tunnel: Expose tunnel service via TLS

[richbayliss]

Connects-to: balena-io/open-balena-vpn/issues/149
Connects-to: balena-io/balena-cli/issues/2042

In order to support the new CLI and balenaCloud deployment
schemes for the tunnel service, the service is now exposed via
the TLS port 443 on the tunnel.{domain} server name.

Change-type: minor
Signed-off-by: Rich Bayliss rich@balena.io

[bartversluijs]

Just for my knowledge, what's the impact of this?
And are there any additional ports required to open (like the 3129) or any added domains to be maintained (like tunnel.domain)?

I'm asking this because I'm running it in Kubernetes, where I've to add these kind of changes manually.

Thanks in advance!

[pdcastro]

@bartversluijs, good question - thanks for asking. I had added some more details in some comments in a balena-cli and open-balena-vpn issues:

• CONNECT proxy should accept TLS / HTTPS connections open-balena-vpn#149 (comment)
• tunnel command uses unencrypted connection to backend server balena-cli#2042 (comment)

Before this PR and the respective changes to balena CLI v12.38.5 and later, the balena CLI's balena tunnel command would use the following backend endpoints:

• vpn.<openBalena-domain>:3128 (openBalena) - unencrypted
• vpn.balena-cloud.com:3128 (balenaCloud production) - unencrypted
• vpn.balena-staging.com:3128 (balenaCloud staging) - unencrypted

After this PR and starting with CLI v12.38.5, a new hostname and port number are used:

• tunnel.<openBalena-domain>:443 (openBalena) - TLS encrypted
• tunnel.balena-cloud.com:443 (balenaCloud production) - TLS encrypted
• tunnel.balena-staging.com:443 (balenaCloud staging) - TLS encrypted

Port 3129 is not used/exposed externally. I gather it is only used by haproxy (backend server) locally (127.0.0.1) for internal server routing / balancing after TLS decryption. Port 3128 also no longer needs to be exposed externally (it's still used internally).

By the way, to be clear, none of this affects how the VPN link to balenaOS devices used encryption. The VPN link to balenaOS devices has always used encryption and this has not changed. Communication between the backend and the devices has always been encrypted. The old vpn.<openBalena-domain>:3128 endpoint was only used by the CLI's balena tunnel command, and only traffic between the CLI's balena tunnel command (typically running on a developer's workstation) and the backend was missing encryption.

To avoid disruption when using the CLI's balena tunnel command, the balena CLI version should be matched to the openBalena version:

• openBalena v3.1.2 or later: use CLI v12.38.5 or later
• older openBalena releases: use older CLI releases

[bartversluijs]

Thanks for your detailed explanation!
I'll update my Kubernetes fork asap.