Overview

WolfStack ships TLS that works out of the box on every install — no manual cert generation, no exposed plain-HTTP dashboards, and a one-click path to real Let’s Encrypt certificates including wildcards via DNS-01.

Three input modes:

• Auto self-signed (default). Generated on first start if you haven’t supplied anything. RSA-2048, 10-year validity, SAN covers your hostname plus localhost / 127.0.0.1 / ::1 and every non-loopback IP the host has. Lives at /etc/wolfstack/tls/cert.pem.
• Let’s Encrypt via certbot. HTTP-01 (webroot) or DNS-01 with 15 supported providers. Auto-renewed daily.
• Bring your own. Upload existing cert/key pairs or point WolfStack at any path on disk (cerbot, ACME.sh, internal CA, whatever).

Secure by default. Real certs in one click.

• HTTPS on every fresh install. Auto-generates a 10-year self-signed cert with SAN covering hostname, localhost, and every host IP. The dashboard is encrypted from boot.
• Guided HTTPS onboarding. Browser-by-browser instructions for accepting the self-signed cert (Chrome / Edge / Firefox / Safari) plus a one-click “Continue to HTTPS login” redirect after upgrades.
• Certbot DNS plugin install across every distro. Six package managers (apt / dnf / pacman / zypper / apk / pipx) plus snap as an EFF-recommended alternative where supported, with smart pre-flight, LXC/Docker awareness, and per-environment guidance.

Self-signed cert (default)

The first time you start WolfStack with no --tls-cert, no --tls-domain, and no Let’s Encrypt cert in a standard location, it generates one:

• Algorithm: RSA-2048 (universal browser compatibility).
• Validity: 10 years — no renewal cron needed for the lifetime of a typical deployment.
• Subject Alternative Names (SAN): includes your hostname, *.<hostname> for FQDNs, localhost, 127.0.0.1, ::1, and every non-loopback IP on the host (auto-detected via ip -j addr show).
• Storage: cert at /etc/wolfstack/tls/cert.pem (0644), private key at /etc/wolfstack/tls/key.pem (0600).
• Reuse logic: if the cert already exists, parses cleanly, and isn’t within 30 days of expiry, it’s used as-is. Delete the file to force regeneration.

Your browser will warn once per node about the self-signed CA — accept it (Advanced → Proceed) or import the cert into your trust store. Once you have a real domain pointed at the node, request a Let’s Encrypt cert via the Certificates page and the self-signed one is replaced automatically.

Let’s Encrypt via DNS-01 (wildcard-friendly)

Wildcard certs (*.example.com) require DNS-01 — the ACME challenge that certbot proves by writing a TXT record. WolfStack supports 15 DNS providers out of the box. Add your API credentials once in Settings → DNS Providers, then issue and renew certs without ever touching port 80.

Supported providers

Credentials are XOR-obfuscated at rest in /etc/wolfstack/dns-providers.json and materialised to a 0600 INI file under /run/wolfstack/dns-creds/ only for the duration of the certbot call (RAII-cleaned via Rust’s Drop — even on error or panic).

Every provider has a “Test” button that runs a Let’s Encrypt staging-CA dry-run so you can validate credentials without burning your production rate limit.

One-click plugin install across every distro

The plain certbot package on most distros doesn’t bundle DNS plugins — each provider is a separate package. WolfStack’s Settings → DNS Providers page detects what’s missing on your node and offers a one-click install with the correct command for your distro.

Distro	Package manager	Example (Cloudflare plugin)
Debian / Ubuntu	apt-get	sudo apt-get install -y python3-certbot-dns-cloudflare
Fedora / RHEL / Rocky / Alma	dnf	sudo dnf install -y python3-certbot-dns-cloudflare
Arch / Manjaro / CachyOS	pacman	sudo pacman -S --noconfirm --needed certbot-dns-cloudflare
openSUSE Leap	zypper	sudo zypper install -y python3-certbot-dns-cloudflare
openSUSE Tumbleweed	zypper	sudo zypper install -y python313-certbot-dns-cloudflare (auto-detected Python version)
Alpine Linux	apk	sudo apk add --no-cache certbot-dns-cloudflare
Any (community plugins)	pipx	pipx install certbot && pipx inject certbot certbot-dns-cloudflare

Smart pre-flight

Before suggesting an install command, WolfStack pre-checks that the package actually exists in your host’s repos — one batched apt-cache show or dnf info covering all 15 plugins. If your distro dropped a package (Debian 13 trixie cut several DNS plugins; EPEL 9/10 omit google and gandi), WolfStack silently falls through to a pipx pipeline that includes the right uninstall-then-reinstall steps so the inject reaches the right venv.

The page also surfaces:

• Runtime badge — host / LXC / Docker / VM, so you see your environment at a glance.
• Cache staleness warning — if your apt/dnf cache is > 24h old, an amber banner tells you which command to run to refresh (so a stale “not available” doesn’t mislead you).
• Snap as an EFF-recommended alternative — offered only when snap is actually usable (snapd running, not in LXC/Docker where it’s broken).
• Container-specific notes — LXC operators get a heads-up about CAP_NET_BIND_SERVICE for HTTP-01 and the Proxmox pct set <CTID> -features keyctl=1 incantation; Docker operators get a reminder about Dockerfile persistence.

Discovery and inventory

The Certificates page scans every configured cert source on every node:

• Certbot live directory (/etc/letsencrypt/live/) — renewals, expiry dates, included domains.
• WolfStack’s own /etc/wolfstack/tls/.
• Proxmox pveproxy-ssl.pem + key pairs across all PVE nodes.
• Any path you’ve uploaded a custom pair to.

Each cert shows expiry countdown, SAN list, signing chain, and origin (which node, which path). Sort by “expires soonest” to find your next renewal action.

Auto-renewal

A daily background task runs certbot renew --quiet with a deploy hook that reloads WolfProxy (and anything else you’ve told it to reload via reload_cmd in /etc/wolfstack/certbot.json). Renewals happen quietly in the background; you get an alert only if one fails.

Container & environment compatibility

WolfStack is tested and supported across:

• Bare-metal hosts — Debian, Ubuntu, Fedora, RHEL, Rocky, Alma, Arch, Manjaro, CachyOS, openSUSE Leap, openSUSE Tumbleweed, Alpine.
• LXC containers (including unprivileged Proxmox CT) — DNS-01 always works; HTTP-01 needs CAP_NET_BIND_SERVICE.
• Proxmox VMs and libvirt/KVM VMs — behave as normal hosts.
• Docker containers — install persists for container lifetime; bake into Dockerfile for permanence.
• systemd-nspawn — same guidance as LXC.

WolfStack auto-detects the container runtime via /proc/1/environ and surfaces environment-specific guidance in the install UI. snap suggestions are auto-disabled in LXC, Docker, and nspawn where snapd is broken.