hosts: optionally set CONSUL_HTTP_ADDR from /etc/consul.json

cluster/services/chant/listener.nix

@@ -1,9 +1,7 @@
 { config, lib, pkgs, ... }:
 
 let
-  consulCfg = config.services.consul.extraConfig;
+  consul = config.links.consulAgent;
-  consulIpAddr = consulCfg.addresses.http or "127.0.0.1";
-  consulHttpAddr = "${consulIpAddr}:${toString (consulCfg.ports.http or 8500)}";
 
   validTargets = lib.pipe config.systemd.services [
     (lib.filterAttrs (name: value: value.chant.enable))
@@ -75,10 +73,10 @@ in
       RestartSec = 60;
       Restart = "always";
       IPAddressDeny = [ "any" ];
-      IPAddressAllow = [ consulIpAddr ];
+      IPAddressAllow = [ consul.ipv4 ];
     };
     environment = {
-      CONSUL_HTTP_ADDR = consulHttpAddr;
+      CONSUL_HTTP_ADDR = consul.tuple;
     };
   };
 }

cluster/services/consul/agent.nix

@@ -10,6 +10,8 @@ let
 in
 
 {
+  links.consulAgent.protocol = "http";
+
   services.consul = {
     enable = true;
     webUi = true;
@@ -24,11 +26,14 @@ in
       ports.serf_lan = hl.port;
       retry_join = map (hostName: hostLinks.${hostName}.consul.tuple) (cfg.otherNodes.agent hostName);
       bootstrap_expect = builtins.length cfg.nodes.agent;
+      addresses.http = config.links.consulAgent.ipv4;
+      ports.http = config.links.consulAgent.port;
     };
   };
 
   services.grafana-agent.settings.integrations.consul_exporter = {
     enabled = true;
     instance = hostName;
+    server = config.links.consulAgent.url;
   };
 }

cluster/services/consul/remote-api.nix

@@ -8,7 +8,7 @@ let
 in
 
 {
-  services.nginx.virtualHosts.${frontendDomain} = depot.lib.nginx.vhosts.proxy "http://127.0.0.1:8500" // {
+  services.nginx.virtualHosts.${frontendDomain} = depot.lib.nginx.vhosts.proxy config.links.consulAgent.url // {
     listenAddresses = lib.singleton addr;
     enableACME = false;
     useACMEHost = "internal.${domain}";
@@ -33,7 +33,7 @@ in
         {
           name = "Backend";
           id = "service:consul-remote:backend";
-          http = "http://127.0.0.1:8500/v1/status/leader";
+          http = "${config.links.consulAgent.url}/v1/status/leader";
           interval = "30s";
         }
       ];

cluster/services/locksmith/receiver.nix

@@ -1,9 +1,7 @@
 { config, lib, pkgs, ... }:
 
 let
-  consulCfg = config.services.consul.extraConfig;
+  consul = config.links.consulAgent;
-  consulIpAddr = consulCfg.addresses.http or "127.0.0.1";
-  consulHttpAddr = "${consulIpAddr}:${toString (consulCfg.ports.http or 8500)}";
 
   kvRoot = "secrets/locksmith";
   kvValue = "recipient/${config.networking.hostName}";
@@ -61,13 +59,13 @@ in
           config.services.consul.package
         ];
         environment = {
-          CONSUL_HTTP_ADDR = consulHttpAddr;
+          CONSUL_HTTP_ADDR = consul.tuple;
         };
         serviceConfig = {
           PrivateTmp = true;
           WorkingDirectory = "/tmp";
           IPAddressDeny = [ "any" ];
-          IPAddressAllow = [ consulIpAddr ];
+          IPAddressAllow = [ consul.ipv4 ];
           LoadCredential = lib.mkForce [];
         };
         script = ''

cluster/services/patroni/worker.nix

@@ -41,7 +41,7 @@ in
     softwareWatchdog = true;
     settings = {
       consul = {
-        host = "127.0.0.1:8500";
+        host = config.links.consulAgent.tuple;
         register_service = true;
       };
       bootstrap.dcs = {

cluster/services/storage/garage.nix

@@ -38,7 +38,7 @@ in
       rpc_public_addr = links.garageRpc.tuple;
       rpc_secret_file = config.age.secrets.garageRpcSecret.path;
       consul_discovery = {
-        consul_http_addr = "http://127.0.0.1:8500";
+        consul_http_addr = config.links.consulAgent.url;
         service_name = "garage-discovery";
       };
       s3_api = {

cluster/services/ways/host.nix

@@ -4,8 +4,6 @@ let
   externalWays = lib.filterAttrs (_: cfg: !cfg.internal) cluster.config.ways;
 
   consulServiceWays = lib.filterAttrs (_: cfg: cfg.useConsul) cluster.config.ways;
-
-  consulHttpAddr = "${config.services.consul.extraConfig.addresses.http or "127.0.0.1"}:${toString (config.services.consul.extraConfig.ports.http or 8500)}";
 in
 
 {
@@ -63,7 +61,7 @@ in
     user = "nginx";
     group = "nginx";
     settings = {
-      consul.address = "http://${consulHttpAddr}";
+      consul.address = config.links.consulAgent.url;
       template = [
         {
           source = let

hosts/deploy.nix

@@ -46,6 +46,9 @@ in
                     ScheduleShutdown st reboot ''${nextScheduledTime}000000
                 '';
               in pkgs.writeShellScript "post-effect.sh" ''
+                if [[ -e /etc/consul.json ]]; then
+                  export CONSUL_HTTP_ADDR="$(${pkgs.jq}/bin/jq -r < /etc/consul.json '"\(.addresses.http // "127.0.0.1"):\(.ports.http // 8500)"')"
+                fi
                 export PATH="${config.packages.consul}/bin:${pkgs.coreutils}/bin"
                 if [[ "$(realpath /run/booted-system/kernel)" != "$(realpath /nix/var/nix/profiles/system/kernel)" ]]; then
                   echo "Scheduling reboot for kernel upgrade"