2 ms·
How did you manage to put the derper behind Traefik? It seems to be not supported at least officially: “ The DERP protocol does a protocol switch inside TLS fr
by antonkochubey 1y ago
How did you manage to put the derper behind Traefik? It seems to be not supported at least officially:
“ The DERP protocol does a protocol switch inside TLS from HTTP to a custom bidirectional binary protocol. It is thus incompatible with many HTTP proxies. Do not put derper behind another HTTP proxy.”
- Jnr 1y agoI learned this from hosting SmallStep CA behind Traefik. You can use TCP mode for specific subdomains and match it using HostSNI. Then if the client uses SNI it should work. So you can use both TCP and HTTP routers on the same port. https://github.com/Janhouse/tailscaled-derper/blob/main/docker-compose.yml#L31-L36 https://github.com/Janhouse/tailscaled-derper/blob/main/dock... Since we use TLS passthrough and Traefik just proxies TCP, you have to pass certificates to derper, so you either use the Traefik certificate extractor or some other tool to get them. And initially I though that I would have to integrate libproxyproto into derper in order to handle client IP addresses correctly behind Traefik but it looks like it doesn't really need it.