> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Demo Creating a Consul Agent Configuration
> This guide explains how to configure a HashiCorp Consul agent in server and client modes using example files from GitHub.
In this guide, you’ll learn how to configure a **HashiCorp Consul** agent—both server and client modes—using example files hosted on GitHub. Follow along by visiting the Consul folder in the repository:
[https://github.com/btkrausen/hashicorp/tree/main/Consul](https://github.com/btkrausen/hashicorp/tree/main/Consul)
## Consul Server Agent Configuration (JSON)
Below is a complete JSON example for a Consul server agent. This configuration enables Raft consensus, TLS encryption, and ACL enforcement.
```json theme={null}
{
"log_level": "INFO",
"server": true,
"key_file": "/etc/consul.d/cert.key",
"cert_file": "/etc/consul.d/client.pem",
"ca_file": "/etc/consul.d/chain.pem",
"verify_incoming": true,
"verify_outgoing": true,
"verify_server_hostname": true,
"ui": true,
"encrypt": "xxxxxxxxxxxxxx",
"leave_on_terminate": true,
"data_dir": "/opt/consul/data",
"datacenter": "us-east-1",
"client_addr": "0.0.0.0",
"bind_addr": "10.11.11.11",
"advertise_addr": "10.11.11.11",
"bootstrap_expect": 5,
"retry_join": [
"provider=aws tag_key=Environment-Name tag_value=consul-cluster region=us-east-1"
],
"enable_syslog": true,
"acl": {
"enabled": true,
"default_policy": "deny",
"down_policy": "extend-cache",
"tokens": {
"agent": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}
},
"performance": {
"raft_multiplier": 1
}
}
```
### Key Settings Overview
| Setting | Description | Example |
| --------------------------------- | --------------------------------------------------------------------------------------------------------- | ----------------------------------------------- |
| log\_level | Controls log verbosity (e.g., `INFO`, `DEBUG`). | `"INFO"` |
| server | Enables server mode; participates in Raft elections and stores cluster state. | `true` |
| key\_file / cert\_file / ca\_file | Paths to TLS key, certificate, and CA used for mutual TLS on RPC and HTTP APIs. | `/etc/consul.d/cert.key` |
| verify\_incoming / outgoing | Enforces mutual TLS for all RPC/API calls. | `true` |
| verify\_server\_hostname | Validates server hostname in TLS certificates. | `true` |
| ui | Enables the built-in Consul Web UI. | `true` |
| encrypt | Gossip encryption key for securing cluster communication. | `"xxxxxxxxxxxxxx"` |
| leave\_on\_terminate | Ensures the agent cleanly leaves the gossip pool when stopped. | `true` |
| data\_dir | Directory for storing Consul state and snapshots. | `/opt/consul/data` |
| datacenter | Logical datacenter identifier (default: `dc1`). | `"us-east-1"` |
| client\_addr / bind\_addr | Network addresses for HTTP/RPC bindings and gossip interface. | `"0.0.0.0"`, `"10.11.11.11"` |
| advertise\_addr | Address announced to peers for incoming connections. | `"10.11.11.11"` |
| bootstrap\_expect | Number of server nodes to wait for before bootstrapping the cluster. | `5` |
| retry\_join | Auto-join peers using AWS tags. | `["provider=aws tag_key=Environment-Name ..."]` |
| enable\_syslog | Sends agent logs to the local syslog. | `true` |
| acl.enabled / default\_policy | Enables ACLs with restrictive defaults—requires a token for all operations. | see JSON block |
| down\_policy | Defines behavior when ACL system is down (e.g., `extend-cache`). | `"extend-cache"` |
| performance.raft\_multiplier | Multiplier for Raft timeouts; setting to `1` improves failure detection speed in production environments. | `1` |
For production clusters, configure at least 3–5 server agents and set `bootstrap_expect` accordingly to ensure high availability.
***
## Minimal Consul Client Agent Configuration (JSON)
Use the following JSON snippet for a lightweight Consul client that joins an existing cluster. It includes essential TLS settings, gossip encryption, and ACL tokens.
```json theme={null}
{
"log_level": "INFO",
"server": false,
"node_name": "node-a.example.com",
"key_file": "/etc/consul.d/cert.key",
"cert_file": "/etc/consul.d/client.pem",
"ca_file": "/etc/consul.d/chain.pem",
"verify_incoming": true,
"verify_outgoing": true,
"encrypt": "xxxxxxxxxxxxxxxxxxxx",
"data_dir": "/opt/consul/data",
"datacenter": "us-east-1",
"bind_addr": "10.10.10.10",
"client_addr": "0.0.0.0",
"retry_join": [
"provider=aws tag_key=Environment-Name tag_value=consul-cluster region=us-east-1"
],
"enable_syslog": true,
"acl": {
"tokens": {
"agent": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}
}
}
```
Ensure your client node has network connectivity to the server agents and valid ACL tokens to authenticate API calls.
## Links and References
* [Consul Agent Configuration | Consul Documentation](https://www.consul.io/docs/agent/options)
* [GitHub Repository: btkrausen/hashicorp](https://github.com/btkrausen/hashicorp)
* [Terraform AWS Provider – Auto-Join Configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs)