quickconfig.zip (3.2 KB)
Finished my quick setup scripts for use on a Debian 13 VM, see attached for zip or below for script files in full.
Guide for starters
Install Debian 13 in a VM, create a snapshot of the VM after installation.
Initial VM prep
Install docker by following these instructions: Debian | Docker Docs .
Add your user to the docker group: sudo usermod -a -G docker yourusername
Log off/log in for the rights to apply.
Ensure the docker service autostart is enabled: sudo systemctl enable docker
Create a VM snapshot.
Give the VM a static IP address. NetworkConfiguration - Debian Wiki
sudo nano /etc/network/interfaces, something like below:
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
allow-hotplug ens18
#iface ens18 inet dhcp
iface ens18 inet static
address 192.168.1.123
netmask 255.255.255.0
gateway 192.168.1.1
dns-nameservers 8.8.8.8 8.8.4.4
Restart VM to apply, or restart networking service.
OpenZiti
Put all these files in one folder, make the .sh files executable (chmod +x filename.sh)
Edit the installserver.sh file with your preferred domain name, ports, password, check domain and portforwarding is OK, you will want to forward these ports mentioned in installserver.sh, as well as check if the DNS settings are pointing to the right WAN address:
DOMAIN=openziti.mydomain.tld
ROUTERPORT=3022
CONTROLLERPORT=8700
Remove exit from installserver.sh and run. (./installserver.sh)
Transfer ziti-admin.jwt from VM to your client, I like python3 -m http.server on VM, then browsing to http://VMIPADDRESS:8000 on a client PC, don’t forget to close python once done.
For a more secure option, use WinSCP to connect to your VM by SSH.
Import the JWT into your OpenZiti client of choice, the instructions per client can be found here: Tunnelers | NetFoundry Documentation
Test https://secured-apis.ziti:$ZACPORT/zac/dashboard from the client
Login with admin for username and the password specified in installserver.sh.
Once working, create another VM snapshot/backup.
I hope this all makes sense, thank you @TheLumberjack!
Troubleshooting
In case you lose your client config with the admin JWT, login to your OpenZiti VM, run below commands, transfer the ziti-admin-help.jwt from VM to your client:
docker compose exec -it ziti-controller bash
ziti edge login ${ZITI_NETWORK}:$ZITI_CTRL_SECURE_PORT \
--username admin --password yourpassword --yes
ziti edge create identity ziti-admin-help -a admins -o ziti-admin-help.jwt
exit
docker compose cp ziti-controller:/persistent/ziti-admin-help.jwt .
adminsetup.sh
#!/bin/bash
source /persistent/ziti.env
ziti edge login ${ZITI_NETWORK}:$ZITI_CTRL_SECURE_PORT
--username $ZITI_USER --password $ZITI_PWD --yes
ziti edge create config secure-apis-host.v1 host.v1
'{"protocol":"tcp", "address":"'"${ZITI_NETWORK}"'","port":'"${ZITI_CTRL_SECURE_PORT}"'}'
ziti edge create config secure-apis-intercept.v1 intercept.v1
'{"protocols":["tcp"],"addresses":["secured-apis.ziti"], "portRanges":[{"low":'${ZITI_CTRL_SECURE_PORT}', "high":'${ZITI_CTRL_SECURE_PORT}'}]}'
ziti edge create service secure-apis --configs "secure-apis-host.v1","secure-apis-intercept.v1" -a admin-services
ziti edge create service-policy "secured-apis-bind" Bind
--service-roles "#admin-services"
--identity-roles "@${ZITI_ROUTER_NAME}"
--semantic "AnyOf"
ziti edge create service-policy "secured-apis-dial" Dial
--service-roles "#admin-services"
--identity-roles "#admins"
--semantic "AnyOf"
ziti edge create identity ziti-admin -a admins -o ziti-admin.jwt
apisplit.sh
#!/bin/bash
source ziti.env
sed '/^web/,$d' ${ZITI_NETWORK}.yaml > temp.yaml && \
