Santeri Kainulainen
7c614ae8ff
This commit will also allow Caddy to properly generate certs with longer lifetimes than 12 hours, and by default it has been set to 1 month. This commit removes the pre-generated certs for safety reasons. This commit also updates the README.md thoroughly with some guides about the certs and how to use the role in general.
73 lines
1.8 KiB
YAML
73 lines
1.8 KiB
YAML
- name: Create Caddy configuration directory
|
|
become: yes
|
|
ansible.builtin.file:
|
|
path: /etc/caddy
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
- name: Deploy Caddyfile
|
|
become: yes
|
|
ansible.builtin.template:
|
|
src: Caddyfile.j2
|
|
dest: "{{ caddy_config_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
- name: Ensure Caddy authorities directory exists
|
|
become: yes
|
|
ansible.builtin.file:
|
|
path: /var/lib/caddy/.local/share/caddy/pki/authorities/local
|
|
state: directory
|
|
owner: caddy
|
|
group: caddy
|
|
mode: '0700'
|
|
|
|
# Copy the pre-generated certs from files/certs folder to Caddy,
|
|
# so that you only need to import the root.crt once for all .local domains
|
|
- name: Deploy Caddy root certificates
|
|
become: yes
|
|
vars:
|
|
cert_list: "{{ lookup('fileglob', role_path + '/files/certs/*', wantlist=True) | map('basename') | list }}"
|
|
ansible.builtin.copy:
|
|
src: "certs/{{ item }}"
|
|
dest: "{{ caddy_authorities_path }}/{{ item }}"
|
|
owner: caddy
|
|
group: caddy
|
|
mode: '0600'
|
|
force: yes
|
|
loop: "{{ cert_list }}"
|
|
|
|
- name: Ensure Caddy root directory exists
|
|
become: yes
|
|
ansible.builtin.file:
|
|
path: "{{ caddy_root }}"
|
|
state: directory
|
|
owner: www-data
|
|
group: www-data
|
|
mode: '0755'
|
|
|
|
- name: Start and enable Caddy service
|
|
become: yes
|
|
ansible.builtin.service:
|
|
name: "{{ caddy_service_name }}"
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Restart Caddy
|
|
become: yes
|
|
ansible.builtin.service:
|
|
name: "{{ caddy_service_name }}"
|
|
state: restarted
|
|
|
|
# By default don't trust as its not usually needed
|
|
- name: Trust Caddy local CA
|
|
become: yes
|
|
copy:
|
|
src: /var/lib/caddy/.local/share/caddy/pki/authorities/local/root.crt
|
|
dest: /usr/local/share/ca-certificates/caddy-local.crt
|
|
remote_src: yes
|
|
notify: Update CA trust
|
|
when: caddy_trust_local_ca | default(false) | bool
|