139 lines
4.3 KiB
YAML
139 lines
4.3 KiB
YAML
- name: Install requirements
|
|
ansible.builtin.package:
|
|
name:
|
|
- "git"
|
|
- "libnss3-tools"
|
|
- "ssl-cert"
|
|
|
|
- name: Create Go directory
|
|
ansible.builtin.file:
|
|
path: "/usr/local/go-{{ caddy_go_version }}"
|
|
state: "directory"
|
|
mode: "0755"
|
|
|
|
- name: Install Go
|
|
ansible.builtin.unarchive:
|
|
src: "https://go.dev/dl/go{{ caddy_go_version }}.linux-amd64.tar.gz"
|
|
dest: "/usr/local/go-{{ caddy_go_version }}"
|
|
creates: "/usr/local/go-{{ caddy_go_version }}/bin/go"
|
|
extra_opts:
|
|
- "--strip-components=1"
|
|
remote_src: true
|
|
|
|
- name: Create xcaddy directory
|
|
ansible.builtin.file:
|
|
path: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
|
|
state: "directory"
|
|
mode: "0755"
|
|
|
|
- name: Install xcaddy
|
|
ansible.builtin.unarchive:
|
|
src: "https://github.com/caddyserver/xcaddy/releases/download/v{{ caddy_xcaddy_version }}/xcaddy_{{ caddy_xcaddy_version }}_linux_amd64.tar.gz"
|
|
dest: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
|
|
creates: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy"
|
|
remote_src: true
|
|
|
|
- name: Create Caddy build command
|
|
ansible.builtin.set_fact:
|
|
caddy_build_command: >
|
|
/usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy build v{{ caddy_version }}
|
|
--with github.com/pteich/caddy-tlsconsul
|
|
--with github.com/corazawaf/coraza-caddy/{{ caddy_coraza_caddy_version }}
|
|
--with github.com/mholt/caddy-ratelimit
|
|
--with github.com/steffenbusch/caddy-bot-barrier
|
|
--with github.com/zhangjiayin/caddy-geoip2
|
|
--output {{ caddy_binary }}
|
|
|
|
- name: Remember and test Caddy version
|
|
ansible.builtin.copy:
|
|
dest: "/usr/local/bin/.caddy.{{ caddy_my_name }}.build"
|
|
content: >
|
|
XCADDY_WHICH_GO=/usr/local/go-{{ caddy_go_version }}/bin/go
|
|
{{ caddy_build_command }}
|
|
mode: "0644"
|
|
register: caddy_test_caddy_version
|
|
|
|
- name: Build Caddy
|
|
# noqa: no-handler
|
|
when: "caddy_test_caddy_version.changed"
|
|
environment:
|
|
XCADDY_WHICH_GO: "/usr/local/go-{{ caddy_go_version }}/bin/go"
|
|
ansible.builtin.command:
|
|
cmd: "{{ caddy_build_command }}"
|
|
creates: "{{ caddy_binary }}"
|
|
notify:
|
|
- "Restart Caddy"
|
|
|
|
- name: Create Caddy system group
|
|
ansible.builtin.group:
|
|
name: "{{ caddy_system_group }}"
|
|
system: true
|
|
|
|
- name: Create Caddy system user
|
|
ansible.builtin.user:
|
|
name: "{{ caddy_system_user }}"
|
|
group: "{{ caddy_system_group }}"
|
|
groups: ["ssl-cert"]
|
|
password: "!"
|
|
system: true
|
|
shell: "/usr/sbin/nologin"
|
|
home: "{{ caddy_home_dir }}"
|
|
|
|
- name: Create Caddy directories
|
|
ansible.builtin.file:
|
|
path: "{{ item.path }}"
|
|
state: "directory"
|
|
owner: "{{ item.owner | default('root') }}"
|
|
group: "{{ caddy_system_group }}"
|
|
mode: "{{ item.mode | default('0750') }}"
|
|
loop:
|
|
- path: "{{ caddy_config_dir }}"
|
|
- path: "{{ caddy_crs_plugins_dir }}"
|
|
- path: "{{ caddy_sites_dir }}"
|
|
- path: "{{ caddy_log_dir }}"
|
|
mode: "0770"
|
|
- path: "{{ caddy_home_dir }}/geoip2"
|
|
owner: "{{ caddy_system_user }}"
|
|
|
|
- name: Install OWASP CRS
|
|
loop: "{{ caddy_owasp_crs_versions }}"
|
|
ansible.builtin.unarchive:
|
|
src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ item }}.tar.gz"
|
|
dest: "{{ caddy_config_dir }}"
|
|
creates: "{{ caddy_config_dir }}/coreruleset-{{ item }}/rules/"
|
|
group: "{{ caddy_system_group }}"
|
|
remote_src: true
|
|
|
|
- name: Install plugins
|
|
loop: "{{ caddy_crs_plugins }}"
|
|
ansible.builtin.unarchive:
|
|
src: "https://github.com/{{ item.provider | default('coreruleset') }}/{{ item.name }}-plugin/archive/refs/tags/v{{ item.version }}.tar.gz"
|
|
dest: "{{ caddy_crs_plugins_dir }}"
|
|
creates: "{{ caddy_crs_plugins_dir }}/{{ item.name }}-config.conf"
|
|
include:
|
|
- "*.conf"
|
|
extra_opts:
|
|
- "--strip-components=2"
|
|
- "--wildcards"
|
|
mode: "0644"
|
|
group: "{{ caddy_system_group }}"
|
|
remote_src: true
|
|
|
|
- name: Create plugins after config
|
|
loop: "{{ caddy_crs_plugins }}"
|
|
when: "not(item.has_after_config | default(false))"
|
|
ansible.builtin.copy:
|
|
content: ""
|
|
dest: "{{ caddy_crs_plugins_dir }}/{{ item.name }}-after.conf"
|
|
mode: "0644"
|
|
group: "{{ caddy_system_group }}"
|
|
|
|
- name: Deploy caddy service file
|
|
ansible.builtin.template:
|
|
src: "templates/caddy.service"
|
|
dest: "/etc/systemd/system/{{ caddy_my_name }}.service"
|
|
mode: "0644"
|
|
notify:
|
|
- "Reload systemd"
|
|
- "Restart Caddy"
|