Use caddy instead of socat for http proxying

roles/caddy_socket_proxy/defaults/main.yaml

@@ -0,0 +1,4 @@
+---
+caddy_socket_proxy_target_container: "{{ caddy_socket_proxy_service_name }}"
+caddy_socket_proxy_container_ip: ""
+caddy_socket_proxy_auto_update: true

roles/caddy_socket_proxy/meta/argument_specs.yaml

@@ -0,0 +1,30 @@
+---
+argument_specs:
+  main:
+    description: >-
+      Sets up a caddy container and a systemd socket unit, forwarding traffic from it to
+      target container
+    options:
+      caddy_socket_proxy_service_name:
+        description: Name of the caddy service, used for systemd unit and container naming
+        type: str
+        required: true
+      caddy_socket_proxy_target_container:
+        description: Name of the container to forward traffic to
+        type: str
+        required: false
+        default: "{{ caddy_socket_proxy_service_name }}"
+      caddy_socket_proxy_target_http_port:
+        description: Port on the target container to forward traffic to
+        type: int
+        required: true
+      caddy_socket_proxy_container_ip:
+        description: IP address to assign to the caddy container.
+        type: str
+        required: false
+        default: ""
+      caddy_socket_proxy_auto_update:
+        description: Whether to automatically update the caddy container
+        type: bool
+        required: false
+        default: true

roles/caddy_socket_proxy/tasks/main.yaml

@@ -0,0 +1,45 @@
+---
+- name: Create caddy socket proxy mount directories for {{ caddy_socket_proxy_service_name }}
+  ansible.builtin.file:
+    path: "{{ item.key }}"
+    state: directory
+    mode: "{{ item.value }}"
+  with_dict:
+    "/srv/{{ caddy_socket_proxy_service_name }}-caddy-socket-proxy/": "0755"
+    "/srv/{{ caddy_socket_proxy_service_name }}-caddy-socket-proxy/mounts": "0700"
+    "/srv/{{ caddy_socket_proxy_service_name }}-caddy-socket-proxy/mounts/caddy": "0755"
+
+- name: Configure caddy socket proxy for {{ caddy_socket_proxy_service_name }}
+  ansible.builtin.template:
+    src: Caddyfile.j2
+    dest: "/srv/{{ caddy_socket_proxy_service_name }}-caddy-socket-proxy/mounts/caddy/Caddyfile"
+    mode: "0644"
+  notify: Restart container service {{ caddy_socket_proxy_service_name }}-caddy-socket-proxy
+
+- name: Caddy socket proxy socket for {{ caddy_socket_proxy_service_name }}
+  ansible.builtin.import_role:
+    name: uumas.general.systemd_socket
+  vars:
+    systemd_socket_name: "{{ caddy_socket_proxy_service_name }}-caddy-socket-proxy"
+    systemd_socket_requires:
+      - "{{ caddy_socket_proxy_target_container }}.service"
+
+- name: Caddy container for {{ caddy_socket_proxy_service_name }}
+  ansible.builtin.import_role:
+    name: container
+  vars:
+    container_name: "{{ caddy_socket_proxy_service_name }}-caddy-socket-proxy"
+    container_image: "docker.io/library/caddy:2-alpine"
+    container_mounts:
+      - type: bind
+        source: "/srv/{{ caddy_socket_proxy_service_name }}-caddy-socket-proxy/mounts/caddy"
+        destination: /etc/caddy
+        readonly: true
+    container_networks:
+      - name: "{{ caddy_socket_proxy_service_name }}-caddy-socket-proxy"
+        ip: "{{ caddy_socket_proxy_container_ip }}"
+    container_requires:
+      - "{{ caddy_socket_proxy_service_name }}-caddy-socket-proxy.socket"
+      - "{{ caddy_socket_proxy_target_container }}.service"
+    container_auto_start: false
+    container_auto_update: "{{ caddy_socket_proxy_auto_update }}"

roles/caddy_socket_proxy/templates/Caddyfile.j2

@@ -0,0 +1,12 @@
+# {{ ansible_managed }}
+{
+	servers {
+		trusted_proxies_unix
+	}
+}
+
+http:// {
+	bind fd/3
+	reverse_proxy {{ caddy_socket_proxy_service_name }}:{{ service_container_http_port }}
+}
+}

roles/service/tasks/main.yaml

@@ -51,16 +51,16 @@
     container_wants: "{{ _service_container_wants }}"
     container_auto_update: "{{ service_auto_update }}"
 
-- name: Socat for http of {{ service_name }}
+- name: Caddy socket proxy for http of {{ service_name }}
   ansible.builtin.include_role:
-    name: socat
+    name: caddy_socket_proxy
   when: service_container_http_port > 0
   vars:
-    socat_service_name: "{{ service_name }}"
+    caddy_socket_proxy_service_name: "{{ service_name }}"
-    socat_target_http_port: "{{ service_container_http_port }}"
+    caddy_socket_proxy_target_http_port: "{{ service_container_http_port }}"
-    socat_container_ip: >-
+    caddy_socket_proxy_container_ip: >-
       {{ service_container_ip | ansible.utils.ipmath(257) if _service_static_ip else '' }}
-    socat_auto_update: "{{ service_auto_update }}"
+    caddy_socket_proxy_auto_update: "{{ service_auto_update }}"
 
 - name: Socat for socket published ports of {{ service_name }}
   ansible.builtin.include_role:

roles/service/vars/main/general.yaml

@@ -7,7 +7,7 @@ _service_container_networks: >-
     }]
     + (
         [{
-          'name': service_name ~ '-socat',
+          'name': service_name ~ '-caddy-socket-proxy',
           'ip': service_container_ip | ansible.utils.ipmath(256) if _service_static_ip else ''
         }] if service_container_http_port > 0 else []
       )
@@ -33,7 +33,7 @@ _service_container_requires: >-
 _service_container_wants: >-
   {{
     service_wants
-    + ([service_name + '-socat.socket'] if service_container_http_port > 0 else [])
+    + ([service_name + '-caddy-socket-proxy.socket'] if service_container_http_port > 0 else [])
     + ([service_name + '-oauth2-proxy.socket'] if _service_oauth2_proxy else [])
     + _service_container_publish_socket_ports
         | map(attribute='name')

roles/service/vars/main/proxy.yaml

@@ -2,7 +2,7 @@
 _service_native_socket: "{{ service_domains | length > 0 and service_container_http_port == 0 }}"
 
 _service_socket_path: >-
-  /run/{{ service_name ~ ('-socat' if not _service_native_socket else '' ) }}.sock
+  /run/{{ service_name ~ ('-caddy-socket-proxy' if not _service_native_socket else '' ) }}.sock
 
 _service_replacement_host_header:
   Host: "{{ service_name }}:{{ service_container_http_port }}"

roles/synapse/tasks/main.yaml

@@ -82,7 +82,7 @@
     vhost_domains:
       - "{{ synapse_external_domain }}:8448"
     vhost_proxy_target_netproto: unix
-    vhost_proxy_target_socket: "/run/synapse-socat.sock"
+    vhost_proxy_target_socket: "/run/synapse-caddy-socket-proxy.sock"
 
 - name: Open port for synapse federation
   ansible.posix.firewalld: