1+ #! /usr/bin/bash
2+
3+ if [[ " $DEBUG " == " 1"
4+ then
5+ set -euxo pipefail
6+ else
7+ set -euo pipefail
8+ fi
9+
10+ sudo apt-get -y install consul
11+
12+ sudo tee /etc/sysctl.d/20-bridge-iptables.conf << EOF
13+ net.bridge.bridge-nf-call-arptables = 1
14+ net.bridge.bridge-nf-call-iptables = 1
15+ EOF
16+
17+ sudo sysctl net.bridge.bridge-nf-call-arptables=1
18+ sudo sysctl net.bridge.bridge-nf-call-iptables=1
19+
20+ cd ~ /src
21+ go install github.com/containernetworking/cni/cnitool@latest
22+ curl -L -o cni-plugins.tgz " https://github.com/containernetworking/plugins/releases/download/v1.0.0/cni-plugins-linux-$( [ $( uname -m) = aarch64 ] && echo arm64 || echo amd64) "
23+ sudo mkdir -p /opt/cni/bin
24+ sudo tar -C /opt/cni/bin -xzf cni-plugins.tgz
25+
26+ sudo tee /etc/consul.d/consul.hcl << EOF
27+ # Full configuration options can be found at https://www.consul.io/docs/agent/config
28+
29+ # datacenter
30+ # This flag controls the datacenter in which the agent is running. If not provided,
31+ # it defaults to "dc1". Consul has first-class support for multiple datacenters, but
32+ # it relies on proper configuration. Nodes in the same datacenter should be on a
33+ # single LAN.
34+ datacenter = "dc1"
35+
36+ # data_dir
37+ # This flag provides a data directory for the agent to store state. This is required
38+ # for all agents. The directory should be durable across reboots. This is especially
39+ # critical for agents that are running in server mode as they must be able to persist
40+ # cluster state. Additionally, the directory must support the use of filesystem
41+ # locking, meaning some types of mounted folders (e.g. VirtualBox shared folders) may
42+ # not be suitable.
43+ data_dir = "/opt/consul"
44+
45+ # client_addr
46+ # The address to which Consul will bind client interfaces, including the HTTP and DNS
47+ # servers. By default, this is "127.0.0.1", allowing only loopback connections. In
48+ # Consul 1.0 and later this can be set to a space-separated list of addresses to bind
49+ # to, or a go-sockaddr template that can potentially resolve to multiple addresses.
50+ client_addr = "127.0.0.1"
51+
52+ # ui
53+ # Enables the built-in web UI server and the required HTTP routes. This eliminates
54+ # the need to maintain the Consul web UI files separately from the binary.
55+ # Version 1.10 deprecated ui=true in favor of ui_config.enabled=true
56+ ui_config{
57+ enabled = false
58+ }
59+
60+ # server
61+ # This flag is used to control if an agent is in server or client mode. When provided,
62+ # an agent will act as a Consul server. Each Consul cluster must have at least one
63+ # server and ideally no more than 5 per datacenter. All servers participate in the Raft
64+ # consensus algorithm to ensure that transactions occur in a consistent, linearizable
65+ # manner. Transactions modify cluster state, which is maintained on all server nodes to
66+ # ensure availability in the case of node failure. Server nodes also participate in a
67+ # WAN gossip pool with server nodes in other datacenters. Servers act as gateways to
68+ # other datacenters and forward traffic as appropriate.
69+ server = true
70+
71+ # Bind addr
72+ # You may use IPv4 or IPv6 but if you have multiple interfaces you must be explicit.
73+ #bind_addr = "[::]" # Listen on all IPv6
74+ #bind_addr = "0.0.0.0" # Listen on all IPv4
75+ bind_addr = "127.0.0.1"
76+ #
77+ # Advertise addr - if you want to point clients to a different address than bind or LB.
78+ advertise_addr = "127.0.0.1"
79+
80+ # Enterprise License
81+ # As of 1.10, Enterprise requires a license_path and does not have a short trial.
82+ #license_path = "/etc/consul.d/consul.hclic"
83+
84+ # bootstrap_expect
85+ # This flag provides the number of expected servers in the datacenter. Either this value
86+ # should not be provided or the value must agree with other servers in the cluster. When
87+ # provided, Consul waits until the specified number of servers are available and then
88+ # bootstraps the cluster. This allows an initial leader to be elected automatically.
89+ # This cannot be used in conjunction with the legacy -bootstrap flag. This flag requires
90+ # -server mode.
91+ #bootstrap_expect=1
92+
93+ # encrypt
94+ # Specifies the secret key to use for encryption of Consul network traffic. This key must
95+ # be 32-bytes that are Base64-encoded. The easiest way to create an encryption key is to
96+ # use consul keygen. All nodes within a cluster must share the same encryption key to
97+ # communicate. The provided key is automatically persisted to the data directory and loaded
98+ # automatically whenever the agent is restarted. This means that to encrypt Consul's gossip
99+ # protocol, this option only needs to be provided once on each agent's initial startup
100+ # sequence. If it is provided after Consul has been initialized with an encryption key,
101+ # then the provided key is ignored and a warning will be displayed.
102+ #encrypt = "..."
103+
104+ # retry_join
105+ # Similar to -join but allows retrying a join until it is successful. Once it joins
106+ # successfully to a member in a list of members it will never attempt to join again.
107+ # Agents will then solely maintain their membership via gossip. This is useful for
108+ # cases where you know the address will eventually be available. This option can be
109+ # specified multiple times to specify multiple agents to join. The value can contain
110+ # IPv4, IPv6, or DNS addresses. In Consul 1.1.0 and later this can be set to a go-sockaddr
111+ # template. If Consul is running on the non-default Serf LAN port, this must be specified
112+ # as well. IPv6 must use the "bracketed" syntax. If multiple values are given, they are
113+ # tried and retried in the order listed until the first succeeds. Here are some examples:
114+ #retry_join = ["consul.domain.internal"]
115+ #retry_join = ["10.0.4.67"]
116+ #retry_join = ["[::1]:8301"]
117+ #retry_join = ["consul.domain.internal", "10.0.4.67"]
118+ # Cloud Auto-join examples:
119+ # More details - https://www.consul.io/docs/agent/cloud-auto-join
120+ #retry_join = ["provider=aws tag_key=... tag_value=..."]
121+ #retry_join = ["provider=azure tag_name=... tag_value=... tenant_id=... client_id=... subscription_id=... secret_access_key=..."]
122+ #retry_join = ["provider=gce project_name=... tag_value=..."]
123+
124+ ports {
125+ grpc = 8502
126+ }
127+
128+ connect {
129+ enabled = true
130+ }
131+ EOF
132+
133+ sudo tee /etc/consul.d/consul-acl.hcl << EOF
134+ acl {
135+ enabled = true
136+ default_policy = "deny"
137+ down_policy = "extend-cache"
138+ tokens {
139+ agent = "AGENT_TOKEN"
140+ }
141+ }
142+ EOF
0 commit comments