updated multica deployment

ansible/roles/multica_docker/templates/Caddyfile.j2

@@ -1,4 +1,16 @@
 # Managed by Ansible (multica_docker) - local changes will be overwritten
+{% macro tls_block() %}
+{% if caddy_tls_mode == 'internal' %}
+	tls internal
+{% elif caddy_tls_mode == 'cloudflare_dns' %}
+	tls {
+		dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+{% if caddy_dns_resolvers | length > 0 %}
+		resolvers {{ caddy_dns_resolvers | join(' ') }}
+{% endif %}
+	}
+{% endif %}
+{% endmacro %}
 {
 {% if caddy_acme_email | length > 0 %}
 	email {{ caddy_acme_email }}
@@ -9,17 +21,11 @@
 {% if caddy_https_port | int != 443 %}
 	https_port {{ caddy_https_port }}
 {% endif %}
-{% if caddy_tls_mode == 'cloudflare_dns' %}
-	acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
-{% endif %}
 }
 
 {% if multica_layout == 'single' %}
 {{ multica_domain }} {
-{% if caddy_tls_mode == 'internal' %}
-	tls internal
-{% endif %}
-	# CLI reachability probe: `multica setup` GETs <server-url>/health and needs a 200
+{{ tls_block() }}	# CLI reachability probe: `multica setup` GETs <server-url>/health and needs a 200
 	handle /health {
 		reverse_proxy 127.0.0.1:{{ _multica_backend_port }}
 	}
@@ -45,10 +51,7 @@
 }
 {% else %}
 {{ multica_app_domain }} {
-{% if caddy_tls_mode == 'internal' %}
-	tls internal
-{% endif %}
-	# Hand browser WebSockets straight to the backend
+{{ tls_block() }}	# Hand browser WebSockets straight to the backend
 	@ws path /ws /ws/*
 	handle @ws {
 		reverse_proxy 127.0.0.1:{{ _multica_backend_port }} {
@@ -63,10 +66,7 @@
 }
 
 {{ multica_api_domain }} {
-{% if caddy_tls_mode == 'internal' %}
-	tls internal
-{% endif %}
-	reverse_proxy 127.0.0.1:{{ _multica_backend_port }} {
+{{ tls_block() }}	reverse_proxy 127.0.0.1:{{ _multica_backend_port }} {
 		flush_interval -1
 	}
 }