From c4b8595f203cd0bfeacd124735fe29bbb1f5e0b8 Mon Sep 17 00:00:00 2001
From: Christian Goll <cgoll@suse.com>
Date: Wed, 3 Dec 2025 15:21:15 +0100
Subject: [PATCH] added documentation

foo
---
 CHANGELOG.md                 | 11 +++++++++++
 userdocs/server/security.rst | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 44d937a1..3db081f4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Updated arguments for `ValidString` to match `regexp.MatchString`
 - New `mig` overlay to configure NVIDIA MIG devices. #2102
 - Documented that booting a node twice fixes broken partition tables
+- Updated arguments for `ValidString` to match `regexp.MatchString`
+- New `mig` overlay to configure NVIDIA MIG devices. #2102
+- TLS with the command `wwctl configure tls` for key management.
+  Keys can be created automtically or imported. The runtime overlay is
+  if TLS is enabled is not distributed over plain http.
+  
 
 ## v4.6.5, 2026-01-12
 
@@ -35,6 +41,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - New `range6 start` and `range6 end` in `warewulf.conf:dhcp`. #2068
 - New `Gateway6` network device field. #2068
 - New `systemd-networkd` overlay. #2068
+- `wwclient.aarch64` overlay always provides an aarch64 wwclient executable.
+- `wwclient.x86_64` overlay always provides an x86_64 wwclient executable.
+- systemd-networkd overlay with IPv6 support
+- `wwctl overlay info` lists the variables used by an overlay template
+- TLS
 
 ### Changed
 
diff --git a/userdocs/server/security.rst b/userdocs/server/security.rst
index a8fb8eb1..c8141764 100644
--- a/userdocs/server/security.rst
+++ b/userdocs/server/security.rst
@@ -40,6 +40,10 @@ There are multiple ways to secure the Warewulf provisioning process:
   This means that the nodes only boot the kernel which is provided by the
   distributor and also custom complied modules can't be loaded.
 
+* Tls (transport layer security) can be enabled for the warewulf server. However
+  the https is only used for runtime overlays. The kernel and system image are *always*
+  transfered unencrypted as iPXE and grub can't handle https.
+
 SELinux
 =======
 
@@ -82,3 +86,34 @@ with the Warewulf server.
    nft add rule inet filter input tcp dport 9873 accept
    nft list ruleset >/etc/nftables.conf
    systemctl restart nftables
+
+
+HTTPS
+=====
+
+The https functionality can be enabled by setting
+
+.. code-block:: yaml
+..
+.. warewulf:
+..   enable https: true
+..   secure port:  9874
+..
+
+Which will enable a https server on the secure port. The certificate and key
+can be created as self signed key with ``wwctl configure keys --create``. The
+keys and certificate are stored if not configured otherwise as
+
+.. code-block:: console
+..
+.. /etc/warewulf/keys/warewulf.crt # PEM certificate
+.. /etc/warewulf/keys/warewulf.key # PEM RSA Key
+
+
+
+For the key and certifcate generation no addiotional parameters can be set, but
+you can import your own keys, with ``wwctl configure keys import``.
+
+If HTTPS is enabled the delivery of the runtime overlays is disabled over HTTP, so
+you **must** use `wwclient` to get the runtime overlays.
+