replace nginx with caddy2

defaults/main.yml

@@ -2,37 +2,32 @@ mumble_domain: "{{ inventory_hostname }}.local"
 
 acme_enabled: no
 acme_domains:
-  - name: "{{ mumble_domain }}"
+  - name: "{{ murmur_domains | first }}"
-    hooks: |
+    alt_domains: "{{ murmur_domains[1:] }}"
-      {{ (
+    hooks:
-        'systemctl reload nginx' if mumble_web_enabled else None,
+      - systemctl restart mumble-server
-        'systemctl restart mumble-server' if murmur_enabled else None
-      ) | reject("none") | list }}
 acme_directory_url: https://acme-v02.api.letsencrypt.org/directory
 
 mumble_web_enabled: no
-mumble_web_domain: "{{ mumble_domain }}"
+mumble_web_domains:
+  - "{{ mumble_domain }}"
 mumble_web_owner: mumble-web
 mumble_web_group: "{{ mumble_web_owner }}"
-mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/{{ acme_enabled | ternary('fullchain','cert') }}.pem"
+mumble_web_home_dir: /var/www/mumble-web
-mumble_web_trusted_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/chain.pem"
+mumble_web_code_dir: "{{ mumble_web_home_dir }}/code"
-mumble_web_private_key: "{{ acme_keys_dir }}/{{ mumble_web_domain }}.key"
+mumble_web_dist_dir: "{{ mumble_web_code_dir }}/dist"
-mumble_web_www_dir: /var/www/mumble-web
-mumble_web_dist_dir: "{{ mumble_web_www_dir }}/dist"
 mumble_web_version: master
 mumble_web_websockify_port: "64737"
 
-mumble_web_nginx_enabled: yes
+mumble_web_caddy_enabled: yes
-mumble_web_nginx_domains: 
+caddy_config_dir: /etc/caddy/conf.d
-  - "{{ mumble_web_domain }}"
+caddy_log_dir: /var/log/caddy
-mumble_web_nginx_config_dir: /etc/nginx
+caddy_owner: caddy
-mumble_web_nginx_log_dir: /var/log/nginx
+caddy_group: caddy
-mumble_web_nginx_generate_dhparam: yes
-mumble_web_nginx_dhparam: "{{ mumble_web_nginx_config_dir }}/ssl/dhparam.pem"
-mumble_web_nginx_dhparam_size: 2048
 
 murmur_enabled: no
-murmur_domain: "{{ mumble_domain }}"
+murmur_domains: 
+  - "{{ mumble_domain }}"
 murmur_superuser_password: supersecret
 murmur_database:
   path: "/var/lib/mumble-server/mumble-server.sqlite"
@@ -82,9 +77,9 @@ murmur_register:
   hostname: "mymumblehostname.domain.org"
 # Enable Bonjour for dev purpose
 murmur_bonjour_enabled: no
-murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/{{ acme_enabled | ternary('fullchain', 'cert') }}.pem"
+murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domains | first }}.d/fullchain.pem"
-murmur_trusted_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/chain.pem"
+murmur_trusted_certificate: "{{ acme_certs_dir }}/{{ murmur_domains | first }}.d/chain.pem"
-murmur_private_key: "{{ acme_keys_dir }}/{{ murmur_domain }}.key"
+murmur_private_key: "{{ acme_keys_dir }}/{{ murmur_domains | first }}.key"
 murmur_dhparam: "@ffdhe4096"
 murmur_owner: "mumble-server"
 murmur_group: "{{ murmur_owner }}"

handlers/main.yml

@@ -17,8 +17,10 @@
   when:
   - not (mumble_web_started.changed | default(false))
 
-- name: reload nginx
+- name: reload caddy
-  include_tasks: ../handlers/nginx.yml
+  service:
+    name: caddy
+    state: reloaded
 
