Configure Consul Connect service mesh with Envoy proxy for secure microservices communication

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Script configuration
CONSUL_VERSION="1.17.0"
ENVOY_VERSION="1.28.0"

# Usage function
usage() {
    echo "Usage: $0 [OPTIONS]"
    echo "Options:"
    echo "  -h, --help     Show this help message"
    echo "  -v, --version  Consul version (default: $CONSUL_VERSION)"
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Parse arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        -h|--help) usage ;;
        -v|--version) CONSUL_VERSION="$2"; shift 2 ;;
        *) log_error "Unknown option: $1"; usage ;;
    esac
done

# Cleanup function for rollback
cleanup() {
    log_warn "Installation failed. Cleaning up..."
    systemctl stop consul 2>/dev/null || true
    systemctl disable consul 2>/dev/null || true
    rm -f /etc/systemd/system/consul.service
    rm -rf /opt/consul /etc/consul /var/log/consul
    userdel -r consul 2>/dev/null || true
    rm -f /usr/local/bin/consul /usr/local/bin/envoy
    systemctl daemon-reload
}

trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    log_error "This script must be run as root or with sudo"
    exit 1
fi

# Detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            PKG_INSTALL="apt install -y"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    log_error "Cannot detect distribution"
    exit 1
fi

log_info "Detected distribution: $PRETTY_NAME"

# Step 1: Update system packages
echo "[1/10] Updating system packages..."
$PKG_UPDATE

# Step 2: Install dependencies
echo "[2/10] Installing dependencies..."
$PKG_INSTALL curl wget unzip jq net-tools

# Step 3: Install Consul
echo "[3/10] Installing Consul $CONSUL_VERSION..."
cd /tmp
wget -q "https://releases.hashicorp.com/consul/${CONSUL_VERSION}/consul_${CONSUL_VERSION}_linux_amd64.zip"
unzip -q "consul_${CONSUL_VERSION}_linux_amd64.zip"
mv consul /usr/local/bin/
chmod 755 /usr/local/bin/consul
rm -f "consul_${CONSUL_VERSION}_linux_amd64.zip"

# Verify Consul installation
if ! consul version >/dev/null 2>&1; then
    log_error "Consul installation failed"
    exit 1
fi

# Step 4: Install Envoy
echo "[4/10] Installing Envoy proxy..."
if [[ "$PKG_MGR" == "apt" ]]; then
    curl -sL 'https://deb.dl.getenvoy.io/public/gpg.8115BA8E629CC074.key' | gpg --dearmor -o /usr/share/keyrings/getenvoy-keyring.gpg
    echo "deb [arch=amd64 signed-by=/usr/share/keyrings/getenvoy-keyring.gpg] https://deb.dl.getenvoy.io/public/deb/ubuntu $(lsb_release -cs) main" > /etc/apt/sources.list.d/getenvoy.list
    apt update
    apt install -y getenvoy-envoy
else
    curl -sL https://func-e.io/install.sh | bash -s -- -b /usr/local/bin
    /usr/local/bin/func-e use $ENVOY_VERSION
    cp ~/.func-e/versions/$ENVOY_VERSION/bin/envoy /usr/local/bin/
    chmod 755 /usr/local/bin/envoy
fi

# Step 5: Create Consul user and directories
echo "[5/10] Creating Consul user and directories..."
if ! id consul >/dev/null 2>&1; then
    useradd --system --home /etc/consul --shell /bin/false consul
fi
mkdir -p /opt/consul /etc/consul /var/log/consul
chown -R consul:consul /opt/consul /etc/consul /var/log/consul
chmod 755 /opt/consul /etc/consul /var/log/consul

# Step 6: Generate encryption key
echo "[6/10] Generating Consul encryption key..."
ENCRYPT_KEY=$(consul keygen)
log_info "Generated encryption key: $ENCRYPT_KEY"

# Step 7: Create Consul configuration
echo "[7/10] Creating Consul configuration..."
cat > /etc/consul/consul.hcl << EOF
datacenter = "dc1"
data_dir = "/opt/consul"
log_level = "INFO"
log_file = "/var/log/consul/consul.log"
server = true
bootstrap_expect = 1
bind_addr = "0.0.0.0"
client_addr = "0.0.0.0"
retry_join = ["127.0.0.1"]
ui_config {
  enabled = true
}
connect {
  enabled = true
}
ports {
  grpc = 8502
}
acl = {
  enabled = true
  default_policy = "allow"
  enable_token_persistence = true
}
encrypt = "$ENCRYPT_KEY"
verify_incoming = false
verify_outgoing = false
verify_server_hostname = false
ca_file = "/etc/consul/consul-agent-ca.pem"
cert_file = "/etc/consul/consul-agent.pem"
key_file = "/etc/consul/consul-agent-key.pem"
EOF

chown consul:consul /etc/consul/consul.hcl
chmod 640 /etc/consul/consul.hcl

# Step 8: Generate TLS certificates
echo "[8/10] Generating TLS certificates..."
cd /etc/consul
consul tls ca create
consul tls cert create -server
chown consul:consul /etc/consul/*.pem
chmod 644 /etc/consul/*.pem

# Step 9: Create systemd service
echo "[9/10] Creating systemd service..."
cat > /etc/systemd/system/consul.service << 'EOF'
[Unit]
Description=Consul
Documentation=https://www.consul.io/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/etc/consul/consul.hcl

[Service]
Type=notify
User=consul
Group=consul
ExecStart=/usr/local/bin/consul agent -config-dir=/etc/consul/
ExecReload=/bin/kill -HUP $MAINPID
ExecStopPost=/bin/sleep 5
KillMode=process
Restart=on-failure
LimitNOFILE=65536
TimeoutStopSec=10s
SendSIGKILL=no

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable consul
systemctl start consul

# Step 10: Verification
echo "[10/10] Verifying installation..."
sleep 5

if ! systemctl is-active --quiet consul; then
    log_error "Consul service is not running"
    exit 1
fi

if ! consul members >/dev/null 2>&1; then
    log_error "Consul cluster is not healthy"
    exit 1
fi

log_info "Installation completed successfully!"
log_info "Consul UI available at: http://$(hostname -I | awk '{print $1}'):8500"
log_info "Consul is running with Connect enabled"
log_info "Service status: $(systemctl is-active consul)"