first commit

roles/caddy/defaults/main.yml

@@ -0,0 +1,5 @@
+caddy_opnsense_cloudflare_binary_url: "https://caddyserver.com/api/download?os=freebsd&arch=amd64&p=github.com%2Fcaddy-dns%2Fcloudflare"
+caddy_opnsense_caddyfile_path: /usr/local/etc/caddy/
+
+caddy_amd64_linux_cloudflare_binary_url: "https://caddyserver.com/api/download?os=linux&arch=amd64&p=github.com%2Fcaddy-dns%2Fcloudflare"
+caddy_linux_caddyfile_path: /etc/caddy

roles/caddy/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: restart caddy
+  service:
+    name: caddy
+    state: restarted
+    enabled: yes

roles/caddy/tasks/configure.yml

@@ -0,0 +1,28 @@
+---
+- name: install caddy service file
+  template:
+    src: templates/caddy.service.j2
+    dest: "/etc/systemd/system/caddy.service"
+    owner: root
+    group: root
+
+- name: ensure Caddyfile target dir exists
+  file:
+    path: "{{ caddy_linux_caddyfile_path }}"
+    state: directory
+
+- name: template and install Caddyfile
+  template:
+    src: templates/Caddyfile.j2
+    dest: "{{ caddy_linux_caddyfile_path }}/Caddyfile"
+    owner: root
+    group: root
+    #validate: caddy fmt --overwrite
+  #notify: restart caddy
+
+- name: Enable caddy service
+  ansible.builtin.systemd:
+    name: caddy
+    enabled: yes
+    state: reloaded
+    daemon_reload: yes

roles/caddy/tasks/install.yml

@@ -0,0 +1,19 @@
+---
+- name: download latest release
+  get_url:
+    url: "{{ caddy_amd64_linux_cloudflare_binary_url }}"
+    dest: /usr/local/bin/caddy
+    owner: root
+    group: root
+    mode: a+x
+  ignore_errors: true
+
+- name: Add the caddy group
+  ansible.builtin.group:
+    name: caddy
+    state: present
+
+- name: Add the caddy user
+  ansible.builtin.user:
+    name: caddy
+    group: caddy

roles/caddy/tasks/main.yml

@@ -0,0 +1,11 @@
+---
+- name: install caddy
+  include_tasks:
+    file: install.yml
+
+- name: configure caddy rules
+  include_tasks:
+    file: configure.yml
+    apply:
+      tags:
+        - caddyconfig

roles/caddy/templates/Caddyfile.j2

@@ -0,0 +1,84 @@
+(cloudflare) {
+  tls {
+    dns cloudflare {{ opnsense_caddy_cloudflare_api_token }}
+    resolvers 1.1.1.1
+  }
+}
+
+(headers) {
+  header {
+    Permissions-Policy interest-cohort=()
+    Strict-Transport-Security "max-age=31536000; includeSubdomains"
+    X-XSS-Protection "1; mode=block"
+    X-Content-Type-Options "nosniff"
+    X-Robots-Tag noindex, nofollow
+    Referrer-Policy "same-origin"
+    Content-Security-Policy "frame-ancestors {{ domain_base }} *.{{ domain_base }}"
+    -Server
+    Permissions-Policy "geolocation=(self {{ domain_base }} *.{{ domain_base }}), microphone=()"
+  }
+}
+
+## core
+
+#neo
+neo.{{ domain_base }} {
+  reverse_proxy https://10.56.0.1:8006 {
+    transport http {
+      tls_insecure_skip_verify
+    }
+  }
+  import cloudflare
+}
+
+# pihole
+dns.{{ domain_base }} {
+  redir / /admin
+  reverse_proxy http://10.56.0.253
+  import cloudflare
+}
+
+# # dhcp
+# dhcp.{{ domain_base }} {
+#   redir / /dhcp.leases
+#   reverse_proxy http://10.56.0.253:81
+#   import cloudflare
+# }
+
+# opnsense
+opnsense.{{ domain_base }} {
+  reverse_proxy https://10.56.0.254:8443 {
+    transport http {
+      tls_insecure_skip_verify
+    }
+  }
+  import cloudflare
+}
+
+# pain ipmi
+ipmi.{{ domain_base }} {
+  reverse_proxy https://10.56.0.20 {
+    transport http {
+      tls_insecure_skip_verify
+    }
+  }
+  import cloudflare
+}
+
+## pikvm
+#kvm.{{ domain_base }} {
+#  reverse_proxy https://10.56.0.100:443 {
+#    transport http {
+#      tls_insecure_skip_verify
+#    }
+#  }
+#  import cloudflare
+#}
+
+# uptime-kuma
+kuma.{{ domain_base }} {
+  reverse_proxy http://10.56.0.247:3001
+  import cloudflare
+}
+
+

roles/caddy/templates/caddy.service.j2

@@ -0,0 +1,37 @@
+# caddy.service
+#
+# For using Caddy with a config file.
+#
+# Make sure the ExecStart and ExecReload commands are correct
+# for your installation.
+#
+# See https://caddyserver.com/docs/install for instructions.
+#
+# WARNING: This service does not use the --resume flag, so if you
+# use the API to make changes, they will be overwritten by the
+# Caddyfile next time the service is restarted. If you intend to
+# use Caddy's API to configure it, add the --resume flag to the
+# `caddy run` command or use the caddy-api.service file instead.
+
+[Unit]
+Description=Caddy
+Documentation=https://caddyserver.com/docs/
+After=network.target network-online.target
+Requires=network-online.target
+
+[Service]
+Type=notify
+User=caddy
+Group=caddy
+ExecStart=/usr/local/bin/caddy run --environ --config /etc/caddy/Caddyfile
+ExecReload=/usr/local/bin/caddy reload --config /etc/caddy/Caddyfile --force
+TimeoutStopSec=5s
+LimitNOFILE=1048576
+LimitNPROC=512
+PrivateDevices=yes
+PrivateTmp=true
+ProtectSystem=full
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target