From c36a80b5969afde3b165f4909b87ac146950f514 Mon Sep 17 00:00:00 2001
From: Daniel Berteaud <dbd@ehtrace.com>
Date: Sun, 4 Sep 2022 14:00:17 +0200
Subject: [PATCH] Update to 2022-09-04 14:00

---
 roles/consul/defaults/main.yml                | 31 ++++++++
 roles/consul/handlers/main.yml                |  5 ++
 roles/consul/meta/main.yml                    |  4 +
 roles/consul/tasks/conf.yml                   | 75 +++++++++++++++++++
 roles/consul/tasks/directories.yml            | 10 +++
 roles/consul/tasks/install.yml                |  9 ++-
 roles/consul/tasks/services.yml               |  5 ++
 roles/consul/templates/agent_cert.tpl.j2      |  9 +++
 roles/consul/templates/cli_cert.tpl.j2        |  3 +
 .../consul-template-consul.service.j2         | 17 +++++
 roles/consul/templates/consul-template.hcl.j2 | 55 ++++++++++++++
 roles/consul/templates/consul.hcl.j2          | 34 +++++++++
 roles/consul/templates/profile.sh.j2          | 12 +++
 roles/consul_template/tasks/facts.yml         |  2 +-
 roles/nomad/tasks/install.yml                 |  7 --
 roles/nomad/templates/profile.sh.j2           |  2 +-
 16 files changed, 270 insertions(+), 10 deletions(-)
 create mode 100644 roles/consul/meta/main.yml
 create mode 100644 roles/consul/templates/agent_cert.tpl.j2
 create mode 100644 roles/consul/templates/cli_cert.tpl.j2
 create mode 100644 roles/consul/templates/consul-template-consul.service.j2
 create mode 100644 roles/consul/templates/consul-template.hcl.j2
 create mode 100644 roles/consul/templates/profile.sh.j2

diff --git a/roles/consul/defaults/main.yml b/roles/consul/defaults/main.yml
index f1ed5cf..63d02e0 100644
--- a/roles/consul/defaults/main.yml
+++ b/roles/consul/defaults/main.yml
@@ -13,6 +13,10 @@ consul_user: consul
 # Root directory where consul will be installed
 consul_root_dir: /opt/consul
 
+# List of Unix group which will be consul admins
+# Used for example to grant access to cli cert with ACL
+consul_admin_groups: "{{ system_admin_groups | default([]) }}"
+
 # If ACL are enabled, you need to set a management token for ansible
 # to be able to manage Consul (eg snapshot before upgrades)
 # consul_mgm_token: XXXXXXXXX
@@ -85,10 +89,37 @@ consul_base_conf:
     # The default_policy is also used for intentions in the service mesh
     default_policy: deny
 
+  tls:
+    # No TLS will be stup unless this is set to True
+    enabled: False
+    # Default TLS settings
+    defaults:
+      ca_file: "{{ consul_root_dir }}/tls/ca.crt"
+      cert_file: "{{ consul_root_dir }}/tls/consul.crt"
+      key_file: "{{ consul_root_dir }}/tls/consul.key"
+      verify_incoming: True
+      verify_outgoing: True
+    # TLS settings for interal RPC
+    internal_rpc:
+      verify_server_hostname: True
+
 consul_extra_conf: {}
 consul_host_conf: {}
 consul_conf: "{{ consul_base_conf | combine(consul_extra_conf, recursive=True) | combine(consul_host_conf, recursive=True) }}"
 
+# To get certificates from vault
+consul_base_vault_tls:
+  enabled: False
+  # address: https://active.vault.service.consul:8200
+  # token: XXXXXX
+  pki:
+    path: /pki/consul
+    role: consul-{{ consul_conf.server | ternary('server', 'client') }}
+    ttl: 24h
+consul_extra_vault_tls: {}
+consul_host_vault_tls: {}
+consul_vault_tls: "{{ consul_base_vault_tls | combine(consul_extra_vault_tls, recursive=True) | combine(consul_host_vault_tls, recursive=True) }}"
+
 # For example
 # consul_extra_conf:
 #   datacenter: my-dc
diff --git a/roles/consul/handlers/main.yml b/roles/consul/handlers/main.yml
index 1b5d8a7..b40d996 100644
--- a/roles/consul/handlers/main.yml
+++ b/roles/consul/handlers/main.yml
@@ -6,3 +6,8 @@
 
