Update to 2022-09-04 14:00

roles/consul/templates/agent_cert.tpl.j2

@@ -0,0 +1,9 @@
+{% if consul_conf.server %}
+[[ with secret "{{ consul_vault_tls.pki.path }}/issue/{{ consul_vault_tls.pki.role }}" "common_name={{ consul_conf.server | ternary('server', 'client') }}-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" "ttl={{ consul_vault_tls.pki.ttl }}" "alt_names=localhost,{{ consul_conf.server | ternary('server', 'client') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" ]]
+[[ .Data.{{ item.what }} ]]
+[[ end ]]
+{% else %}
+[[ with secret "{{ consul_vault_tls.pki.path }}/cert/ca" ]]
+[[ .Data.certificate ]]
+[[ end ]]
+{% endif %}

roles/consul/templates/cli_cert.tpl.j2

@@ -0,0 +1,3 @@
+[[ with secret "{{ consul_vault_tls.pki.path }}/issue/{{ consul_vault_tls.pki.role }}" "ttl={{ consul_vault_tls.pki.ttl }}" "common_name=cli-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" ]]
+[[ .Data.{{ item.what }} ]]
+[[ end ]]

roles/consul/templates/consul-template-consul.service.j2

@@ -0,0 +1,17 @@
+[Unit]
+Description="HashiCorp consul-template"
+Documentation=https://github.com/hashicorp/consul-template
+Requires=network-online.target
+After=network-online.target
+ConditionFileNotEmpty={{ consul_root_dir }}/consul-template/consul-template.hcl
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/consul-template -config={{ consul_root_dir }}/consul-template/consul-template.hcl
+ExecReload=/bin/kill --signal HUP $MAINPID
+KillSignal=SIGINT
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=multi-user.target

roles/consul/templates/consul-template.hcl.j2

@@ -0,0 +1,55 @@
+vault {
+  address      = "{{ consul_vault_tls.address }}"
+  token        = "{{ consul_vault_tls.token }}"
+  unwrap_token = false
+}
+
+template {
+  source          = "{{ consul_root_dir }}/consul-template/ca.crt.tpl"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  destination     = "{{ consul_conf.tls.defaults.ca_file }}"
+  perms           = 0644
+  exec {
+    command = "systemctl reload consul"
+  }
+}
+
+{% if consul_conf.server %}
+template {
+  source          = "{{ consul_root_dir }}/consul-template/agent.crt.tpl"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  destination     = "{{ consul_conf.tls.defaults.cert_file }}"
+  perms           = 0644
+  exec {
+    command = "systemctl reload consul"
+  }
+}
+
+template {
+  source          = "{{ consul_root_dir }}/consul-template/agent.key.tpl"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  destination     = "{{ consul_conf.tls.defaults.key_file }}"
+  perms           = 0640
+  exec {
+    command = ["sh", "-c", "chgrp {{ consul_user }} {{ consul_conf.tls.defaults.key_file }} && systemctl reload consul"]
+  }
+}
+
+template {
+  source          = "{{ consul_root_dir }}/consul-template/cli.crt.tpl"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  destination     = "{{ consul_root_dir }}/tls/cli.crt"
+}
+
+template {
+  source          = "{{ consul_root_dir }}/consul-template/cli.key.tpl"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  destination     = "{{ consul_root_dir }}/tls/cli.key"
+  perms           = 0640
+}
+{% endif %}

roles/consul/templates/consul.hcl.j2

@@ -76,3 +76,37 @@ acl {
   enabled = {{ consul_conf.acl.enabled | ternary('true', 'false') }}
   default_policy = "{{ consul_conf.acl.default_policy }}"
 }
+
+{% if consul_conf.tls.enabled %}
+# TLS settings
+tls {
+{% for section in ['defaults', 'grpc', 'https', 'internal_rpc'] %}
+{% if consul_conf.tls[section] is defined %}
+  {{ section }} {
+{% for key in ['ca_file', 'ca_path', 'cert_file', 'key_file', 'tls_min_version', 'tls_cipher_suites'] %}
+{% if consul_conf.tls[section][key] is defined %}
+    {{ key }} = "{{ consul_conf.tls[section][key] }}"
+{% endif %}
+{% endfor %}
+{% for key in ['verify_incoming', 'verify_outgoing', 'verify_server_hostname'] %}
+{% if consul_conf.tls[section][key] is defined %}
+    {{ key }} = {{ consul_conf.tls[section][key] | ternary('true', 'false') }}
+{% endif %}
+{% endfor %}
+  }
+{% endif %}
+{% endfor %}
+}
+
+# auto_encrypt, to distribute certificates from servers to clients
+{% if consul_conf.server %}
+auto_encrypt {
+  allow_tls = true
+}
+{% else %}
+auto_encrypt {
+  tls = true
+}
+{% endif %}
+
+{% endif %}

roles/consul/templates/profile.sh.j2

@@ -0,0 +1,12 @@
+{% if consul_conf.tls.enabled and consul_conf.server %}
+export CONSUL_HTTP_ADDR=https://localhost:{{ consul_services.https.port }}
+export CONSUL_HTTP_SSL=true
+export CONSUL_CACERT={{ consul_conf.tls.defaults.ca_file }}
+{% if consul_vault_tls.enabled %}
+export CONSUL_CLIENT_CERT={{ consul_root_dir }}/tls/cli.crt
+export CONSUL_CLIENT_KEY={{ consul_root_dir }}/tls/cli.key
+export CONSUL_TLS_SERVER_NAME=server.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}
+{% endif %}
+{% else %}
+# TLS not enabled or not running in server mode
+{% endif %}