 - name: change murmur superuser password
   command: murmurd -ini /etc/mumble-server.ini -supw "{{ murmur_superuser_password }}"

handlers/nginx.yml

@@ -1,7 +0,0 @@
-- name: Validate Nginx config
-  command: nginx -t
-
-- name: Reload Nginx server
-  service:
-    name: nginx
-    state: reloaded

molecule/default/prepare.yml

@@ -8,7 +8,48 @@
         update_cache: yes
         cache_valid_time: 3600
 
-    - name: Install nginx package
+    - name: Install GPG package
       package:
-        name: nginx-light
+        name: gpg
         state: present
+
+    - name: Add Caddy2 APT key
+      apt_key:
+        url: https://dl.cloudsmith.io/public/caddy/stable/gpg.155B6D79CA56EA34.key
+        state: present
+
+    - name: Add Caddy2 APT repository
+      apt_repository:
+        repo: deb https://dl.cloudsmith.io/public/caddy/stable/deb/{{ ansible_distribution | lower }} any-version main
+        filename: caddy-stable
+        state: present
+
+    - name: Install caddy package
+      package:
+        name: caddy
+        state: present
+    
+    - name: Create Caddy2 config directory
+      file:
+        path: "/etc/caddy/conf.d"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+    
+    - name: Create Caddy2 log directory
+      file:
+        path: "/var/log/caddy"
+        state: directory
+        owner: caddy
+        group: caddy
+        mode: "0755"
+  
+    - name: Copy Caddy2 config file
+      copy:
+        content:
+          import conf.d/*.conf
+        dest: /etc/caddy/Caddyfile
+        owner: root
+        group: root
+        mode: "0644"

molecule/mumble-web/prepare.yml

@@ -8,7 +8,48 @@
         update_cache: yes
         cache_valid_time: 3600
 
-    - name: Install nginx package
+    - name: Install GPG package
       package:
-        name: nginx-light
+        name: gpg
         state: present
+
+    - name: Add Caddy2 APT key
+      apt_key:
+        url: https://dl.cloudsmith.io/public/caddy/stable/gpg.155B6D79CA56EA34.key
+        state: present
+
+    - name: Add Caddy2 APT repository
+      apt_repository:
+        repo: deb https://dl.cloudsmith.io/public/caddy/stable/deb/{{ ansible_distribution | lower }} any-version main
+        filename: caddy-stable
+        state: present
+
+    - name: Install caddy package
+      package:
+        name: caddy
+        state: present
+    
+    - name: Create Caddy2 config directory
+      file:
+        path: "/etc/caddy/conf.d"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+    
+    - name: Create Caddy2 log directory
+      file:
+        path: "/var/log/caddy"
+        state: directory
+        owner: caddy
+        group: caddy
+        mode: "0755"
+  
+    - name: Copy Caddy2 config file
+      copy:
+        content:
+          import conf.d/*.conf
+        dest: /etc/caddy/Caddyfile
+        owner: root
+        group: root
+        mode: "0644"

molecule/murmur/prepare.yml

@@ -7,3 +7,49 @@
       apt:
         update_cache: yes
         cache_valid_time: 3600
+
+    - name: Install GPG package
+      package:
+        name: gpg
+        state: present
+
+    - name: Add Caddy2 APT key
+      apt_key:
+        url: https://dl.cloudsmith.io/public/caddy/stable/gpg.155B6D79CA56EA34.key
+        state: present
+
+    - name: Add Caddy2 APT repository
+      apt_repository:
+        repo: deb https://dl.cloudsmith.io/public/caddy/stable/deb/{{ ansible_distribution | lower }} any-version main
+        filename: caddy-stable
+        state: present
+
+    - name: Install caddy package
+      package:
+        name: caddy
+        state: present
+    
+    - name: Create Caddy2 config directory
+      file:
+        path: "/etc/caddy/conf.d"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+    
+    - name: Create Caddy2 log directory
+      file:
+        path: "/var/log/caddy"
+        state: directory
+        owner: caddy
+        group: caddy
+        mode: "0755"
+  
+    - name: Copy Caddy2 config file
+      copy:
+        content:
+          import conf.d/*.conf
+        dest: /etc/caddy/Caddyfile
+        owner: root
+        group: root
+        mode: "0644"

tasks/caddy.yml

@@ -0,0 +1,13 @@
+- name: Copy Caddy2 config file
+  template:
+    src: mumble-web/Caddyfile.j2
+    dest: "{{ caddy_config_dir }}/mumble.conf"
+    owner: "{{ caddy_owner }}"
+    group: "{{ caddy_group }}"
+    mode: "0640"
+    # validate: caddy validate -config %s
+  notify: reload caddy
+  tags: caddy_config
+
+- name: Trigger Caddy2 handlers
+  meta: flush_handlers

