Configure advanced Consul ACL policies for production security hardening

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Script variables
SCRIPT_NAME=$(basename "$0")
CONSUL_DATA_DIR="/opt/consul"
CONSUL_CONFIG_DIR="/etc/consul.d"
CONSUL_CERT_DIR="/etc/consul.d/certs"
CONSUL_USER="consul"
DC_NAME="dc1"
NODE_NAME="consul-server-1"
BIND_ADDR=""
ENCRYPTION_KEY=""
BOOTSTRAP_TOKEN=""
TOTAL_STEPS=8

# Function to print colored output
print_status() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Usage function
usage() {
    cat << EOF
Usage: $SCRIPT_NAME [OPTIONS]

Configure Consul with advanced ACL policies for production security.

Options:
    -b, --bind-addr ADDR    Bind address for Consul (required)
    -n, --node-name NAME    Node name (default: consul-server-1)
    -d, --datacenter DC     Datacenter name (default: dc1)
    -h, --help             Show this help message

Example:
    $SCRIPT_NAME --bind-addr 10.0.1.10
EOF
}

# Parse command line arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        -b|--bind-addr)
            BIND_ADDR="$2"
            shift 2
            ;;
        -n|--node-name)
            NODE_NAME="$2"
            shift 2
            ;;
        -d|--datacenter)
            DC_NAME="$2"
            shift 2
            ;;
        -h|--help)
            usage
            exit 0
            ;;
        *)
            print_error "Unknown option: $1"
            usage
            exit 1
            ;;
    esac
done

# Validate required arguments
if [[ -z "$BIND_ADDR" ]]; then
    print_error "Bind address is required"
    usage
    exit 1
fi

# Cleanup function for rollback
cleanup() {
    print_error "Installation failed. Cleaning up..."
    systemctl stop consul 2>/dev/null || true
    systemctl disable consul 2>/dev/null || true
    userdel -r consul 2>/dev/null || true
    rm -rf $CONSUL_DATA_DIR $CONSUL_CONFIG_DIR 2>/dev/null || true
}

trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    print_error "This script must be run as root"
    exit 1
fi

# Detect distribution and set package manager
if [[ -f /etc/os-release ]]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update"
            PKG_INSTALL="apt install -y"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf makecache"
            PKG_INSTALL="dnf install -y"
            # Use yum for older CentOS versions
            if ! command -v dnf &> /dev/null; then
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum makecache fast"
            fi
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum makecache fast"
            PKG_INSTALL="yum install -y"
            ;;
        *)
            print_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    print_error "Cannot detect distribution"
    exit 1
fi

print_status "Detected distribution: $PRETTY_NAME"
print_status "Using package manager: $PKG_MGR"

# Step 1: Install prerequisites and Consul
echo -e "${GREEN}[1/$TOTAL_STEPS]${NC} Installing Consul..."

if [[ "$PKG_MGR" == "apt" ]]; then
    curl -fsSL https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
    echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/hashicorp.list
    $PKG_UPDATE
    $PKG_INSTALL consul
else
    $PKG_INSTALL dnf-plugins-core 2>/dev/null || true
    if command -v dnf &> /dev/null; then
        dnf config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
    else
        yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
    fi
    $PKG_INSTALL consul
fi

# Step 2: Create consul user and directories
echo -e "${GREEN}[2/$TOTAL_STEPS]${NC} Creating consul user and directories..."

if ! id "$CONSUL_USER" &>/dev/null; then
    useradd --system --home $CONSUL_CONFIG_DIR --shell /bin/false $CONSUL_USER
fi

mkdir -p $CONSUL_DATA_DIR $CONSUL_CONFIG_DIR $CONSUL_CERT_DIR
chown $CONSUL_USER:$CONSUL_USER $CONSUL_DATA_DIR $CONSUL_CONFIG_DIR $CONSUL_CERT_DIR
chmod 755 $CONSUL_DATA_DIR $CONSUL_CONFIG_DIR
chmod 750 $CONSUL_CERT_DIR

# Step 3: Generate encryption key
echo -e "${GREEN}[3/$TOTAL_STEPS]${NC} Generating encryption key..."

ENCRYPTION_KEY=$(consul keygen)
print_status "Generated encryption key: ${ENCRYPTION_KEY:0:8}..."

