From 95c6ae3a884812bac4c1479e5635e0e91dc5225d Mon Sep 17 00:00:00 2001 From: Shawn Jackson Date: Fri, 11 Sep 2026 21:49:14 -0700 Subject: [PATCH] Fix --- docs/self-hosted/multi.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/self-hosted/multi.md b/docs/self-hosted/multi.md index b0ead7c..9978449 100644 --- a/docs/self-hosted/multi.md +++ b/docs/self-hosted/multi.md @@ -77,7 +77,7 @@ RESGRID_APPLY=1 \ ./setup.sh ``` -Without supplied TLS files, setup generates a self-signed certificate containing all three hostnames. Distribute/trust `deploy/generated/tls.crt` on clients. +Without supplied TLS files, setup generates a self-signed certificate containing all three hostnames. Distribute/trust `deploy/generated/tls.crt` on clients. Treat this as a lab or LAN-only option: for an internet-reachable cluster, supply a certificate issued by a trusted CA through `RESGRID_TLS_CERT_FILE` / `RESGRID_TLS_KEY_FILE` (or replace the ingress TLS secret with one managed by your cluster's certificate tooling) so browsers and mobile apps trust the web, API, and events endpoints without manual certificate installation. The pod CIDR configures which ingress-to-pod forwarded headers Resgrid trusts. k3s commonly uses `10.42.0.0/16`; inspect your CNI and supply its actual network for other distributions.