Hi, all.

I'm trying (and failing) to securely configure a stretched cluster where the control plane is on-prem, and some workers are in Azure. I don't have KubeSpan, but a working Wireguard setup for on-prem that fails when the worker is in Azure. I think its related to boot order requirements.

It seems to me that the even if the control plane tries to connect to the azure worker using Wireguard and the tunnel comes up, the worker still tries to connect to the cp using the Talos API over the local interface and IP. Therefore the worker never boots up correctly, waiting forever for the cp reply. When the same setup is used on-prem the worker boots correctly, sees the cp over LAN, sets up the wg tunnel and then communicates with the cp over the wg interface. Is this intended behavior?

The worker is configured using --custom-data.

After spending several hours troubleshooting self-hosted Talos Omni deployments, TLS certificate chains, Dex configuration, Trusted Roots, and the dreaded:

x509: certificate signed by unknown authority

I decided to automate the entire process into a single script.

The script deploys a complete self-hosted Omni environment and automatically handles the certificate trust issues that many people encounter when onboarding Talos nodes.

What It Does

✅ Installs and configures Dex

✅ Deploys Omni

✅ Generates a self-signed internal CA

✅ Creates server certificates with the full certificate chain

✅ Configures SideroLink

✅ Generates Trusted Roots configuration

✅ Creates the talos.config.early kernel argument

✅ Produces everything needed for Talos Image Factory

✅ Ready for Proxmox, VMware, Bare Metal, or Cloud VMs

Why?

Most self-hosted Omni guides require multiple manual steps:

• Generate certificates
• Configure Dex
• Configure OIDC
• Fix certificate trust issues
• Create Trusted Roots
• Generate custom Talos boot media

Missing any of these steps can prevent Talos nodes from connecting successfully.

This script automates the entire workflow.

Prerequisites

• Linux server
• Docker installed and running
• Internet access
• Open ports:

Port	Service
443	Omni UI
5556	Dex
8090	SideroLink API
8091	Event Sink
8100	Kubernetes Proxy
50180/UDP	WireGuard

Quick Start

Make the script executable:

chmod +x install.sh

(Optional) Customize your environment.

Replace the values below with the ones appropriate for your setup:

export OMNI_IP=<YOUR_OMNI_SERVER_IP>
export ADMIN_EMAIL=<YOUR_ADMIN_EMAIL>

./install.sh

Example:

export OMNI_IP=192.168.1.100
export ADMIN_EMAIL=admin@example.com

./install.sh

Variables

Variable	Description
OMNI_IP	IP address or hostname of the Omni server
ADMIN_EMAIL	Administrator email used for Omni login

If not provided, the script uses its built-in defaults.

Login Credentials

The installer automatically creates an administrator account in Dex.

Use the email configured in:

export ADMIN_EMAIL=<YOUR_ADMIN_EMAIL>

to authenticate.

Default Password

Admin123!

Changing the Default Password

If you want to use a different password, generate a new bcrypt hash before running the installer:

docker run --rm -it httpd:2.4-alpine htpasswd -BnC 15 admin

You will be prompted to enter the password twice.

Example output:

admin:$2y$15$XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Copy only the hash portion after:

admin:

Open the script and search for:

DEX_PASSWORD_HASH=

Replace the existing hash with your newly generated one.

In the current version of the script, this variable is located near the beginning of the file (around line 46).

What Happens Next?

After the installation completes:

1. Open Omni:

​

https://YOUR_OMNI_IP

1. Log in using:
   • Email: ADMIN_EMAIL
   • Password: Admin123! (or your custom password)
2. Click:

​

Copy Kernel Parameters

1. Open Talos Image Factory:

​

https://factory.talos.dev

1. Build a Talos ISO.

Recommended settings:

• Platform: Metal
• Architecture: amd64
• Extension:
  • siderolabs/qemu-guest-agent (for Proxmox)

1. Paste:

​

<contents of talos-config-early.arg>
<Omni Kernel Parameters>

into:

Extra kernel command line arguments

1. Download the ISO.
2. Boot your nodes.

Result

After booting:

✅ Nodes automatically join Omni

✅ SideroLink connects successfully

✅ No x509 certificate trust issues

✅ Cluster creation works immediately

Tested On

• Talos 1.13.x
• Omni Self-Hosted
• Ubuntu Server
• Docker
• Proxmox VE

Feedback, bug reports, and improvements are welcome.

Hopefully this saves someone else from spending hours debugging TLS chains, Trusted Roots, and Talos onboarding 😅

dowload the script here