825071750290210916 #netmaker

bored-island-21407

11/20/2022, 1:28 PM

look in older branches and you should be able to find it

tall-plumber-99778

11/20/2022, 1:34 PM

Thank you, I found an older version here: https://github.com/gravitl/netmaker/blob/refactor_0.14.1_setupMQTT/kube/netmaker-template.yaml But I can't find anything that indicates usage of a wildcard certificate there.. I may be misunderstanding something

tall-plumber-99778

11/20/2022, 1:34 PM

Is there any other file I can use for reference?

bored-island-21407

11/20/2022, 1:34 PM

not one which uses static certs

tall-plumber-99778

11/20/2022, 1:35 PM

What about one that uses 'non-wildcard' static certs, then?

bored-island-21407

11/20/2022, 1:36 PM

nope, all the docker-compose files include the proxy obtaining the certs for you

tall-plumber-99778

11/20/2022, 1:38 PM

Oh, alright.. Maybe there is another solution for my use case, then? I'm looking to have multiple netmaker servers (which have different public addresses) under a single domain (I will route different dns queries to their matching servers via my own dns server)

tall-plumber-99778

11/20/2022, 1:39 PM

So I assumed I should be able to use a single wildcard cert for all the servers

bored-island-21407

11/20/2022, 1:41 PM

sorry, I can't help you.. I never use wildcard certs. I find it just as easy to get individual certs whether you are using a proxy or even just cert-bot

tall-plumber-99778

11/20/2022, 1:42 PM

Won't I have to create a specific A record for every sub-domain in that case?

bored-island-21407

11/20/2022, 1:42 PM

yes, but you need to do that to have them reachable from the outside world anyways

tall-plumber-99778

11/20/2022, 1:44 PM

I thought about having a single proxy server pointed to by the A record, and have that server route requests to the sub-domains That way, any sub-domain will use the proxy server's wildcard cert

tall-plumber-99778

11/20/2022, 1:44 PM

If there's an easier way to do it I'll be happy to hear about it

bored-island-21407

11/20/2022, 1:47 PM

then you have to figure out how to use your proxy server with a static wildcard cert

tall-plumber-99778

11/20/2022, 1:49 PM

That was the intent of my question 😅 I guess I'll have to browse the docs and experiment with it, though I'll be glad if you'll tell me in case you find anything that might point me in the right direction later on 🙂

bored-island-21407

11/20/2022, 1:51 PM

I pointed you to the article on using static certs with traefik..... for wildcard certs I can't help

tall-plumber-99778

11/20/2022, 1:55 PM

For static certs - Should I simply add the command "--providers.file.directory=my/static/cert/path" and switch the 'traefik_certs: {}' volume with.. 'traefik_certs: my/static/cert/path'?

tall-plumber-99778

11/20/2022, 1:55 PM

I feel like I might be mistaken as I'm not familiar enough with docker

bored-island-21407

11/20/2022, 1:57 PM

traefik static certs are more complicated than that

bored-island-21407

11/20/2022, 1:59 PM

you need a cert-traefik.yml file that you then point to in the docker-compose

tall-plumber-99778

11/20/2022, 2:02 PM

Thank you, I'll try that

tall-plumber-99778

11/21/2022, 7:29 AM

Which certificates are being generated during the deployment of Netmaker? Is it a single certificate that includes dashboard.domain, api.domain and broker.domain, or does each sub-domain get its own certificate?

tall-plumber-99778

11/21/2022, 9:19 AM

It might be a silly question, but why can't I connect directly to PublicIPAddr:80 instead of dashboard.domain? Doesn't traefik map the 'dashboard' sub-domain to port 80?

tall-plumber-99778

11/21/2022, 9:20 AM

Is there some sort of whitelist that only allows traefik to directly communicate with that service?

bored-island-21407

11/21/2022, 12:14 PM

Traefik, or any proxy, only proxies the routes that you set up. No routes have been set up for plain IP addresses

bulky-waitress-18193

11/21/2022, 8:39 PM

If I wanted to manually edit a wireguard conf file where would those be?

bulky-waitress-18193

11/21/2022, 9:16 PM

Thank you. Where are ext client configs stored ?

bored-island-21407

11/21/2022, 9:16 PM

where ever you downloaded them to

bulky-waitress-18193

11/21/2022, 9:19 PM

No I mean like on a vanilla wireguard server.. the [peer] config normally in /etc/wireguard/wg0.conf for example. Where is that config stored in netmaker?

bored-island-21407

11/21/2022, 9:21 PM

if you are on a network called mynet ... the client config is stored in /etc/netclient/conf/nm-mynet.conf