diff --git a/hieradata/country/au/region/drw1/infra/storage/consul.yaml b/hieradata/country/au/region/drw1/infra/storage/consul.yaml
index b44e321..6fba403 100644
--- a/hieradata/country/au/region/drw1/infra/storage/consul.yaml
+++ b/hieradata/country/au/region/drw1/infra/storage/consul.yaml
@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: true
+profiles::consul::server::join_remote_regions: false
 profiles::consul::server::remote_regions:
   - syd1
diff --git a/hieradata/country/au/region/syd1/infra/storage/consul.yaml b/hieradata/country/au/region/syd1/infra/storage/consul.yaml
index 52a084f..2c339f8 100644
--- a/hieradata/country/au/region/syd1/infra/storage/consul.yaml
+++ b/hieradata/country/au/region/syd1/infra/storage/consul.yaml
@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: true
+profiles::consul::server::join_remote_regions: false
 profiles::consul::server::remote_regions:
   - drw1
diff --git a/hieradata/roles/infra/storage/consul.yaml b/hieradata/roles/infra/storage/consul.yaml
index 8741c43..d509776 100644
--- a/hieradata/roles/infra/storage/consul.yaml
+++ b/hieradata/roles/infra/storage/consul.yaml
@@ -13,9 +13,19 @@ profiles::consul::server::addresses:
   grpc_tls: "%{::networking.ip}"
 profiles::consul::server::ports:
   grpc: 8502
+  grpc_tls: 8503
   dns: 8600
   http: 8500
   https: -1
+profiles::consul::server::tls:
+  defaults:
+    ca_file: /etc/pki/ca-trust/source/anchors/vaultcaroot.pem
+    cert_file: /etc/pki/tls/vault/full_chain.crt
+    key_file: /etc/pki/tls/vault/private.key
+  internal_rpc:
+    verify_incoming: false
+    verify_outgoing: false
+    verify_server_hostname: false
 profiles::consul::server::acl:
   enabled: true
   default_policy: 'deny'
@@ -31,6 +41,8 @@ profiles::pki::vault::alt_names:
   - consul.service.consul
   - "consul.service.%{facts.country}-%{facts.region}.consul"
   - consul
+  - "server.%{facts.country}-%{facts.region}.consul"
+  - "%{facts.networking.fqdn}.server.%{facts.country}-%{facts.region}.consul"
 
 # manage a simple nginx reverse proxy
 profiles::nginx::simpleproxy::nginx_vhost: 'consul.service.consul'
diff --git a/site/profiles/manifests/consul/server.pp b/site/profiles/manifests/consul/server.pp
index 039dea1..9e4b90c 100644
--- a/site/profiles/manifests/consul/server.pp
+++ b/site/profiles/manifests/consul/server.pp
@@ -11,6 +11,7 @@ class profiles::consul::server (
   Hash      $acl = {},
   Hash      $ports = {},
   Hash      $addresses = {},
+  Hash      $tls = {},
   Boolean   $members_lookup     = false,
   String    $members_role       = undef,
   Array     $consul_servers     = [],
@@ -112,6 +113,8 @@ class profiles::consul::server (
           'acl'                  => $acl,
           'ports'                => $ports,
           'addresses'            => $addresses,
+          'tls'                  => $tls,
+          'auto_reload_config'   => true,
           'disable_remote_exec'  => $disable_remote_exec,
           'disable_update_check' => $disable_update_check,
           'domain'               => $domain,