 - name: reload consul
   service: name=consul state=reloaded
+  when: consul_service_started is not defined or not consul_service_started.changed
+
+- name: restart consul-template-consul
+  service: name=consul-template-consul state=restarted
+
diff --git a/roles/consul/meta/main.yml b/roles/consul/meta/main.yml
new file mode 100644
index 0000000..754933e
--- /dev/null
+++ b/roles/consul/meta/main.yml
@@ -0,0 +1,4 @@
+---
+
+dependencies:
+  - role: consul_template
diff --git a/roles/consul/tasks/conf.yml b/roles/consul/tasks/conf.yml
index 7fb9a2a..39e1169 100644
--- a/roles/consul/tasks/conf.yml
+++ b/roles/consul/tasks/conf.yml
@@ -1,5 +1,26 @@
 ---
 
+# Ensure certificates exists. This is needed so first consul service starts doesn't fail
+# when consul-template hasn't populated the cert yet
+- name: Generate self-signed certificate
+  import_tasks: ../includes/create_selfsigned_cert.yml
+  vars:
+    cert_path: "{{ consul_conf.tls.defaults.cert_file }}"
+    cert_key_path: "{{ consul_conf.tls.defaults.key_file }}"
+    cert_key_group: "{{ consul_user }}"
+    cert_key_mode: 640
+  tags: consul
+
+- name: Check if CA exists
+  stat: path={{ consul_conf.tls.defaults.ca_file }}
+  register: consul_ca_file
+  tags: consul
+
+- name: Copy cert as CA
+  copy: src={{ consul_conf.tls.defaults.cert_file }} dest={{ consul_conf.tls.defaults.ca_file }} remote_src=True
+  when: not consul_ca_file.stat.exists
+  tags: consul
+
 - name: Deploy consul configuration
   block:
     - name: Deploy consul configuration
@@ -72,3 +93,57 @@
   file: path={{ item }} state=absent
   loop: "{{ consul_backup_configs.stdout_lines }}"
   tags: consul
+
+- when: consul_vault_tls.enabled
+  block:
+
+    - name: Deploy consul-template config
+      template: src=consul-template.hcl.j2 dest={{ consul_root_dir }}/consul-template/consul-template.hcl
+      notify: restart consul-template-consul
+
+    - name: Deploy consul-template agent cert template
+      template: src=agent_cert.tpl.j2 dest={{ consul_root_dir }}/consul-template/{{ item.where }} owner=root group=root
+      loop:
+        - what: certificate
+          where: agent.crt.tpl
+        - what: private_key
+          where: agent.key.tpl
+        - what: issuing_ca
+          where: ca.crt.tpl
+      notify: restart consul-template-consul
+
+    - name: Check if certificate exists
+      stat: path={{ consul_conf.tls.defaults.cert_file }}
+      register: consul_tls_cert_file
+
+  tags: consul
+
+- when: consul_vault_tls.enabled and consul_conf.server
+  block:
+
+    - name: Deploy consul-template cli cert template
+      template: src=cli_cert.tpl.j2 dest={{ consul_root_dir }}/consul-template/{{ item.where }} owner=root group=root
+      loop:
+        - what: certificate
+          where: cli.crt.tpl
+        - what: private_key
+          where: cli.key.tpl
+      notify: restart consul-template-consul
+
+  tags: consul
+
+- name: Set ACL on the TLS dir
+  shell: |
+    setfacl -R -b -x {{ consul_root_dir }}/tls
+    {% if consul_admin_groups | length > 0 %}
+    setfacl -R -m {% for group in consul_admin_groups %}g:{{ group }}:rX{{ ',' if not loop.last }}{% endfor %} {{ consul_root_dir }}/tls
+    setfacl -R -m {% for group in consul_admin_groups %}d:g:{{ group }}:rX{{ ',' if not loop.last }}{% endfor %} {{ consul_root_dir }}/tls
+    {% endif %}
+  changed_when: False
+  failed_when: False # Do not fail if eg, the FS doesn't support ACL
+  tags: consul
+
+- name: Deploy profile script
+  template: src=profile.sh.j2 dest=/etc/profile.d/consul.sh
+  tags: consul
+
diff --git a/roles/consul/tasks/directories.yml b/roles/consul/tasks/directories.yml
index 0e99029..f715f7c 100644
--- a/roles/consul/tasks/directories.yml
+++ b/roles/consul/tasks/directories.yml
@@ -3,6 +3,10 @@
 - name: Create needed directories
   file: path={{ consul_root_dir }}/{{ item.dir }} state=directory owner={{ item.owner | default(omit) }} group={{ item.group | default(omit) }} mode={{ item.mode | default(omit) }}
   loop:
+    - dir: /
+      owner: root
+      group: root
+      mode: 755
     - dir: archives
       owner: root
       group: root
@@ -28,4 +32,10 @@
       owner: root
       group: "{{ consul_user }}"
       mode: 750
+    - dir: tls
+      owner: root
+      group: root
+      mode: 755
+    - dir: consul-template
+      mode: 755
   tags: consul
diff --git a/roles/consul/tasks/install.yml b/roles/consul/tasks/install.yml
index 7df808f..4a3a864 100644
--- a/roles/consul/tasks/install.yml
+++ b/roles/consul/tasks/install.yml
@@ -6,6 +6,7 @@
       - tar
       - zstd
       - unzip
+      - acl
   tags: consul
 
