 +273,6 @@
   }
 {% endif %}
 
-{% if site.header | default(caddy_sites_defaults.header) %}
   header {
     Content-Security-Policy      "{{ caddy_sites_defaults.header_content_security_policy | combine(site.header_content_security_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
     Cross-Origin-Embedder-Policy "{{ site.header_cross_origin_embedder_policy | default(caddy_sites_defaults.header_cross_origin_embedder_policy) }}"
@@ -327,7 +294,6 @@
     {{ header.name }}            "{{ header.value }}"
 {% endfor %}
   }
-{% endif %}
 
   handle_errors 403 {
     header X-Blocked "true"
@@ -335,12 +301,12 @@
   }
 
   log {
+    format {{ site.log_format | default(caddy_sites_defaults.log_format) }}
     level INFO
-    format {{ caddy_log_format }}
     format append {
       waf_id {{ caddy_my_name }}
     }
-{% if caddy_log_to_file %}
+{% if site.log_to_file | default(caddy_sites_defaults.log_to_file) %}
     output file {{ caddy_log_dir }}/site_{{ site.id }}.log
 {% else %}
     output stdout

seb4itik/byow/roles/caddy/vars/main.yml

@@ -1,9 +1,16 @@
 # Sites default parameter values
 caddy_global_sites_defaults:
 
-  # Site aliases
+  # Site settings
-  site_aliases_redirect: true
   site_aliases: []
+  site_redirect_from_aliases: true
+
+  # Log settings
+  # If log_to_file is true, logs will go:
+  # - for each site, in: /var/log/<caddy_my_name>/site_<site id>.log
+  # - for WAF logs (Coraza), in /var/log/<caddy_my_name>/waf.log
+  log_to_file: false
+  log_format: "json"
 
   # Proxy settings
   # See: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#lb_policy
@@ -83,9 +90,6 @@ caddy_global_sites_defaults:
     - "Content-Length"
     - "Content-Range"
 
-  # Security headers
-  header: true
-
   # Security headers
   header_content_security_policy:
 
@@ -268,19 +272,19 @@ caddy_global_sites_defaults:
       value: "🍷"
 
   # caddy-ratelimit
-  rate_limit: "{{ caddy_ratelimit }}"
+  rate_limit: true
   rate_limit_events: 1000
   rate_limit_window: "1m"
 
   # steffenbusch/caddy-bot-barrier
-  bot_barrier: "{{ caddy_bot_barrier }}"
+  bot_barrier: false
   bot_barrier_secret: null    # Required
   bot_barrier_complexity: 18
   bot_barrier_valid_for: "60m"
 
   # corazawaf/coraza-caddy
   crs: true
-  crs_version: "4.24.1"
+  crs_version: "4.22.0"
   crs_log_only: false
   crs_plugins: []
   crs_exceptions:
@@ -465,5 +469,3 @@ caddy_global_sites_defaults:
   geoip: false
   geoip_debug: false
   geoip_filter_expression: '{geoip2.country_code} == "UNK"'
-
-  crowdsec: "{{ caddy_crowdsec }}"

seb4itik/byow/roles/common/defaults/main.yml

@@ -1,3 +1,2 @@
-common_search_strings: []
 common_default_packages: []
 common_proxy_server: null

seb4itik/byow/roles/common/handlers/main.yml

@@ -1,4 +0,0 @@
-- name: Restart systemd-resolved
-  ansible.builtin.service:
-    name: "systemd-resolved"
-    state: "restarted"

seb4itik/byow/roles/common/tasks/main.yml

@@ -1,11 +1,7 @@
-- name: Setup hosts file
-  ansible.builtin.include_tasks: "setup_hosts.yml"
-
-- name: Setup resolved
-  ansible.builtin.include_tasks: "setup_resolved.yml"
-
 - name: Setup proxy client
+  when: "common_proxy_server != None"
   ansible.builtin.include_tasks: "setup_proxy_client.yml"
 
 - name: Setup packages
+  when: "common_default_packages | length > 0"
   ansible.builtin.include_tasks: "setup_packages.yml"

seb4itik/byow/roles/common/tasks/setup_hosts.yml

@@ -1,25 +0,0 @@
-- name: Check if /etc/cloud/cloud.cfg exists
-  ansible.builtin.stat:
-    path: "/etc/cloud/cloud.cfg"
-  register: common_out_cloud_cfg
-
-- name: Disable /etc/hosts management by cloud-init
-  when: "common_out_cloud_cfg.stat.exists"
-  block:
-    - name: Disable /etc/hosts management by cloud-init (manage_etc_hosts)
-      ansible.builtin.lineinfile:
-        path: "/etc/cloud/cloud.cfg"
-        search_string: 'manage_etc_hosts:'
-        line: "manage_etc_hosts: false"
-        insertafter: "preserve_hostname:"
-    - name: Disable /etc/hosts management by cloud-init (update_etc_hosts)
-      ansible.builtin.replace:
-        path: "/etc/cloud/cloud.cfg"
-        regexp: '^([^#]*update_etc_hosts.*)$'
-        replace: '# \\1'
-
-- name: Configure /etc/hosts file
-  ansible.builtin.template:
-    src: "templates/hosts"
-    dest: "/etc/hosts"
-    mode: "0644"

seb4itik/byow/roles/common/tasks/setup_packages.yml

@@ -4,7 +4,6 @@
     upgrade: "safe"
 
