Implement support for conditional proxy (nginx or caddy)

26 files changed, 212 insertions, 10 deletions

diff --git a/configure.yml b/configure.yml
index 200a79c1..6331ccfb 100644
--- a/configure.yml
+++ b/configure.yml
@@ -98,7 +98,7 @@
     - role: "vim"
     - role: "wireguard"
     - role: "gateway"
-    - role: "nginx"
+    - role: "proxy"
     - role: "wg_portal"
     - role: "pihole"
     - role: "prometheus"
diff --git a/group_vars/all.yml b/group_vars/all.yml
index cba875ac..ffc5eb07 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
diff --git a/group_vars/all.yml.example b/group_vars/all.yml.example
index cc323a1f..e240f347 100644
--- a/group_vars/all.yml.example
+++ b/group_vars/all.yml.example
@@ -60,6 +60,8 @@ vimrc_setup_script: |
 chromium_is_default: false
 firefox_is_default: true
 
+proxy_type: "nginx"
+
 wireguard_autostart_connection: "vpn0"
 wireguard_connections:
   # All wireguard config files are prefixed with wg-
diff --git a/molecule/raspberrypi/converge.yml b/molecule/raspberrypi/converge.yml
index d282354f..13a4dcaa 100644
--- a/molecule/raspberrypi/converge.yml
+++ b/molecule/raspberrypi/converge.yml
@@ -47,6 +47,7 @@
     pihole_password: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}"
     pihole_dhcp_enabled: false
     wireguard_autostart_connection: ""
+    proxy_type: "nginx"
     gateway_enabled: true
     gateway_local_ipv4_subnet: "10.0.0.0/24"
     grafana_dashboards:
@@ -82,7 +83,7 @@
     - role: "usbutils"
     - role: "wireguard"
     - role: "gateway"
-    - role: "nginx"
+    - role: "proxy"
     - role: "wg_portal"
     - role: "pihole"
     - role: "prometheus"
diff --git a/roles/caddy/defaults/main.yml b/roles/caddy/defaults/main.yml
new file mode 100644
index 00000000..9eed9960
--- /dev/null
+++ b/roles/caddy/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+caddy_server_name: "{{ ansible_facts['hostname'] }}.local"
diff --git a/roles/caddy/handlers/main.yml b/roles/caddy/handlers/main.yml
new file mode 100644
index 00000000..acfe3947
--- /dev/null
+++ b/roles/caddy/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+- name: "Restart caddy"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "caddy"
+    state: "restarted"
diff --git a/roles/caddy/meta/argument_specs.yml b/roles/caddy/meta/argument_specs.yml
new file mode 100644
index 00000000..7a55e9a2
--- /dev/null
+++ b/roles/caddy/meta/argument_specs.yml
@@ -0,0 +1,8 @@
+---
+argument_specs:
+  main:
+    options:
+      caddy_server_name:
+        type: "str"
+        description: "The server name for caddy configuration"
+        default: "{{ ansible_facts['hostname'] }}.local"
diff --git a/roles/caddy/meta/main.yml b/roles/caddy/meta/main.yml
new file mode 100644
index 00000000..a22dcce9
--- /dev/null
+++ b/roles/caddy/meta/main.yml
@@ -0,0 +1,17 @@
+---
+dependencies: []
+galaxy_info:
+  author: "a14m"
+  description: "Configure Caddy reverse proxy"
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "ArchLinux"
+      versions:
+        - "all"
+    - name: "Ubuntu"
+      versions:
+        - "noble"
+    - name: "Debian"
+      versions:
+        - "bookworm"
diff --git a/roles/caddy/tasks/main.yml b/roles/caddy/tasks/main.yml
new file mode 100644
index 00000000..78d484fc
--- /dev/null
+++ b/roles/caddy/tasks/main.yml
@@ -0,0 +1,32 @@
+---
+- name: "Install caddy"
+  become: true
+  ansible.builtin.package:
+    name: "caddy"
+    state: "present"
+
+- name: "Ensure caddy sites directory exists"
+  become: true
+  ansible.builtin.file:
+    path: "/etc/caddy/sites"
+    state: "directory"
+    owner: "root"
+    group: "caddy"
+    mode: "0750"
+
+- name: "Create Caddyfile"
+  become: true
+  ansible.builtin.template:
+    src: "Caddyfile.j2"
+    dest: "/etc/caddy/Caddyfile"
+    owner: "root"
+    group: "caddy"
+    mode: "0640"
+  notify: "Restart caddy"
+
+- name: "Start and enable caddy"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "caddy"
+    state: "started"
+    enabled: true
diff --git a/roles/caddy/templates/Caddyfile.j2 b/roles/caddy/templates/Caddyfile.j2
new file mode 100644
index 00000000..f7b32a0c
--- /dev/null
+++ b/roles/caddy/templates/Caddyfile.j2
@@ -0,0 +1,5 @@
+{
+	local_certs
+}
+
+import /etc/caddy/sites/*.caddy
diff --git a/roles/grafana/handlers/main.yml b/roles/grafana/handlers/main.yml
index b212487b..feeeea7c 100644
--- a/roles/grafana/handlers/main.yml
+++ b/roles/grafana/handlers/main.yml
@@ -6,7 +6,17 @@
     state: "restarted"
 
