Yay I have working nginx conf, I will write a medium post so others can do it too because it needn't be such a mystery
🔎 1
s
Sarah Gillespie
08/09/2021, 3:02 PM
Zoinks!
😂 1
d
defensivedepth
08/09/2021, 3:30 PM
What specifically were you working on RE: nginx?
m
Mystery Incorporated
08/09/2021, 4:07 PM
splitting UI and agent traffic, having an LE cert for UI and using my self signed cert using ed448 (for CA) and ed25519 (for server) for the agent api.
All the doco I could find was using old kolide endpoints that don't exist anymore or have been renamed.
Also split the domains so for e.g. ui.fleet.mydomain.com and api.fleet.mydomain.com (didn't use this naming scheme tho) so the UI is accessed on a different domain than the agents use.
This also allows me to set up a honey pot that looks for anything trying to access the api on my UI domain, or anything trying to access the UI on my api domain :)