counterweight
cc9340b7cc
Replaces the four-task Caddy vhost block currently copy-pasted into 10
playbooks. Nothing calls it yet; this commit only adds the role.
Verified by rendering all 10 sites through the template and diffing against
what the current playbooks produce: 9 of 10 byte-identical. The tenth is
datum-gateway, where the resolvers comment is standardised, rewriting one
comment line Caddy ignores.
Then dry-run against the live hosts (--check, nothing written):
- vipy: forgejo, vaultwarden, lnbits, personal-blog, ntfy-emergency-app
all report ok/unchanged against the real files
- watchtower: ntfy renders identical via caddy_site_body, blank line and
{host}{uri} placeholders intact
- spacey: headscale renders identical when given the config that is
actually running
- memos, mempool, datum-gateway report changed - the comment, as expected
All 14 site files on all 3 hosts confirmed unchanged afterwards.
Two things the build turned up:
- Ansible does not template dict *keys*, so caddy_site_basic_auth is a list
of {user, hash}. As a dict, a Jinja username passes through literally.
The assert refuses a mapping.
- `caddy validate` does accept a single site fragment - rc=0 on a good one,
rc=1 with a line number on a broken one. This was the plan's one untested
claim. A failed validate leaves the live file untouched.
The reload is now a handler, so it fires once at end of play rather than
immediately; anything needing the new config live mid-play must
flush_handlers first.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
46 lines
1.6 KiB
YAML
46 lines
1.6 KiB
YAML
---
|
|
- name: Assert caddy_site parameters are sane
|
|
ansible.builtin.assert:
|
|
that:
|
|
- caddy_site_name | length > 0
|
|
- caddy_site_domain | length > 0
|
|
- (caddy_site_upstream | length > 0) or (caddy_site_root | length > 0) or (caddy_site_body | length > 0)
|
|
- caddy_site_basic_auth is not mapping
|
|
fail_msg: >-
|
|
caddy_site: '{{ caddy_site_name | default("<unnamed>") }}' needs a name, a domain and
|
|
one of caddy_site_upstream / caddy_site_root / caddy_site_body.
|
|
caddy_site_basic_auth must be a LIST of {user, hash} — Ansible does not template dict keys.
|
|
quiet: true
|
|
|
|
- name: Ensure Caddy sites-enabled directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ caddy_sites_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
- name: Ensure Caddyfile imports sites-enabled
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/caddy/Caddyfile
|
|
line: 'import sites-enabled/*'
|
|
insertafter: EOF
|
|
state: present
|
|
create: yes
|
|
mode: '0644'
|
|
backup: yes
|
|
|
|
# `validate` runs `caddy validate` against the rendered temp file before it is
|
|
# moved into place: verified on vipy that a single site fragment validates
|
|
# cleanly (rc=0, "Valid configuration") and that a malformed one is rejected
|
|
# (rc=1). A failed validate leaves the live file untouched.
|
|
- name: "Write Caddy site '{{ caddy_site_name }}'"
|
|
ansible.builtin.template:
|
|
src: site.conf.j2
|
|
dest: "{{ caddy_sites_dir }}/{{ caddy_site_name }}.conf"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
validate: "caddy validate --adapter caddyfile --config %s"
|
|
diff: "{{ caddy_site_reveal | bool }}"
|
|
notify: Reload caddy
|