consul: ACL, policies, tokens

seb4itik/byow/roles/consul/templates/acl.json

@@ -0,0 +1,9 @@
+{
+  "acl" : {
+    "enabled" : true,
+{% if consul_server %}
+    "default_policy" : "deny",
+{% endif %}
+    "down_policy" : "extend-cache"
+  }
+}

seb4itik/byow/roles/consul/templates/config.json

@@ -1,28 +1,43 @@
 {
   "log_level": "INFO",
+  "enable_syslog": true,
+  "node_name": "{{ ansible_hostname }}",
   "domain": "{{ consul_domain }}",
   "datacenter": "{{ consul_datacenter | mandatory }}",
-  "key_file": "{{ consul_key_file }}",
-  "cert_file": "{{ consul_cert_file }}",
-  "ca_file": "{{ consul_ca_file }}",
-  "verify_incoming": true,
-  "verify_outgoing": true,
-  "verify_server_hostname": true,
   "encrypt": "{{ consul_secret_key }}",
   "data_dir": "/opt/consul",
+  "retry_join": ["{{ consul_servers | join('", "') }}"],
+  "disable_coordinates": true,
+  "disable_remote_exec": true,
+  "disable_update_check": true,
+  "tls": {
+    "defaults": {
+      "ca_file": "{{ consul_ca_file }}",
+      "cert_file": "{{ consul_cert_file }}",
+      "key_file": "{{ consul_key_file }}",
+      "verify_incoming": true,
+      "verify_outgoing": true
+    },
+    "internal_rpc": {
+      "verify_server_hostname": true
+    }
+  },
 {% if consul_server %}
-  "node_name": "{{ ansible_hostname }}",
   "server": true,
-  "ui": true,
   "leave_on_terminate": true,
-  "client_addr": "{{ consul_client_addr }}",
   "bind_addr": "{{ consul_bind_addr }}",
-  "advertise_addr": "{{ consul_advertise_addr }}",
-  "bootstrap_expect": {{ (consul_servers | length) - 1 }},
-  "enable_syslog": true,
+{#
+  "addresses": {
+    "https": "{{ consul_client_addr }}"
+  },
+#}
+  "bootstrap_expect": {{ consul_servers | length }},
+  "ui_config": {
+    "enabled": {{ (consul_ui_secret_id != None) | ternary('true', 'false') }}
+  },
   "performance": {
     "raft_multiplier": 1
-  },
+  }
+{% else %}
 {% endif %}
-  "retry_join": ["{{ consul_servers | join('", "') }}"]
 }

seb4itik/byow/roles/consul/templates/consul.service

@@ -9,10 +9,10 @@ ConditionFileNotEmpty=/etc/consul/config.json
 Type=notify
 User=consul
 Group=consul
-ExecStart=/usr/local/bin/consul agent -config-file=/etc/consul/config.json
+ExecStart=/usr/local/consul-{{ consul_version }}/consul agent -config-file=/etc/consul/
 KillMode=process
 Restart=on-failure
 LimitNOFILE=65536
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target

seb4itik/byow/roles/consul/templates/tokens.json

@@ -0,0 +1,10 @@
+{
+  "acl" : {
+    "tokens": {
+{% if consul_server %}
+      "dns": "{{ consul_out_dns_token.token.SecretID }}",
+{% endif %}
+      "default": "{{ consul_out_agent_token.token.SecretID }}"
+    }
+  }
+}