feat: Document the security setup for access to the API.
@@ -16,6 +16,7 @@ Opinionated platform that runs on Kubernetes, that takes you from App to URL in
- [Install dependencies](#install-dependencies)
- [Get yourself a cluster](#get-yourself-a-cluster)
- [Install Epinio](#install-epinio)
+ - [A Quick Note On Security](#a-quick-note-on-security)
- [Push an application](#push-an-application)
- [Check that your application is working](#check-that-your-application-is-working)
- [List all commands](#list-all-commands)
@@ -137,6 +138,24 @@ In case of trouble with Epinio's Traefik component or Ingress controllers, the
[Traefik](docs/advanced.md#traefik) section in the
[Advanced Topics](docs/advanced.md) document shall be your friend.
+#### A Quick Note On Security
+
+Epinio secures access to its API with TLS and basic authentication.
+
+None sign of that appeared in the above example because the installation process
+automatically creates and saves the necessary credentials (user, password) and
+certificates. The information is stored in Epinio's configuration, for pickup by
+other Epinio commands.
+
+For a trial deployment as described above the certificate securing the API will
+be generated by the underlying cluster, and self-signed, and its CA certificate
+is stored in the configuration to allow verification.
+
+For a production-oriented deployment on the other hand, with a proper
+`--system-domain` specified, the certificate is obtained from
+[Let's Encrypt](https://letsencrypt.org/) instead. Nothing is stored in the
+configuration in that case, as LE is a known CA.
+
### Push an application
NOTE: If you want to know the details of the `epinio push` process, read this