tasks/dhparam/begin.yml

@@ -1,21 +0,0 @@
-- name: Ensure Diffie-Hellman directory exists
-  file:
-    path: "{{ mumble_web_nginx_dhparam | dirname }}"
-    state: directory
-    owner: root
-    group: www-data
-    mode: "755"
-
-- name: Generate Diffie-Hellman parameters
-  # This can take a long time... So we are doing it in async mode
-  openssl_dhparam:
-      path: "{{ mumble_web_nginx_dhparam }}"
-      state: present
-      owner: root
-      group: www-data
-      mode: "640"
-      size: "{{ mumble_web_nginx_dhparam_size }}"
-  async: 3600
-  poll: 0
-  changed_when: no
-  register: _mumble_web_nginx_dhparam

tasks/dhparam/end.yml

@@ -1,7 +0,0 @@
-- name: Waiting for Diffie-Hellman task to complete…
-  async_status:
-    jid: "{{ _mumble_web_nginx_dhparam.ansible_job_id }}"
-  register: _mumble_web_nginx_dhparam_job
-  retries: 60
-  delay: 30 # will retry every 30s for 30min (60 retries)
-  until: _mumble_web_nginx_dhparam_job.finished

tasks/main.yml

@@ -1,21 +1,14 @@
-- name: Generate Diffie-Hellman parameters in async mode
-  import_tasks: dhparam/begin.yml
-  when: mumble_web_enabled and mumble_web_nginx_generate_dhparam
-  tags:
-  - certificate
-  - dhparam
-
 - name: Install ACME certificates
   import_role:
     name: ppbe.acme
-  when: acme_enabled
+  when: acme_enabled and murmur_enabled
   tags:
     - certificate
     - acme
 
 - name: Install Self-Signed certificates
   import_tasks: self_signed.yml
-  when: not acme_enabled
+  when: not acme_enabled and murmur_enabled
   tags:
     - certificate
     - self_signed
@@ -30,14 +23,7 @@
   when: mumble_web_enabled
   tags: mumble_web
 
-- name: Wait for Diffie-Hellman task to complete
+- name: Configure Caddy2 for mumble web client
-  import_tasks: dhparam/end.yml
+  import_tasks: caddy.yml
-  when: mumble_web_enabled and mumble_web_nginx_generate_dhparam
+  when: mumble_web_enabled and mumble_web_caddy_enabled
-  tags:
+  tags: caddy
-  - certificate
-  - dhparam
-
-- name: Configure Nginx for mumble web client
-  import_tasks: nginx.yml
-  when: mumble_web_enabled and mumble_web_nginx_enabled
-  tags: nginx

tasks/mumble_web.yml

@@ -19,7 +19,7 @@
 - name: Create mumble-web system user
   user:
     name: "{{ mumble_web_owner }}"
-    home: "{{ mumble_web_www_dir }}"
+    home: "{{ mumble_web_home_dir }}"
     groups:
       - www-data
     shell: /sbin/nologin
@@ -27,11 +27,11 @@
     state: present
     system: yes
     append: yes
-    create_home: no
+  tags: mumble_web_install
 
 - name: Change mumble-web home directory's permissions
   file:
-    path: "{{ mumble_web_www_dir }}"
+    path: "{{ mumble_web_home_dir }}"
     owner: "{{ mumble_web_owner }}"
     group: "{{ mumble_web_group }}"
     mode: "755"
@@ -41,7 +41,7 @@
 - name: Clone mumble-web git repository
   git:
     repo: https://github.com/Johni0702/mumble-web.git
-    dest: "{{ mumble_web_www_dir }}"
+    dest: "{{ mumble_web_code_dir }}"
     version: "{{ mumble_web_version }}"
   register: mumble_web_cloned
   become_user: "{{ mumble_web_owner }}"
@@ -49,26 +49,33 @@
 
 - name: Check if mumble-web dist directory exists
   stat:
-    path: "{{ mumble_web_www_dir }}/dist"
+    path: "{{ mumble_web_dist_dir }}"
   register: _mumble_web_dist
+  tags:
+    - mumble_web_install
+    - mumble_web_build
 
