Implement Consul Connect mTLS with Vault PKI backend for secure service mesh communication

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Configuration variables
VAULT_TOKEN=""
CONSUL_TOKEN=""
DOMAIN="${1:-dc1.consul}"

# Cleanup function
cleanup() {
    echo -e "${RED}[ERROR] Installation failed. Cleaning up...${NC}"
    systemctl stop vault consul 2>/dev/null || true
    rm -f /etc/vault.d/vault.hcl /etc/consul.d/consul.hcl 2>/dev/null || true
}

trap cleanup ERR

usage() {
    echo "Usage: $0 [domain]"
    echo "  domain: Consul datacenter domain (default: dc1.consul)"
    exit 1
}

# Check prerequisites
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}This script must be run as root${NC}"
    exit 1
fi

if ! command -v curl &> /dev/null; then
    echo -e "${RED}curl is required but not installed${NC}"
    exit 1
fi

# Auto-detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora) 
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            ;;
        amzn) 
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            ;;
        *) 
            echo -e "${RED}Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
else
    echo -e "${RED}Cannot detect distribution${NC}"
    exit 1
fi

echo -e "${GREEN}[1/12] Installing HashiCorp repository...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    curl -fsSL https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
    echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" > /etc/apt/sources.list.d/hashicorp.list
    $PKG_UPDATE
else
    $PKG_INSTALL dnf-plugins-core 2>/dev/null || $PKG_INSTALL yum-utils 2>/dev/null || true
    if [[ "$PKG_MGR" == "dnf" ]]; then
        dnf config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
    else
        yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
    fi
fi

echo -e "${GREEN}[2/12] Installing Vault and Consul...${NC}"
$PKG_INSTALL vault consul

echo -e "${GREEN}[3/12] Creating directories and setting permissions...${NC}"
mkdir -p /var/lib/vault/data /var/lib/consul /etc/vault.d /etc/consul.d
chown vault:vault /var/lib/vault/data /etc/vault.d
chown consul:consul /var/lib/consul /etc/consul.d
chmod 755 /var/lib/vault/data /var/lib/consul /etc/vault.d /etc/consul.d

echo -e "${GREEN}[4/12] Configuring Vault...${NC}"
cat > /etc/vault.d/vault.hcl << 'EOF'
storage "file" {
  path = "/var/lib/vault/data"
}

listener "tcp" {
  address = "0.0.0.0:8200"
  tls_disable = true
}

api_addr = "http://127.0.0.1:8200"
cluster_addr = "http://127.0.0.1:8201"
ui = true
disable_mlock = true
EOF

chown vault:vault /etc/vault.d/vault.hcl
chmod 644 /etc/vault.d/vault.hcl

echo -e "${GREEN}[5/12] Starting Vault service...${NC}"
systemctl enable vault
systemctl start vault
sleep 5

export VAULT_ADDR='http://127.0.0.1:8200'

echo -e "${GREEN}[6/12] Initializing Vault...${NC}"
vault operator init -key-shares=5 -key-threshold=3 > /tmp/vault-init.txt
chmod 600 /tmp/vault-init.txt

echo -e "${YELLOW}Vault initialization complete. Keys saved to /tmp/vault-init.txt${NC}"
echo -e "${YELLOW}IMPORTANT: Save these keys securely!${NC}"

UNSEAL_KEY_1=$(grep 'Unseal Key 1:' /tmp/vault-init.txt | awk '{print $4}')
UNSEAL_KEY_2=$(grep 'Unseal Key 2:' /tmp/vault-init.txt | awk '{print $4}')
UNSEAL_KEY_3=$(grep 'Unseal Key 3:' /tmp/vault-init.txt | awk '{print $4}')
ROOT_TOKEN=$(grep 'Initial Root Token:' /tmp/vault-init.txt | awk '{print $4}')

echo -e "${GREEN}[7/12] Unsealing Vault...${NC}"
vault operator unseal "$UNSEAL_KEY_1"
vault operator unseal "$UNSEAL_KEY_2"
vault operator unseal "$UNSEAL_KEY_3"

echo -e "${GREEN}[8/12] Configuring Vault PKI...${NC}"
vault auth "$ROOT_TOKEN"
vault secrets enable -path=connect-ca pki
vault secrets tune -max-lease-ttl=87600h connect-ca

vault write connect-ca/root/generate/internal \
    common_name="Consul Connect CA" \
    ttl=87600h

vault write connect-ca/roles/consul-connect \
    allowed_domains="consul" \
    allow_subdomains=true \
    max_ttl=72h \
    generate_lease=true

echo -e "${GREEN}[9/12] Creating Vault policy for Consul...${NC}"
cat > /tmp/consul-connect-policy.hcl << 'EOF'
path "connect-ca/cert/ca" {
  capabilities = ["read"]
}

path "connect-ca/root/sign-intermediate" {
  capabilities = ["update"]
}

path "connect-ca/intermediate/set-signed" {
  capabilities = ["update"]
}
EOF

vault policy write consul-connect /tmp/consul-connect-policy.hcl
CONSUL_TOKEN=$(vault token create -policy=consul-connect -ttl=8760h -renewable -format=json | grep -o '"client_token":"[^"]*' | cut -d'"' -f4)

echo -e "${GREEN}[10/12] Configuring Consul...${NC}"
cat > /etc/consul.d/consul.hcl << EOF
datacenter = "dc1"
data_dir = "/var/lib/consul"
log_level = "INFO"
server = true
bootstrap_expect = 1
bind_addr = "127.0.0.1"
client_addr = "127.0.0.1"

connect {
  enabled = true
  ca_provider = "vault"
  ca_config {
    address = "http://127.0.0.1:8200"
    token = "$CONSUL_TOKEN"
    root_pki_path = "connect-ca"
    intermediate_pki_path = "connect-intermediate"
  }
}

ui_config {
  enabled = true
}

ports {
  grpc = 8502
}
EOF

chown consul:consul /etc/consul.d/consul.hcl
chmod 644 /etc/consul.d/consul.hcl

echo -e "${GREEN}[11/12] Starting Consul service...${NC}"
systemctl enable consul
systemctl start consul
sleep 10

echo -e "${GREEN}[12/12] Verifying installation...${NC}"
if ! systemctl is-active --quiet vault; then
    echo -e "${RED}Vault service is not running${NC}"
    exit 1
fi

if ! systemctl is-active --quiet consul; then
    echo -e "${RED}Consul service is not running${NC}"
    exit 1
fi

if ! vault status | grep -q "Sealed.*false"; then
    echo -e "${RED}Vault is sealed${NC}"
    exit 1
fi

if ! consul members | grep -q "alive"; then
    echo -e "${RED}Consul cluster not healthy${NC}"
    exit 1
fi

rm -f /tmp/consul-connect-policy.hcl

echo -e "${GREEN}Installation completed successfully!${NC}"
echo -e "${YELLOW}Important files:${NC}"
echo "  - Vault keys: /tmp/vault-init.txt (secure this file!)"
echo "  - Vault UI: http://localhost:8200"
echo "  - Consul UI: http://localhost:8500"
echo ""
echo -e "${YELLOW}Next steps:${NC}"
echo "  1. Secure /tmp/vault-init.txt and remove it from this server"
echo "  2. Configure your services to use Consul Connect"
echo "  3. Set up proper TLS for Vault in production"