mv temp.yaml ${ZITI_NETWORK}.yaml
cat >> ${ZITI_NETWORK}.yaml <<HERE
web:
- name: public-apis
bindPoints:
- interface: 0.0.0.0:8841
address: ec2-3-18-113-172.us-east-2.compute.amazonaws.com:8841
options:
idleTimeout: 5000ms
readTimeout: 5000ms
writeTimeout: 100000ms
minTLSVersion: TLS1.2
maxTLSVersion: TLS1.3
apis:
- binding: edge-client
options: { }
- binding: edge-oidc
options: { }
- name: secured-apis
bindPoints:
- interface: ${ZITI_NETWORK}:${ZITI_CTRL_SECURE_PORT}
address: ${ZITI_NETWORK}:${ZITI_CTRL_SECURE_PORT}
options:
idleTimeout: 5000ms
readTimeout: 5000ms
writeTimeout: 100000ms
minTLSVersion: TLS1.2
maxTLSVersion: TLS1.3
apis:
- binding: edge-management
options: { }
- binding: fabric
options: { }
- binding: zac
options:
location: /zac
indexFile: index.html
HERE
docker-compose.yml
services:
ziti-controller:
image: "${ZITI_IMAGE}:${ZITI_VERSION}"
env_file:
- ./.env
ports:
- ${ZITI_INTERFACE:-0.0.0.0}:${ZITI_CTRL_EDGE_ADVERTISED_PORT:-1280}:${ZITI_CTRL_EDGE_ADVERTISED_PORT:-1280}
- ${ZITI_INTERFACE:-0.0.0.0}:${ZITI_CTRL_ADVERTISED_PORT:-6262}:${ZITI_CTRL_ADVERTISED_PORT:-6262}
environment:
- ZITI_CTRL_NAME=${ZITI_CTRL_NAME:-ziti-edge-controller}
- ZITI_CTRL_EDGE_ADVERTISED_ADDRESS=${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS:-ziti-edge-controller}
- ZITI_CTRL_EDGE_ADVERTISED_PORT=${ZITI_CTRL_EDGE_ADVERTISED_PORT:-1280}
- ZITI_CTRL_EDGE_IP_OVERRIDE=${ZITI_CTRL_EDGE_IP_OVERRIDE:-127.0.0.1}
- ZITI_CTRL_ADVERTISED_PORT=${ZITI_CTRL_ADVERTISED_PORT:-6262}
- ZITI_EDGE_IDENTITY_ENROLLMENT_DURATION=${ZITI_EDGE_IDENTITY_ENROLLMENT_DURATION}
- ZITI_ROUTER_ENROLLMENT_DURATION=${ZITI_ROUTER_ENROLLMENT_DURATION}
- ZITI_USER=${ZITI_USER:-admin}
- ZITI_PWD=${ZITI_PWD}
networks:
ziti:
aliases:
- ziti-edge-controller
volumes:
- ziti-fs:/persistent
entrypoint:
- "/var/openziti/scripts/run-controller.sh"
restart: always
ziti-controller-init-container:
image: "${ZITI_IMAGE}:${ZITI_VERSION}"
depends_on:
- ziti-controller
environment:
- ZITI_CTRL_EDGE_ADVERTISED_ADDRESS=${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS:-ziti-edge-controller}
- ZITI_CTRL_EDGE_ADVERTISED_PORT=${ZITI_CTRL_EDGE_ADVERTISED_PORT:-1280}
env_file:
- ./.env
networks:
ziti:
volumes:
- ziti-fs:/persistent
entrypoint:
- "/var/openziti/scripts/run-with-ziti-cli.sh"
command:
- "/var/openziti/scripts/access-control.sh"
ziti-edge-router:
image: "${ZITI_IMAGE}:${ZITI_VERSION}"
env_file:
- ./.env
depends_on:
- ziti-controller
ports:
- ${ZITI_INTERFACE:-0.0.0.0}:${ZITI_ROUTER_PORT:-3022}:${ZITI_ROUTER_PORT:-3022}
- ${ZITI_INTERFACE:-0.0.0.0}:${ZITI_ROUTER_LISTENER_BIND_PORT:-10080}:${ZITI_ROUTER_LISTENER_BIND_PORT:-10080}
environment:
- ZITI_CTRL_ADVERTISED_ADDRESS=${ZITI_CTRL_ADVERTISED_ADDRESS:-ziti-controller}
- ZITI_CTRL_ADVERTISED_PORT=${ZITI_CTRL_ADVERTISED_PORT:-6262}
- ZITI_CTRL_EDGE_ADVERTISED_ADDRESS=${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS:-ziti-edge-controller}
- ZITI_CTRL_EDGE_ADVERTISED_PORT=${ZITI_CTRL_EDGE_ADVERTISED_PORT:-1280}
- ZITI_ROUTER_NAME=${ZITI_ROUTER_NAME:-ziti-edge-router}
- ZITI_ROUTER_ADVERTISED_ADDRESS=${ZITI_ROUTER_ADVERTISED_ADDRESS:-ziti-edge-router}
- ZITI_ROUTER_PORT=${ZITI_ROUTER_PORT:-3022}
- ZITI_ROUTER_LISTENER_BIND_PORT=${ZITI_ROUTER_LISTENER_BIND_PORT:-10080}
- ZITI_ROUTER_ROLES=public
networks:
- ziti
volumes:
- ziti-fs:/persistent
entrypoint: /bin/bash
command: "/var/openziti/scripts/run-router.sh edge"
restart: always
networks:
ziti:
volumes:
ziti-fs:
installserver.sh
#!/bin/bash
#!!add bits for installing docker for debian 13 and adding user to docker group!
