WIP

2026-01-20 17:40:16 +03:00
parent cda556eec6
commit b78da80550
83 changed files with 108 additions and 82 deletions
--- a/roles/consul/defaults/main.yml
+++ b/roles/consul/defaults/main.yml
@@ -0,0 +1,22 @@
+# Required
+consul_datacenter: null
+consul_domain: null
+consul_secret_key: null
+consul_server: false
+consul_servers: []
+
+# Required for registering services
+consul_services: []
+
+# Defaults
+consul_version: "1.22.2"
+consul_key_file: "/etc/ssl/private/server.{{ consul_datacenter }}.{{ consul_domain }}.key"
+consul_cert_file: "/etc/ssl/certs/server.{{ consul_datacenter }}.{{ consul_domain }}.crt"
+consul_ca_file: "/etc/ssl/certs/local-ca.crt"
+consul_client_addr: "0.0.0.0"
+consul_bind_addr: "{{ ansible_default_ipv4.address }}"
+consul_advertise_addr: "{{ ansible_default_ipv4.address }}"
+consul_default_check_interval: "15s"
+consul_default_check_timeout: "2s"
+
+consul_acl_bootstraped: false
--- a/roles/consul/handlers/main.yml
+++ b/roles/consul/handlers/main.yml
@@ -0,0 +1,5 @@
+- name: Restart Consul
+  ansible.builtin.service:
+    name: "consul"
+    state: "restarted"
+    daemon_reload: true
--- a/roles/consul/notes.txt
+++ b/roles/consul/notes.txt
@@ -0,0 +1,62 @@
+Security:
+- Gossip protocol encryption
+- Built-in ACL
+- Consul agent communication
+- mTLS for authentitication and encryption
+- Certificate authority
+
+
+FIXME:
+- Ne fonctionne pas sous Debian 13
+
+
+  "acl": {
+    "enabled": true,
+{% if not consul_acl_bootstraped %}
+    "default_policy": "allow",
+{% else %}
+    "default_policy": "deny",
+    "tokens": {
+      "agent": "FIXME"
+    },
+{% endif %}
+    "down_policy": "extend-cache"
+  },
+
+
+FIXME:
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN]  agent: The 'ca_file' field is deprecated. Use the 'tls.defaults.ca_file' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN]  agent: The 'cert_file' field is deprecated. Use the 'tls.defaults.cert_file' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN]  agent: The 'key_file' field is deprecated. Use the 'tls.defaults.key_file' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN]  agent: The 'verify_incoming' field is deprecated. Use the 'tls.defaults.verify_incoming' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN]  agent: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN]  agent: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN]  agent: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN]  agent: bootstrap_expect > 0: expecting 3 servers
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN]  agent.auto_config: The 'ca_file' field is deprecated. Use the 'tls.defaults.ca_file' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN]  agent.auto_config: The 'cert_file' field is deprecated. Use the 'tls.defaults.cert_file' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN]  agent.auto_config: The 'key_file' field is deprecated. Use the 'tls.defaults.key_file' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN]  agent.auto_config: The 'verify_incoming' field is deprecated. Use the 'tls.defaults.verify_incoming' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN]  agent.auto_config: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN]  agent.auto_config: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN]  agent.auto_config: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'ca_file' field is deprecated. Use the 'tls.defaults.ca_file' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN]  agent.auto_config: bootstrap_expect > 0: expecting 3 servers
+Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'cert_file' field is deprecated. Use the 'tls.defaults.cert_file' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'key_file' field is deprecated. Use the 'tls.defaults.key_file' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_incoming' field is deprecated. Use the 'tls.defaults.verify_incoming' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead.
+Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead.
+
+
+FIXME:
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/recordlabel
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/artist
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/album
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/concept
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v2/festival
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/multicluster/v2/exportedservices
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/multicluster/v2/namespaceexportedservices
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/multicluster/v2/partitionexportedservices
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/internal/v1/tombstone
--- a/roles/consul/tasks/main.yml
+++ b/roles/consul/tasks/main.yml
@@ -0,0 +1,131 @@
+- name: Install requirements
+  ansible.builtin.apt:
+    name:
+      - "unzip"
+
+ # Not required for Ubuntu 24, was a test for Debian 13
+- name: Disable IPv6 on all interfaces
+  ansible.posix.sysctl:
+    name: "net.ipv6.conf.all.disable_ipv6"
+    value: "1"
+    sysctl_set: true
+
+- name: Create Consul directory
+  ansible.builtin.file:
+    path: "/usr/local/consul-{{ consul_version }}"
+    state: "directory"
+    mode: "0755"
+
+- name: Install Consul
+  ansible.builtin.unarchive:
+    src: "https://releases.hashicorp.com/consul/{{ consul_version }}/consul_{{ consul_version }}_linux_amd64.zip"
+    dest: "/usr/local/consul-{{ consul_version }}"
+    remote_src: true
+  notify:
+    - "Restart Consul"
+
+- name: Link Consul
+  ansible.builtin.file:
+    src: "/usr/local/consul-{{ consul_version }}/consul"
+    dest: "/usr/local/bin/consul"
+    state: "link"
+  notify:
+    - "Restart Consul"
+
+- name: Create consul system group
+  ansible.builtin.group:
+    name: "consul"
+    system: true
+
+- name: Create consul system user
+  ansible.builtin.user:
+    name: "consul"
+    group: "consul"
+    groups: ["ssl-cert"]
+    password: "!"
