Consul - technical advise

Hi,

I need some technical advise about Consul. My use case looks as follow.

We have up and running production Vault instances in private network.

The Vault exposes kv store with authorization based on tls-auth model.

Because the Vault is accessible only within private networks my services from public network are not able to use the Vault.

I need to create solution based on Consul which gives public services access to the Vault’s kv store.

Beacuse the Consul provides a lot of solutions like: mesh, proxy, side-car proxy, api gateways, termianate gateways and much more

I’m confused which solution would be the best to fit my use case.

My idea is to use Consul as middleman between public services and Vault.

Thank you for any advise.