Feature/tls docs

docs/quickstart.md

@@ -12,4 +12,7 @@ You can create a first user on the user page. The `admin` user cannot create VPN
 * Log-out and Log-in using the new credentials
 * Create a new connection on the Connections page
 * Download the configuration
-* Import the configuration in a WireGuard® Client. See [https://www.wireguard.com/install/](https://www.wireguard.com/install/) for WireGuard® clients.
+* Import the configuration in a WireGuard® Client. See [https://www.wireguard.com/install/](https://www.wireguard.com/install/) for WireGuard® clients.
+
+# Access for existing users in Identity Providers
+To allow access for users created in Active Directory, Okta, Onelogin, or other Identity Providers, navigate to the [OIDC](oidc.md), [SAML](saml.md), or [Provisioning (SCIM)](scim.md) pages to setup an IdP connection.

docs/release-notes.md

@@ -5,6 +5,8 @@
 * UI: ability to reload WireGuard® configuration 
 * UI: modify client/server WireGuard® configuration files using templates
 
+Note: after upgrading, make sure to close any old browser tab to ensure the new UI version is loaded.
+
 ## Version v1.0.41
 * UI: axios version bump
 * UI: disable https forwarding when request is served over http

docs/tls.md

@@ -0,0 +1,16 @@
+# TLS
+
+## Configuration
+
+You can enable TLS (https) in the VPN Settings. TLS only works if you have a hostname configured as the "VPN Server Hostname". Make sure you have created a DNS record like vpn.yourcompany.com to the IP address of the VM instance. Once you enable the TLS setting, let's encrypt will be activated. An API call will be made to [letsencrypt.com](https://letsencrypt.org/), which will then make an HTTP call on your hostname to verify ownership. Only when this call succeeds, the TLS certificate will be issued, and the VPN Server will be accessible over https.
+
+## http to https forward
+Make sure to only enable the http to https forwarding when https is fully working. If you enabled the http to https forwarding, but can't access the VPN Server over https, you can still disable the forwarding manually.
+
+Log in using SSH to the VPN Server and cd into the /vpn/config directory. The config.json file contains an attribute `redirectToHttps` that will be set to `true`. You can either remove the attribute and value or set the value to false. Also make sure that the attribute `protocol` is set back to `http` instead of `https`. Restart the VPN server using `systemctl restart vpn-rest-server`.
+
+## Alternatives
+On Cloud providers like AWS a Load Balancer can be created to ensure access between the client and the AWS Load Balancer is using TLS.
+
+## VPN Traffic
+VPN Traffic between client and VPN Server using WireGuard® is always encrypted. The TLS solution using Let's Encrypt is only to encrypt web traffic between the client (the browser) and the VPN Server Admin Web Interface.

mkdocs.yml

@@ -4,6 +4,7 @@ nav:
   - 'User Guide':
     - 'Installation': 'install.md'
     - 'Quick Start': 'quickstart.md'
+    - 'TLS (https)': 'tls.md'
     - Upgrade: 'upgrade.md'
     - FAQ: faq.md
   - 'Authentication & Provisioning':