No instructions for mdm.xml creation

[jondycz]

The documentation for warp connector links to cloudflare's docs, which were probably changed and do not contain information necessary in setting up warp-docker in connector mode.

https://github.com/cmj2002/warp-docker/blob/main/docs/warp-connector.md

[jondycz]

I found this, but I'm unsure whether this would work or if it needs more changes

https://developers.cloudflare.com/cloudflare-one/tutorials/warp-on-headless-linux/#3-create-an-installation-script

[jondycz]

Way back machine has a snapshot that is almost 2 years old. No idea whether this method of installation is supported considering its removal from the docs.

https://web.archive.org/web/20240128042134/https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/private-net/warp-connector/

[jondycz]

After struggling for a whole day, I wasn't able to get this working. Farthest I got was my packets being dropped due to them being "Martian"

[cmj2002]

Warp connector is contributed by @vinothsubramanian in #26. Unfortunately, I've never used it, so I don't know how to fix it. Maybe you can ask him for some suggestion (if he willing to).

[vinothsubramanian]

@jondycz @cmj2002 My setup is still up and running. I will check the latest documentation and get back with an update on how to make it work.

[jondycz]

Awesome. Thanks @vinothsubramanian

When I did it the old way, the JWT of the connector was not being used (tunnel showed as inactive). When I installed warp-cli into an lxc and used the official clooudflare install script, the tunnel did show up as active, but I couldn't run any traffic through it because I already have cloudflared tunnels running on the same subnet and setting the same subnet on the connector results in an error message saying the same subnet is already defined on another tunnel. But I need the tunnel to expose my local services to the outside internet. And wanted to use warp connector to connect 2 of my subnets with site-to-site routing tunnel.

Do you think my end goal is possible? I'm currently exploring other options like tailscale due to this limitation.

[vinothsubramanian]

🚀 Guide: Creating mdm.xml - Enrolling WARP Connector in Docker using Service Tokens

Follow these steps to set up the correct permissions and mdm.xml file.

Step 1: Create a Service Token

1. In the Cloudflare Zero Trust Dashboard, go to Access > Service Auth > Service Tokens.
2. Click Create Service Token.
3. Name it (e.g., warp-connector-token) and set a duration.
4. Copy the Client ID and Client Secret immediately. (You won't be able to see the secret again).

Step 2: Configure Device Enrollment Policy

1. Go to Settings > WARP Client > Device enrollment.
2. Click Manage (or Add a rule).
3. Important: Set the Rule Action to Service Auth (not "Allow").
4. Under Include, set:

• Selector: Service Token
• Value: Select the token name you created in Step 1.

5. Click Save.

Step 3: Create the WARP Connector

1. Go to Networks > Connectors > WARP Connector.
2. Click Create a connector.
3. Give it a name and click Create.
4. You will see a registration command. Copy only the token string (the long alphanumeric string following --token).

Step 4: Associate the Policy

1. Go to Settings > WARP Client > Device Settings.
2. Ensure the policy you modified in Step 2 is active for this registration.
   Note: If you have multiple profiles, ensure the one with "Service Auth" is ranked correctly or matches the connector's criteria.

Step 5: Create the mdm.xml file

Create a file named mdm.xml with the following content. This file tells the Docker container how to authenticate silently.

<dict>
    <key>organization</key>
    <string>YOUR_TEAM_NAME</string>
    <key>auth_client_id</key>
    <string>CLIENT_ID_FROM_STEP_1</string>
    <key>auth_client_secret</key>
    <string>CLIENT_SECRET_FROM_STEP_1</string>
    <key>warp_connector_token</key>
    <string>TOKEN_FROM_STEP_3</string>
</dict>

Step 6: Deploy

Once mdm.xml is ready, place it in the directory you've mapped to the container (usually /var/lib/cloudflare-warp inside the container) as described in the [warp-connector.md](https://github.com/cmj2002/warp-docker/blob/main/docs/warp-connector.md) documentation.

@jondycz Regarding your other issue, can you please try mdm.xml with above steps and let me know how it goes.