From 5eeb74d53e1172decea360b07a2f100b443acf1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=2E=20Nam=C3=A8che?= Date: Thu, 12 Feb 2026 14:37:42 +0100 Subject: [PATCH] consul: activate https --- example/ansible/play-main.yml | 4 ++++ seb4itik/byow/roles/caddy/defaults/main.yml | 9 ++++----- seb4itik/byow/roles/caddy/templates/Caddyfile | 4 ++-- seb4itik/byow/roles/caddy/templates/caddy.service | 9 ++++----- seb4itik/byow/roles/consul/templates/config.json | 12 +++++++----- 5 files changed, 21 insertions(+), 17 deletions(-) diff --git a/example/ansible/play-main.yml b/example/ansible/play-main.yml index 11c2542..a505368 100644 --- a/example/ansible/play-main.yml +++ b/example/ansible/play-main.yml @@ -74,6 +74,8 @@ - cn: "server.{{ common.consul.datacenter }}.{{ common.consul.domain }}" domains: - "DNS:server.{{ common.consul.datacenter }}.{{ common.consul.domain }}" + - "DNS:{{ ansible_fqdn }}" + - "DNS:{{ ansible_hostname }}" # Sites - cn: "test.lab" domains: @@ -120,6 +122,8 @@ caddy_consul_delegate_to: "waf1" caddy_consul_admin_token: "{{ secrets.consul.bootstrap_secret }}" caddy_consul_aes_key: "{{ secrets.caddy.storage_consul_aes_key }}" + caddy_consul_client_cert: "/etc/ssl/certs/server.lab.itik.fr.crt" + caddy_consul_client_key: "/etc/ssl/private/server.lab.itik.fr.key" caddy_sites: "{{ common.sites }}" # ovh_ldp_cluster: "gra2.logs.ovh.com" # ovh_ldp_token: "{{ secrets.ovh_ldp.token }}" diff --git a/seb4itik/byow/roles/caddy/defaults/main.yml b/seb4itik/byow/roles/caddy/defaults/main.yml index 8b21429..77ad631 100644 --- a/seb4itik/byow/roles/caddy/defaults/main.yml +++ b/seb4itik/byow/roles/caddy/defaults/main.yml @@ -21,13 +21,12 @@ caddy_ca_root: null # For using a Consul cluster. caddy_consul: false +caddy_consul_server: "{{ ansible_fqdn }}:8501" caddy_consul_delegate_to: null # Required, Consul host for running Consul commands -caddy_consul_admin_token: null # Required, generate with "uuidgen" +caddy_consul_admin_token: null # Required caddy_consul_aes_key: null # Required, 32 characters -caddy_consul_server: "127.0.0.1:8500" -# FIXME: SSL connexion doesn't work -# caddy_consul_client_cert: "/etc/ssl/certs/server.lab.itik.fr.crt" -# caddy_consul_client_key: "/etc/ssl/private/server.lab.itik.fr.key" +caddy_consul_client_cert: null # Required +caddy_consul_client_key: null # Required # Accound id and license key are required if a site use Geoip filtering. # See: https://dev.maxmind.com/geoip/updating-databases/ diff --git a/seb4itik/byow/roles/caddy/templates/Caddyfile b/seb4itik/byow/roles/caddy/templates/Caddyfile index bb2f675..60d3fca 100644 --- a/seb4itik/byow/roles/caddy/templates/Caddyfile +++ b/seb4itik/byow/roles/caddy/templates/Caddyfile @@ -17,7 +17,7 @@ prefix "caddy-{{ caddy_my_name }}-tls" value_prefix "{{ caddy_my_name }}" aes_key "{{ caddy_consul_aes_key }}" - tls_enabled "false" + tls_enabled "true" tls_insecure "false" } {% endif %} @@ -214,7 +214,7 @@ prefix "caddy-{{ caddy_my_name }}-rl" value_prefix "{{ caddy_my_name }}" aes_key "{{ caddy_consul_aes_key }}" - tls_enabled "false" + tls_enabled "true" tls_insecure "false" } {% endif %} diff --git a/seb4itik/byow/roles/caddy/templates/caddy.service b/seb4itik/byow/roles/caddy/templates/caddy.service index 10b6d6c..a8a8cbb 100644 --- a/seb4itik/byow/roles/caddy/templates/caddy.service +++ b/seb4itik/byow/roles/caddy/templates/caddy.service @@ -1,7 +1,7 @@ [Unit] Description=WAF ({{ caddy_my_name }}) (built with BYOW: Build Your Own WAF) After=network.target network-online.target -Requires=network-online.target +Requires=network-online.target{% if caddy_consul %} consul.service{% endif %} [Service] Type=notify @@ -17,10 +17,9 @@ AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE StandardOutput=journal StandardError=journal SyslogIdentifier={{ caddy_my_name }} -{# -# FIXME: SSL connexion doesn't work -# Environment="CONSUL_CLIENT_CERT={{ caddy_consul_client_cert }}" "CONSUL_CLIENT_KEY={{ caddy_consul_client_key }}" -#} +{% if caddy_consul %} +Environment="CONSUL_CLIENT_CERT={{ caddy_consul_client_cert }}" "CONSUL_CLIENT_KEY={{ caddy_consul_client_key }}" +{% endif %} [Install] WantedBy=multi-user.target diff --git a/seb4itik/byow/roles/consul/templates/config.json b/seb4itik/byow/roles/consul/templates/config.json index 6da23de..b21f34c 100644 --- a/seb4itik/byow/roles/consul/templates/config.json +++ b/seb4itik/byow/roles/consul/templates/config.json @@ -22,15 +22,17 @@ "verify_server_hostname": true } }, + "addresses": { + "http": "127.0.0.1", + "https": "0.0.0.0" + }, + "ports": { + "https": 8501 + }, {% if consul_server %} "server": true, "leave_on_terminate": true, "bind_addr": "{{ consul_bind_addr }}", -{# - "addresses": { - "https": "{{ consul_client_addr }}" - }, -#} "bootstrap_expect": {{ consul_servers | length }}, "ui_config": { "enabled": {{ (consul_ui_secret_id != None) | ternary('true', 'false') }}