 - name: "Restart nginx"
+  listen: "Restart proxy"
   become: true
   ansible.builtin.systemd_service:
     name: "nginx"
     state: "restarted"
+  when: proxy_type == "nginx"
+
+- name: "Restart caddy"
+  listen: "Restart proxy"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "caddy"
+    state: "restarted"
+  when: proxy_type == "caddy"
diff --git a/roles/grafana/tasks/main.yml b/roles/grafana/tasks/main.yml
index f1fa479e..f7b7d851 100644
--- a/roles/grafana/tasks/main.yml
+++ b/roles/grafana/tasks/main.yml
@@ -89,7 +89,7 @@
 
 - name: "Create grafana nginx vhost configuration"
   become: true
-  when: grafana_hostname | length > 0
+  when: proxy_type == "nginx" and grafana_hostname | length > 0
   ansible.builtin.template:
     src: "grafana.nginx.conf.j2"
     dest: "/etc/nginx/vhosts.d/grafana.conf"
@@ -100,4 +100,15 @@
     validate: >
       bash -c 'echo "events { worker_connections 64; } http { include %s; }" > /tmp/nginx-vhost.conf;
         sudo nginx -T -c /tmp/nginx-vhost.conf; ec=$?; rm -f /tmp/nginx-vhost.conf; exit $ec'
-  notify: "Restart nginx"
+  notify: "Restart proxy"
+
+- name: "Create grafana caddy configuration"
+  become: true
+  when: proxy_type == "caddy" and grafana_hostname | length > 0
+  ansible.builtin.template:
+    src: "grafana.caddy.j2"
+    dest: "/etc/caddy/sites/grafana.caddy"
+    owner: "root"
+    group: "caddy"
+    mode: "0640"
+  notify: "Restart proxy"
diff --git a/roles/grafana/templates/grafana.caddy.j2 b/roles/grafana/templates/grafana.caddy.j2
new file mode 100644
index 00000000..c18668a6
--- /dev/null
+++ b/roles/grafana/templates/grafana.caddy.j2
@@ -0,0 +1,3 @@
+{{ grafana_hostname }} {
+	reverse_proxy localhost:{{ grafana_port }}
+}
diff --git a/roles/pihole/handlers/main.yml b/roles/pihole/handlers/main.yml
index d839828e..a1318068 100644
--- a/roles/pihole/handlers/main.yml
+++ b/roles/pihole/handlers/main.yml
@@ -22,7 +22,17 @@
     state: "restarted"
 
 - name: "Restart nginx"
+  listen: "Restart proxy"
   become: true
   ansible.builtin.systemd_service:
     name: "nginx"
     state: "restarted"
+  when: proxy_type == "nginx"
+
+- name: "Restart caddy"
+  listen: "Restart proxy"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "caddy"
+    state: "restarted"
+  when: proxy_type == "caddy"
diff --git a/roles/pihole/tasks/main.yml b/roles/pihole/tasks/main.yml
index 66208bdf..f6101632 100644
--- a/roles/pihole/tasks/main.yml
+++ b/roles/pihole/tasks/main.yml
@@ -151,7 +151,7 @@
 
