- name: Install requirements
  ansible.builtin.package:
    name:
      - "git"
      - "libnss3-tools"
      - "ssl-cert"

- name: Create Go directory
  ansible.builtin.file:
    path: "/usr/local/go-{{ caddy_go_version }}"
    state: "directory"
    mode: "0755"

- name: Install Go
  ansible.builtin.unarchive:
    src: "https://go.dev/dl/go{{ caddy_go_version }}.linux-amd64.tar.gz"
    dest: "/usr/local/go-{{ caddy_go_version }}"
    remote_src: true

- name: Create xcaddy directory
  ansible.builtin.file:
    path: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
    state: "directory"
    mode: "0755"

- name: Install xcaddy
  ansible.builtin.unarchive:
    src: "https://github.com/caddyserver/xcaddy/releases/download/v{{ caddy_xcaddy_version }}/xcaddy_{{ caddy_xcaddy_version }}_linux_amd64.tar.gz"
    dest: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
    remote_src: true

- name: Create Caddy build command
  ansible.builtin.set_fact:
    caddy_build_command: >
      /usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy build v{{ caddy_version }}
      --with github.com/pteich/caddy-tlsconsul
      --with github.com/corazawaf/coraza-caddy/{{ caddy_coraza_caddy_version }}
      --with github.com/mholt/caddy-ratelimit
      --with github.com/steffenbusch/caddy-bot-barrier
      --with github.com/zhangjiayin/caddy-geoip2
      --output {{ caddy_binary }}

- name: Remember and test Caddy version
  ansible.builtin.copy:
    dest: "/usr/local/bin/.caddy.{{ caddy_my_name }}.build"
    content: >
      XCADDY_WHICH_GO=/usr/local/go-{{ caddy_go_version }}/go/bin/go
      {{ caddy_build_command }}"
    mode: "0644"
  register: caddy_test_caddy_version

- name: Build Caddy
  # noqa: no-handler
  when: "caddy_test_caddy_version.changed"
  environment:
    XCADDY_WHICH_GO: "/usr/local/go-{{ caddy_go_version }}/go/bin/go"
  ansible.builtin.command:
    cmd: "{{ caddy_build_command }}"
    creates: "{{ caddy_binary }}"
  notify:
    - "Restart Caddy"

- name: Create Caddy system group
  ansible.builtin.group:
    name: "{{ caddy_system_group }}"
    system: true

- name: Create Caddy system user
  ansible.builtin.user:
    name: "{{ caddy_system_user }}"
    group: "{{ caddy_system_group }}"
    groups: ["ssl-cert"]
    password: "!"
    system: true
    home: "{{ caddy_home_dir }}"

- name: Create Caddy directories
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: "directory"
    owner: "{{ item.owner | default('root') }}"
    group: "{{ caddy_system_group }}"
    mode: "{{ item.mode | default('0750') }}"
  loop:
    - path: "{{ caddy_config_dir }}"
    - path: "{{ caddy_config_dir }}/crs-plugins"
    - path: "{{ caddy_config_dir }}/sites"
    - path: "{{ caddy_log_dir }}"
      mode: "0770"
    - path: "{{ caddy_home_dir }}/geoip2"
      owner: "{{ caddy_system_user }}"

- name: Install OWASP CRS
  loop: "{{ caddy_owasp_crs_versions }}"
  ansible.builtin.unarchive:
    src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ item }}.tar.gz"
    dest: "{{ caddy_config_dir }}"
    group: "{{ caddy_system_group }}"
    remote_src: true

- name: Install plugins
  loop: "{{ caddy_crs_plugins }}"
  loop_control:
    loop_var: "plugin"
  ansible.builtin.include_tasks: "caddy_install_plugin.yml"

- name: Deploy caddy service file
  ansible.builtin.template:
    src: "templates/caddy.service"
    dest: "/etc/systemd/system/{{ caddy_my_name }}.service"
    mode: "0644"
  notify:
    - "Restart Caddy"