Last updated
Last updated
With the introduction of antMan 0.9.1 we can set a subdomain to access antMan via https://<subdomain>.antsle.us
First we want to set the subdomain in antHill. We will assume you have activated your Antsle in antHill, if you have not take a look at the . Once you login to antHill you should see your Antsle in your dashboard.
The under the subdomain column click "Get one!". You can then set the subdomain you want for this Antsle as long as its available. Lets say we set the subdomain to aster
. After you submit the configuration you will be able to connect to antMan via https://aster.antsle.us!
With InstantSSL configured, you can now securely access your antlets--just like antMan--via https. You can reach an https server on an antlet with the antlet name and antsle.us subdomain.
e.g. if I have an antlet named 'webserver', you can securely access your antlet via https://webserver.aster.antsle.us
Obtain your domain name, SSL certificate files
Place the certificate files in the certs directory
Create a virtualhosts .conf file
Restart nginx
Note: If using a self-signed certificate, as I will in this example, your browser will show warnings because the certificate has not been signed by a trusted CA. Note: Replace antman.mydomain.com with your domain in the example configuration.
First lets create a new directory to store our certificate files
You will be prompted with several questions. Enter your domain name when prompted for "Common Name"
Create and edit a new nginx virtualhosts configuration file. The .conf extension is required.
Paste the following content into the file. Replace antman.mydomain.com with your domain name on lines 9, 10 and 18. Replace the certificate path/file names if different on lines 16, 17, 46, 47, 92 and 93.
Restart the nginx service
If working on the same local network as the antsle, the domain name must resolve to the private IP of the antsle. If accessing remotely from the public internet, the domain name must resolve to your gateway/router public IP address and the router must forward port 443 to the antsle's private IP address.
SSH can be used to create a 'reverse tunnel' to antMan. The nice thing about this is the only configuration required is to create the port forwarding rule in the router. No additional nginx configuration or ssl certificates are required.
For example:
router public IP: 2.2.2.2
Antsle private IP: 192.168.1.3
router is forwarding port 22 to the Antsle's private IP 192.168.1.3 port 22
We can run the following command from a remote location
The command maps a local port (3333 in this case) to the remote port (3000) via an ssh tunnel - antMan is listening on port 3000. Now you can enter the following url in your browser to open the remote antMan
Using port 3333 is just an arbitrary choice. You can uses different local port numbers to connect to different antsle's e.g. 3333 for the San Diego Antsle and 4444 for the Dallas Antsle.
In the first example the standard ssh port is used (22). But you could forward a different port on the public side of your router. In this next example we will use port 44761 on the public side of the router.
router is forwarding port 44761 to the Antsle's private IP 192.168.1.3 port 22
For this use the '-p' option to designate the target ssh port.
The url used in your browser to open antMan is the same as the first example.
To be able to open remote kvm antlet vncConsoles via antMan add these port mappings to the ssh command
You can add as many '-L' mappings as you like. The first kvm antlet started will use port 6900 for its console. The second kvm antlet started will use port 6901... and so on.
To set up an ssl certificate for an antlet we have a couple of options
Install the certificate in the antlet
Use nginx proxy to handle the certificate
The first option requires the antlet to have a bridged NIC and be addressed directly. The traffic for each antlet/webserver would require a unique public IP address or use a unique port number for the router to direct the traffic to the correct antlet IP address. Here the certificate files are installed and handled by the antlet
The second option allows nginx to connect to the proper antlet based on the URL in the header of the request. This is desireable because you can forward traffic (at the router) for multiple sites to one IP address, the private IP address of the Antsle. The certificate files are installed and handled by nginx on the edgeLinux OS.
First create a directory for your certificate files on the edgeLinux OS.
Use SCP or SFTP to copy your certificate files to this directory.
Create and edit a new nginx virtualhosts configuration file for your domain name. Replace example.com with your domain name.
Paste the following content into the file and replace 'example.com' with your domain name.
In the 'upstream' block replace the word 'example' with your domain name and enter the server IP address. For example if the domain name is 'antsle.com' and the antlet address is 10.1.1.32 and listening on port 8080, then the upstream block would look like this:
Replace the two occurrences of 'proxy_pass http://example;' with the upstream name on lines 74 and 102
Restart the nginx service
Then copy your certificate files to the mycerts directory with or scp. For this example I will create a self-signed certificate. You can skip creating the self-signed certificate if you already have your certificate.