 - name: Install default packages
-  when: "common_default_packages | length > 0"
   ansible.builtin.apt:
     name: "{{ common_default_packages }}"
     autoclean: true

seb4itik/byow/roles/common/tasks/setup_proxy_client.yml

@@ -1,5 +1,4 @@
 - name: Create 00proxy.conf file
-  when: "common_proxy_server != None"
   ansible.builtin.template:
     src: "templates/apt_proxy.conf"
     dest: "/etc/apt/apt.conf.d/00proxy.conf"
@@ -8,7 +7,6 @@
     group: "root"
 
 - name: Add http_proxy and https_proxy variable to file /etc/environment
-  when: "common_proxy_server != None"
   ansible.builtin.lineinfile:
     path: "/etc/environment"
     regexp: '^{{ item.key }}='

seb4itik/byow/roles/common/tasks/setup_resolved.yml

@@ -1,8 +0,0 @@
-- name: Add multipass in search domains
-  when: "common_search_domains | length > 0"
-  ansible.builtin.lineinfile:
-    path: "/etc/systemd/resolved.conf"
-    search_string: 'Domains='
-    line: "Domains={{ common_search_domains | join(' ') }}"
-  notify:
-    - "Restart systemd-resolved"

seb4itik/byow/roles/common/templates/hosts

@@ -1,9 +0,0 @@
-127.0.0.1 localhost
-{{ ansible_default_ipv4.address }} {{ ansible_fqdn }} {{ ansible_hostname }}
-
-# The following lines are desirable for IPv6 capable hosts
-::1     ip6-localhost ip6-loopback
-fe00::0 ip6-localnet
-ff00::0 ip6-mcastprefix
-ff02::1 ip6-allnodes
-ff02::2 ip6-allrouters

seb4itik/byow/roles/consul/tasks/main.yml

@@ -18,12 +18,6 @@
   notify:
     - "Restart Consul"
 
-- name: Link consul
-  ansible.builtin.file:
-    src: "/usr/local/consul-{{ consul_version }}/consul"
-    dest: "/usr/local/sbin/consul"
-    state: "link"
-
 - name: Create Consul system group
   ansible.builtin.group:
     name: "consul"

seb4itik/byow/roles/crowdsec/README.md

@@ -1,5 +0,0 @@
-# BYOW - Build Your Own WAF
-
-A WAF _à la carte_.
-
-## CrowdSec

seb4itik/byow/roles/crowdsec/defaults/main.yml

@@ -1,4 +0,0 @@
-crowdsec_collections: []
-crowdsec_bouncers: []
-# - name: <name>
-#   key: <LAPI key>

seb4itik/byow/roles/crowdsec/handlers/main.yml

@@ -1,4 +0,0 @@
-- name: Restart Crowdsec Securiy Engine
-  ansible.builtin.systemd_service:
-    name: "crowdsec"
-    state: "restarted"

seb4itik/byow/roles/crowdsec/tasks/main.yml

@@ -1,71 +0,0 @@
-# FIXME: cluster
-# FIXME: BdD PostgreSQL
-# FIXME: sudo cscli console enroll cmmszy92r000402l1kugvmw76
-# FIXME: AppSec
-
-- name: Add Crowdsec repository
-  ansible.builtin.deb822_repository:
-    name: "crowdsec"
-    uris: "https://packagecloud.io/crowdsec/crowdsec/any/"
-    suites: "any"
-    components: "main"
-    signed_by: "https://packagecloud.io/crowdsec/crowdsec/gpgkey"
-
-- name: Install Crowdsec Security Engine
-  ansible.builtin.apt:
-    name:
-      - "crowdsec"
-      - "jq"
-    update_cache: true
-  notify:
-    - "Restart Crowdsec Securiy Engine"
-
-- name: Configure Crowdsec
-  ansible.builtin.template:
-    src: "templates/config.yaml"
-    dest: "/etc/crowdsec/config.yaml"
-    mode: "0600"
-  notify:
-    - "Restart Crowdsec Securiy Engine"
-
-- name: Enable and start Crowdsec Securiy Engine
-  ansible.builtin.systemd_service:
-    name: "crowdsec"
-    state: "started"
-    enabled: true
-
-- name: Get collections list
-  ansible.builtin.shell:
-    executable: "/usr/bin/bash"
-    cmd: |
-      set -o pipefail
-      cscli collection list --output=json |jq -r '.collections[] |.name'
-  register: "crowdsec_out_list_collections"
-  changed_when: false
-
-- name: Install collections
-  loop: "{{ crowdsec_collections }}"
-  when: "item not in crowdsec_out_list_collections.stdout_lines"
-  ansible.builtin.command:
-    cmd: "cscli collections install {{ item }}"
-  changed_when: true
-  notify:
-    - "Restart Crowdsec Securiy Engine"
-
-- name: Get bouncers list
-  ansible.builtin.shell:
-    executable: "/usr/bin/bash"
-    cmd: |
-      set -o pipefail
-      cscli bouncers list --output=json |jq -r '.[] |.name'
-  register: "crowdsec_out_list_bouncers"
-  changed_when: false
-
-- name: Create bouncers API keys
-  loop: "{{ crowdsec_bouncers }}"
-  when: "item.name not in crowdsec_out_list_bouncers.stdout_lines"
-  ansible.builtin.command:
-    cmd: "cscli bouncers add {{ item.name }} --key '{{ item.key }}'"
-  changed_when: true
-  notify:
-    - "Restart Crowdsec Securiy Engine"

