TLS config documentation for HTTPS server

[ryanuber]

From https://groups.google.com/forum/#!topic/consul-tool/JOGcE2o1GK0:

the docs don't specify that you need to (or even that you can) set the 'https' address in the config.
If you don't do that it silently fails to set up the https server. Bit of a head-scratcher for a while.

/cc @ryanbreen

[ryanbreen]

Cool, I can get that added.

[ryanbreen]

Definitely makes sense to add documentation of the https address to the options docs, but it also feels like we need a "Securing Consul" guide to cover this stuff in more depth. Forcing people to scour the config options feels unreasonable.

[ryanuber]

I agree, a security guide would be great!

[armon]

Yep, totally agreed. There is too broad a surface to reason about.

[ryanbreen]

For starters, I made one minor change to the options docs, clarifying that https port must be set. However, I'm having a hard time validating that there's a codepath where address: https needs to be set for the https listener to start.

If an https port is set but no https address is set, this line https://github.com/hashicorp/consul/blob/master/command/agent/http.go#L47 calls https://github.com/hashicorp/consul/blob/master/command/agent/config.go#L453 with an empty string as the first param. That'll yield a returned addr equivalent to ClientAddr, and that should default to 127.0.0.1.

What am I missing?

[ryanuber]

@ryanbreen I don't think you are missing anything. If the port is configured, the HTTPS server should start, and the HTTPS address field is just there to allow changing what it binds to.

[armon]

Closing, this seems to be done. Thanks @ryanbreen