OK - I have a worked through and got a working container. It is not pretty, but it is enrolling and looking good (haven’t put anything though it yet but getting two green dots. Here is what I did. Note that this is cut down, and I think that you could keep the container as is it but add in another script to it.
As an aside comment, I think it could be good to work towards only requiring the environment variables required for this but having the ziti.env environment clobber any passed in variables is annoying. For instance, I see that the ZITI_USER and ZITI_PWD is in the ziti.env. For an external router, these variables should only need to be passed through to initiate the config, then should be able to be deleted from the docker-compose file as no longer needed. This make sense? Maybe I could work towards a production container vs a quickstart container?
Anyhow, what follows is what I have done. Will leave it to you to decide how you want to import it or whatnot.
I created a new openziti/quickstart container (named test:latest here). I modified the image/Dockerfile from GIT and added this line:
COPY --chown=ziti run-extrouter.sh "${ZITI_SCRIPTS}/"
at the end of the other copy lines.
The run-extrouter.sh file is basically a modified run-router.sh script and lives in the docker/image folder (dont forget to chmod +x it!)
#!/bin/bash
# give the controller time to ramp up before running if running in docker-compose
sleep 5
. "${ZITI_SCRIPTS}/ziti-cli-functions.sh"
if [[ "${ZITI_CONTROLLER_RAWNAME-}" == "" ]]; then export ZITI_CONTROLLER_RAWNAME="ziti-controller"; fi
if [[ "${ZITI_EDGE_CONTROLLER_RAWNAME-}" == "" ]]; then export ZITI_EDGE_CONTROLLER_RAWNAME="ziti-edge-controller"; fi
if [[ "${ZITI_EDGE_ROUTER_RAWNAME-}" == "" ]]; then
export ZITI_EDGE_ROUTER_DESIRED_RAWNAME="${ZITI_NETWORK-}-edge-router"
else
ZITI_EDGE_ROUTER_DESIRED_RAWNAME="${ZITI_EDGE_ROUTER_RAWNAME}"
fi
if [[ "${ZITI_EDGE_ROUTER_PORT-}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi
if [[ "${ZITI_EDGE_ROUTER_HOSTNAME}" == "" ]]; then export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
if [[ "${ZITI_EDGE_ROUTER_ROLES}" == "" ]]; then export ZITI_EDGE_ROUTER_ROLES="${ZITI_EDGE_ROUTER_RAWNAME}"; fi
. ${ZITI_HOME}/ziti.env
echo "ZITI_EDGE_ROUTER_RAWNAME = ${ZITI_EDGE_ROUTER_RAWNAME}"
echo "ZITI_EDGE_ROUTER_HOSTNAME = ${ZITI_EDGE_ROUTER_HOSTNAME}"
echo "ZITI_EDGE_ROUTER_ROLES = ${ZITI_EDGE_ROUTER_ROLES}"
echo "ZITI_EDGE_ROUTER_PORT = ${ZITI_EDGE_ROUTER_PORT}"
# If we dont have a router yaml, then we assume we haven't enrolled, so lets do that
if [ ! -f ${ZITI_EDGE_ROUTER_RAWNAME}.yaml ]; then
# Login to the cloud controller
ziti edge login -y ${ZITI_EDGE_CTRL_ADVERTISED_HOST_PORT} -u ${ZITI_USER} -p ${ZITI_PWD}
if [[ "$1" == "edge" ]]; then
echo "CREATING EDGE ROUTER CONFIG"
createEdgeRouterConfig "${ZITI_EDGE_ROUTER_RAWNAME}"
fi
if [[ "$1" == "wss" ]]; then
echo "CREATING EDGE ROUTER WSS CONFIG"
createEdgeRouterWssConfig "${ZITI_EDGE_ROUTER_RAWNAME}"
fi
if [[ "$1" == "fabric" ]]; then
echo "CREATING FABRIC ROUTER CONFIG"
createFabricRouterConfig "${ZITI_EDGE_ROUTER_RAWNAME}"
fi
if [[ "$1" == "private" ]]; then
echo "CREATING PRIVATE ROUTER CONFIG"
createPrivateRouterConfig "${ZITI_EDGE_ROUTER_RAWNAME}"
fi
echo "---------- Creating edge-router ${ZITI_EDGE_ROUTER_HOSTNAME}...."
found=$(ziti edge list edge-routers 'name = "'"${ZITI_EDGE_ROUTER_HOSTNAME}"'"' | grep -c "${ZITI_EDGE_ROUTER_HOSTNAME}")
if [[ found -gt 0 ]]; then
echo "---------- Found existing edge-router ${ZITI_EDGE_ROUTER_HOSTNAME}...."
else
"${ZITI_BIN_DIR}/ziti" edge create edge-router "${ZITI_EDGE_ROUTER_HOSTNAME}" -o "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.jwt" -t -a "${ZITI_EDGE_ROUTER_ROLES}"
sleep 1
echo "---------- Enrolling edge-router ${ZITI_EDGE_ROUTER_HOSTNAME}...."
"${ZITI_BIN_DIR}/ziti-router" enroll "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.yaml" --jwt "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.jwt"
echo ""
fi
fi
# Run the router
"${ZITI_BIN_DIR}/ziti-router" run "${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" > "${ZITI_HOME}/ziti-${ZITI_EDGE_ROUTER_HOSTNAME}.log"
Build the container like normal. Note that the helper functions create pki, certs etc directories in the /persistent folder. Messy but not impacting.
As for the docker-compose file, this is what I have been testing with…
version: '2.4'
services:
ziti-edge-router:
# image: "${ZITI_IMAGE}:${ZITI_VERSION}"
image: test:latest
environment:
#- ZITI_CONTROLLER_RAWNAME="${ZITI_CONTROLLER_HOSTNAME}"
#- ZITI_EDGE_CONTROLLER_RAWNAME="${ZITI_EDGE_CONTROLLER_HOSTNAME}"
- ZITI_EDGE_ROUTER_HOSTNAME=ziti-edge-router
- ZITI_EDGE_ROUTER_ROLES=public
- ZITI_EDGE_ROUTER_PORT=443
ports:
- "443:3022"
networks:
- zitiblue
volumes:
- ziti-fs:/persistent
entrypoint: /bin/bash
command: "/var/openziti/scripts/run-extrouter.sh edge"
networks:
zitiblue:
volumes:
ziti-fs:
The final step in the puzzle, is as you said, you need to copy the ziti.env file from the controller across to the persistent folder of the router to get all the environment variables defined. Not nice. Once the router is enrolled, then the ziti.env should be edited to remove the password variables.
So, to recap, once the modified container is built, the process would be as follows to get this working:
- Change the command in the
docker-compose.yml to point to the run-extrouter.sh script
- Copy the
ziti.env file in from the controller into the /persistent folder
- Define the
ZITI_EDGE_ROUTER_ROLES, ZITI_EDGE_ROUTER_HOSTNAME environment variables
- Start the container