 - name: "Create pihole nginx vhost configuration"
   become: true
-  when: pihole_hostname | length > 0
+  when: proxy_type == "nginx" and pihole_hostname | length > 0
   ansible.builtin.template:
     src: "pihole.nginx.conf.j2"
     dest: "/etc/nginx/vhosts.d/pihole.conf"
@@ -162,4 +162,15 @@
     validate: >
       bash -c 'echo "events { worker_connections 64; } http { include %s; }" > /tmp/nginx-vhost.conf;
         sudo nginx -T -c /tmp/nginx-vhost.conf; ec=$?; rm -f /tmp/nginx-vhost.conf; exit $ec'
-  notify: "Restart nginx"
+  notify: "Restart proxy"
+
+- name: "Create pihole caddy configuration"
+  become: true
+  when: proxy_type == "caddy" and pihole_hostname | length > 0
+  ansible.builtin.template:
+    src: "pihole.caddy.j2"
+    dest: "/etc/caddy/sites/pihole.caddy"
+    owner: "root"
+    group: "caddy"
+    mode: "0640"
+  notify: "Restart proxy"
diff --git a/roles/pihole/templates/pihole.caddy.j2 b/roles/pihole/templates/pihole.caddy.j2
new file mode 100644
index 00000000..ee62299e
--- /dev/null
+++ b/roles/pihole/templates/pihole.caddy.j2
@@ -0,0 +1,5 @@
+{{ pihole_hostname }} {
+	redir / /admin/ permanent
+	reverse_proxy /admin/* localhost:{{ pihole_port }}
+	reverse_proxy /api/* localhost:{{ pihole_port }}
+}
diff --git a/roles/prometheus/handlers/main.yml b/roles/prometheus/handlers/main.yml
index b42a2391..7ee44e81 100644
--- a/roles/prometheus/handlers/main.yml
+++ b/roles/prometheus/handlers/main.yml
@@ -6,7 +6,17 @@
     state: "restarted"
 
 - name: "Restart nginx"
+  listen: "Restart proxy"
   become: true
   ansible.builtin.systemd_service:
     name: "nginx"
     state: "restarted"
+  when: proxy_type == "nginx"
+
+- name: "Restart caddy"
+  listen: "Restart proxy"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "caddy"
+    state: "restarted"
+  when: proxy_type == "caddy"
diff --git a/roles/prometheus/tasks/main.yml b/roles/prometheus/tasks/main.yml
index 8e315bec..123c1216 100644
--- a/roles/prometheus/tasks/main.yml
+++ b/roles/prometheus/tasks/main.yml
@@ -64,7 +64,7 @@
 
