blob: 24620701bd8664271d67196baf748294ad0a3886 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
# cert-manager for f3s LAN TLS
This directory contains cert-manager configuration for providing self-signed TLS certificates for LAN access to f3s services via `*.f3s.lan.buetow.org`.
## Overview
- **Purpose**: Provide TLS certificates for LAN ingresses
- **Certificate Type**: Self-signed (via self-signed ClusterIssuer)
- **Wildcard Cert**: `*.f3s.lan.buetow.org`
- **TLS terminated by**: Traefik inside k3s (via ingress `tls.secretName: f3s-lan-tls`).
FreeBSD relayd on the CARP VIP (192.168.1.138) is a **pure TCP passthrough**
(`forward to <k3s_nodes> port 443 check tcp`, no `tls` keyword) — it does **not**
terminate TLS and needs no certificate of its own.
## Components
1. **cert-manager.yaml** - Official cert-manager installation (v1.14.4)
2. **self-signed-issuer.yaml** - ClusterIssuer for self-signed certificates
3. **ca-certificate.yaml** - CA certificate for signing
4. **wildcard-certificate.yaml** - Wildcard certificate for `*.f3s.lan.buetow.org`
## Deployment
Deployed via ArgoCD from `argocd-apps/infra/cert-manager.yaml`.
Manual deployment:
```bash
just install
```
## relayd does NOT need the certificate (historical note)
> **Obsolete:** relayd used to terminate TLS and required the wildcard keypair
> exported to `/usr/local/etc/ssl/relayd/`. The setup has since moved to **TCP
> passthrough** — relayd forwards raw TLS to Traefik, which terminates it using
> the `f3s-lan-tls` secret. There is no longer any export step, and the leftover
> `/usr/local/etc/ssl/relayd/f3s.lan.buetow.org*` files on f0/f1 are unused.
Because cert-manager renews the cert in-cluster and Traefik reloads it
automatically, **no manual action is normally required** on renewal.
Pitfall (root cause of the 2026 LAN-cert outage): if `relayd.conf` is changed
(e.g. termination → passthrough), the running relayd process keeps the **old**
behaviour and its cached keypair until restarted. Always `doas service relayd
restart` (not `reload` — SIGHUP does not re-read TLS keypairs) on **f0 and f1**
after editing relayd's TLS config, then verify the live cert at the VIP:
```bash
echo | openssl s_client -connect 192.168.1.138:443 \
-servername f3s.lan.buetow.org 2>/dev/null | openssl x509 -noout -dates
```
## Trusting the CA Certificate
To avoid browser warnings, clients must trust the self-signed CA:
### Export CA Certificate
```bash
kubectl get secret selfsigned-ca-secret -n cert-manager -o jsonpath='{.data.ca\.crt}' | base64 -d > f3s-lan-ca.crt
```
### Install on Clients
**Linux (Fedora/Debian/Ubuntu):**
```bash
sudo cp f3s-lan-ca.crt /usr/local/share/ca-certificates/f3s-lan-ca.crt
sudo update-ca-certificates
```
**macOS:**
```bash
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain f3s-lan-ca.crt
```
**Windows:**
- Double-click `f3s-lan-ca.crt`
- Install to "Trusted Root Certification Authorities"
**Android:**
- Settings → Security → Encryption & credentials → Install a certificate → CA certificate
**iOS:**
- AirDrop the certificate or email it
- Settings → General → VPN & Device Management → Install Profile
## Certificate Renewal
The wildcard cert is valid for 90 days (`renewBefore: 360h` = 15 days).
cert-manager renews it automatically and Traefik picks up the updated
`f3s-lan-tls` secret on its own — **no manual re-export to relayd** (relayd is
now TCP passthrough; see the section above).
## See Also
- [cert-manager documentation](https://cert-manager.io/docs/)
- [Self-signed certificates](https://cert-manager.io/docs/configuration/selfsigned/)
|