 - when: consul_install_mode != 'none'
@@ -48,9 +49,15 @@
   notify: restart consul
   tags: consul
 
+- name: Install consul-template unit
+  template: src=consul-template-consul.service.j2 dest=/etc/systemd/system/consul-template-consul.service
+  register: consul_template_tpl_unit
+  notify: restart consul-template-consul
+  tags: consul
+
 - name: Reload systemd
   systemd: daemon_reload=True
-  when: consul_unit.changed
+  when: consul_unit.changed or consul_template_tpl_unit.changed
   tags: consul
 
 - name: Install backup hooks
diff --git a/roles/consul/tasks/services.yml b/roles/consul/tasks/services.yml
index 679e0cb..1d2eb4c 100644
--- a/roles/consul/tasks/services.yml
+++ b/roles/consul/tasks/services.yml
@@ -4,3 +4,8 @@
   service: name=consul state=started enabled=True
   register: consul_service_started
   tags: consul
+
+- name: Handle consul-template-consul service
+  service: name=consul-template-consul state={{ consul_vault_tls.enabled | ternary('started', 'stopped') }} enabled={{ consul_vault_tls.enabled | ternary(True, False) }}
+  tags: consul
+
diff --git a/roles/consul/templates/agent_cert.tpl.j2 b/roles/consul/templates/agent_cert.tpl.j2
new file mode 100644
index 0000000..2bfe14a
--- /dev/null
+++ b/roles/consul/templates/agent_cert.tpl.j2
@@ -0,0 +1,9 @@
+{% if consul_conf.server %}
+[[ with secret "{{ consul_vault_tls.pki.path }}/issue/{{ consul_vault_tls.pki.role }}" "common_name={{ consul_conf.server | ternary('server', 'client') }}-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" "ttl={{ consul_vault_tls.pki.ttl }}" "alt_names=localhost,{{ consul_conf.server | ternary('server', 'client') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" ]]
+[[ .Data.{{ item.what }} ]]
+[[ end ]]
+{% else %}
+[[ with secret "{{ consul_vault_tls.pki.path }}/cert/ca" ]]
+[[ .Data.certificate ]]
+[[ end ]]
+{% endif %}
diff --git a/roles/consul/templates/cli_cert.tpl.j2 b/roles/consul/templates/cli_cert.tpl.j2
new file mode 100644
index 0000000..5439983
--- /dev/null
+++ b/roles/consul/templates/cli_cert.tpl.j2
@@ -0,0 +1,3 @@
+[[ with secret "{{ consul_vault_tls.pki.path }}/issue/{{ consul_vault_tls.pki.role }}" "ttl={{ consul_vault_tls.pki.ttl }}" "common_name=cli-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" ]]
+[[ .Data.{{ item.what }} ]]
+[[ end ]]
diff --git a/roles/consul/templates/consul-template-consul.service.j2 b/roles/consul/templates/consul-template-consul.service.j2
new file mode 100644
index 0000000..b70b7fd
--- /dev/null
+++ b/roles/consul/templates/consul-template-consul.service.j2
@@ -0,0 +1,17 @@
+[Unit]
+Description="HashiCorp consul-template"
+Documentation=https://github.com/hashicorp/consul-template
+Requires=network-online.target
+After=network-online.target
+ConditionFileNotEmpty={{ consul_root_dir }}/consul-template/consul-template.hcl
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/consul-template -config={{ consul_root_dir }}/consul-template/consul-template.hcl
+ExecReload=/bin/kill --signal HUP $MAINPID
+KillSignal=SIGINT
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/consul/templates/consul-template.hcl.j2 b/roles/consul/templates/consul-template.hcl.j2
new file mode 100644
index 0000000..176336a
--- /dev/null
+++ b/roles/consul/templates/consul-template.hcl.j2
@@ -0,0 +1,55 @@
+vault {
+  address      = "{{ consul_vault_tls.address }}"
+  token        = "{{ consul_vault_tls.token }}"
+  unwrap_token = false
+}
+
+template {
+  source          = "{{ consul_root_dir }}/consul-template/ca.crt.tpl"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  destination     = "{{ consul_conf.tls.defaults.ca_file }}"
