Configuring Teleport 13+ behind nginx as an HTTPS reverse proxy #26445
Replies: 5 comments 9 replies
-
|
Hi, thank you for your tutorial. The difference is that I use cloudflare and cloudflare universal SSL doesnt support sub sub domain Now I have a CORS preflight issue in browser's console :
I tried to add in teleport config app : I have put in nginx
|
Beta Was this translation helpful? Give feedback.
-
|
I'm afraid I can't recreate this either. I set up an app with a config like this: app_service:
enabled: true
debug_app: true
apps:
- name: test
uri: http://localhost:8000
public_addr: gus-nginx-app-test.teleportdemo.comThe public address of my cluster is a different subdomain of the same root domain ( proxy_service:
enabled: true
web_listen_addr: 0.0.0.0:3080
public_addr: gus-nginx.teleportdemo.com:443I pointed the DNS records for both to my server's IP. I ran I provided that to Restarted both
When I click "Launch", the application loads fine:
(the 500 error is because there's actually nothing listening on I'm not sure exactly what the issue is here :( I'm not using Cloudflare so I have to conclude that's probably where the root of the issue lies. |
Beta Was this translation helpful? Give feedback.
-
|
Hey Guys, thanks a ton for all your questions and answers. I'm also fighting with a reverse proxy setup. I'm using the nginx proxy manager, since I'm not that skilled to use pure config-files. I got it working though... I read somewhere (I'm sorry I forgot the Website), to create the certificates within nginx proxy manager, copy them over to teleport and add the path within the teleport.yaml file - so it looks like this: version: v3
teleport:
nodename: teleport
data_dir: /var/lib/teleport
log:
output: stderr
severity: INFO
format:
output: text
ca_pin: ""
diag_addr: ""
auth_service:
enabled: "yes"
listen_addr: 0.0.0.0:3025
cluster_name: teleport.example.com
ssh_service:
enabled: "yes"
commands:
- name: hostname
command: [hostname]
period: 1m0s
proxy_service:
enabled: "yes"
web_listen_addr: 0.0.0.0:443
listen_addr: 0.0.0.0:3023
public_addr: teleport.example.com:443
tunnel_public_addr: teleport.example.com:3024
tunnel_listen_addr: 0.0.0.0:3024
peer_listen_addr: 0.0.0.0:3022
ssh_public_addr: teleport.example.com:3023
kube_listen_addr: 0.0.0.0:3026
kube_public_addr: teleport.example.com:3026
https_keypairs:
- key_file: /var/lib/teleport/privkey.pem
cert_file: /var/lib/teleport/fullchain.pem
https_keypairs_reload_interval: 0s
acme: {}so what I (also) did was:
I created one entry in nginx proxy manager just for teleport.example.com: Please note that this file is created by nginx proxy manager itself - I just cut out empty lines. Then I added another one for the wildcard with no certificate yet: Caveats:
Feel free to add your two cents to this since my solution is far from perfect :) |
Beta Was this translation helpful? Give feedback.
-
|
You don't need a wildcard certificate unless you're planning to use Teleport application access, and even then it's only a recommendation to save time. I believe Nginx proxy manager has native support for the use of Let's Encrypt to get SSL certificates as well, so you shouldn't need to pay anything at all (unless you mean that you don't have any DNS records for your domain?) |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for your advise. Yes I want to use the Web access Feature. Nginx reverse proxy manager doesn't support the Hoster, where my domain is registered. If you are on cloud flare for instance, you can use the DNS challenge to get a wildcard certificate through let's Encrypt. |
Beta Was this translation helpful? Give feedback.
-
|
But if a wildcard certificate is only optional, please share with me, how I can get access to websites. Right now the teleport cluster access (with the webUI and the tsh command) works fine. ALSO the implementation of new nodes runs flawless, but when I add a local website it's giving me a self-signed certificate warning.: |
Beta Was this translation helpful? Give feedback.
-
|
So say your cluster is
|
Beta Was this translation helpful? Give feedback.
-
|
Thanks Webvictim, so in my case, where I want to utilize the App-Section for many Services, wildcard is the only real option. This didn't change with teleport 13.0 upward, right? The change from that version on is, that a reverse proxy-szenario is supported by default, like you said here |
Beta Was this translation helpful? Give feedback.
-
|
Yes, correct, nothing has changed with regard to certificate requirements in Teleport 13 - but we added the ability to deploy Teleport behind a layer 7 load balancer/HTTP proxy. |
Beta Was this translation helpful? Give feedback.
-
|
After some work I got this to work for applications. The Problem I am facing now is the following: it works only for applications that run on http. Some of my applications run on https with a self signed cert. These do not work. Any Idea how to get them to work? |
Beta Was this translation helpful? Give feedback.
-
|
This config on the Teleport side should work: app_service:
enabled: true
debug_app: true
apps:
- name: test
uri: https://localhost:8888
insecure_skip_verify: true |
Beta Was this translation helpful? Give feedback.
-
|
This is the way. Thank you |
Beta Was this translation helpful? Give feedback.
-
|
I finally made time to reset my teleport cluster WITH the DNS-Challenge, so I can issue Wildcard certificates. I have my nginx Proxy Manager setup to a local DNS-Provider, where I get my Certs for teleport.example.com and *.teleport.example.com from. I have the cluster up and running and it´s the same error again - I can add a SSH-Reesource, but no Application ressource. Once I implemented it, the log on the teleport node sais: and the server sais: On the WebPage I still see and in the logs there are these events at that moment popping up: I try to analyse the data but I failed understanding the issue. |
Beta Was this translation helpful? Give feedback.
-
|
I checked the API-Token and I can read and write with it in the DNS-Zones. The Cert gets delivered successfully, nginx-sais: |
Beta Was this translation helpful? Give feedback.
-
Here's how to configure Teleport 13+ behind
nginxas an HTTPS reverse proxy.Notes:
teleport.example.comwith your own public domain.teleport.example.com, pointing to the external IP address of your nginx server*.teleport.example.compointing to the external IP address of your nginx server if you want to use Teleport application accessIf you're using Cloudflare, your DNS records must be set to "DNS only" rather than "proxied"EDIT: Since version 15.1, Teleport uses regular websocket upgrades which work fine with Cloudflare proxying. However, Application Access subdomains should remain unproxied ("DNS only") unless you're using Advanced Certificate Manager.certbotwhich you can supply to nginx:sudo certbot certonly -d teleport.example.comsudo certbot certonly -d teleport.example.com,*.teleport.example.com --dns-route53certbot renewat least every 90 daysnginxto read the updated certificates when this is done.certbot.tshversion 13+ installed locally.tsh, commands liketsh loginwill not work as expected. Check your version withtsh versionand upgrade if necessary./etc/teleport.yaml:/etc/nginx/conf.d/teleport.conf:Once these files are in place, start Teleport with
sudo systemctl start teleportor similar, then start nginx withsudo systemctl start nginx.sudo journalctl -u teleport -f.sudo tail -F /var/log/nginx/access.logIf you have any issues, post comments here for assistance. We'd also love to hear if you just get it working!
Beta Was this translation helpful? Give feedback.
All reactions