netbirdio / netbird

Connect your devices into a single secure private WireGuard®-based mesh network with SSO/MFA and simple access controls.
https://netbird.io
BSD 3-Clause "New" or "Revised" License
9.87k stars 428 forks source link

TLS/SSL Handling for Netbird Domain #2080

Open Thunderbottom opened 1 month ago

Thunderbottom commented 1 month ago

Is your feature request related to a problem? Please describe. Currently the only TLS/SSL being used is the one that wireguard brings. We would like to have SSL connection to endpoints running over netbird for services that can be accessed through the configured netbird domain (eg. peer.netbird.domain).

Describe the solution you'd like

  1. A way for netbird to handle TLS/SSL termination for the netbird domain.
  2. A way to configure TLS/SSL for such endpoints.

Maybe a wildcard certificate can be generated, and trusted in the root CA for all the netbird registered peers, so service-level SSL can be made possible. If netbird is to not handle the termination, the certificates can be placed in some directory on the peer, and can be utilised within the reverse proxy or application configuration.

Describe alternatives you've considered Currently none, but can use self-signed certificates and install on each node manually. This process can be automated through netbird since it already allows access through the configured domain.

Additional context N/A