+  perms           = 0644
+  exec {
+    command = "systemctl reload consul"
+  }
+}
+
+{% if consul_conf.server %}
+template {
+  source          = "{{ consul_root_dir }}/consul-template/agent.crt.tpl"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  destination     = "{{ consul_conf.tls.defaults.cert_file }}"
+  perms           = 0644
+  exec {
+    command = "systemctl reload consul"
+  }
+}
+
+template {
+  source          = "{{ consul_root_dir }}/consul-template/agent.key.tpl"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  destination     = "{{ consul_conf.tls.defaults.key_file }}"
+  perms           = 0640
+  exec {
+    command = ["sh", "-c", "chgrp {{ consul_user }} {{ consul_conf.tls.defaults.key_file }} && systemctl reload consul"]
+  }
+}
+
+template {
+  source          = "{{ consul_root_dir }}/consul-template/cli.crt.tpl"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  destination     = "{{ consul_root_dir }}/tls/cli.crt"
+}
+
+template {
+  source          = "{{ consul_root_dir }}/consul-template/cli.key.tpl"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  destination     = "{{ consul_root_dir }}/tls/cli.key"
+  perms           = 0640
+}
+{% endif %}
diff --git a/roles/consul/templates/consul.hcl.j2 b/roles/consul/templates/consul.hcl.j2
index e6688c0..c547c3f 100644
--- a/roles/consul/templates/consul.hcl.j2
+++ b/roles/consul/templates/consul.hcl.j2
@@ -76,3 +76,37 @@ acl {
   enabled = {{ consul_conf.acl.enabled | ternary('true', 'false') }}
   default_policy = "{{ consul_conf.acl.default_policy }}"
 }
+
+{% if consul_conf.tls.enabled %}
+# TLS settings
+tls {
+{% for section in ['defaults', 'grpc', 'https', 'internal_rpc'] %}
+{% if consul_conf.tls[section] is defined %}
+  {{ section }} {
+{% for key in ['ca_file', 'ca_path', 'cert_file', 'key_file', 'tls_min_version', 'tls_cipher_suites'] %}
+{% if consul_conf.tls[section][key] is defined %}
+    {{ key }} = "{{ consul_conf.tls[section][key] }}"
+{% endif %}
+{% endfor %}
+{% for key in ['verify_incoming', 'verify_outgoing', 'verify_server_hostname'] %}
+{% if consul_conf.tls[section][key] is defined %}
+    {{ key }} = {{ consul_conf.tls[section][key] | ternary('true', 'false') }}
+{% endif %}
+{% endfor %}
+  }
+{% endif %}
+{% endfor %}
+}
+
+# auto_encrypt, to distribute certificates from servers to clients
+{% if consul_conf.server %}
+auto_encrypt {
+  allow_tls = true
+}
+{% else %}
+auto_encrypt {
+  tls = true
+}
+{% endif %}
+
+{% endif %}
diff --git a/roles/consul/templates/profile.sh.j2 b/roles/consul/templates/profile.sh.j2
new file mode 100644
index 0000000..b45216b
--- /dev/null
+++ b/roles/consul/templates/profile.sh.j2
@@ -0,0 +1,12 @@
+{% if consul_conf.tls.enabled and consul_conf.server %}
+export CONSUL_HTTP_ADDR=https://localhost:{{ consul_services.https.port }}
+export CONSUL_HTTP_SSL=true
+export CONSUL_CACERT={{ consul_conf.tls.defaults.ca_file }}
+{% if consul_vault_tls.enabled %}
+export CONSUL_CLIENT_CERT={{ consul_root_dir }}/tls/cli.crt
+export CONSUL_CLIENT_KEY={{ consul_root_dir }}/tls/cli.key
+export CONSUL_TLS_SERVER_NAME=server.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}
+{% endif %}
+{% else %}
+# TLS not enabled or not running in server mode
+{% endif %}
diff --git a/roles/consul_template/tasks/facts.yml b/roles/consul_template/tasks/facts.yml
index e553259..b32e464 100644
--- a/roles/consul_template/tasks/facts.yml
+++ b/roles/consul_template/tasks/facts.yml
@@ -13,7 +13,7 @@
   tags: consul,vault
 
