diff options
26 files changed, 212 insertions, 10 deletions
diff --git a/configure.yml b/configure.yml index 200a79c1..6331ccfb 100644 --- a/configure.yml +++ b/configure.yml @@ -98,7 +98,7 @@ - role: "vim" - role: "wireguard" - role: "gateway" - - role: "nginx" + - role: "proxy" - role: "wg_portal" - role: "pihole" - role: "prometheus" diff --git a/group_vars/all.yml b/group_vars/all.yml Binary files differindex cba875ac..ffc5eb07 100644 --- a/group_vars/all.yml +++ b/group_vars/all.yml diff --git a/group_vars/all.yml.example b/group_vars/all.yml.example index cc323a1f..e240f347 100644 --- a/group_vars/all.yml.example +++ b/group_vars/all.yml.example @@ -60,6 +60,8 @@ vimrc_setup_script: | chromium_is_default: false firefox_is_default: true +proxy_type: "nginx" + wireguard_autostart_connection: "vpn0" wireguard_connections: # All wireguard config files are prefixed with wg- diff --git a/molecule/raspberrypi/converge.yml b/molecule/raspberrypi/converge.yml index d282354f..13a4dcaa 100644 --- a/molecule/raspberrypi/converge.yml +++ b/molecule/raspberrypi/converge.yml @@ -47,6 +47,7 @@ pihole_password: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}" pihole_dhcp_enabled: false wireguard_autostart_connection: "" + proxy_type: "nginx" gateway_enabled: true gateway_local_ipv4_subnet: "10.0.0.0/24" grafana_dashboards: @@ -82,7 +83,7 @@ - role: "usbutils" - role: "wireguard" - role: "gateway" - - role: "nginx" + - role: "proxy" - role: "wg_portal" - role: "pihole" - role: "prometheus" diff --git a/roles/caddy/defaults/main.yml b/roles/caddy/defaults/main.yml new file mode 100644 index 00000000..9eed9960 --- /dev/null +++ b/roles/caddy/defaults/main.yml @@ -0,0 +1,2 @@ +--- +caddy_server_name: "{{ ansible_facts['hostname'] }}.local" diff --git a/roles/caddy/handlers/main.yml b/roles/caddy/handlers/main.yml new file mode 100644 index 00000000..acfe3947 --- /dev/null +++ b/roles/caddy/handlers/main.yml @@ -0,0 +1,6 @@ +--- +- name: "Restart caddy" + become: true + ansible.builtin.systemd_service: + name: "caddy" + state: "restarted" diff --git a/roles/caddy/meta/argument_specs.yml b/roles/caddy/meta/argument_specs.yml new file mode 100644 index 00000000..7a55e9a2 --- /dev/null +++ b/roles/caddy/meta/argument_specs.yml @@ -0,0 +1,8 @@ +--- +argument_specs: + main: + options: + caddy_server_name: + type: "str" + description: "The server name for caddy configuration" + default: "{{ ansible_facts['hostname'] }}.local" diff --git a/roles/caddy/meta/main.yml b/roles/caddy/meta/main.yml new file mode 100644 index 00000000..a22dcce9 --- /dev/null +++ b/roles/caddy/meta/main.yml @@ -0,0 +1,17 @@ +--- +dependencies: [] +galaxy_info: + author: "a14m" + description: "Configure Caddy reverse proxy" + license: "MIT" + min_ansible_version: "2.18" + platforms: + - name: "ArchLinux" + versions: + - "all" + - name: "Ubuntu" + versions: + - "noble" + - name: "Debian" + versions: + - "bookworm" diff --git a/roles/caddy/tasks/main.yml b/roles/caddy/tasks/main.yml new file mode 100644 index 00000000..78d484fc --- /dev/null +++ b/roles/caddy/tasks/main.yml @@ -0,0 +1,32 @@ +--- +- name: "Install caddy" + become: true + ansible.builtin.package: + name: "caddy" + state: "present" + +- name: "Ensure caddy sites