+    system: true
+    home: "/opt/consul"
+
+- name: Create consul config directory
+  ansible.builtin.file:
+    path: "/etc/consul"
+    state: "directory"
+    group: "consul"
+    mode: "0750"
+
+- name: Create consul log dir
+  ansible.builtin.file:
+    path: "/var/log/consul"
+    state: "directory"
+    group: "consul"
+    mode: "0770"
+
+- name: Generate Consul config
+  ansible.builtin.template:
+    src: "templates/config.json"
+    dest: "/etc/consul/config.json"
+    group: "consul"
+    mode: "0640"
+  notify:
+    - "Restart Consul"
+
+- name: Deploy Consul service file
+  ansible.builtin.template:
+    src: "templates/consul.service"
+    dest: "/etc/systemd/system/consul.service"
+    mode: "0644"
+  notify:
+    - "Restart Consul"
+
+- name: Enable and start Consul
+  ansible.builtin.service:
+    name: "consul"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+
+# consul acl bootstrap -format=json
+# {
+#     "CreateIndex": 1042,
+#     "ModifyIndex": 1042,
+#     "AccessorID": "50f8bfb6-b259-4c08-f9aa-2dc0eeb08e99",
+#     "SecretID": "b7f16a8a-0b4f-4661-fea2-f79d95dd011b",
+#     "Description": "Bootstrap Token (Global Management)",
+#     "Policies": [
+#         {
+#             "ID": "00000000-0000-0000-0000-000000000001",
+#             "Name": "global-management"
+#         }
+#     ],
+#     "Local": false,
+#     "CreateTime": "2026-01-19T18:41:13.294800712+03:00",
+#     "Hash": "X2AgaFhnQGRhSSF/h0m6qpX1wj/HJWbyXcxkEM/5GrY="
+# }
+
+- name: Register services to consul
+  loop: "{{ consul_services }}"
+  community.general.consul_agent_service:
+    name: "{{ item.name }}"
+    service_port: "{{ item.port }}"
+    tags: "{{ item.tags | default([]) }}"
+
+- name: Register HTTP checks to consul
+  loop: "{{ consul_services }}"
+  when: "item.check_http | default(None) != None"
+  community.general.consul_agent_check:
+    name: "{{ item.name }}_check"
+    service_id: "{{ item.name }}"
+    interval: "{{ item.check_interval | default(consul_default_check_interval) }}"
+    timeout: "{{ item.check_timeout | default(consul_default_check_timeout) }}"
+    http: "{{ item.check_http }}"
+    scheme: "{{ item.check_scheme | default('http') }}"
+
+- name: Register TCP checks to consul
+  loop: "{{ consul_services }}"
+  when: "item.check_tcp | default(None) != None"
+  community.general.consul_agent_check:
+    name: "{{ item.name }}_check"
+    service_id: "{{ item.name }}"
+    interval: "{{ item.check_interval | default(consul_default_check_interval) }}"
+    timeout: "{{ item.check_timeout | default(consul_default_check_timeout) }}"
+    tcp: "{{ item.check_tcp }}"
--- a/roles/consul/templates/config.json
+++ b/roles/consul/templates/config.json
@@ -0,0 +1,28 @@
+{
+  "log_level": "INFO",
+  "domain": "{{ consul_domain }}",
+  "datacenter": "{{ consul_datacenter | mandatory }}",
+  "key_file": "{{ consul_key_file }}",
+  "cert_file": "{{ consul_cert_file }}",
+  "ca_file": "{{ consul_ca_file }}",
+  "verify_incoming": true,
+  "verify_outgoing": true,
+  "verify_server_hostname": true,
+  "encrypt": "{{ consul_secret_key }}",
+  "data_dir": "/opt/consul",
+{% if consul_server %}
+  "node_name": "{{ ansible_hostname }}",
+  "server": true,
+  "ui": true,
+  "leave_on_terminate": true,
+  "client_addr": "{{ consul_client_addr }}",
+  "bind_addr": "{{ consul_bind_addr }}",
+  "advertise_addr": "{{ consul_advertise_addr }}",
+  "bootstrap_expect": {{ (consul_servers | length) - 1 }},
+  "enable_syslog": true,
+  "performance": {
+    "raft_multiplier": 1
+  },
+{% endif %}
+  "retry_join": ["{{ consul_servers | join('", "') }}"]
+}
--- a/roles/consul/templates/consul.service
+++ b/roles/consul/templates/consul.service
@@ -0,0 +1,18 @@
+[Unit]
+Description="HashiCorp Consul - A service mesh solution"
+Documentation=https://www.consul.io/
+Requires=network-online.target
+After=network-online.target
+ConditionFileNotEmpty=/etc/consul/config.json
+
+[Service]
+Type=notify
+User=consul
+Group=consul
+ExecStart=/usr/local/bin/consul agent -config-file=/etc/consul/config.json
+KillMode=process
+Restart=on-failure
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target