itamae/cookbooks/consul/setup.rb

137 lines
2.9 KiB
Ruby
Raw Normal View History

# Create directories
%w( certs howto misc policies tokens ).each do |d|
directory "/etc/consul.d/#{d}" do
owner 'consul'
group 'consul'
mode '0755'
end
end
# deploy certificates
if node['consul']['manager']
2024-02-11 09:55:25 +00:00
encrypted_remote_file '/etc/consul.d/certs/consul-agent-ca-key.pem' do
owner 'consul'
group 'consul'
mode '0444'
source 'files/etc/consul.d/certs/consul-agent-ca-key.pem'
password ENV['ITAMAE_PASSWORD']
end
encrypted_remote_file '/etc/consul.d/certs/dc1-server-consul-1-key.pem' do
owner 'consul'
group 'consul'
mode '0444'
2024-02-11 09:55:25 +00:00
source 'files/etc/consul.d/certs/dc1-server-consul-1-key.pem'
password ENV['ITAMAE_PASSWORD']
end
2024-02-11 09:55:25 +00:00
encrypted_remote_file '/etc/consul.d/certs/dc1-server-consul-1.pem' do
owner 'consul'
group 'consul'
mode '0444'
source 'files/etc/consul.d/certs/dc1-server-consul-1.pem'
password ENV['ITAMAE_PASSWORD']
end
end
encrypted_remote_file '/etc/consul.d/certs/consul-agent-ca.pem' do
owner 'consul'
group 'consul'
mode '0444'
source 'files/etc/consul.d/certs/consul-agent-ca.pem'
password ENV['ITAMAE_PASSWORD']
end
2024-02-11 09:55:25 +00:00
# Deploy configs
2020-11-22 08:25:09 +00:00
if node['consul']['manager']
SRC = 'consul-server.hcl.erb'
else
SRC = 'consul-agent.hcl.erb'
end
template '/etc/consul.d/consul.hcl' do
2020-11-22 07:00:00 +00:00
owner 'consul'
group 'consul'
2019-03-03 08:50:49 +00:00
mode '644'
variables(manager: node['consul']['manager'],
manager_hosts: node['consul']['manager_hosts'],
ipaddr: node['consul']['ipaddr'],
encrypt: node['consul']['encrypt'],
token: node['consul']['token'],
2019-03-03 08:50:49 +00:00
)
2020-11-22 08:25:09 +00:00
source "templates/etc/consul.d/#{SRC}"
notifies :restart, 'service[consul]'
2019-03-03 08:50:49 +00:00
end
2024-02-11 09:55:25 +00:00
# Deploy server specific config
if node['consul']['manager']
template '/etc/consul.d/server.hcl' do
owner 'consul'
group 'consul'
mode '644'
2024-02-11 09:55:25 +00:00
variables(server_token: node['consul']['server_token'])
2024-02-11 09:55:25 +00:00
notifies :restart, 'service[consul]'
end
2024-02-11 09:55:25 +00:00
end
%w( 01-bootstrap.sh 02-policy.sh ).each do |sh|
remote_file("/etc/consul.d/howto/#{sh}") {
owner 'root'
group 'root'
mode '0755'
}
end
%w( anonymous nodes nomad-policy vault-service-registration ).each do |policy|
remote_file("/etc/consul.d/policies/#{policy}.hcl") {
owner 'root'
group 'root'
mode '0644'
}
end
# misc
2020-11-22 14:26:05 +00:00
directory '/var/log/consul/' do
owner 'consul'
group 'consul'
mode '0755'
end
remote_file '/etc/systemd/system/consul.service' do
owner 'root'
group 'root'
mode '0644'
notifies :restart, 'service[consul]'
end
2019-03-03 08:50:49 +00:00
remote_file '/etc/consul.d/service-consul.json' do
2020-11-22 07:00:00 +00:00
owner 'consul'
group 'consul'
2019-03-03 08:50:49 +00:00
mode '644'
end
service 'consul' do
action [:enable, :start]
end
2019-03-03 08:50:49 +00:00
# iptables settings here:
%w( 8300/tcp 8301/tcp 8301/udp 8500/tcp 8502/tcp ).each do |port|
2019-03-03 08:50:49 +00:00
execute "ufw allow #{port}" do
user 'root'
not_if "LANG=c ufw status | grep #{port}"
notifies :run, 'execute[ufw reload-or-enable]'
end
end