Advice in Ziti docker compose deploy

Support
21

Ooook that wasn't cleare before! Thanks!

The other question is about the volume ziti-identity. I need to create this folder on my host with partitcular files inside it?
The question is related to the following adding to compose.yml you suggested me before:

services:
    ziti-host:
        image: openziti/ziti-host
        volumes:
            - ziti-identity:/ziti-edge-tunnel #?????
        environment:
            - ZITI_ENROLL_TOKEN=mytoken

#?????
volumes:
    ziti-identity:
22

It's a choice between storing the files in a Docker "named" volume or mounting a folder from the Docker host with a "bind" volume. A Docker "named" volume is managed by Docker, and is a good choice for this case because it's unlikely you will need to edit the files in the volume named "ziti-identity".

1 Like
23

I think ziti-host is searching for the enrollment token in /enrollment-token/ziti_id.jwt. In addition there's also connection refused when trying to connect to the controller. :weary:

The output:

ziti-host-1  | DEBUG: waiting 3s for /ziti-edge-tunnel/ziti_id.json (or token) to appear
ziti-host-1  | DEBUG: identity file /ziti-edge-tunnel/ziti_id.json not found
ziti-host-1  | DEBUG: /var/run/secrets/netfoundry.io/enrollment-token/ziti_id.jwt not found
ziti-host-1  | DEBUG: /enrollment-token/ziti_id.jwt not found
ziti-host-1  | INFO: enrolling /ziti-edge-tunnel/ziti_id.jwt
ziti-host-1  | (7)[        0.000]    INFO ziti-sdk:utils.c:201 ziti_log_set_level() set log level: root=3/INFO
ziti-host-1  | (7)[        0.000]    INFO ziti-sdk:utils.c:170 ziti_log_init() Ziti C SDK version 1.0.9 @g5cbbb5c(HEAD) starting at (2024-08-26T15:50:42.012)
ziti-host-1  | (7)[        0.000]    INFO ziti-sdk:ziti_enroll.c:88 ziti_enroll() Ziti C SDK version 1.0.9 @g5cbbb5c(HEAD) starting enrollment at (2024-08-26T15:50:42.012)
ziti-host-1  | (7)[        0.000]   ERROR ziti-sdk:ziti_ctrl.c:164 ctrl_resp_cb() ctrl[ziti.example.com] request failed: -111(connection refused)
ziti-host-1  | (7)[        0.000]   ERROR ziti-sdk:ziti_enroll.c:222 well_known_certs_cb() /__w/ziti-tunnel-sdk-c/ziti-tunnel-sdk-c/build/_deps/ziti-sdk-c-src/library/ziti_enroll.c:139 - ZITI_JWT_VERIFICATION_FAILED => -7 (JWT verification failed)
ziti-host-1  | (7)[        0.000]   ERROR ziti-edge-tunnel:ziti-edge-tunnel.c:2228 enroll_cb() enrollment failed: CONTROLLER_UNAVAILABLE(-7)
ziti-host-1  | ERROR: failed to enroll with token from /ziti-edge-tunnel/ziti_id.jwt (995B)

Tomorrow i'll try to figured it out hoping to find the solution!

Thanks a lot @qrkourier, you've been usefull and so kind!!
I think we'll see another time tomorrow :joy:

24

It's a good sign the ZITI_ENROLL_TOKEN variable was used to define /ziti-edge-tunnel/ziti_id.jwt inside the container. The problem is the tunneler could not reach the controller. The cause is I forgot to mention the ziti-host container must be on the same Docker network as the quickstart container.

services:
    ziti-host:
        networks:
            - quickstart
        image: openziti/ziti-host
        volumes:
            - ziti-identity:/ziti-edge-tunnel
        environment:
            - ZITI_ENROLL_TOKEN=mytoken

volumes:
    ziti-identity:

EDIT: I'm now assuming you want a local Docker quickstart network for testing. That is why it was necessary to attach the hosting tunneler container to the same network, so it could reach the "quickstart" DNS name. A public Ziti network would use a normal DNS name to find the OpenZiti controller.

25

It makes sense, and i supposed i should have guessed… :man_facepalming:t3:

Then, i have to use ziti edge config command to config the tunneler and intercept all incoming requests for the server? So:

  1. Create the service
  2. Config the tunneler to intercept service traffic

Is it correct?

26

You are running everything locally in one compose project, including client and server applications, correct?

If so, you can follow this router sidecar example with your existing local quickstart network: Deploy the Router with Docker | OpenZiti

This example includes:

  1. running the docker quickstart network
  2. create Ziti entities, including a service
  3. run the router container as a client proxy sidecar
1 Like
27

Yes, all in one compose project!

Thanks a lot, tomorrow i’ll try it! :muscle:t3:

28

The main difference is that the docker router sidecar example uses the router named "quickstart-router" included with the quickstart container as the hosting identity. In contrast, your existing setup uses a ziti-host container to host the service.

29

Yesterday i made some changes to my project's structure so i think its better to create a new topic for the discussion. I hope we'll find out the best configuration for my purpose!

1 Like