infra/ansible/roles/consul/templates/consul.hcl.j2

datacenter          = "{{ main_dc_name }}"
primary_datacenter  = "{{ main_dc_name }}"
domain              = "{{ consul_domain }}"
node_name           = "{{ inventory_hostname_short }}"

encrypt             = "{{ lookup('hashi_vault', 'secret=kv/data/consul:data ca_cert=/etc/pki/certs/MaskedName_Root_CA.crt')['gossip'] }}"

verify_incoming         = false
verify_outgoing         = true
verify_server_hostname  = true
ca_file                 = "/etc/pki/certs/{{ vault_ca_cert_name }}"

auto_encrypt {
  tls   = true
}

bind_addr           = "{{ ansible_default_ipv4.address }}"
start_join          = ["{{ groups['consul_server'] | map('extract', hostvars, ['ansible_default_ipv4', 'address']) | join('","') }}"]

data_dir            = "/opt/consul"
log_level           = "INFO"
raft_protocol       = 3

addresses {
 http = "0.0.0.0"
}

enable_local_script_checks = true

acl {
  enabled = true
  default_policy = "deny"
  enable_token_persistence = true
  tokens {
    default = "{{ lookup('hashi_vault', 'secret=kv/data/consul:data ca_cert=/etc/pki/certs/MaskedName_Root_CA.crt')['server-acl-token'] }}"
  }
}