One-Click Self-Hosted Talos Omni Deployment with Automatic TLS Trust Configuration

After spending several hours troubleshooting self-hosted Talos Omni deployments, TLS certificate chains, Dex configuration, Trusted Roots, and the dreaded:

x509: certificate signed by unknown authority
Enter fullscreen mode Exit fullscreen mode

I decided to automate the entire process into a single script.

The script deploys a complete self-hosted Omni environment and automatically handles the certificate trust issues that many people encounter when onboarding Talos nodes.

What This Script Does

  • Installs and configures Dex
  • Deploys Omni
  • Generates a self-signed internal CA
  • Creates server certificates with the complete certificate chain
  • Configures SideroLink
  • Generates Trusted Roots configuration
  • Creates the talos.config.early kernel argument
  • Produces everything needed for Talos Image Factory
  • Works with Proxmox, VMware, bare metal, and cloud VMs

Why This Exists

Most self-hosted Omni installation guides require multiple manual steps:

  1. Generate certificates
  2. Configure Dex
  3. Configure OIDC
  4. Fix certificate trust issues
  5. Create Trusted Roots
  6. Generate custom Talos boot media

Missing any of these steps can prevent Talos nodes from connecting successfully.

This script automates the entire workflow from start to finish.

Prerequisites

  • Linux server
  • Docker installed and running
  • Internet access

Required Ports

Port Service
443 Omni UI
5556 Dex
8090 SideroLink API
8091 Event Sink
8100 Kubernetes Proxy
50180/UDP WireGuard

Quick Start

Make the script executable:

chmod +x install.sh
Enter fullscreen mode Exit fullscreen mode

(Optional) Customize your environment:

export OMNI_IP=<YOUR_OMNI_SERVER_IP>
export ADMIN_EMAIL=<YOUR_ADMIN_EMAIL>

./install.sh
Enter fullscreen mode Exit fullscreen mode

Example:

export OMNI_IP=192.168.1.100
export ADMIN_EMAIL=admin@example.com

./install.sh
Enter fullscreen mode Exit fullscreen mode

Variables

Variable Description
OMNI_IP IP address or hostname of the Omni server
ADMIN_EMAIL Administrator email used for Omni login

If not provided, the script uses built-in defaults.

Login Credentials

The installer automatically creates an administrator account in Dex.

Use the email configured in:

export ADMIN_EMAIL=<YOUR_ADMIN_EMAIL>
Enter fullscreen mode Exit fullscreen mode

to authenticate.

Default Password 

Admin123!
Enter fullscreen mode Exit fullscreen mode

Changing the Default Password

If you prefer a different password, generate a new bcrypt hash before running the installer:

docker run --rm -it httpd:2.4-alpine htpasswd -BnC 15 admin
Enter fullscreen mode Exit fullscreen mode

You will be prompted to enter the password twice.

Example output:

admin:$2y$15$XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Enter fullscreen mode Exit fullscreen mode

Copy only the hash portion after:

admin:
Enter fullscreen mode Exit fullscreen mode

Open the script and search for:

DEX_PASSWORD_HASH=
Enter fullscreen mode Exit fullscreen mode

Replace the existing hash with your newly generated one.

In the current version of the script, this variable is located near the beginning of the file (around line 46).

What Happens After Installation?

Once the installation completes:

Open Omni:

https://YOUR_OMNI_IP
Enter fullscreen mode Exit fullscreen mode

Log in using:

Email: ADMIN_EMAIL
Password: Admin123!
Enter fullscreen mode Exit fullscreen mode

(or your custom password)

Click:

Copy Kernel Parameters
Enter fullscreen mode Exit fullscreen mode

Open Talos Image Factory:

https://factory.talos.dev
Enter fullscreen mode Exit fullscreen mode

Build a Talos ISO using:

Recommended Settings

Platform

Metal
Enter fullscreen mode Exit fullscreen mode

Architecture

amd64
Enter fullscreen mode Exit fullscreen mode

Extensions

siderolabs/qemu-guest-agent
Enter fullscreen mode Exit fullscreen mode

(for Proxmox users)

Paste the following into:

Extra kernel command line arguments
Enter fullscreen mode Exit fullscreen mode 
<contents of talos-config-early.arg>
<Omni Kernel Parameters>
Enter fullscreen mode Exit fullscreen mode

Download the ISO and boot your nodes.

Result

After booting:

  • Nodes automatically join Omni
  • SideroLink connects successfully
  • No TLS trust errors
  • No x509: certificate signed by unknown authority
  • Cluster creation works immediately

Tested On

  • Talos 1.13.x
  • Omni Self-Hosted
  • Ubuntu Server
  • Docker
  • Proxmox VE

Download

You can download the script here:

https://github.com/jgilbertcastro/talosomni/blob/main/install.sh

Feedback

Feedback, bug reports, and pull requests are welcome.

Hopefully this saves someone else from spending hours debugging TLS certificate chains, Trusted Roots, and Talos onboarding. 😅