Automating zrok Forwarding URL Generation for Clients on AWS EC2: API, Database Access, or Shell Script?

[vkagent47]

Hi OpenZiti community,

I’m self-hosting zrok inside a Docker container on an AWS EC2 instance, where my service is also running. My goal is to expose this service using zrok and automate the process of generating forwarding URLs for clients. Specifically, I have the following questions:

1. Database Access:
   Does zrok store forwarding URLs in its SQLite database (zrok.db)? If so, can clients directly query this database to retrieve their forwarding URLs? What’s the recommended way to expose this data securely, especially in an AWS EC2 environment?
2. API for URL Generation:
   Does zrok provide a REST API for programmatically creating shares and retrieving forwarding URLs? If yes, could you share an example of how to authenticate and use this API? I’d like to allow clients to generate forwarding URLs on their own without manual intervention.
3. Fallback Solution:
   If the above options aren’t feasible, I’m considering a shell script that runs zrok share public and a Spring Boot API to execute this script. The idea is to allow clients to hit the API, pass the port number of the service they want to expose, and get the forwarding URL in response. Would this approach work, and are there any pitfalls I should be aware of?

Additionally, since this is on AWS EC2, are there any specific configurations or security considerations I should keep in mind while exposing my service using zrok?

Any guidance, examples, or best practices would be greatly appreciated!

Thanks in advance!

[michael.quigley]

@vkagent47

Database Access:
Does zrok store forwarding URLs in its SQLite database (zrok.db)? If so, can clients directly query this database to retrieve their forwarding URLs? What’s the recommended way to expose this data securely, especially in an AWS EC2 environment?

You for sure do not want clients directly interacting with the underlying database. Whatever data you want is available through the API.

@vkagent47

API for URL Generation:
Does zrok provide a REST API for programmatically creating shares and retrieving forwarding URLs? If yes, could you share an example of how to authenticate and use this API? I’d like to allow clients to generate forwarding URLs on their own without manual intervention.

I would suggest you take a look at the OpenAPI spec:

specs/zrok.yml

Specifically check out the /share endpoint, it already does what you want.

zrok also includes an SDK in the sdk tree in the project. Bindings exist for golang, nodejs, and python.

Checking these things out should answer most of your questions.