Controller advertised address is ignoring port

Ziti Overlay
1

Hi - I'm using Ziti v1 and, it's great; but migrating to v2 is proving a challenge!

Our primary controller and router are on a single host, accessed via Nginx on port 443 with proxy destination selected by hostname.
We have found firewalls and VPNs block non-standard ports, and 443 is nearly always permitted; hence we want to use port 443.

  • controller.example.com:443 -> port 1280
  • router.example.com:443 -> port 3022

Here is our controller configuration

v: 3

cluster:
  dataDir:         "/var/lib/ziti-controller/raft"

identity:
  cert:        "pki/intermediate/certs/client.chain.pem"
  server_cert: "pki/intermediate/certs/server.chain.pem"
  key:         "pki/intermediate/keys/server.key"
  ca:          "pki/root/certs/root.cert"

ctrl:
  options:
    advertiseAddress: tls:controller.example.com:443
    # newListener: tls:controller.example.com:443
  listener: tls:0.0.0.0:1280

healthChecks:
  boltCheck:
    interval: 30s
    timeout: 20s
    initialDelay: 30s

edge:
  api:
    sessionTimeout: 30m
    address: controller.example.com:443
  enrollment:
    signingCert:
      cert: pki/intermediate/certs/intermediate.cert
      key:  pki/intermediate/keys/intermediate.key
    edgeIdentity:
      duration: 180m
    edgeRouter:
      duration: 180m

web:
  - name: client
    bindPoints:
      - interface: 0.0.0.0:1280
        address: controller.example.com:443
    identity:
      ca:          "pki/root/certs/root.cert"
      key:         "pki/intermediate/keys/server.key"
      server_cert: "pki/intermediate/certs/server.chain.pem"
      cert:        "pki/intermediate/certs/client.chain.pem"
    options:
      idleTimeout: 5000ms  #http timeouts, new
      readTimeout: 5000ms
      writeTimeout: 100000ms
      minTLSVersion: TLS1.2
      maxTLSVersion: TLS1.3
    apis:
      - binding: edge-client
        options: { }
      - binding: edge-oidc
        options: { }
      - binding: health-checks
        options: { }
  - name: management
    bindPoints:
      - interface: 0.0.0.0:8444
        address: controller.example.com:8444
    identity:
      ca:          "pki/root/certs/root.cert"
      key:         "pki/intermediate/keys/server.key"
      server_cert: "pki/intermediate/certs/server.chain.pem"
      cert:        "pki/intermediate/certs/client.chain.pem"
    options:
      idleTimeout: 5000ms  #http timeouts, new
      readTimeout: 5000ms
      writeTimeout: 100000ms
      minTLSVersion: TLS1.2
      maxTLSVersion: TLS1.3
    apis:
      - binding: edge-management
        options: { }
      - binding: edge-client
        options: { }
      - binding: fabric
        options: { }
      - binding: edge-oidc
        options: { }
  - name: zac
    bindPoints:
      - interface: 0.0.0.0:18441
        address: controller.example.com:18441
    identity:
      ca:          "pki/root/certs/root.cert"
      key:         "pki/intermediate/keys/server.key"
      server_cert: "pki/intermediate/certs/server.chain.pem"
      cert:        "pki/intermediate/certs/client.chain.pem"
      alt_server_certs:
        - server_cert: "/etc/letsencrypt/live/example.com/fullchain.pem"
          server_key:  "/etc/letsencrypt/live/example.com/privkey.pem"
    options:
      idleTimeout: 5000ms  #http timeouts, new
      readTimeout: 5000ms
      writeTimeout: 100000ms
      minTLSVersion: TLS1.2
      maxTLSVersion: TLS1.3
    apis:
      - binding: edge-management
        options: { }
      - binding: spa
        options:
          path: zac
          location: /opt/openziti/share/console
          indexFile: index.html

However....
The command line shows the controller is at port 1280, not port 443!

ubuntu@ip-N.N.N.N:~$ sudo ziti agent cluster list
╭────────────┬─────────────────────────────────┬───────┬────────┬─────────┬───────────┬───────────╮
│ ID         │ ADDRESS                         │ VOTER │ LEADER │ VERSION │ CONNECTED │ PREFERRED │
├────────────┼─────────────────────────────────┼───────┼────────┼─────────┼───────────┼───────────┤
│ controller │ tls:controller.example.com:1280 │ true  │ false  │ v2.0.4  │ true      │ false     │
╰────────────┴─────────────────────────────────┴───────┴────────┴─────────┴───────────┴───────────╯

This causes routers a problem.
The routers are configured to communicate with controller port 443.
First launch of a router works fine and it shows online in ZAC.
However, the endpoints file stores port 1280 (not 443).
When the router is restarted, it fails to communicate with the controller as it is trying to use port 1280 which is not a public port.

I'd say this looks like a simple bug, but the controller documentation makes me think otherwise.

listener - (required) is in the format of <protocol>:<interface>:<port> format. The value set here must be resolvable by routers and correspond the routers ctrl.endpoint configuration value.

I cannot put 443 into listener as the controller will try to listen on this port; it is already used by Nginx.
1280 is the only port number that makes sense, but it cannot be resolved by other routers.

TLDR
How to configure a controller to listen at one port with a different port advertised to networked components?
It is not clear how to write the controller configuration to achieve this goal.

2

FYI - this is related to What rewrites and loads endpoints.yml when ctrl.endpointsFile is commented out?
This post only covers the controller, the related post starts by using the router to diagnose incorrectly published port numbers.