Update to 2022-09-04 14:00

roles/consul/tasks/conf.yml

@@ -1,5 +1,26 @@
 ---
 
+# Ensure certificates exists. This is needed so first consul service starts doesn't fail
+# when consul-template hasn't populated the cert yet
+- name: Generate self-signed certificate
+  import_tasks: ../includes/create_selfsigned_cert.yml
+  vars:
+    cert_path: "{{ consul_conf.tls.defaults.cert_file }}"
+    cert_key_path: "{{ consul_conf.tls.defaults.key_file }}"
+    cert_key_group: "{{ consul_user }}"
+    cert_key_mode: 640
+  tags: consul
+
+- name: Check if CA exists
+  stat: path={{ consul_conf.tls.defaults.ca_file }}
+  register: consul_ca_file
+  tags: consul
+
+- name: Copy cert as CA
+  copy: src={{ consul_conf.tls.defaults.cert_file }} dest={{ consul_conf.tls.defaults.ca_file }} remote_src=True
+  when: not consul_ca_file.stat.exists
+  tags: consul
+
 - name: Deploy consul configuration
   block:
     - name: Deploy consul configuration
@@ -72,3 +93,57 @@
   file: path={{ item }} state=absent
   loop: "{{ consul_backup_configs.stdout_lines }}"
   tags: consul
+
+- when: consul_vault_tls.enabled
+  block:
+
+    - name: Deploy consul-template config
+      template: src=consul-template.hcl.j2 dest={{ consul_root_dir }}/consul-template/consul-template.hcl
+      notify: restart consul-template-consul
+
+    - name: Deploy consul-template agent cert template
+      template: src=agent_cert.tpl.j2 dest={{ consul_root_dir }}/consul-template/{{ item.where }} owner=root group=root
+      loop:
+        - what: certificate
+          where: agent.crt.tpl
+        - what: private_key
+          where: agent.key.tpl
+        - what: issuing_ca
+          where: ca.crt.tpl
+      notify: restart consul-template-consul
+
+    - name: Check if certificate exists
+      stat: path={{ consul_conf.tls.defaults.cert_file }}
+      register: consul_tls_cert_file
+
+  tags: consul
+
+- when: consul_vault_tls.enabled and consul_conf.server
+  block:
+
+    - name: Deploy consul-template cli cert template
+      template: src=cli_cert.tpl.j2 dest={{ consul_root_dir }}/consul-template/{{ item.where }} owner=root group=root
+      loop:
+        - what: certificate
+          where: cli.crt.tpl
+        - what: private_key
+          where: cli.key.tpl
+      notify: restart consul-template-consul
+
+  tags: consul
+
+- name: Set ACL on the TLS dir
+  shell: |
+    setfacl -R -b -x {{ consul_root_dir }}/tls
+    {% if consul_admin_groups | length > 0 %}
+    setfacl -R -m {% for group in consul_admin_groups %}g:{{ group }}:rX{{ ',' if not loop.last }}{% endfor %} {{ consul_root_dir }}/tls
+    setfacl -R -m {% for group in consul_admin_groups %}d:g:{{ group }}:rX{{ ',' if not loop.last }}{% endfor %} {{ consul_root_dir }}/tls
+    {% endif %}
+  changed_when: False
+  failed_when: False # Do not fail if eg, the FS doesn't support ACL
+  tags: consul
+
+- name: Deploy profile script
+  template: src=profile.sh.j2 dest=/etc/profile.d/consul.sh
+  tags: consul
+

roles/consul/tasks/directories.yml

@@ -3,6 +3,10 @@
 - name: Create needed directories
   file: path={{ consul_root_dir }}/{{ item.dir }} state=directory owner={{ item.owner | default(omit) }} group={{ item.group | default(omit) }} mode={{ item.mode | default(omit) }}
   loop:
+    - dir: /
+      owner: root
+      group: root
+      mode: 755
     - dir: archives
       owner: root
       group: root
@@ -28,4 +32,10 @@
       owner: root
       group: "{{ consul_user }}"
       mode: 750
+    - dir: tls
+      owner: root
+      group: root
+      mode: 755
+    - dir: consul-template
+      mode: 755
   tags: consul

roles/consul/tasks/install.yml

@@ -6,6 +6,7 @@
       - tar
       - zstd
       - unzip
+      - acl
   tags: consul
 
 - when: consul_install_mode != 'none'
@@ -48,9 +49,15 @@
   notify: restart consul
   tags: consul
 
+- name: Install consul-template unit
+  template: src=consul-template-consul.service.j2 dest=/etc/systemd/system/consul-template-consul.service
+  register: consul_template_tpl_unit
+  notify: restart consul-template-consul
+  tags: consul
+
 - name: Reload systemd
   systemd: daemon_reload=True
-  when: consul_unit.changed
+  when: consul_unit.changed or consul_template_tpl_unit.changed
   tags: consul
 
 - name: Install backup hooks

roles/consul/tasks/services.yml

@@ -4,3 +4,8 @@
   service: name=consul state=started enabled=True
   register: consul_service_started
   tags: consul
+
+- name: Handle consul-template-consul service
+  service: name=consul-template-consul state={{ consul_vault_tls.enabled | ternary('started', 'stopped') }} enabled={{ consul_vault_tls.enabled | ternary(True, False) }}
+  tags: consul
+