Hello again!
I’ve playing with Ziti for a few weeks now and I’ve come to realize that I’ve never changed the default configuration of the ZAC and the management API. That means that the config.yml of the controller remains the same as the installation (I added a prometheus endpoint only). So “anyone” can access to the ZAC going to mydomain.controller:1280/zac and if you go to mydomain.controller:1280 you can see the URL of the management API, that in my case would be mydomain.controller:1280/edge/management/v1, which clearly it’s not good.
I’ve seen a few discourse post talking about this, but I’m not sure if I understood correctly how to change it, so here are my questions:
-
I think that I need to change the web part of the controller configuration, which looks like this now:
web: - name: client-management bindPoints: - interface: 0.0.0.0:1280 address: mydomain.controller:1280 identity: ca: "pki/root/certs/root.cert" key: "pki/intermediate/keys/server.key" server_cert: "pki/intermediate/certs/server.chain.pem" cert: "pki/intermediate/certs/client.chain.pem" options: idleTimeout: 5000ms #http timeouts, new readTimeout: 5000ms writeTimeout: 100000ms minTLSVersion: TLS1.2 maxTLSVersion: TLS1.3 apis: - binding: edge-management options: { } - binding: edge-client options: { } - binding: fabric options: { } - binding: edge-oidc options: { } - binding: zac options: location: /opt/openziti/share/console indexFile: index.html
But I’m not sure if I have to make a new section (adding a new - name: ) and in the bind points say something like
bindPoints:
- interface: 127.0.0.1:8443
address: mydomain.controller:8443
And in there I add
apis:
- binding: edge-management
options: { }
- binding: zac
options:
location: /opt/openziti/share/console
indexFile: index.html
So I delete those in the previous one.
But in that case how do I manage the certificates and the options section? Do i need to add it again in the new one, or not? Or am I mistaken and there is another way to do this?
- Now that I want to make the ZAC and the management API dark, I need to make a ziti service to be able to access to it. Right now in the controller’s container I don’t have installed anything else. What is the recommended approach, have a edge router or a ziti-edge-tunnel in the same place as the controller?
I hope I made myself clear, I’ll give more information if it is needed.
Thank you! 
