117 lines
3.4 KiB
YAML
117 lines
3.4 KiB
YAML
- name: Install requirements
|
|
ansible.builtin.package:
|
|
name:
|
|
- "git"
|
|
- "libnss3-tools"
|
|
- "ssl-cert"
|
|
# - "geoipupdate"
|
|
|
|
- name: Create Go directory
|
|
ansible.builtin.file:
|
|
path: "/usr/local/go-{{ caddy_go_version }}"
|
|
state: "directory"
|
|
mode: "0755"
|
|
|
|
- name: Install Go
|
|
ansible.builtin.unarchive:
|
|
src: "https://go.dev/dl/go{{ caddy_go_version }}.linux-amd64.tar.gz"
|
|
dest: "/usr/local/go-{{ caddy_go_version }}"
|
|
remote_src: true
|
|
|
|
- name: Create xcaddy directory
|
|
ansible.builtin.file:
|
|
path: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
|
|
state: "directory"
|
|
mode: "0755"
|
|
|
|
- name: Install xcaddy
|
|
ansible.builtin.unarchive:
|
|
src: "https://github.com/caddyserver/xcaddy/releases/download/v{{ caddy_xcaddy_version }}/xcaddy_{{ caddy_xcaddy_version }}_linux_amd64.tar.gz"
|
|
dest: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
|
|
remote_src: true
|
|
|
|
- name: Create Caddy build command
|
|
ansible.builtin.set_fact:
|
|
caddy_build_command: >
|
|
/usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy build v{{ caddy_version }}
|
|
--with github.com/pteich/caddy-tlsconsul
|
|
--with github.com/corazawaf/coraza-caddy/v2@v{{ caddy_coraza_caddy_version }}
|
|
--with github.com/mholt/caddy-ratelimit
|
|
--with github.com/steffenbusch/caddy-bot-barrier
|
|
--with github.com/zhangjiayin/caddy-geoip2
|
|
--output /usr/local/bin/{{ caddy_my_name }}
|
|
|
|
- name: Remember and test Caddy version
|
|
ansible.builtin.copy:
|
|
dest: "/usr/local/bin/.caddy.build"
|
|
content: >
|
|
XCADDY_WHICH_GO=/usr/local/go-{{ caddy_go_version }}/go/bin/go
|
|
{{ caddy_build_command }}"
|
|
mode: "0644"
|
|
register: caddy_test_caddy_version
|
|
|
|
- name: Build Caddy
|
|
# noqa: no-handler
|
|
when: "caddy_test_caddy_version.changed"
|
|
environment:
|
|
XCADDY_WHICH_GO: "/usr/local/go-{{ caddy_go_version }}/go/bin/go"
|
|
ansible.builtin.command:
|
|
cmd: "{{ caddy_build_command }}"
|
|
creates: "/usr/local/bin/{{ caddy_my_name }}"
|
|
notify:
|
|
- "Restart Caddy"
|
|
|
|
- name: Create Caddy system group
|
|
ansible.builtin.group:
|
|
name: "{{ caddy_system_group }}"
|
|
system: true
|
|
|
|
- name: Create Caddy system user
|
|
ansible.builtin.user:
|
|
name: "{{ caddy_system_user }}"
|
|
group: "{{ caddy_system_group }}"
|
|
groups: ["ssl-cert"]
|
|
password: "!"
|
|
system: true
|
|
home: "{{ caddy_home_dir }}"
|
|
|
|
- name: Create Caddy config directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: "directory"
|
|
group: "{{ caddy_system_group }}"
|
|
mode: "0750"
|
|
loop:
|
|
- "{{ caddy_config_dir }}"
|
|
- "{{ caddy_config_dir }}/crs-plugins"
|
|
- "{{ caddy_config_dir }}/sites"
|
|
|
|
- name: Create Caddy log dir
|
|
ansible.builtin.file:
|
|
path: "{{ caddy_log_dir }}"
|
|
state: "directory"
|
|
group: "{{ caddy_system_group }}"
|
|
mode: "0770"
|
|
|
|
- name: Install OWASP CRS
|
|
loop: "{{ caddy_owasp_crs_versions }}"
|
|
ansible.builtin.unarchive:
|
|
src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ item }}.tar.gz"
|
|
dest: "{{ caddy_config_dir }}"
|
|
group: "{{ caddy_system_group }}"
|
|
remote_src: true
|
|
|
|
- name: Install plugins
|
|
loop: "{{ caddy_crs_plugins }}"
|
|
loop_control:
|
|
loop_var: "plugin"
|
|
ansible.builtin.include_tasks: "plugin_install.yml"
|
|
|
|
- name: Deploy caddy service file
|
|
ansible.builtin.template:
|
|
src: "templates/caddy.service"
|
|
dest: "/etc/systemd/system/{{ caddy_my_name }}.service"
|
|
mode: "0644"
|
|
notify:
|
|
- "Restart Caddy"
|