consul: ACL, policies, tokens

seb4itik/byow/roles/consul/templates/config.json

@@ -1,28 +1,43 @@
 {
   "log_level": "INFO",
+  "enable_syslog": true,
+  "node_name": "{{ ansible_hostname }}",
   "domain": "{{ consul_domain }}",
   "datacenter": "{{ consul_datacenter | mandatory }}",
-  "key_file": "{{ consul_key_file }}",
-  "cert_file": "{{ consul_cert_file }}",
-  "ca_file": "{{ consul_ca_file }}",
-  "verify_incoming": true,
-  "verify_outgoing": true,
-  "verify_server_hostname": true,
   "encrypt": "{{ consul_secret_key }}",
   "data_dir": "/opt/consul",
+  "retry_join": ["{{ consul_servers | join('", "') }}"],
+  "disable_coordinates": true,
+  "disable_remote_exec": true,
+  "disable_update_check": true,
+  "tls": {
+    "defaults": {
+      "ca_file": "{{ consul_ca_file }}",
+      "cert_file": "{{ consul_cert_file }}",
+      "key_file": "{{ consul_key_file }}",
+      "verify_incoming": true,
+      "verify_outgoing": true
+    },
+    "internal_rpc": {
+      "verify_server_hostname": true
+    }
+  },
 {% if consul_server %}
-  "node_name": "{{ ansible_hostname }}",
   "server": true,
-  "ui": true,
   "leave_on_terminate": true,
-  "client_addr": "{{ consul_client_addr }}",
   "bind_addr": "{{ consul_bind_addr }}",
-  "advertise_addr": "{{ consul_advertise_addr }}",
-  "bootstrap_expect": {{ (consul_servers | length) - 1 }},
-  "enable_syslog": true,
+{#
+  "addresses": {
+    "https": "{{ consul_client_addr }}"
+  },
+#}
+  "bootstrap_expect": {{ consul_servers | length }},
+  "ui_config": {
+    "enabled": {{ (consul_ui_secret_id != None) | ternary('true', 'false') }}
+  },
   "performance": {
     "raft_multiplier": 1
-  },
+  }
+{% else %}
 {% endif %}
-  "retry_join": ["{{ consul_servers | join('", "') }}"]
 }