added caddy provider support

ansible/plays/machine_setup/caddy.yml

@@ -2,6 +2,18 @@
 - name: Set up caddy LXC
   hosts: caddy
   become: yes
+  vars:
+    # Where the Caddy admin API listens. OpenTofu manages reverse-proxy routes
+    # through this endpoint (caddy_host / caddy_ssh_host in terraform.tfvars).
+    caddy_admin_listen: "0.0.0.0:2019"
+
+  handlers:
+    - name: restart caddy
+      ansible.builtin.systemd:
+        name: caddy
+        state: restarted
+        daemon_reload: yes
+
   tasks:
     - name: default_packages
       ansible.builtin.include_tasks: ../../templates/default_packages.yml
@@ -12,9 +24,52 @@
         username: nick
         github_user: Chewbaccalakis
 
+    # Config is deployed BEFORE the caddy package is installed: dpkg keeps a
+    # pre-existing /etc/caddy/Caddyfile instead of the package default (which
+    # serves a static page on :80 as server "srv0" — that would get autosaved
+    # and collide with the OpenTofu-managed :80 server forever after).
+    - name: configure caddy
+      block:
+        - name: create /etc/caddy
+          ansible.builtin.file:
+            path: /etc/caddy
+            state: directory
+            mode: '0755'
+
+        - name: deploy Caddyfile (seeds the admin API listener)
+          ansible.builtin.template:
+            src: templates/Caddyfile.j2
+            dest: /etc/caddy/Caddyfile
+            owner: root
+            group: root
+            mode: '0644'
+          notify: restart caddy
+
+        - name: create caddy systemd override directory
+          ansible.builtin.file:
+            path: /etc/systemd/system/caddy.service.d
+            state: directory
+            mode: '0755'
+
+        - name: override caddy service to resume OpenTofu-applied config
+          ansible.builtin.copy:
+            dest: /etc/systemd/system/caddy.service.d/resume.conf
+            content: |
+              # Managed by Ansible. --resume makes Caddy prefer its autosaved
+              # JSON config (written whenever OpenTofu applies changes via the
+              # admin API) over the Caddyfile, so managed routes survive
+              # restarts. The Caddyfile only seeds the initial config; to
+              # re-seed from it, delete
+              # /var/lib/caddy/.config/caddy/autosave.json and restart caddy.
+              [Service]
+              ExecStart=
+              ExecStart=/usr/bin/caddy run --environ --resume --config /etc/caddy/Caddyfile --adapter caddyfile
+            mode: '0644'
+          notify: restart caddy
+
     - name: install caddy
       block:
-        - name: install xcaddy prerequisites
+        - name: install apt prerequisites
           ansible.builtin.apt:
             name:
               - debian-keyring
@@ -22,6 +77,16 @@
               - apt-transport-https
             state: present
 
+        - name: download caddy gpg key
+          ansible.builtin.shell:
+            cmd: curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+            creates: /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+
+        - name: add caddy apt repository
+          ansible.builtin.shell:
+            cmd: curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list
+            creates: /etc/apt/sources.list.d/caddy-stable.list
+
         - name: download xcaddy gpg key
           ansible.builtin.shell:
             cmd: curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg
@@ -32,8 +97,17 @@
             cmd: curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-xcaddy.list
             creates: /etc/apt/sources.list.d/caddy-xcaddy.list
 
-        - name: install xcaddy
+        - name: install caddy and xcaddy
           ansible.builtin.apt:
-            name: xcaddy
+            name:
+              - caddy
+              - xcaddy
             state: present
-            update_cache: yes
+            update_cache: yes
+
+    - name: enable and start caddy
+      ansible.builtin.systemd:
+        name: caddy
+        enabled: yes
+        state: started
+        daemon_reload: yes