114 lines
4.2 KiB
YAML
114 lines
4.2 KiB
YAML
---
|
|
- name: Set up caddy LXC
|
|
hosts: caddy
|
|
become: yes
|
|
vars:
|
|
# Where the Caddy admin API listens. OpenTofu manages reverse-proxy routes
|
|
# through this endpoint (caddy_host / caddy_ssh_host in terraform.tfvars).
|
|
caddy_admin_listen: "0.0.0.0:2019"
|
|
|
|
handlers:
|
|
- name: restart caddy
|
|
ansible.builtin.systemd:
|
|
name: caddy
|
|
state: restarted
|
|
daemon_reload: yes
|
|
|
|
tasks:
|
|
- name: default_packages
|
|
ansible.builtin.include_tasks: ../../templates/default_packages.yml
|
|
|
|
- name: create_user
|
|
ansible.builtin.include_tasks: ../../templates/create_user.yml
|
|
vars:
|
|
username: nick
|
|
github_user: Chewbaccalakis
|
|
|
|
# Config is deployed BEFORE the caddy package is installed: dpkg keeps a
|
|
# pre-existing /etc/caddy/Caddyfile instead of the package default (which
|
|
# serves a static page on :80 as server "srv0" — that would get autosaved
|
|
# and collide with the OpenTofu-managed :80 server forever after).
|
|
- name: configure caddy
|
|
block:
|
|
- name: create /etc/caddy
|
|
ansible.builtin.file:
|
|
path: /etc/caddy
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: deploy Caddyfile (seeds the admin API listener)
|
|
ansible.builtin.template:
|
|
src: templates/Caddyfile.j2
|
|
dest: /etc/caddy/Caddyfile
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify: restart caddy
|
|
|
|
- name: create caddy systemd override directory
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/system/caddy.service.d
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: override caddy service to resume OpenTofu-applied config
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/caddy.service.d/resume.conf
|
|
content: |
|
|
# Managed by Ansible. --resume makes Caddy prefer its autosaved
|
|
# JSON config (written whenever OpenTofu applies changes via the
|
|
# admin API) over the Caddyfile, so managed routes survive
|
|
# restarts. The Caddyfile only seeds the initial config; to
|
|
# re-seed from it, delete
|
|
# /var/lib/caddy/.config/caddy/autosave.json and restart caddy.
|
|
[Service]
|
|
ExecStart=
|
|
ExecStart=/usr/bin/caddy run --environ --resume --config /etc/caddy/Caddyfile --adapter caddyfile
|
|
mode: '0644'
|
|
notify: restart caddy
|
|
|
|
- name: install caddy
|
|
block:
|
|
- name: install apt prerequisites
|
|
ansible.builtin.apt:
|
|
name:
|
|
- debian-keyring
|
|
- debian-archive-keyring
|
|
- apt-transport-https
|
|
state: present
|
|
|
|
- name: download caddy gpg key
|
|
ansible.builtin.shell:
|
|
cmd: curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
|
|
creates: /usr/share/keyrings/caddy-stable-archive-keyring.gpg
|
|
|
|
- name: add caddy apt repository
|
|
ansible.builtin.shell:
|
|
cmd: curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list
|
|
creates: /etc/apt/sources.list.d/caddy-stable.list
|
|
|
|
- name: download xcaddy gpg key
|
|
ansible.builtin.shell:
|
|
cmd: curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg
|
|
creates: /usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg
|
|
|
|
- name: add xcaddy apt repository
|
|
ansible.builtin.shell:
|
|
cmd: curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-xcaddy.list
|
|
creates: /etc/apt/sources.list.d/caddy-xcaddy.list
|
|
|
|
- name: install caddy and xcaddy
|
|
ansible.builtin.apt:
|
|
name:
|
|
- caddy
|
|
- xcaddy
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: enable and start caddy
|
|
ansible.builtin.systemd:
|
|
name: caddy
|
|
enabled: yes
|
|
state: started
|
|
daemon_reload: yes
|