diff --git a/hieradata/country/au/region/syd1/infra/storage/consul.yaml b/hieradata/country/au/region/syd1/infra/storage/consul.yaml
index 52a084f..2c339f8 100644
--- a/hieradata/country/au/region/syd1/infra/storage/consul.yaml
+++ b/hieradata/country/au/region/syd1/infra/storage/consul.yaml
@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: true
+profiles::consul::server::join_remote_regions: false
 profiles::consul::server::remote_regions:
   - drw1
diff --git a/hieradata/roles/infra/storage/consul.yaml b/hieradata/roles/infra/storage/consul.yaml
index cac2fe4..390e082 100644
--- a/hieradata/roles/infra/storage/consul.yaml
+++ b/hieradata/roles/infra/storage/consul.yaml
@@ -16,6 +16,15 @@ profiles::consul::server::ports:
   dns: 8600
   http: 8500
   https: -1
+profiles::consul::server::tls:
+  defaults:
+    ca_file: /etc/pki/ca-trust/source/anchors/vaultcaroot.pem
+    cert_file: /etc/pki/tls/vault/full_chain.crt
+    key_file: /etc/pki/tls/vault/private.key
+  internal_rpc:
+    verify_incoming: false
+    verify_outgoing: false
+    verify_server_hostname: false
 profiles::consul::server::acl:
   enabled: true
   default_policy: 'deny'
diff --git a/site/profiles/manifests/consul/server.pp b/site/profiles/manifests/consul/server.pp
index 039dea1..28f144b 100644
--- a/site/profiles/manifests/consul/server.pp
+++ b/site/profiles/manifests/consul/server.pp
@@ -11,6 +11,7 @@ class profiles::consul::server (
   Hash      $acl = {},
   Hash      $ports = {},
   Hash      $addresses = {},
+  Hash      $tls = {},
   Boolean   $members_lookup     = false,
   String    $members_role       = undef,
   Array     $consul_servers     = [],
@@ -112,6 +113,8 @@ class profiles::consul::server (
           'acl'                  => $acl,
           'ports'                => $ports,
           'addresses'            => $addresses,
+          'tls'                  => $tls,
+          'auto_reload_config'   => true,
           'disable_remote_exec'  => $disable_remote_exec,
           'disable_update_check' => $disable_update_check,
           'domain'               => $domain,
@@ -129,7 +132,7 @@ class profiles::consul::server (
           'advertise_addr'       => $advertise_addr,
           'retry_join'           => $servers_array,
           'retry_join_wan'       => $remote_servers_array,
-          'connect'              => { 'enabled' => true },
+          'connect'              => { 'enabled' => true, 'enable_mesh_gateway_wan_federation' => true },
           'recursors'            => ['198.18.19.16'],
         },
       }