infra/home/ansible/caddy-almalinux.yml

---
- name: Configure Caddy reverse proxy with Tailscale on AlmaLinux 10
  hosts: caddy
  become: yes
  gather_facts: yes
  strategy: free
  vars:
    tailscale_key: "{{ lookup('env', 'TAILSCALE_KEY') }}"

  tasks:
    - name: Enable passwordless sudo on AlmaLinux
      ansible.builtin.lineinfile:
        path: /etc/sudoers
        state: present
        regexp: "^%wheel"
        line: "%wheel ALL=(ALL) NOPASSWD: ALL"
        validate: "visudo -cf %s"

    - name: Clean up repository files
      ansible.builtin.file:
        path: "{{ item }}"
        state: absent
      loop:
        - /etc/yum.repos.d/caddy.repo
        - /etc/yum.repos.d/tailscale-stable.repo
      when: false  # Only enable if you have issues

    - name: Check if EPEL is already installed
      ansible.builtin.stat:
        path: /etc/yum.repos.d/epel.repo
      register: epel_check

    - name: Install EPEL repo
      ansible.builtin.dnf:
        name: epel-release
        state: present
      when: not epel_check.stat.exists

    - name: Check if Caddy COPR repo exists
      ansible.builtin.stat:
        path: /etc/yum.repos.d/_copr:copr.fedorainfracloud.org:group_caddy:caddy.repo
      register: caddy_repo_check

    - name: Add Caddy COPR repository
      ansible.builtin.command:
        cmd: dnf copr enable -y @caddy/caddy
      when: not caddy_repo_check.stat.exists

    - name: Install all required packages in one transaction
      ansible.builtin.dnf:
        state: present
        name:
          - caddy
          - firewalld
          - htop
          - rsync
          - tmux
          - tar
          - unzip
          - python3-libsemanage
          - python3-policycoreutils
          - iptables-services
        update_cache: yes

    - name: Enable and start firewalld
      service:
        name: firewalld
        state: started
        enabled: yes

    - name: Configure firewall for Caddy
      firewalld:
        port: "{{ item }}"
        permanent: yes
        state: enabled
        immediate: yes
      loop:
        - "80/tcp"
        - "443/tcp"
        - "22/tcp"

    - name: Check if Tailscale is installed
      command: which tailscale
      register: tailscale_check
      changed_when: false
      failed_when: false

    - name: Install Tailscale on AlmaLinux
      block:
        - name: Add Tailscale repository
          yum_repository:
            name: tailscale-stable
            description: Tailscale stable
            baseurl: https://pkgs.tailscale.com/stable/centos/9/$basearch
            repo_gpgcheck: yes
            gpgcheck: yes
            enabled: yes
            gpgkey: https://pkgs.tailscale.com/stable/centos/9/repo.gpg

        - name: Install Tailscale
          dnf:
            name: tailscale
            state: present

        - name: Enable and start Tailscale daemon
          service:
            name: tailscaled
            state: started
            enabled: yes
      when: tailscale_check.rc != 0

    - name: Allow Tailscale through firewall
      firewalld:
        port: 41641/udp
        permanent: yes
        state: enabled
        immediate: yes

    - name: Check if Tailscale is already authenticated
      command: tailscale status --json
      register: tailscale_status_check
      changed_when: false
      failed_when: false

    - name: Authenticate Tailscale
      command: tailscale up --authkey="{{ tailscale_key }}" --hostname=caddy
      when:
        - tailscale_key is defined
        - tailscale_key != ""
        - tailscale_status_check.rc != 0 or (tailscale_status_check.stdout | from_json).BackendState != "Running"
      register: tailscale_auth
      failed_when: false
      ignore_errors: yes

    - name: Get Tailscale status
      command: tailscale status
      register: tailscale_final_status
      changed_when: false
      failed_when: false

    - name: Show final Tailscale status
      debug:
        var: tailscale_final_status.stdout_lines

    - name: Enable and start Caddy
      service:
        name: caddy
        state: started
        enabled: yes

    - name: Deploy Caddyfile configuration
      template:
        src: templates/Caddyfile.j2
        dest: /etc/caddy/Caddyfile
        owner: caddy
        group: caddy
        mode: "0644"
        backup: yes
      notify: reload caddy

    - name: SELinux - Allow Caddy to proxy
      seboolean:
        name: httpd_can_network_connect
        state: yes
        persistent: yes

    - name: SELinux - Allow Caddy to bind to ports
      seport:
        ports: "80,443"
        proto: tcp
        setype: http_port_t
        state: present

    # Note about SSH forwarding:
    # Since SSH doesn't support hostname-based routing, you have two options:
    # 1. Use git.w5isp.com:22 which forwards ALL SSH to Forgejo (can't SSH to caddy directly)
    # 2. Use different ports: caddy.w5isp.com:22 for server, git.w5isp.com:2222 for git
    # 3. Configure client-side SSH config to use ProxyJump through caddy server
    
    - name: Create SSH config info
      copy:
        content: |
          # SSH Configuration for git.w5isp.com
          # 
          # Since SSH protocol doesn't support hostname-based routing like HTTP,
          # users need to configure their SSH client to access git properly.
          #
          # Add this to your ~/.ssh/config:
          #
          # Host git.w5isp.com
          #     ProxyJump caddy.w5isp.com
          #     HostName 100.109.233.14
          #     User git
          #     Port 22
          #
          # This allows:
          # - ssh caddy.w5isp.com → Direct access to caddy server
          # - ssh git.w5isp.com → Access to Forgejo via ProxyJump
          # - git clone git@git.w5isp.com:user/repo.git → Works with ProxyJump
        dest: /etc/ssh/ssh_routing_info.txt
        mode: '0644'

  handlers:
    - name: reload caddy
      service:
        name: caddy
        state: reloaded