echo "Ensure ports, password and domain in this file are set, ports forwarded and exit removed, otherwise press CTRL+C!"
read -sr -n 1 -p "Press any key to continue..."
exit
DOMAIN=openziti.mydomain.tld
ROUTERPORT=3022
CONTROLLERPORT=8700
ZACPORT=9000
PASSWORD=clintisawesome
echo "install openziti repo debian"
sudo apt update && sudo apt install jq unzip gpg -y
curl -sSLf https://get.openziti.io/tun/package-repos.gpg | sudo gpg --dearmor --output /usr/share/keyrings/openziti.gpg
sudo chmod a+r /usr/share/keyrings/openziti.gpg
sudo tee /etc/apt/sources.list.d/openziti-release.list >/dev/null <<EOF
deb [signed-by=/usr/share/keyrings/openziti.gpg] https://packages.openziti.org/zitipax-openziti-deb-stable debian main
EOF
echo "openziti debian repo install complete"
echo "install openziti apt package"
sudo apt update && sudo apt install openziti -y
echo "openziti apt package installation done"
echo "getting openziti script files"
wget https://raw.githubusercontent.com/dovholuknf/openziti-scripts/refs/heads/main/fetch-zac.sh
wget https://raw.githubusercontent.com/dovholuknf/openziti-scripts/refs/heads/main/discourse/5255/docker-compose.yml
wget https://raw.githubusercontent.com/dovholuknf/openziti-scripts/refs/heads/main/discourse/5255/.env
echo "script files retrieved"
echo "adding in our values"
sed -i "s|ec2-3-18-113-172.us-east-2.compute.amazonaws.com|$DOMAIN|" .env
sed -i "s|8841|$CONTROLLERPORT|" .env
sed -i "s|8842|$ROUTERPORT|" .env
sed -i "s|8888|$ZACPORT|" .env
sed -i "s|discourse5255|$PASSWORD|" .env
echo "values added"
echo "setting up zac"
chmod +x fetch-zac.sh
./fetch-zac.sh
sed -i "s|\/home\/ubuntu\/discourse\/discourse5255\/zac\/ziti-console-v3.12.6|\/home\/$USER\/zac\/ziti-console-v3.12.6|g" docker-compose.yml
echo "zac setup"
echo "starting containers, give it a minute"
docker compose up -d
echo "sleeping for 30s to give services time to start, please wait..."
sleep 30
echo "should be started now, testing traffic"
ziti ops verify traffic --controller-url https://$DOMAIN:$CONTROLLERPORT --username admin --password $PASSWORD -y
read -sr -n 1 -p "Does above look happy? Press any key to continue or press Ctrl+C to cancel."
echo -e
echo "splitting API"
sed -i "s|ec2-3-18-113-172.us-east-2.compute.amazonaws.com|$DOMAIN|" apisplit.sh
sed -i "s|8841|$CONTROLLERPORT|" apisplit.sh
sed -i "s|8842|$ROUTERPORT|" apisplit.sh
chmod +x apisplit.sh
docker compose cp apisplit.sh ziti-controller:/persistent
docker compose exec -i ziti-controller /persistent/apisplit.sh && docker compose restart ziti-controller
#echo "waiting 10s for ziti-controller to restart, please wait..."
sleep 20s
echo "getting adminsetup and running"
chmod +x adminsetup.sh
docker compose cp adminsetup.sh ziti-controller:/persistent
docker compose exec --user ziti -i ziti-controller /persistent/adminsetup.sh && docker compose restart ziti-controller
echo "waiting 10s for ziti-controller to restart, please wait..."
sleep 10s
docker compose cp ziti-controller:/persistent/ziti-admin.jwt .
echo "import ziti-admin.jwt file into your workstation tunneler!"
echo "check if https://secured-apis.ziti:$ZACPORT/zac/dashboard works!"
(at least)