# Step 4: Generate TLS certificates
echo -e "${GREEN}[4/$TOTAL_STEPS]${NC} Generating TLS certificates..."

cd $CONSUL_CERT_DIR
consul tls ca create
consul tls cert create -server -dc $DC_NAME

chown -R $CONSUL_USER:$CONSUL_USER $CONSUL_CERT_DIR
chmod 600 $CONSUL_CERT_DIR/*.key
chmod 644 $CONSUL_CERT_DIR/*.pem

# Step 5: Create Consul configuration
echo -e "${GREEN}[5/$TOTAL_STEPS]${NC} Creating Consul configuration..."

cat > $CONSUL_CONFIG_DIR/consul.hcl << EOF
datacenter = "$DC_NAME"
data_dir = "$CONSUL_DATA_DIR"
log_level = "INFO"
node_name = "$NODE_NAME"
bind_addr = "$BIND_ADDR"
client_addr = "0.0.0.0"

# Server configuration
server = true
bootstrap_expect = 1

# UI configuration
ui_config {
  enabled = true
}

# ACL configuration
acl = {
  enabled = true
  default_policy = "deny"
  enable_token_persistence = true
  tokens = {
    initial_management = "BOOTSTRAP_TOKEN_PLACEHOLDER"
  }
}

# Encryption
encrypt = "$ENCRYPTION_KEY"
encrypt_verify_incoming = true
encrypt_verify_outgoing = true

# TLS configuration
tls {
  defaults {
    ca_file = "$CONSUL_CERT_DIR/consul-agent-ca.pem"
    cert_file = "$CONSUL_CERT_DIR/$DC_NAME-server-consul-0.pem"
    key_file = "$CONSUL_CERT_DIR/$DC_NAME-server-consul-0-key.pem"
    verify_incoming = true
    verify_outgoing = true
  }
  internal_rpc {
    verify_server_hostname = true
  }
}

# Performance
performance {
  raft_multiplier = 1
}

# Logging
log_rotate_duration = "24h"
log_rotate_max_files = 5
EOF

chown $CONSUL_USER:$CONSUL_USER $CONSUL_CONFIG_DIR/consul.hcl
chmod 640 $CONSUL_CONFIG_DIR/consul.hcl

# Step 6: Start Consul service
echo -e "${GREEN}[6/$TOTAL_STEPS]${NC} Starting Consul service..."

systemctl enable consul
systemctl start consul
sleep 5

# Step 7: Bootstrap ACL system
echo -e "${GREEN}[7/$TOTAL_STEPS]${NC} Bootstrapping ACL system..."

# Wait for Consul to be ready
for i in {1..30}; do
    if consul members &>/dev/null; then
        break
    fi
    sleep 2
done

# Bootstrap ACL
BOOTSTRAP_OUTPUT=$(consul acl bootstrap 2>/dev/null || echo "ALREADY_BOOTSTRAPPED")

if [[ "$BOOTSTRAP_OUTPUT" != "ALREADY_BOOTSTRAPPED" ]]; then
    BOOTSTRAP_TOKEN=$(echo "$BOOTSTRAP_OUTPUT" | grep "SecretID" | awk '{print $2}')
    
    # Update configuration with actual token
    sed -i "s/BOOTSTRAP_TOKEN_PLACEHOLDER/$BOOTSTRAP_TOKEN/" $CONSUL_CONFIG_DIR/consul.hcl
    systemctl restart consul
    
    print_status "ACL Bootstrap Token: $BOOTSTRAP_TOKEN"
    echo "$BOOTSTRAP_TOKEN" > /root/consul_bootstrap_token
    chmod 600 /root/consul_bootstrap_token
    print_warning "Bootstrap token saved to /root/consul_bootstrap_token - keep it secure!"
else
    print_warning "ACL system already bootstrapped"
fi

# Step 8: Verification
echo -e "${GREEN}[8/$TOTAL_STEPS]${NC} Verifying installation..."

# Check service status
if systemctl is-active consul &>/dev/null; then
    print_status "Consul service is running"
else
    print_error "Consul service is not running"
    exit 1
fi

# Check cluster status
if consul members &>/dev/null; then
    print_status "Consul cluster is accessible"
else
    print_error "Cannot access Consul cluster"
    exit 1
fi

# Check TLS
if consul members -ca-file="$CONSUL_CERT_DIR/consul-agent-ca.pem" &>/dev/null; then
    print_status "TLS certificates are working"
fi

print_status "Consul installation completed successfully!"
print_status "Web UI available at: https://$BIND_ADDR:8501"
print_status "Remember to:"
print_status "  1. Configure firewall to allow ports 8300-8302, 8500-8502"
print_status "  2. Set CONSUL_HTTP_TOKEN environment variable for CLI access"
print_status "  3. Create additional ACL policies for your services"