directory exists" + become: true + ansible.builtin.file: + path: "/etc/caddy/sites" + state: "directory" + owner: "root" + group: "caddy" + mode: "0750" + +- name: "Create Caddyfile" + become: true + ansible.builtin.template: + src: "Caddyfile.j2" + dest: "/etc/caddy/Caddyfile" + owner: "root" + group: "caddy" + mode: "0640" + notify: "Restart caddy" + +- name: "Start and enable caddy" + become: true + ansible.builtin.systemd_service: + name: "caddy" + state: "started" + enabled: true diff --git a/roles/caddy/templates/Caddyfile.j2 b/roles/caddy/templates/Caddyfile.j2 new file mode 100644 index 00000000..f7b32a0c --- /dev/null +++ b/roles/caddy/templates/Caddyfile.j2 @@ -0,0 +1,5 @@ +{ + local_certs +} + +import /etc/caddy/sites/*.caddy diff --git a/roles/grafana/handlers/main.yml b/roles/grafana/handlers/main.yml index b212487b..feeeea7c 100644 --- a/roles/grafana/handlers/main.yml +++ b/roles/grafana/handlers/main.yml @@ -6,7 +6,17 @@ state: "restarted" - name: "Restart nginx" + listen: "Restart proxy" become: true ansible.builtin.systemd_service: name: "nginx" state: "restarted" + when: proxy_type == "nginx" + +- name: "Restart caddy" + listen: "Restart proxy" + become: true + ansible.builtin.systemd_service: + name: "caddy" + state: "restarted" + when: proxy_type == "caddy" diff --git a/roles/grafana/tasks/main.yml b/roles/grafana/tasks/main.yml index f1fa479e..f7b7d851 100644 --- a/roles/grafana/tasks/main.yml +++ b/roles/grafana/tasks/main.yml @@ -89,7 +89,7 @@ - name: "Create grafana nginx vhost configuration" become: true - when: grafana_hostname | length > 0 + when: proxy_type == "nginx" and grafana_hostname | length > 0 ansible.builtin.template: src: "grafana.nginx.conf.j2" dest: "/etc/nginx/vhosts.d/grafana.conf" @@ -100,4 +100,15 @@ validate: > bash -c 'echo "events { worker_connections 64; } http { include %s; }" > /tmp/nginx-vhost.conf; sudo nginx -T -c /tmp/nginx-vhost.conf; ec=$?; rm -f /tmp/nginx-vhost.conf; exit $ec' - notify: "Restart nginx" + notify: "Restart proxy" + +- name: "Create grafana caddy configuration" + become: true + when: proxy_type == "caddy" and grafana_hostname | length > 0 + ansible.builtin.template: + src: "grafana.caddy.j2" + dest: "/etc/caddy/sites/grafana.caddy" + owner: "root" + group: "caddy" + mode: "0640" + notify: "Restart proxy" diff --git a/roles/grafana/templates/grafana.caddy.j2 b/roles/grafana/templates/grafana.caddy.j2 new file mode 100644 index 00000000..c18668a6 --- /dev/null +++ b/roles/grafana/templates/grafana.caddy.j2 @@ -0,0 +1,3 @@ +{{ grafana_hostname }} { + reverse_proxy localhost:{{ grafana_port }} +} diff --git a/roles/pihole/handlers/main.yml b/roles/pihole/handlers/main.yml index d839828e..a1318068 100644 --- a/roles/pihole/handlers/main.yml +++ b/roles/pihole/handlers/main.yml @@ -22,7 +22,17 @@ state: "restarted" - name: "Restart nginx" + listen: "Restart proxy" become: true ansible.builtin.systemd_service: name: "nginx" state: "restarted" + when: proxy_type == "nginx" + +- name: "Restart caddy" + listen: "Restart proxy" + become: true + ansible.builtin.systemd_service: + name: "caddy" + state: "restarted" + when: proxy_type == "caddy" diff --git a/roles/pihole/tasks/main.yml b/roles/pihole/tasks/main.yml index 