WIP

ansible/roles/consul/defaults/main.yml

@@ -2,7 +2,11 @@
 consul_datacenter: null
 consul_domain: null
 consul_secret_key: null
-consul_nodes: []
+consul_server: false
+consul_servers: []
+
+# Required for registering services
+consul_services: []
 
 # Defaults
 consul_version: "1.22.2"
@@ -12,3 +16,5 @@ consul_ca_file: "/etc/ssl/certs/local-ca.crt"
 consul_client_addr: "0.0.0.0"
 consul_bind_addr: "{{ ansible_default_ipv4.address }}"
 consul_advertise_addr: "{{ ansible_default_ipv4.address }}"
+consul_default_check_interval: "15s"
+consul_default_check_timeout: "2s"

ansible/roles/consul/handlers/main.yml

@@ -3,8 +3,3 @@
     name: "consul"
     state: "restarted"
     daemon_reload: true
-
-- name: Reload Consul
-  ansible.builtin.service:
-    name: "consul"
-    state: "reloaded"

ansible/roles/consul/notes.txt

@@ -0,0 +1,6 @@
+Security:
+- Gossip protocol encryption
+- Built-in ACL
+- Consul agent communication
+- mTLS for authentitication and encryption
+- Certificate authority

ansible/roles/consul/tasks/main.yml

@@ -60,7 +60,7 @@
     group: "consul"
     mode: "0640"
   notify:
-    - "Reload Consul"
+    - "Restart Consul"
 
 - name: Deploy Consul service file
   ansible.builtin.template:
@@ -76,3 +76,31 @@
     state: "started"
     enabled: true
     daemon_reload: true
+
+- name: Register services to consul
+  loop: "{{ consul_services }}"
+  community.general.consul_agent_service:
+    name: "{{ item.name }}"
+    service_port: "{{ item.port }}"
+    tags: ="{{ item.tags | default([]) }}"
+
+- name: Register HTTP checks to consul
+  loop: "{{ consul_services }}"
+  when: "item.check_http | default(None) != None"
+  community.general.consul_agent_check:
+    name: "{{ item.name }}_check"
+    service_id: "{{ item.name }}"
+    interval: "{{ item.check_interval | default(consul_default_check_interval) }}"
+    timeout: "{{ item.check_timeout | default(consul_default_check_timeout) }}"
+    http: "{{ item.check_http }}"
+    scheme: "{{ item.check_scheme | default('http') }}"
+
+- name: Register TCP checks to consul
+  loop: "{{ consul_services }}"
+  when: "item.check_tcp | default(None) != None"
+  community.general.consul_agent_check:
+    name: "{{ item.name }}_check"
+    service_id: "{{ item.name }}"
+    interval: "{{ item.check_interval | default(consul_default_check_interval) }}"
+    timeout: "{{ item.check_timeout | default(consul_default_check_timeout) }}"
+    tcp: "{{ item.check_tcp }}"

ansible/roles/consul/templates/config.json

@@ -1,8 +1,7 @@
 {
   "log_level": "INFO",
-  "node_name": "{{ ansible_hostname }}",
   "domain": "{{ consul_domain }}",
-  "server": true,
+  "datacenter": "{{ consul_datacenter | mandatory }}",
   "key_file": "{{ consul_key_file }}",
   "cert_file": "{{ consul_cert_file }}",
   "ca_file": "{{ consul_ca_file }}",
@@ -10,17 +9,20 @@
   "verify_outgoing": true,
   "verify_server_hostname": true,
   "encrypt": "{{ consul_secret_key }}",
+  "data_dir": "/opt/consul",
+{% if consul_server %}
+  "node_name": "{{ ansible_hostname }}",
+  "server": true,
   "ui": true,
   "leave_on_terminate": true,
-  "data_dir": "/opt/consul",
-  "datacenter": "{{ consul_datacenter | mandatory }}",
   "client_addr": "{{ consul_client_addr }}",
   "bind_addr": "{{ consul_bind_addr }}",
   "advertise_addr": "{{ consul_advertise_addr }}",
-  "bootstrap_expect": {{ consul_nodes | length }},
-  "retry_join": ["{{ consul_nodes | join('", "') }}"],
+  "bootstrap_expect": {{ consul_servers | length }},
   "enable_syslog": true,
   "performance": {
     "raft_multiplier": 1
-  }
+  },
+{% endif %}
+  "retry_join": ["{{ consul_servers | join('", "') }}"]
 }

ansible/roles/consul/templates/consul.service

@@ -10,7 +10,6 @@ Type=notify
 User=consul
 Group=consul
 ExecStart=/usr/local/bin/consul agent -config-file=/etc/consul/config.json
-ExecReload=/usr/local/bin/consul reload
 KillMode=process
 Restart=on-failure
 LimitNOFILE=65536