PhilandClaude Opus 5.5
57c29f1a7f
bcrypt uses a random salt, so hashing the basic auth password on every run changed the Caddyfile each time and triggered the Caddy restart handler. Reuse the deployed hash while it still matches the vault password, and only make a new one when it doesn't (or on a fresh host). The old awk also turned htpasswd's trailing blank line into a stray line in the Caddyfile; the next deploy removes it once. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
73 lines
2.2 KiB
YAML
73 lines
2.2 KiB
YAML
- name: make caddy directories
|
|
ansible.builtin.file:
|
|
path: "{{ item}}"
|
|
state: directory
|
|
loop:
|
|
- /opt/stacks/caddy
|
|
|
|
- name: Install apache2-utils for htpasswd
|
|
ansible.builtin.apt:
|
|
name: apache2-utils
|
|
state: present
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
become: true
|
|
when: vault_dir2opds is defined
|
|
|
|
# bcrypt uses a random salt, so a fresh hash would change the Caddyfile (and
|
|
# restart Caddy) on every run. Reuse the deployed hash while it still matches
|
|
# the vault password; only make a new one when it doesn't.
|
|
- name: Get bcrypt hash for dir2opds basic auth
|
|
ansible.builtin.shell: |
|
|
set -eu
|
|
cur=$(awk -v u="$AUTH_USER" '/basic_?auth/ {b=1} b && $1 == u {print $2; exit}' \
|
|
/opt/stacks/caddy/Caddyfile 2>/dev/null || true)
|
|
if [ -n "$cur" ]; then
|
|
tmp=$(mktemp); trap 'rm -f "$tmp"' EXIT
|
|
printf '%s:%s\n' "$AUTH_USER" "$cur" > "$tmp"
|
|
if htpasswd -vb "$tmp" "$AUTH_USER" "$AUTH_PASS" >/dev/null 2>&1; then
|
|
echo "$AUTH_USER $cur"
|
|
exit 0
|
|
fi
|
|
fi
|
|
htpasswd -bnB "$AUTH_USER" "$AUTH_PASS" | awk -F: 'NF {print $1, $2}'
|
|
environment:
|
|
AUTH_USER: "{{ vault_dir2opds.basic_auth_user }}"
|
|
AUTH_PASS: "{{ vault_dir2opds.basic_auth_password }}"
|
|
register: dir2opds_basic_auth_hash_result
|
|
changed_when: false
|
|
check_mode: false
|
|
no_log: true
|
|
when: vault_dir2opds is defined
|
|
|
|
- name: template Caddyfile
|
|
ansible.builtin.template:
|
|
src: Caddyfile.j2
|
|
dest: /opt/stacks/caddy/Caddyfile
|
|
owner: root
|
|
mode: '0640'
|
|
group: docker
|
|
notify: restart caddy
|
|
|
|
- name: template caddy compose file
|
|
ansible.builtin.template:
|
|
src: caddy-compose.yml.j2
|
|
dest: /opt/stacks/caddy/compose.yml
|
|
owner: root
|
|
mode: '0644'
|
|
|
|
- name: deploy caddy stack
|
|
community.docker.docker_compose_v2:
|
|
project_src: /opt/stacks/caddy
|
|
recreate: never
|
|
files:
|
|
- compose.yml
|
|
|
|
# Lets public traffic through to Caddy. Re-adds the rule if Caddy's IP changed.
|
|
- name: allow public traffic to caddy
|
|
ansible.builtin.command: /usr/local/bin/ufw-docker.sh allow caddy-caddy-1 {{ item }}
|
|
loop: [80/tcp, 443/tcp, 443/udp]
|
|
register: caddy_ufw
|
|
changed_when: "'Skipping' not in caddy_ufw.stdout"
|
|
when: not ansible_check_mode
|