example/ansible/play-config.yml

@@ -17,6 +17,11 @@
           - "DNS:{{ ansible_hostname }}"
           - "IP:{{ ansible_default_ipv4.address }}"
     caddy_config_only: true
+    caddy_consul: true
+    caddy_consul: true
+    caddy_consul_delegate_to: "waf1"
+    caddy_consul_admin_token: "{{ secrets.consul.bootstrap_secret }}"
+    caddy_consul_aes_key: "{{ secrets.caddy.storage_consul_aes_key }}"
     caddy_sites: "{{ common.sites }}"
   roles:
     - "local_ca_certs"

example/ansible/play-debug.yml

@@ -6,6 +6,10 @@
   vars:
     caddy_debug: true
     caddy_config_only: true
+    caddy_consul: true
+    caddy_consul_delegate_to: "waf1"
+    caddy_consul_admin_token: "{{ secrets.consul.bootstrap_secret }}"
+    caddy_consul_aes_key: "{{ secrets.caddy.storage_consul_aes_key }}"
     caddy_sites: "{{ common.sites }}"
   roles:
     - "caddy"

example/ansible/play-main.yml

@@ -81,13 +81,16 @@
           - "DNS:{{ ansible_fqdn }}"
           - "DNS:{{ ansible_hostname }}"
           - "IP:{{ ansible_default_ipv4.address }}"
+    consul_server: true
     consul_domain: "{{ common.consul.domain }}"
     consul_datacenter: "{{ common.consul.datacenter }}"
+    consul_bootstrap_secret: "{{ secrets.consul.bootstrap_secret }}"
     consul_secret_key: "{{ secrets.consul.secret_key }}"
     consul_servers: ["waf1", "waf2", "waf3"]
-    consul_server: true
+    consul_ui_secret_id: "{{ secrets.consul.ui_secret }}"
     consul_services:
       - name: "www"
+        address: "{{ ansible_default_ipv4.address }}"
         port: 443
         check_http: "http://{{ ansible_default_ipv4.address }}:80/"
 #   keepalived_script_user: "byow"
@@ -113,6 +116,10 @@
     unbound_stub_zones:
       - name: "{{ common.consul.datacenter }}.{{ common.consul.domain }}"
         stub_to: "127.0.0.1@8600"
+    caddy_consul: true
+    caddy_consul_delegate_to: "waf1"
+    caddy_consul_admin_token: "{{ secrets.consul.bootstrap_secret }}"
+    caddy_consul_aes_key: "{{ secrets.caddy.storage_consul_aes_key }}"
     caddy_sites: "{{ common.sites }}"
 #   ovh_ldp_cluster: "gra2.logs.ovh.com"
 #   ovh_ldp_token: "{{ secrets.ovh_ldp.token }}"
@@ -127,7 +134,7 @@
     - "waf"
 
 - name: MySQL servers
-  hosts: mysql
+  hosts: bdd
   gather_facts: false
   vars_files:
     - "vars/common.yml"
@@ -151,22 +158,11 @@
         password: "{{ secrets.wordpress.mysql_password }}"
         priv: "wordpress.*:ALL"
         host: "{{ ansible_default_ipv4.network }}/255.255.255.0"
-    consul_domain: "{{ common.consul.domain }}"
-    consul_datacenter: "{{ common.consul.datacenter }}"
-    consul_secret_key: "{{ secrets.consul.secret_key }}"
-    consul_key_file: "/etc/ssl/private/{{ ansible_fqdn }}.key"
-    consul_cert_file: "/etc/ssl/certs/{{ ansible_fqdn }}.crt"
-    consul_servers: ["waf1", "waf2", "waf3"]
-    consul_services:
-      - name: "test-lab-mysql"
-        port: 3306
-        check_tcp: "{{ ansible_default_ipv4.address }}:3306"
   roles:
     - "local_ca_certs"
     - "mysql"
-    - "consul"
   tags:
-    - "mysql"
+    - "bdd"
 
 - name: NFS servers
   hosts: nfs
@@ -223,22 +219,11 @@
     wordpress_admin_email: "seb@itik.fr"
     wordpress_themes: ["twentytwentyfive"]
     wordpress_active_theme: "twentytwentyfive"
-    wordpress_db_host: "sql1"
+    wordpress_db_host: "bdd1"
     wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}"
-    consul_domain: "{{ common.consul.domain }}"
-    consul_datacenter: "{{ common.consul.datacenter }}"
-    consul_secret_key: "{{ secrets.consul.secret_key }}"
-    consul_key_file: "/etc/ssl/private/{{ ansible_fqdn }}.key"
-    consul_cert_file: "/etc/ssl/certs/{{ ansible_fqdn }}.crt"
-    consul_servers: ["waf1", "waf2", "waf3"]
-    consul_services:
-      - name: "test-lab-www"
-        port: 80
-        check_http: "http://localhost:80/"
   roles:
     - "local_ca_certs"
     - "nfs_client"
     - "wordpress"
-    - "consul"
   tags:
     - "www"

example/ansible/vars/common.yml

@@ -20,6 +20,7 @@ common:
             - "http://www3"
       proxy_lb_policy: "random"
       proxy_active_checks: true
+      proxy_active_checks_status: "301"
       proxy_passive_checks: false
       custom_cert: true
       custom_cert_file: "/etc/ssl/certs/test.lab.crt"
@@ -31,8 +32,8 @@ common:
       # Cf. https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v3.x)
 #       before_request:
 #         - 'SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" "id:1,nolog,ctl:ruleRemoveById=932260"'
-        after_response:
+#       after_response:
-          - 'SecRuleUpdateTargetById 932260 "!ARGS:tag-name"'
+#         - 'SecRuleUpdateTargetById 932260 "!ARGS:tag-name"'
       header_cross_origin_embedder_policy: "unsafe-none"
       header_content_security_policy:
         worker-src: "'self' blob:"

example/tofu/infra.auto.tfvars

@@ -11,7 +11,7 @@ vms = {
   waf3 = {
     cpus = 4
   },
-  sql1 = {},
+  bdd1 = {},
   nfs1 = {},
   www1 = {},
   www2 = {},