 - name: "Create prometheus nginx vhost configuration"
   become: true
-  when: prometheus_hostname | length > 0
+  when: proxy_type == "nginx" and prometheus_hostname | length > 0
   ansible.builtin.template:
     src: "prometheus.nginx.conf.j2"
     dest: "/etc/nginx/vhosts.d/prometheus.conf"
@@ -75,4 +75,15 @@
     validate: >
       bash -c 'echo "events { worker_connections 64; } http { include %s; }" > /tmp/nginx-vhost.conf;
         sudo nginx -T -c /tmp/nginx-vhost.conf; ec=$?; rm -f /tmp/nginx-vhost.conf; exit $ec'
-  notify: "Restart nginx"
+  notify: "Restart proxy"
+
+- name: "Create prometheus caddy configuration"
+  become: true
+  when: proxy_type == "caddy" and prometheus_hostname | length > 0
+  ansible.builtin.template:
+    src: "prometheus.caddy.j2"
+    dest: "/etc/caddy/sites/prometheus.caddy"
+    owner: "root"
+    group: "caddy"
+    mode: "0640"
+  notify: "Restart proxy"
diff --git a/roles/prometheus/templates/prometheus.caddy.j2 b/roles/prometheus/templates/prometheus.caddy.j2
new file mode 100644
index 00000000..c346da59
--- /dev/null
+++ b/roles/prometheus/templates/prometheus.caddy.j2
@@ -0,0 +1,3 @@
+{{ prometheus_hostname }} {
+	reverse_proxy localhost:{{ prometheus_port }}
+}
diff --git a/roles/proxy/defaults/main.yml b/roles/proxy/defaults/main.yml
new file mode 100644
index 00000000..5f0d40a0
--- /dev/null
+++ b/roles/proxy/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+proxy_type: "nginx"
diff --git a/roles/proxy/meta/argument_specs.yml b/roles/proxy/meta/argument_specs.yml
new file mode 100644
index 00000000..ee11aa1a
--- /dev/null
+++ b/roles/proxy/meta/argument_specs.yml
@@ -0,0 +1,8 @@
+---
+argument_specs:
+  main:
+    options:
+      proxy_type:
+        type: "str"
+        description: "Reverse proxy to use: 'nginx' or 'caddy'"
+        default: "nginx"
diff --git a/roles/proxy/meta/main.yml b/roles/proxy/meta/main.yml
new file mode 100644
index 00000000..3715eae2
--- /dev/null
+++ b/roles/proxy/meta/main.yml
@@ -0,0 +1,17 @@
+---
+dependencies: []
+galaxy_info:
+  author: "a14m"
+  description: "Conditionally configure nginx or caddy reverse proxy based on proxy_type"
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "ArchLinux"
+      versions:
+        - "all"
+    - name: "Ubuntu"
+      versions:
+        - "noble"
+    - name: "Debian"
+      versions:
+        - "bookworm"
diff --git a/roles/proxy/tasks/main.yml b/roles/proxy/tasks/main.yml
new file mode 100644
index 00000000..c5626725
--- /dev/null
+++ b/roles/proxy/tasks/main.yml
@@ -0,0 +1,4 @@
+---
+- name: "Setup proxy"
+  ansible.builtin.include_role:
+    name: "{{ proxy_type }}"
diff --git a/roles/wg_portal/handlers/main.yml b/roles/wg_portal/handlers/main.yml
index 244370d8..6a2356f5 100644
--- a/roles/wg_portal/handlers/main.yml
+++ b/roles/wg_portal/handlers/main.yml
@@ -6,7 +6,17 @@
     state: "restarted"
 
 - name: "Restart nginx"
+  listen: "Restart proxy"
   become: true
   ansible.builtin.systemd_service:
     name: "nginx"
     state: "restarted"
+  when: proxy_type == "nginx"
+
+- name: "Restart caddy"
+  listen: "Restart proxy"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "caddy"
+    state: "restarted"
+  when: proxy_type == "caddy"
diff --git a/roles/wg_portal/tasks/main.yml b/roles/wg_portal/tasks/main.yml
index 78a235a1..dc24f892 100644
--- a/roles/wg_portal/tasks/main.yml
+++ b/roles/wg_portal/tasks/main.yml
@@ -96,7 +96,7 @@
 
 - name: "Create wg-portal nginx vhost configuration"
   become: true
-  when: wg_portal_hostname | length > 0
+  when: proxy_type == "nginx" and wg_portal_hostname | length > 0
   ansible.builtin.template:
     src: "wg_portal.nginx.conf.j2"
     dest: "/etc/nginx/vhosts.d/wg-portal.conf"
@@ -107,4 +107,15 @@
     validate: >
       bash -c 'echo "events { worker_connections 64; } http { include %s; }" > /tmp/nginx-vhost.conf;
         sudo nginx -T -c /tmp/nginx-vhost.conf; ec=$?; rm -f /tmp/nginx-vhost.conf; exit $ec'
-  notify: "Restart nginx"
+  notify: "Restart proxy"
+
+- name: "Create wg-portal caddy configuration"
+  become: true
+  when: proxy_type == "caddy" and wg_portal_hostname | length > 0
+  ansible.builtin.template:
+    src: "wg_portal.caddy.j2"
+    dest: "/etc/caddy/sites/wg-portal.caddy"
+    owner: "root"
+    group: "caddy"
+    mode: "0640"
+  notify: "Restart proxy"
diff --git a/roles/wg_portal/templates/wg_portal.caddy.j2 b/roles/wg_portal/templates/wg_portal.caddy.j2
new file mode 100644
index 00000000..397a4683
--- /dev/null
+++ b/roles/wg_portal/templates/wg_portal.caddy.j2
@@ -0,0 +1,3 @@
+{{ wg_portal_hostname }} {
+	reverse_proxy localhost:{{ wg_portal_port }}
+}