I'm planning a small deployment and would like to confirm an architectural assumption before building.
Setup:
~15 mobile users (iOS/Android) running Ziti Mobile Edge
Ziti Controller + Edge Router on a VPS
One on-prem Windows server that should host (bind) a single HTTP upload service. Company policy forbids opening any inbound port on site, so the on-prem side must dial out only.
What I found so far:
The Windows tunneler docs describe ZDEW purely as an intercepting tunneler; hosting/bind is not mentioned.
ziti-edge-tunnel run-host exists and there are Windows builds.
This topic shows someone successfully hosting services on Windows, but only after switching to a beta Windows tunneler, while the same config on a Linux edge router worked immediately.
Questions:
Is bind/hosting on Windows officially supported, or is it best-effort?
If supported: ZDEW, or standalone ziti-edge-tunnel run-host installed as a Windows service? Which is recommended for an unattended server role?
Any known caveats for production use (service restarts, updates, running under a service account)?
Would you generally recommend putting the hosting side on a small Linux VM instead and keeping Windows out of the Ziti path?
Hi @muekat, welcome to the community and to OpenZiti!
They do? Interesting, that seems like something I'll want to fix. Would you point out exactly what docs led you to believe that? I didn't think that we put something like that into our doc...
Certainly. It always has (thus my confusion from your prior 'intercepting only' comment). I use it routinely for RDP myself to get back to my home windows server (or my mother's laptop for support) etc.
This is a minor misunderstanding. 'run-host' is available only as a command line option at this time and is NOT implemented in the ZDEW yet but it's usually not what you want. run-host mode prevents interception while still allowing for hosting. It just makes the ziti-edge-tunnel exit only. I'd say that's usually not what people want anyway. I never run in run-host mode for normal operation.
No? None I can think of. If the machine restarts ZDEW restarts too so you'll eventually regain access after a reboot. ZDEW always runs as SYSTEM anyway and it's a system-wide installation. That's the only caveat I can think of with respect to a server, if you use terminal services and if other users RDP there, there is only one instance of ZDEW per machine so all users would have access to the same services.
I mean, that's just entirely up to you. If you like linux - sure. If you prefer windows, use windows. The only difference might be once you want to allow connections from inside that VPC you might find it helpful to run a router inside your private networking space for inbound (and outbound) OpenZiti connectivity and for that you need linux. We don't currently support running a controller or router on windows for numerous reasons. You CAN do that too if you like, it's just not something we provide (you'd have to figure out your own service/updates etc on windows).
I didn't think that we put something like that into our doc...