Consul Single Server, Five Listeners On Loopback

consul-server

HashiCorp Consul as a single-node server from the upstream release (sha256-verified), as a hardened system service with every listener (HTTP, DNS, RPC, serf) on loopback and its configuration checked by consul validate before it lands. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, so the checksum is the whole story. EL 10 carries no consul; HashiCorp ships a release with a checksum file beside it. The role downloads both and has Ansible's get_url refuse the asset unless its SHA-256 is the one in the vendor's file, then installs the binaries as root's in /usr/local/bin, pinned by consul_server_version.

A service account, a hardened unit, a loopback listener. consul is a system user with no shell that owns the data directory and nothing else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict. The listener is 127.0.0.1:8500 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

Five listeners, all on loopback. A Consul server opens HTTP (8500), DNS (8600), RPC (8300) and two serf ports (8301, 8302); bind_addr and client_addr both on 127.0.0.1 keep every one off the network, and the live test reads the sockets and expects exactly that. A datacenter is retry_join plus TLS and ACLs in consul_server_extra_config, checked by the same consul validate.

A key, written and read. The live test waits for the single node to elect itself leader, writes a key through the HTTP API, reads it back raw, deletes it, and reads consul members as one alive server. ACLs are off by default (upstream's default too); enabling them is the first thing to do on a network.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.