BrowZer really needs to have legitimate, 3rd party verifiable certificates from a publicly trusted CA, something like LetsEncrypt or ZeroSSL (or other). So beware of that particular problem. If you're running it locally from the example docker-compose quickstart, you'll likely struggle with BrowZer. you can do it, but it gets more complex due to the self-signed CA/pki... Just beware. It's way easier to start with BrowZer with a public url, and alt server certs setup. I assume you also discovered the sub menu item of the example setup here Example Enabling BrowZer | OpenZiti ? It's got a video that goes along and has a full video walkthrough too. Maybe that will be a good resource for you to review but it doesn't use the docker compose quickstart so - maybe not. Maybe this would be a good topic for Ziti TV, I don't have one queued up but a "working session" of me trying to get browzer working might be educational? Ziti TV airs at 11 AM ET on Fridays when I have a topic to cover (approx 3.5 hours from right now) You can find them here https://www.youtube.com/playlist?list=PLMUj_5fklasKBlnVqh6YJuURKlgo39Yo1
ZITI_CONTROLLER_HOST is the externally visible url to the controller that has that 3rd party, trusted certificate. So for me, you can see my value is ZITI_CONTROLLER_HOST: ctrl.clint.demo.openziti.org (and with the port https://ctrl.clint.demo.openziti.org:8441/) you can get to this url and inspect the certificate if you like. So this is the "alternate" url because there's ALSO the self-signed PKI on the internet at this address (the 'main' url) https://ec2-3-142-245-63.us-east-2.compute.amazonaws.com:8441/
Here's a sample environment from my running BrowZer install:
environment:
NODE_ENV: production
ZITI_BROWZER_BOOTSTRAPPER_LOGLEVEL: debug
ZITI_BROWZER_RUNTIME_LOGLEVEL: debug
ZITI_CONTROLLER_HOST: ctrl.clint.demo.openziti.org
ZITI_CONTROLLER_PORT: 8441
ZITI_BROWZER_BOOTSTRAPPER_HOST: browzer.clint.demo.openziti.org
ZITI_BROWZER_BOOTSTRAPPER_LISTEN_PORT: 443
ZITI_BROWZER_BOOTSTRAPPER_CERTIFICATE_PATH: /etc/letsencrypt/live/clint.demo.openziti.org/fullchain.pem
ZITI_BROWZER_BOOTSTRAPPER_KEY_PATH: /etc/letsencrypt/live/clint.demo.openziti.org/privkey.pem
ZITI_BROWZER_BOOTSTRAPPER_SCHEME: https
ZITI_BROWZER_RUNTIME_ORIGIN_TRIAL_TOKEN: "YOUR_TOKEN_HERE"
_ZITI_BROWZER_BOOTSTRAPPER_WILDCARD_VHOSTS: false
ZITI_BROWZER_BOOTSTRAPPER_TARGETS: >
{
"targetArray": [
{
"vhost": "docker-whale.clint.demo.openziti.org",
"service": "docker.whale",
"path": "/",
"scheme": "http",
"idp_issuer_base_url": "https://keycloak.clint.demo.openziti.org:8446/realms/zitirealm",
"idp_client_id": "browzerBootstrapClient",
"idp_type": "keycloak",
"idp_realm": "zitirealm"
},
{
"vhost": "brozac.clint.demo.openziti.org",
"service": "brozac",
"path": "/",
"scheme": "http",
"idp_issuer_base_url": "https://keycloak.clint.demo.openziti.org:8446/realms/zitirealm",
"idp_client_id": "browzerBootstrapClient",
"idp_type": "keycloak",
"idp_realm": "zitirealm"
},
{
"vhost": "puter.clint.demo.openziti.org",
"service": "puter",
"path": "/",
"scheme": "http",
"idp_issuer_base_url": "https://keycloak.clint.demo.openziti.org:8446/realms/zitirealm",
"idp_client_id": "browzerBootstrapClient",
"idp_type": "keycloak",
"idp_realm": "zitirealm"
}
]
}
NODE_EXTRA_CA_CERTS -- as I recall (I'm fuzzy on it right now as I don't use this feature much) is to allow you to use your own PKI for the BrowZer bootstrapper so that it can actually connect to a controller without an third-party server cert (self-signed PKI). This is part of the "more complex" part I was alluduing to before.
We don't have a "how to browzer entirely locally" guide that I know of. That also might be a good Ziti TV topic in general. it's a similar idea.
hope that helps?
