Hello @himeose
I use docker-compose for a test environment (OK Prod for home). I use the docker-simplified compose script, which just has the ZAC, Controller and Edge router. Reason for this, is that these are the components that I wanted without the extra stuff for testing.
This is available to the outside world (ie available over the Internet), and internally as well.
As for the ENV file, I am running this
ZITI_IMAGE=openziti/quickstart
ZITI_VERSION=latest
ZITI_CONTROLLER_RAWNAME=ziti-controller
ZITI_CONTROLLER_HOSTNAME=ziticontroller.example.com
ZITI_CTRL_ADVERTISED_ADDRESS=ziticontroller.example.com
ZITI_EDGE_CONTROLLER_RAWNAME=ziticontroller.example.com
ZITI_EDGE_CONTROLLER_HOSTNAME=ziticontroller.example.com
ZITI_EDGE_CTRL_ADVERTISED_HOST_PORT=ziticontroller.example.com:1280
This is an old setup, but still works. Points to note:
a) I only have one external IP (home network), so hence why everything is pointing to the same DNS name
b) I have de-fanged the above by replacing my hostname with example.com (so cliche’)
For the docker compose, I have all the ports bound to listening on the host address, ie this is my docker-compose script (note old references to ziti-blue and ziti-red) - use as a guide:
version: '2.4'
services:
ziti-controller:
image: "${ZITI_IMAGE}:${ZITI_VERSION}"
env_file:
- ./.env
restart: always
ports:
- "1280:1280"
- "6262:6262"
networks:
zitiblue:
aliases:
- ziti-edge-controller
zitired:
aliases:
- ziti-edge-controller
volumes:
- prod-ziti-fs:/persistent
entrypoint:
- "/var/openziti/scripts/run-controller.sh"
ziti-controller-init-container:
image: "${ZITI_IMAGE}:${ZITI_VERSION}"
depends_on:
- ziti-controller
environment:
- ZITI_CONTROLLER_RAWNAME="${ZITI_CONTROLLER_RAWNAME}"
- ZITI_EDGE_CONTROLLER_RAWNAME="${ZITI_EDGE_CONTROLLER_RAWNAME}"
env_file:
- ./.env
networks:
zitiblue:
aliases:
- ziti-edge-controller-init-container
zitired:
aliases:
- ziti-edge-controller-init-container
volumes:
- prod-ziti-fs:/persistent
entrypoint:
- "/var/openziti/scripts/run-with-ziti-cli.sh"
command:
- "/var/openziti/scripts/access-control.sh"
ziti-edge-router:
image: "${ZITI_IMAGE}:${ZITI_VERSION}"
environment:
- ZITI_EDGE_ROUTER_RAWNAME=zitiedgerouter.thesmithcave.nz
depends_on:
- ziti-controller
ports:
- "3022:3022"
restart: always
networks:
- zitiblue
- zitired
volumes:
- prod-ziti-fs:/persistent
entrypoint: /bin/bash
command: "/var/openziti/scripts/run-router.sh edge"
ziti-console:
image: openziti/zac
environment:
- ZAC_SERVER_CERT_CHAIN=/openziti/pki/ziti-controller-intermediate/certs/ziti-controller-server.cert
- ZAC_SERVER_KEY=/openziti/pki/ziti-controller-intermediate/keys/ziti-controller-server.key
depends_on:
- ziti-controller
restart: always
ports:
- "1408:1408"
- "18443:8443"
volumes:
- prod-ziti-fs:/persistent
- type: bind
source: /opt/container/prod/openziti/ziti-edge-controller-server.key
target: /usr/src/app/server.key
- type: bind
source: /opt/container/prod/openziti/ziti-edge-controller-server.chain.pem
target: /usr/src/app/server.chain.pem
networks:
- zitiblue
- zitired
networks:
zitired:
zitiblue:
volumes:
prod-ziti-fs:
Then, I have then forwarded the respective firewall ports (6262, 3022 and 1280) to the host running docker.
I echo @TheLumberjack, if you are early into setting this up, I would probably look to ‘start again’ with the PKI - using docker-compose down -v. This will blow away your volume, so you will be starting again from scratch, and re-setting up the PKI. Do this after you have the .env file configured to ensure all is configured the way you want to.listening.
Hope this is a good guide to get you started. Let me know if you have any issues.