viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(meshcentral): re-enable TLSOffload for Traefik reverse proxy

Browse source 
The previous init container incorrectly disabled TLSOffload, causing
MeshCentral to serve HTTPS on port 443. Traefik connects via HTTP,
resulting in protocol mismatch and 500 errors. Fix ensures TLSOffload
is always enabled so MeshCentral serves plain HTTP behind Traefik.
This commit is contained in:
Viktor Barzin 2026-04-06 13:29:21 +03:00
parent cf62771177
commit 66f1e2ea3b
1 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
stacks/meshcentral/main.tf
View file

@ -115,8 +115,18 @@ resource "kubernetes_deployment" "meshcentral" {
command = ["/bin/sh"]
args = ["-c", <<-EOT
if [ -f /opt/meshcentral/meshcentral-data/config.json ]; then
# Replace "certUrl" with "_certUrl" to disable it when using TLSOffload
# Disable certUrl when using Traefik reverse proxy with TLS offload
sed -i 's/"certUrl":/"_certUrl":/g' /opt/meshcentral/meshcentral-data/config.json
# Fix WebRTC value from string to boolean
sed -i 's/"WebRTC": "[^"]*"/"WebRTC": false/g' /opt/meshcentral/meshcentral-data/config.json
# Ensure TLSOffload is enabled (Traefik terminates TLS, MeshCentral serves HTTP on 443)
# Re-enable if previously disabled by restoring _TLSOffload back to TLSOffload
sed -i 's/"_TLSOffload":/"TLSOffload":/g' /opt/meshcentral/meshcentral-data/config.json
# Set TLSOffload to true (accepts any reverse proxy)
sed -i 's/"TLSOffload": "[^"]*"/"TLSOffload": true/g' /opt/meshcentral/meshcentral-data/config.json
sed -i 's/"TLSOffload": false/"TLSOffload": true/g' /opt/meshcentral/meshcentral-data/config.json
fi
EOT
]