66208bdf..f6101632 100644 --- a/roles/pihole/tasks/main.yml +++ b/roles/pihole/tasks/main.yml @@ -151,7 +151,7 @@ - name: "Create pihole nginx vhost configuration" become: true - when: pihole_hostname | length > 0 + when: proxy_type == "nginx" and pihole_hostname | length > 0 ansible.builtin.template: src: "pihole.nginx.conf.j2" dest: "/etc/nginx/vhosts.d/pihole.conf" @@ -162,4 +162,15 @@ validate: > bash -c 'echo "events { worker_connections 64; } http { include %s; }" > /tmp/nginx-vhost.conf; sudo nginx -T -c /tmp/nginx-vhost.conf; ec=$?; rm -f /tmp/nginx-vhost.conf; exit $ec' - notify: "Restart nginx" + notify: "Restart proxy" + +- name: "Create pihole caddy configuration" + become: true + when: proxy_type == "caddy" and pihole_hostname | length > 0 + ansible.builtin.template: + src: "pihole.caddy.j2" + dest: "/etc/caddy/sites/pihole.caddy" + owner: "root" + group: "caddy" + mode: "0640" + notify: "Restart proxy" diff --git a/roles/pihole/templates/pihole.caddy.j2 b/roles/pihole/templates/pihole.caddy.j2 new file mode 100644 index 00000000..ee62299e --- /dev/null +++ b/roles/pihole/templates/pihole.caddy.j2 @@ -0,0 +1,5 @@ +{{ pihole_hostname }} { + redir / /admin/ permanent + reverse_proxy /admin/* localhost:{{ pihole_port }} + reverse_proxy /api/* localhost:{{ pihole_port }} +} diff --git a/roles/prometheus/handlers/main.yml b/roles/prometheus/handlers/main.yml index b42a2391..7ee44e81 100644 --- a/roles/prometheus/handlers/main.yml +++ b/roles/prometheus/handlers/main.yml @@ -6,7 +6,17 @@ state: "restarted" - name: "Restart nginx" + listen: "Restart proxy" become: true ansible.builtin.systemd_service: name: "nginx" state: "restarted" + when: proxy_type == "nginx" + +- name: "Restart caddy" + listen: "Restart proxy" + become: true + ansible.builtin.systemd_service: + name: "caddy" + state: "restarted" + when: proxy_type == "caddy" diff --git a/roles/prometheus/tasks/main.yml b/roles/prometheus/tasks/main.yml index 8e315bec..123c1216 100644 --- a/roles/prometheus/tasks/main.yml +++ b/roles/prometheus/tasks/main.yml @@ -64,7 +64,7 @@ - name: "Create prometheus nginx vhost configuration" become: true - when: prometheus_hostname | length > 0 + when: proxy_type == "nginx" and prometheus_hostname | length > 0 ansible.builtin.template: src: "prometheus.nginx.conf.j2" dest: "/etc/nginx/vhosts.d/prometheus.conf" @@ -75,4 +75,15 @@ validate: > bash -c 'echo "events { worker_connections 64; } http { include %s; }" > /tmp/nginx-vhost.conf; sudo nginx -T -c /tmp/nginx-vhost.conf; ec=$?; rm -f /tmp/nginx-vhost.conf; exit $ec' - notify: "Restart nginx" + notify: "Restart proxy" + +- name: "Create prometheus caddy configuration" + become: true + when: proxy_type == "caddy" and prometheus_hostname | length > 0 + ansible.builtin.template: + src: "prometheus.caddy.j2" + dest: "/etc/caddy/sites/prometheus.caddy" + owner: "root" + group: "caddy" + mode: "0640" + notify: "Restart proxy" diff --git a/roles/prometheus/templates/prometheus.caddy.j2 b/roles/prometheus/templates/prometheus.caddy.j2 new file mode 100644 index 00000000..c346da59 --- /dev/null +++ b/roles/prometheus/templates/prometheus.caddy.j2 @@ -0,0 +1,3 @@ +{{ prometheus_hostname }} { + reverse_proxy localhost:{{ prometheus_port }} +} diff --git