consul: long list of todos

[noahehall]

• stay away from envconsul @see Is envconsul no longer a priority? hashicorp/envconsul#322
• https://developer.hashicorp.com/consul/tutorials/vault-secure/vault-consul-secrets

---

• using the same token for service & sidecar proxy

Security Note: Explicitly allowing intentions:write on the token you provide to a service instance at registration time opens up a significant additional vulnerability. Although you may trust the service team to define which inbound connections they accept, using a combined token for registration allows a compromised instance to to redefine the intentions which allows many additional attack vectors and may be hard to detect. We strongly recommend only delegating intentions:write using tokens that are used by operations teams or orchestrators rather than spread via application config, or only manage intentions with management tokens.

---

• complete integration with consul-template
  • this has been baked into ubuntu and alpine images

---

• run through all default config types

---

• dns alt domain

# works
dig server.us-east.mesh.nirv.ai
dig server.us-east.search

# doesnt works: 
dig @127.0.0.1 -p 8600 consul.service.search SRV
dig @127.0.0.1 -p 8600 consul.service.mesh.nirv.ai SRV

; <<>> DiG 9.18.1-1ubuntu1.2-Ubuntu <<>> @127.0.0.1 -p 8600 consul.service.mesh.nirv.ai SRV
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

---

pretty sure haproxy is calling consul DNS instead of the local envoy proxy to figure out vaults uri
we need to point haproxy to the local envoy sidecar and not to consul dns

---

## todo
# consul kv put consul/configuration/db_port 5432
# consul kv get consul/configuration/db_port
# dig @127.0.0.1 -p 8600 consul.service.consul
# consul catalog services -tags
# consul services register svc-db.hcl
# curl 172.17.0.1:8500/v1/status/leader  #get the leader
# consul cmd cmd cmd --help has wonderful examples, thank me later
# curl --request GET http://127.0.0.1:8500/v1/agent/checks

---

# this only works if the consul server is bootstrapped
# doesnt work if your trying to bootstrap a greenfield server
 healthcheck:
       <<: *service-healthcheck
       test: consul catalog nodes | grep $CONSUL_NODE_PREFIX || exit $?