consul: activate https

example/ansible/play-main.yml

@@ -74,6 +74,8 @@
       - cn: "server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
         domains:
           - "DNS:server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
+          - "DNS:{{ ansible_fqdn }}"
+          - "DNS:{{ ansible_hostname }}"
       # Sites
       - cn: "test.lab"
         domains:
@@ -120,6 +122,8 @@
     caddy_consul_delegate_to: "waf1"
     caddy_consul_admin_token: "{{ secrets.consul.bootstrap_secret }}"
     caddy_consul_aes_key: "{{ secrets.caddy.storage_consul_aes_key }}"
+    caddy_consul_client_cert: "/etc/ssl/certs/server.lab.itik.fr.crt"
+    caddy_consul_client_key: "/etc/ssl/private/server.lab.itik.fr.key"
     caddy_sites: "{{ common.sites }}"
 #   ovh_ldp_cluster: "gra2.logs.ovh.com"
 #   ovh_ldp_token: "{{ secrets.ovh_ldp.token }}"

seb4itik/byow/roles/caddy/defaults/main.yml

@@ -21,13 +21,12 @@ caddy_ca_root: null
 
 # For using a Consul cluster.
 caddy_consul: false
+caddy_consul_server: "{{ ansible_fqdn }}:8501"
 caddy_consul_delegate_to: null         # Required, Consul host for running Consul commands
-caddy_consul_admin_token: null         # Required, generate with "uuidgen"
+caddy_consul_admin_token: null         # Required
 caddy_consul_aes_key: null             # Required, 32 characters
-caddy_consul_server: "127.0.0.1:8500"
-# FIXME: SSL connexion doesn't work
-# caddy_consul_client_cert: "/etc/ssl/certs/server.lab.itik.fr.crt"
-# caddy_consul_client_key: "/etc/ssl/private/server.lab.itik.fr.key"
+caddy_consul_client_cert: null         # Required
+caddy_consul_client_key: null          # Required
 
 # Accound id and license key are required if a site use Geoip filtering.
 # See: https://dev.maxmind.com/geoip/updating-databases/

seb4itik/byow/roles/caddy/templates/Caddyfile

@@ -17,7 +17,7 @@
     prefix       "caddy-{{ caddy_my_name }}-tls"
     value_prefix "{{ caddy_my_name }}"
     aes_key      "{{ caddy_consul_aes_key }}"
-    tls_enabled  "false"
+    tls_enabled  "true"
     tls_insecure "false"
   }
 {% endif %}
@@ -214,7 +214,7 @@
       prefix       "caddy-{{ caddy_my_name }}-rl"
       value_prefix "{{ caddy_my_name }}"
       aes_key      "{{ caddy_consul_aes_key }}"
-      tls_enabled  "false"
+      tls_enabled  "true"
       tls_insecure "false"
   }
 {%  endif %}

seb4itik/byow/roles/caddy/templates/caddy.service

@@ -1,7 +1,7 @@
 [Unit]
 Description=WAF ({{ caddy_my_name }}) (built with BYOW: Build Your Own WAF)
 After=network.target network-online.target
-Requires=network-online.target
+Requires=network-online.target{% if caddy_consul %} consul.service{% endif %}
 
 [Service]
 Type=notify
@@ -17,10 +17,9 @@ AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
 StandardOutput=journal
 StandardError=journal
 SyslogIdentifier={{ caddy_my_name }}
-{#
-# FIXME: SSL connexion doesn't work
-# Environment="CONSUL_CLIENT_CERT={{ caddy_consul_client_cert }}" "CONSUL_CLIENT_KEY={{ caddy_consul_client_key }}"
-#}
+{% if caddy_consul %}
+Environment="CONSUL_CLIENT_CERT={{ caddy_consul_client_cert }}" "CONSUL_CLIENT_KEY={{ caddy_consul_client_key }}"
+{% endif %}
 
 [Install]
 WantedBy=multi-user.target

seb4itik/byow/roles/consul/templates/config.json

@@ -22,15 +22,17 @@
       "verify_server_hostname": true
     }
   },
+  "addresses": {
+    "http": "127.0.0.1",
+    "https": "0.0.0.0"
+  },
+  "ports": {
+    "https": 8501
+  },
 {% if consul_server %}
   "server": true,
   "leave_on_terminate": true,
   "bind_addr": "{{ consul_bind_addr }}",
-{#
-  "addresses": {
-    "https": "{{ consul_client_addr }}"
-  },
-#}
   "bootstrap_expect": {{ consul_servers | length }},
   "ui_config": {
     "enabled": {{ (consul_ui_secret_id != None) | ternary('true', 'false') }}