a/roles/proxy/defaults/main.yml b/roles/proxy/defaults/main.yml new file mode 100644 index 00000000..5f0d40a0 --- /dev/null +++ b/roles/proxy/defaults/main.yml @@ -0,0 +1,2 @@ +--- +proxy_type: "nginx" diff --git a/roles/proxy/meta/argument_specs.yml b/roles/proxy/meta/argument_specs.yml new file mode 100644 index 00000000..ee11aa1a --- /dev/null +++ b/roles/proxy/meta/argument_specs.yml @@ -0,0 +1,8 @@ +--- +argument_specs: + main: + options: + proxy_type: + type: "str" + description: "Reverse proxy to use: 'nginx' or 'caddy'" + default: "nginx" diff --git a/roles/proxy/meta/main.yml b/roles/proxy/meta/main.yml new file mode 100644 index 00000000..3715eae2 --- /dev/null +++ b/roles/proxy/meta/main.yml @@ -0,0 +1,17 @@ +--- +dependencies: [] +galaxy_info: + author: "a14m" + description: "Conditionally configure nginx or caddy reverse proxy based on proxy_type" + license: "MIT" + min_ansible_version: "2.18" + platforms: + - name: "ArchLinux" + versions: + - "all" + - name: "Ubuntu" + versions: + - "noble" + - name: "Debian" + versions: + - "bookworm" diff --git a/roles/proxy/tasks/main.yml b/roles/proxy/tasks/main.yml new file mode 100644 index 00000000..c5626725 --- /dev/null +++ b/roles/proxy/tasks/main.yml @@ -0,0 +1,4 @@ +--- +- name: "Setup proxy" + ansible.builtin.include_role: + name: "{{ proxy_type }}" diff --git a/roles/wg_portal/handlers/main.yml b/roles/wg_portal/handlers/main.yml index 244370d8..6a2356f5 100644 --- a/roles/wg_portal/handlers/main.yml +++ b/roles/wg_portal/handlers/main.yml @@ -6,7 +6,17 @@ state: "restarted" - name: "Restart nginx" + listen: "Restart proxy" become: true ansible.builtin.systemd_service: name: "nginx" state: "restarted" + when: proxy_type == "nginx" + +- name: "Restart caddy" + listen: "Restart proxy" + become: true + ansible.builtin.systemd_service: + name: "caddy" + state: "restarted" + when: proxy_type == "caddy" diff --git a/roles/wg_portal/tasks/main.yml b/roles/wg_portal/tasks/main.yml index 78a235a1..dc24f892 100644 --- a/roles/wg_portal/tasks/main.yml +++ b/roles/wg_portal/tasks/main.yml @@ -96,7 +96,7 @@ - name: "Create wg-portal nginx vhost configuration" become: true - when: wg_portal_hostname | length > 0 + when: proxy_type == "nginx" and wg_portal_hostname | length > 0 ansible.builtin.template: src: "wg_portal.nginx.conf.j2" dest: "/etc/nginx/vhosts.d/wg-portal.conf" @@ -107,4 +107,15 @@ validate: > bash -c 'echo "events { worker_connections 64; } http { include %s; }" > /tmp/nginx-vhost.conf; sudo nginx -T -c /tmp/nginx-vhost.conf; ec=$?; rm -f /tmp/nginx-vhost.conf; exit $ec' - notify: "Restart nginx" + notify: "Restart proxy" + +- name: "Create wg-portal caddy configuration" + become: true + when: proxy_type == "caddy" and wg_portal_hostname | length > 0 + ansible.builtin.template: + src: "wg_portal.caddy.j2" + dest: "/etc/caddy/sites/wg-portal.caddy" + owner: "root" + group: "caddy" + mode: "0640" + notify: "Restart proxy" diff --git a/roles/wg_portal/templates/wg_portal.caddy.j2 b/roles/wg_portal/templates/wg_portal.caddy.j2 new file mode 100644 index 00000000..397a4683 --- /dev/null +++ b/roles/wg_portal/templates/wg_portal.caddy.j2 @@ -0,0 +1,3 @@ +{{ wg_portal_hostname }} { + reverse_proxy localhost:{{ wg_portal_port }} +} |