Enable native TLS support

[Jose Delarosa]

It would be very beneficial to have native support for TLS encryption for the web UI in MAAS. Though a solution [0] using a reverse proxy server is available, it can be a burden or difficult to deploy and configure this proxy server as part of an automated MAAS/Juju deployments.

Even if the reverse proxy server can be added as a Juju application, it would make the most sense to just add TLS support in MAAS proper.

[0] https://maas.io/docs/ssl

[Lee Trager (ltrager)]

I wrote a spec up a few months ago to add SSL support to MAAS, including using MAAS as a CA. It didn't get on the roadmap but I agree it is something we should do.

https://docs.google.com/document/d/1Dt1U_lSTRg0h1_8RFfNgxcDUF71W_elSWkYMEx83tUc/edit#heading=h.oncww1139tq8

[Eric Stumbo (ericstumbo)]

This is something that should be enabled. On a single node deployment native support would make deployments much easier over deploying another machine as the TLS LB for encrypting and decrypting. I can remember when MaaS had this built in but was removed somewhere during its lifetime.

The user should have the ability to turn this on or off depending on deployment type. For example our development and QA environment are single node machines but PROD is a HA cluster. In Prod I understand the need for external load balancers acting as a TLS encryption/decryption application but in QA or DEV it seems like extra steps for something that used to or needs to be included.

[Adam Collard (adam-collard)]

We worked on this in 3.2 - user docs at https://maas.io/docs/how-to-enable-tls-encryption#heading--how-to-use-maas-native-tls