 - name: Build mumble-web from sources
-  command: npm clean-install
+  command: npm clean-install {{ mumble_web_dist_dir | quote }}
   args:
-    chdir: "{{ mumble_web_www_dir }}"
+    chdir: "{{ mumble_web_code_dir }}"
   register: _mumble_web_installed
   become_user: "{{ mumble_web_owner }}"
   when: mumble_web_cloned is changed or not _mumble_web_dist.stat.exists
-  tags: [mumble_web_install,mumble_web_build]
+  tags:
+    - mumble_web_install
+    - mumble_web_build
 
 - name: Copy mumble-web config file
   template:
     src: mumble-web/config.js.j2
-    dest: "{{ mumble_web_www_dir }}/dist/config.local.js"
+    dest: "{{ mumble_web_dist_dir }}/config.local.js"
     owner: "{{ mumble_web_owner }}"
     group: "{{ mumble_web_group }}"
     mode: "644"
-  tags: [mumble_web_install,mumble_web_config]
+  tags:
+    - mumble_web_install
+    - mumble_web_config
 
 - name: Copy mumble-web systemd service
   template:
@@ -80,7 +87,9 @@
   notify:
   - reload systemd
   - reload mumble-web
-  tags: [mumble_web_install,mumble_web_config]
+  tags:
+    - mumble_web_install
+    - mumble_web_config
 
 - name: Start mumble-web service
   service:

tasks/murmur.yml

@@ -3,17 +3,16 @@
     name: mumble-server
     state: present
   register: murmur_installed
+  tags: murmur_install
 
 - name: Install ICE dependencies for Python
   package:
-    name: "{{ package }}"
+    name:
-    state: present
-  loop:
       - python3-zeroc-ice
       - python3-yaml
       - zeroc-ice-compilers
-  loop_control:
+    state: present
-    loop_var: package
+  tags: murmur_install
 
 - name: Append ssl-cert group to {{ murmur_owner }} user
   user:
@@ -24,6 +23,7 @@
     append: yes
     system: yes
   notify: restart murmur
+  tags: murmur_install
 
 - name: Copy Murmur config file
   template:
@@ -33,12 +33,16 @@
     group: "{{ murmur_group }}"
     mode: "640"
   notify: restart murmur
+  tags:
+    - murmur_install
+    - murmur_config
 
 - name: Start mumble-server service
   service:
     name: mumble-server
     enabled: yes
     state: started
+  tags: murmur_install
 
 - name: Write superuser password to a file
   copy:
@@ -49,6 +53,9 @@
     mode: "600"
   when: murmur_superuser_password is defined
   notify: change murmur superuser password
+  tags:
+    - murmur_install
+    - murmur_config
 
 - name: Trigger Murmur handlers
   meta: flush_handlers
@@ -60,6 +67,9 @@
     owner: root
     group: root
     mode: "755"
+  tags: 
+    - murmur_install
+    - murmur_ice
 
 - name: Copy mice Python script
   copy:
@@ -70,6 +80,9 @@
     mode: "755"
   notify: create murmur channels
   register: _murmur_mice_script_copied
+  tags:
+    - murmur_install
+    - murmur_ice
 
 - name: Compile Murmur.ice slice file
   command: |-
@@ -81,6 +94,9 @@
   args:
     chdir: "{{ murmur_ice_script_dir }}"
   when: _murmur_mice_script_copied is changed
+  tags:
+    - murmur_install
+    - murmur_ice
 
 - name: Copy mice config
   copy:
@@ -91,6 +107,10 @@
     group: root
     mode: "644"
   notify: create murmur channels
+  tags:
+    - murmur_install
+    - murmur_config
+    - murmur_ice
 
