consul: ACL, policies, tokens

seb4itik/byow/roles/consul/defaults/main.yml

@@ -1,22 +1,34 @@
-# Required
-consul_datacenter: null
-consul_domain: null
-consul_secret_key: null
+# Required.
 consul_server: false
+consul_datacenter: null
+consul_secret_key: null           # Generate with "consul keygen"
 consul_servers: []
 
-# Required for registering services
-consul_services: []
+# Required if consul_server.
+consul_bootstrap_secret: null     # Generate with "uuidgen"
 
-# Defaults
-consul_version: "1.22.2"
-consul_key_file: "/etc/ssl/private/server.{{ consul_datacenter }}.{{ consul_domain }}.key"
-consul_cert_file: "/etc/ssl/certs/server.{{ consul_datacenter }}.{{ consul_domain }}.crt"
-consul_ca_file: "/etc/ssl/certs/local-ca.crt"
-consul_client_addr: "0.0.0.0"
+# Required for activating UI.
+consul_ui_secret_id: null         # Generate with "uuidgen"
+
+# Defaults.
+consul_domain: "consul"
+consul_version: "1.22.3"
+consul_client_addr: "127.0.0.1"
 consul_bind_addr: "{{ ansible_default_ipv4.address }}"
-consul_advertise_addr: "{{ ansible_default_ipv4.address }}"
 consul_default_check_interval: "15s"
 consul_default_check_timeout: "2s"
 
-consul_acl_bootstraped: false
+# Attributes for certificate must be:
+# cn: server.<consul_datacenter>.<consul_domain>
+# SANs: DNS:server.<consul_datacenter>.<consul_domain>
+consul_key_file: "/etc/ssl/private/server.{{ consul_datacenter }}.{{ consul_domain }}.key"
+consul_cert_file: "/etc/ssl/certs/server.{{ consul_datacenter }}.{{ consul_domain }}.crt"
+consul_ca_file: "/etc/ssl/certs/local-ca.crt"
+
+# Required for registering services.
+consul_services: []
+# - name: "www"
+#   port: 443
+#   check_tcp: ""
+#   check_http: "http://{{ ansible_default_ipv4.address }}:80/"
+#   scheme: "" (default "http")