seb4itik/byow/roles/crowdsec/templates/config.yaml

@@ -1,66 +0,0 @@
-common:
-  daemonize: true
-  log_media: "file"
-  log_level: "info"
-  log_dir: "/var/log/"
-  log_max_size: 20
-  compress_logs: true
-  log_max_files: 10
-
-config_paths:
-  config_dir: "/etc/crowdsec/"
-  data_dir: "/var/lib/crowdsec/data/"
-  simulation_path: "/etc/crowdsec/simulation.yaml"
-  hub_dir: "/etc/crowdsec/hub/"
-  index_path: "/etc/crowdsec/hub/.index.json"
-  notification_dir: "/etc/crowdsec/notifications/"
-  plugin_dir: "/usr/lib/crowdsec/plugins/"
-
-crowdsec_service:
-  #console_context_path: "/etc/crowdsec/console/context.yaml"
-  #acquisition_path: "/etc/crowdsec/acquis.yaml"
-  acquisition_dir: "/etc/crowdsec/acquis.d"
-  parser_routines: 1
-
-cscli:
-  output: "human"
-  color: "auto"
-
-db_config:
-  log_level: "info"
-  type: "sqlite"
-  db_path: "/var/lib/crowdsec/data/crowdsec.db"
-  #max_open_conns: 100
-  #user: 
-  #password:
-  #db_name:
-  #host:
-  #port:
-  flush:
-    max_items: 5000
-    max_age: "7d"
-
-plugin_config:
-  user: "nobody"
-  group: "nogroup"
-
-api:
-  client:
-    insecure_skip_verify: false
-    credentials_path: "/etc/crowdsec/local_api_credentials.yaml"
-  server:
-    log_level: "info"
-    listen_uri: "127.0.0.1:8080"
-    profiles_path: "/etc/crowdsec/profiles.yaml"
-    console_path: "/etc/crowdsec/console.yaml"
-    online_client: # Central API credentials (to push signals and receive bad IPs)
-      credentials_path: "/etc/crowdsec/online_api_credentials.yaml"
-    trusted_ips: # IP ranges, or IPs which can have admin API access
-      - "127.0.0.1"
-      - "::1"
-#    tls:
-#      cert_file: "/etc/crowdsec/ssl/cert.pem"
-#      key_file: "/etc/crowdsec/ssl/key.pem"
-
-prometheus:
-  enabled: false

seb4itik/byow/roles/mysql/tasks/main.yml

@@ -1,14 +1,14 @@
 - name: Installation de MySQL
   ansible.builtin.apt:
     name:
-      - "{{ mysql_distros[ansible_distribution].mysql_package }}"
+      - "mysql-server"
       - "python3-pymysql"
   notify:
     - "Restart MySQL"
 
 - name: Set MySQL bind_address parameter
   ansible.builtin.lineinfile:
-    path: "{{ mysql_distros[ansible_distribution].mysql_config_file }}"
+    path: "/etc/mysql/mysql.conf.d/mysqld.cnf"
     regexp: "^bind-address\\s+="
     line: "bind-address = *"
   notify:

seb4itik/byow/roles/mysql/vars/main.yml

@@ -1,7 +0,0 @@
-mysql_distros:
-  Debian:
-    mysql_package: "default-mysql-server"
-    mysql_config_file: "/etc/mysql/mariadb.conf.d/50-server.cnf"
-  Ubuntu:
-    mysql_package: "mysql-server"
-    mysql_config_file: "/etc/mysql/mysql.conf.d/mysqld.cnf"

seb4itik/byow/roles/wordpress/tasks/install_wordpress.yml

@@ -1,5 +1,3 @@
-# FIXME: Wait for DB to be ready
-
 - name: Téléchargement de Wordpress
   become: true
   become_user: "{{ wordpress_user }}"
@@ -120,7 +118,7 @@
     state: "directory"
     owner: "{{ wordpress_user }}"
     group: "www-data"
-    mode: "0775"
+    mode: "0750"
 
 - name: Apply permissions
   loop: