Skip to main content
In this guide, you’ll learn how to configure a HashiCorp Consul agent—both server and client modes—using example files hosted on GitHub. Follow along by visiting the Consul folder in the repository: https://github.com/btkrausen/hashicorp/tree/main/Consul

​
Consul Server Agent Configuration (JSON)

Below is a complete JSON example for a Consul server agent. This configuration enables Raft consensus, TLS encryption, and ACL enforcement. 
{
  "log_level": "INFO",
  "server": true,
  "key_file": "/etc/consul.d/cert.key",
  "cert_file": "/etc/consul.d/client.pem",
  "ca_file": "/etc/consul.d/chain.pem",
  "verify_incoming": true,
  "verify_outgoing": true,
  "verify_server_hostname": true,
  "ui": true,
  "encrypt": "xxxxxxxxxxxxxx",
  "leave_on_terminate": true,
  "data_dir": "/opt/consul/data",
  "datacenter": "us-east-1",
  "client_addr": "0.0.0.0",
  "bind_addr": "10.11.11.11",
  "advertise_addr": "10.11.11.11",
  "bootstrap_expect": 5,
  "retry_join": [
    "provider=aws tag_key=Environment-Name tag_value=consul-cluster region=us-east-1"
  ],
  "enable_syslog": true,
  "acl": {
    "enabled": true,
    "default_policy": "deny",
    "down_policy": "extend-cache",
    "tokens": {
      "agent": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    }
  },
  "performance": {
    "raft_multiplier": 1
  }
}

​
Key Settings Overview

SettingDescriptionExample
log_levelControls log verbosity (e.g., INFO, DEBUG)."INFO"
serverEnables server mode; participates in Raft elections and stores cluster state.true
key_file / cert_file / ca_filePaths to TLS key, certificate, and CA used for mutual TLS on RPC and HTTP APIs./etc/consul.d/cert.key
verify_incoming / outgoingEnforces mutual TLS for all RPC/API calls.true
verify_server_hostnameValidates server hostname in TLS certificates.true
uiEnables the built-in Consul Web UI.true
encryptGossip encryption key for securing cluster communication."xxxxxxxxxxxxxx"
leave_on_terminateEnsures the agent cleanly leaves the gossip pool when stopped.true
data_dirDirectory for storing Consul state and snapshots./opt/consul/data
datacenterLogical datacenter identifier (default: dc1)."us-east-1"
client_addr / bind_addrNetwork addresses for HTTP/RPC bindings and gossip interface."0.0.0.0", "10.11.11.11"
advertise_addrAddress announced to peers for incoming connections."10.11.11.11"
bootstrap_expectNumber of server nodes to wait for before bootstrapping the cluster.5
retry_joinAuto-join peers using AWS tags.["provider=aws tag_key=Environment-Name ..."]
enable_syslogSends agent logs to the local syslog.true
acl.enabled / default_policyEnables ACLs with restrictive defaults—requires a token for all operations.see JSON block
down_policyDefines behavior when ACL system is down (e.g., extend-cache)."extend-cache"
performance.raft_multiplierMultiplier for Raft timeouts; setting to 1 improves failure detection speed in production environments.1
For production clusters, configure at least 3–5 server agents and set bootstrap_expect accordingly to ensure high availability.

​
Minimal Consul Client Agent Configuration (JSON)

Use the following JSON snippet for a lightweight Consul client that joins an existing cluster. It includes essential TLS settings, gossip encryption, and ACL tokens. 
{
  "log_level": "INFO",
  "server": false,
  "node_name": "node-a.example.com",
  "key_file": "/etc/consul.d/cert.key",
  "cert_file": "/etc/consul.d/client.pem",
  "ca_file": "/etc/consul.d/chain.pem",
  "verify_incoming": true,
  "verify_outgoing": true,
  "encrypt": "xxxxxxxxxxxxxxxxxxxx",
  "data_dir": "/opt/consul/data",
  "datacenter": "us-east-1",
  "bind_addr": "10.10.10.10",
  "client_addr": "0.0.0.0",
  "retry_join": [
    "provider=aws tag_key=Environment-Name tag_value=consul-cluster region=us-east-1"
  ],
  "enable_syslog": true,
  "acl": {
    "tokens": {
      "agent": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    }
  }
}
Ensure your client node has network connectivity to the server agents and valid ACL tokens to authenticate API calls.
The image shows a GitHub repository page for "hashicorp" with a list of configuration files, including JSON and HCL files, and a recent commit message about removing Consul items from the Vault folder.

Watch Video