From 0820c484d6872c8c5bdbd161981c0b2b0a8357c8 Mon Sep 17 00:00:00 2001
From: Paul Bellamy <paul.a.bellamy@gmail.com>
Date: Fri, 11 Sep 2015 15:33:23 +0100
Subject: [PATCH] [proxy] Documenting TLS autoconfig

---
 site/boot2docker.md | 12 ++++--------
 site/proxy.md       | 26 +++++++++++++++++---------
 2 files changed, 21 insertions(+), 17 deletions(-)

diff --git a/site/boot2docker.md b/site/boot2docker.md
index a3819b66..f964082d 100644
--- a/site/boot2docker.md
+++ b/site/boot2docker.md
@@ -15,15 +15,11 @@ instructions. First, we need to get Boot2Docker running:
 
 Assuming you have fetched the 'weave' script via curl or similar, and
 it is in the current directory, launch weave on the Boot2Docker VM and
-configure our shell. Because Boot2Docker uses TLS, we have to pass a
-few extra options when launching the docker API proxy:
+configure our shell. Boot2Docker uses TLS, but weave will auto-detect
+that, and configure things appropriately.
 
-    host1$ ./weave launch-router
-    host1$ ./weave launch-proxy --tls \
-             --tlscacert /var/lib/boot2docker/tls/ca.pem \
-             --tlscert /var/lib/boot2docker/tls/server.pem \
-             --tlskey /var/lib/boot2docker/tls/serverkey.pem
-    host1$ eval "$(./weave env)"
+    host1$ weave launch
+    host1$ eval "$(weave env)"
 
 Now, we can use the docker command to run our containers, as shown in
 the [proxy documentation](proxy.html):
diff --git a/site/proxy.md b/site/proxy.md
index 647bb098..a0c7795f 100644
--- a/site/proxy.md
+++ b/site/proxy.md
@@ -45,8 +45,9 @@ argument, e.g.
 
     host1$ weave launch-proxy -H tcp://127.0.0.1:9999
 
-When launching the proxy via TLS, `-H` and/or [TLS options](#tls) are
-required.
+If no TLS or listening interfaces are set, TLS will be autoconfigured
+based on the docker daemon's settings, and listening interfaces will
+be autoconfigured based on your docker client's settings.
 
 Multiple `-H` arguments can be specified. If you are working with a
 remote docker daemon, then any firewalls inbetween need to be
@@ -204,13 +205,20 @@ to the proxy, the specified label has precedence over the container's name.
 
 ## <a name="tls"></a>Securing the docker communication with TLS
 
-If you are
-[connecting to the docker daemon with TLS](https://docs.docker.com/articles/https/),
-you will probably want to do the same when connecting to the
-proxy. That is accomplished by launching the proxy with the same
-TLS-related command-line flags as supplied to the docker daemon. For
-example, if you have generated your certificates and keys into the
-docker host's `/tls` directory, we can launch the proxy with:
+If you are [connecting to the docker daemon with
+TLS](https://docs.docker.com/articles/https/), you will probably want
+to do the same when connecting to the proxy. The proxy will
+automatically detect the docker daemon's TLS configuration, and
+attempt to duplicate it. In the standard auto-detection case you will
+be able to launch a TLS-enabled proxy with:
+
+    host1$ weave launch-proxy
+
+You can also manually configure the proxy's TLS. This is accomplished
+by launching the proxy with the same TLS-related command-line flags as
+supplied to the docker daemon. For example, if you have generated your
+certificates and keys into the docker host's `/tls` directory, we can
+launch the proxy with:
 
     host1$ weave launch-proxy --tls-verify --tls-cacert=/tls/ca.pem \
              --tls-cert=/tls/server-cert.pem --tls-key=/tls/server-key.pem