 - name: Trigger Mice handlers
   meta: flush_handlers

tasks/nginx.yml

@@ -1,18 +0,0 @@
-- name: Copy Nginx config file
-  template:
-    src: mumble-web/nginx.conf.j2
-    dest: "{{ mumble_web_nginx_config_dir }}/sites-available/mumble.conf"
-    owner: root
-    group: www-data
-    mode: "755"
-  notify: reload nginx
-
-- name: Enable Nginx config file
-  file:
-    src: "{{ mumble_web_nginx_config_dir }}/sites-available/mumble.conf"
-    path: "{{ mumble_web_nginx_config_dir }}/sites-enabled/mumble.conf"
-    state: link
-  notify: reload nginx
-
-- name: Trigger Nginx handlers
-  meta: flush_handlers

tasks/self_signed.yml

@@ -1,12 +1,9 @@
 - name: Install SSL dependencies
   package:
-    name: "{{ package }}"
+    name:
-    state: present
-  loop:
       - ssl-cert
       - python3-openssl
-  loop_control:
+    state: present
-    loop_var: package
   tags: selfsigned_install
 
 - name: Create SSL config directories

tasks/self_signed_domain.yml

@@ -31,7 +31,7 @@
 
 - name: Generate self-signed certificate
   openssl_certificate:
-    path: "{{ acme_certs_dir }}/{{ domain.name }}.d/cert.pem" 
+    path: "{{ acme_certs_dir }}/{{ domain.name }}.d/fullchain.pem" 
     csr_path: "{{ acme_csr_dir }}/{{ domain.name }}.csr"
     privatekey_path: "{{ acme_keys_dir }}/{{ domain.name }}.key"
     provider: selfsigned 
@@ -39,3 +39,4 @@
     owner: root 
     group: root
     mode: "644"
+  tags: selfsigned_config

templates/mumble-web/Caddyfile.j2

@@ -0,0 +1,14 @@
+{{ ansible_managed | comment }}
+
+{{ mumble_web_domains | join(',') }} {
+    root * {{ mumble_web_dist_dir }}
+    file_server
+{% if not acme_enabled %}
+    tls internal
+{% endif %}
+    reverse_proxy /mumble http://localhost:{{ mumble_web_websockify_port }}
+
+    log {
+        output file {{ caddy_log_dir }}/{{ mumble_web_domains | first }}.log
+    }
+}

templates/mumble-web/config.js.j2

@@ -20,4 +20,4 @@ config.connectDialog.password = {{ (murmur_server_password != '') | lower }}
 config.settings.pttKey = 'shift'
 
 // Default values (can be changed by passing a query parameter of the same name)
-config.defaults.address = "{{ mumble_web_domain }}/mumble"
+config.defaults.address = "{{ mumble_web_domains | first }}/mumble"

templates/mumble-web/nginx.conf.j2

@@ -2,7 +2,7 @@
 server {
   listen 80;
   listen [::]:80;
-  server_name {{ mumble_web_nginx_domains | join(' ') }};
+  server_name {{ mumble_web_domains | join(' ') }};
 
   location / {
     return 301 https://$host$request_uri;
@@ -16,15 +16,15 @@ server {
 	}
 {% endif %}
 
-  access_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-access.log;
+  access_log {{ nginx_log_dir }}/{{ mumble_web_domains | first }}-access.log;
-  error_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-error.log;
+  error_log {{ nginx_log_dir }}/{{ mumble_web_domains | first }}-error.log;
 }
 
 server {
   listen 443 ssl http2;
   listen [::]:443 ssl http2;
 
-  server_name {{ mumble_web_nginx_domains | join(' ') }};
+  server_name {{ mumble_web_domains | join(' ') }};
 
   ssl_certificate {{ mumble_web_certificate }};
   ssl_certificate_key {{ mumble_web_private_key }};
@@ -33,8 +33,8 @@ server {
   ssl_session_cache shared:AnsibleSSL:10m;  # about 40000 sessions
   ssl_session_tickets off;
 
-{% if mumble_web_nginx_dhparam %}
+{% if nginx_dhparam %}
-  ssl_dhparam {{ mumble_web_nginx_dhparam }};
+  ssl_dhparam {{ nginx_dhparam }};
 {% endif %}
 
   ssl_protocols TLSv1.2 TLSv1.3;
@@ -63,8 +63,8 @@ server {
     proxy_set_header Connection $connection_upgrade;
   }
 
-  access_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-access.log;
+  access_log {{ nginx_log_dir }}/{{ mumble_web_domains | first }}-access.log;
-  error_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-error.log;
+  error_log {{ nginx_log_dir }}/{{ mumble_web_domains | first }}-error.log;
 }
 
 map $http_upgrade $connection_upgrade {