WIP

ansible/roles/consul/defaults/main.yml

@@ -18,3 +18,5 @@ consul_bind_addr: "{{ ansible_default_ipv4.address }}"
 consul_advertise_addr: "{{ ansible_default_ipv4.address }}"
 consul_default_check_interval: "15s"
 consul_default_check_timeout: "2s"
+
+consul_acl_bootstraped: false

ansible/roles/consul/tasks/main.yml

@@ -77,12 +77,30 @@
     enabled: true
     daemon_reload: true
 
+# consul acl bootstrap -format=json
+# {
+#     "CreateIndex": 1042,
+#     "ModifyIndex": 1042,
+#     "AccessorID": "50f8bfb6-b259-4c08-f9aa-2dc0eeb08e99",
+#     "SecretID": "b7f16a8a-0b4f-4661-fea2-f79d95dd011b",
+#     "Description": "Bootstrap Token (Global Management)",
+#     "Policies": [
+#         {
+#             "ID": "00000000-0000-0000-0000-000000000001",
+#             "Name": "global-management"
+#         }
+#     ],
+#     "Local": false,
+#     "CreateTime": "2026-01-19T18:41:13.294800712+03:00",
+#     "Hash": "X2AgaFhnQGRhSSF/h0m6qpX1wj/HJWbyXcxkEM/5GrY="
+# }
+
 - name: Register services to consul
   loop: "{{ consul_services }}"
   community.general.consul_agent_service:
     name: "{{ item.name }}"
     service_port: "{{ item.port }}"
-    tags: ="{{ item.tags | default([]) }}"
+    tags: "{{ item.tags | default([]) }}"
 
 - name: Register HTTP checks to consul
   loop: "{{ consul_services }}"

ansible/roles/consul/templates/config.json

@@ -23,6 +23,18 @@
   "performance": {
     "raft_multiplier": 1
   },
+  "acl": {
+    "enabled": true,
+{% if not consul_acl_bootstraped %}
+    "default_policy": "allow",
+{% else %}
+    "default_policy": "deny",
+    "tokens": {
+      "agent": "FIXME"
+    },
+{% endif %}
+    "down_policy": "extend-cache"
+  },
 {% endif %}
   "retry_join": ["{{ consul_servers | join('", "') }}"]
 }