mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 02:21:02 +08:00
Paul Gottschling
c423c08fd3
* Refresh the Enterprise Getting Started guide Fixes #14249 Edit the Enterprise Getting Started guide based on manual testing to make the guide up to date and easier to follow. - Update the architectural description in the introduction - Structure the guide, following out Linux Server guide for open source installations, to include Application Access - Add DNS instructions rather than using the `--insecure` flag - Add copy-pastable installation instructions - Flesh out the license file instructions and add a screenshot of the customer portal - Simplify the instructions for adding a local user - Remove the docker-compose instructions, since we want the user to finish setting up a minimal Teleport cluster by the end of the guide, and these instructions begin a new step-by-step sequence. We also have a separate docker-compose guide that users can follow for a local demo - Add a "Next steps" section and move relevant content there * Respond to PR feedback
71 lines
2.7 KiB
Plaintext
71 lines
2.7 KiB
Plaintext
Set up two `A` DNS records: `tele.example.com` for all traffic and
|
|
`*.tele.example.com` for web apps using Application Access. We are assuming
|
|
that your domain name is `example.com`. Use your own subdomain instead of
|
|
`tele`.
|
|
|
|
<Details opened={false} title="Why are we using wildcard subdomains for Application Access?">
|
|
(!docs/pages/includes/dns-app-access.mdx!)
|
|
</Details>
|
|
|
|
<Details title="DNS instructions for cloud providers" opened={false}>
|
|
|
|
Execute the following commands on the host where you are running the Teleport Proxy
|
|
Service:
|
|
|
|
<Tabs>
|
|
<TabItem label="AWS Route 53">
|
|
```code
|
|
# Tip for finding AWS zone id by the domain name.
|
|
$ MYIP="$(curl https://ipv4.icanhazip.com/)"
|
|
$ MYZONE_DNS="example.com"
|
|
$ MYZONE=$(aws route53 list-hosted-zones-by-name --dns-name=${MYZONE_DNS?} | jq -r '.HostedZones[0].Id' | sed s_/hostedzone/__)
|
|
|
|
# The fully qualified domain name for your Teleport Proxy Service.
|
|
# These commands will also create an A record for a wildcard subdomain.
|
|
$ MYDNS="tele.example.com"
|
|
|
|
# Create a JSON file changeset for AWS.
|
|
$ jq -n --arg ip ${MYIP?} --arg dns ${MYDNS?} '{"Comment": "Create records", "Changes": [{"Action": "CREATE","ResourceRecordSet": {"Name": $dns, "Type": "A", "TTL": 300, "ResourceRecords": [{ "Value": $ip}]}},{"Action": "CREATE", "ResourceRecordSet": {"Name": ("*." + $dns), "Type": "A", "TTL": 300, "ResourceRecords": [{ "Value": $ip}]}}]}' > myrecords.json
|
|
|
|
# Review records before applying.
|
|
$ cat myrecords.json | jq
|
|
# Apply the records and capture change id
|
|
$ CHANGEID=$(aws route53 change-resource-record-sets --hosted-zone-id ${MYZONE?} --change-batch file://myrecords.json | jq -r '.ChangeInfo.Id')
|
|
|
|
# Verify that change has been applied
|
|
$ aws route53 get-change --id ${CHANGEID?} | jq '.ChangeInfo.Status'
|
|
# "INSYNC"
|
|
```
|
|
</TabItem>
|
|
<TabItem label="GCP Cloud DNS">
|
|
```code
|
|
$ MYZONE="myzone"
|
|
# The fully qualified domain name for your Teleport Proxy Service.
|
|
# These commands will also create an A record for a wildcard subdomain.
|
|
$ MYDNS="tele.example.com"
|
|
$ MYIP="$(curl https://ipv4.icanhazip.com/)"
|
|
|
|
$ gcloud dns record-sets transaction start --zone="${MYZONE?}"
|
|
$ gcloud dns record-sets transaction add ${MYIP?} --name="${MYDNS?}" --ttl="30" --type="A" --zone="${MYZONE?}"
|
|
$ gcloud dns record-sets transaction add ${MYIP?} --name="*.${MYDNS?}" --ttl="30" --type="A" --zone="${MYZONE?}"
|
|
$ gcloud dns record-sets transaction describe --zone="${MYZONE?}"
|
|
$ gcloud dns record-sets transaction execute --zone="${MYZONE?}"
|
|
```
|
|
</TabItem>
|
|
|
|
|
|
</Tabs>
|
|
|
|
</Details>
|
|
|
|
<Admonition
|
|
type="tip"
|
|
title="Tip"
|
|
>
|
|
You can use `dig` to make sure that DNS records are propagated:
|
|
|
|
```code
|
|
$ dig tele.example.com
|
|
```
|
|
</Admonition>
|