mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-24 12:49:51 +08:00
Paul Gottschling
f189f1b809
start-auth-proxy.mdx is a partial used by a number of Database Access guides. After PR #9556, the partial included garbled instructions for setting up Teleport with Let's Encrypt. This change edits these instructions for clarity.
61 lines
2.0 KiB
Plaintext
61 lines
2.0 KiB
Plaintext
<Tabs>
|
|
<TabItem scope={["oss","enterprise"]} label="Self-Hosted">
|
|
Download the latest version of Teleport for your platform from our
|
|
[downloads page](https://goteleport.com/teleport/download) and follow the
|
|
installation [instructions](../../installation.mdx).
|
|
|
|
Teleport requires a valid TLS certificate to operate and can fetch one
|
|
automatically using Let's Encrypt's ACME protocol. Before Let's Encrypt can
|
|
issue a TLS certificate for the Teleport Proxy host's domain, the ACME protocol
|
|
must verify that an HTTPS server is reachable on port 443 of the host.
|
|
|
|
You can configure the Teleport Proxy service to complete the Let's Encrypt
|
|
verification process when it starts up.
|
|
|
|
Run the following `teleport configure` command, where `tele.example.com` is the
|
|
domain name of your Teleport cluster and `user@example.com` is an email address
|
|
used for notifications (you can use any domain):
|
|
|
|
```code
|
|
teleport configure --acme --acme-email=user@example.com --cluster-name=tele.example.com > /etc/teleport.yaml
|
|
```
|
|
|
|
The `--acme`, `--acme-email`, and `--cluster-name` flags will add the following
|
|
settings to your Teleport configuration file:
|
|
|
|
```yaml
|
|
proxy_service:
|
|
enabled: "yes"
|
|
web_listen_addr: :443
|
|
public_addr: tele.example.com:443
|
|
acme:
|
|
enabled: "yes"
|
|
email: user@example.com
|
|
```
|
|
|
|
Port 443 on your Teleport Proxy Service host must allow traffic from all sources.
|
|
|
|
Next, start the Teleport Auth and Proxy Services:
|
|
|
|
```code
|
|
$ sudo teleport start
|
|
```
|
|
</TabItem>
|
|
<TabItem label="Teleport Cloud" scope={["cloud"]}>
|
|
If you do not have a Teleport Cloud account, use our [signup form](/signup) to
|
|
get started. Teleport Cloud manages instances of the Proxy Service and Auth
|
|
Service, and automatically issues and renews the required TLS certificate.
|
|
|
|
You will need to download the Enterprise version of Teleport from the
|
|
[customer portal](https://dashboard.gravitational.com/web/login) to run `tctl`
|
|
commands in Teleport Cloud.
|
|
|
|
You must log into your cluster before you can run `tctl` commands.
|
|
```code
|
|
$ tsh login --proxy=mytenant.teleport.sh
|
|
$ tctl status
|
|
```
|
|
</TabItem>
|
|
</Tabs>
|
|
|