 - name: Detect if consul_tpl is installed
-  stat: path=/usr/local/bin/consul_tpl
+  stat: path=/usr/local/bin/consul-template
   register: consul_tpl_bin
   tags: consul,vault
 
diff --git a/roles/nomad/tasks/install.yml b/roles/nomad/tasks/install.yml
index 105d6b0..35696a9 100644
--- a/roles/nomad/tasks/install.yml
+++ b/roles/nomad/tasks/install.yml
@@ -109,13 +109,6 @@
   notify: restart nomad
   tags: nomad
 
-- name: Install backup hooks
-  template: src={{ item }}-backup.j2 dest=/etc/backup/{{ item }}.d/nomad mode=755
-  loop:
-    - pre
-    - post
-  tags: nomad
-
 - name: Install consul-template unit
   template: src=consul-template-nomad.service.j2 dest=/etc/systemd/system/consul-template-nomad.service
   register: nomad_consul_tpl_unit
diff --git a/roles/nomad/templates/profile.sh.j2 b/roles/nomad/templates/profile.sh.j2
index 1a135bb..84ef228 100644
--- a/roles/nomad/templates/profile.sh.j2
+++ b/roles/nomad/templates/profile.sh.j2
@@ -4,7 +4,7 @@ export NOMAD_CACERT={{ nomad_conf.tls.ca_file }}
 {% if nomad_vault_tls.enabled %}
 export NOMAD_CLIENT_CERT={{ nomad_root_dir }}/tls/cli.crt
 export NOMAD_CLIENT_KEY={{ nomad_root_dir }}/tls/cli.key
-export NOMAD_TLS_SERVER_NAME=server.{{ nomad_conf.region }}.nomad
+export NOMAD_TLS_SERVER_NAME=server.{{ nomad_conf.region | default('global') }}.nomad
 {% endif %}
 {% else %}
 # TLS not enabled or not running in server mode