# Is there a streamlined configuration guide?

**URL:** <https://openziti.discourse.group/t/is-there-a-streamlined-configuration-guide/3553>\
**Category:** General Questions\
**Created:** [December 8, 2024, 3:03pm UTC](https://openziti.discourse.group/t/is-there-a-streamlined-configuration-guide/3553 "2024-12-08T15:03:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![amano](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@amano](https://openziti.discourse.group/u/amano)\
**Post date:** [December 8, 2024, 3:03pm UTC](https://openziti.discourse.group/t/is-there-a-streamlined-configuration-guide/3553/1 "2024-12-08T15:03:24Z")

</div>

[Controller Deployment | OpenZiti](https://openziti.io/docs/guides/deployments/linux/controller/deploy) gives me a bash script for configuration. I want to learn how to do it myself.

[Configuration Quickstart :: strongSwan Documentation](https://docs.strongswan.org/docs/latest/config/quickstart.html) seems streamlined enough. That's why I seriously considered ipsec vpn with strongswan despite ipsec vpn's limitations. I prefer something that I can actually understand how to set up.

For my network's size, even something like [yggdrasil](https://yggdrasil-network.github.io/) with some port forwarding can work.... Actually, yggdrasil with port forwarding for machines that can't run a full operating system is simplest at my current scale.

I believe openziti is manageable with a streamlined configuration guide, but the documentation currently doesn't make it easy to understand how to set it up from scratch manually.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [December 8, 2024, 3:21pm UTC](https://openziti.discourse.group/t/is-there-a-streamlined-configuration-guide/3553/2 "2024-12-08T15:21:21Z")

</div>

The idea of a bash script is that it's easier to understand and follow than say - go code.

We don't have a doc page yet that explains each part step by step. I like the idea though and filed an issue [explain configuring a simple overlay · Issue #991 · openziti/ziti-doc · GitHub](https://github.com/openziti/ziti-doc/issues/991) We have this, but it's not quite detailed enough [Quickstart Walkthrough | OpenZiti](https://openziti.io/docs/learn/quickstarts/network/help/quickstart-walkthrough/)

I've gone through it numerous times here on the forums and numerous times on YouTube. Here's one that I did last year for a discourse user ([referenced on this post](https://openziti.discourse.group/t/what-does-the-quickstart-do-that-i-need-to-do-myself/1600/)):

[![](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/c/c89cfeca6579860ff1be816e1fc4f1198b26b125.jpeg "overview of the steps a quickstart bringup completes") ](https://www.youtube.com/watch?v=10KUPH-LwlA)

It comes with a very short set of commands I added to a gist that is a very minimal setup: [openziti-compose/from-scratch.sh at main · dovholuknf/openziti-compose · GitHub](https://github.com/dovholuknf/openziti-compose/blob/main/from-scratch.sh)

You can also get down and dirty with openssl and create your PKI manually if you wish. A forum member contributed a github repo a few months back: [GitHub - nenkoru/openziti\_manual\_pki: Bootstrap PKI for OpenZiti manually](https://github.com/nenkoru/openziti_manual_pki)

And I went through that whole thing on Ziti TV too here:

[![](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/1/129d9691ab25e4e0986924b970b16eaee6a39d3a.jpeg "Ziti TV Jun 07 2024 - OpenZiti PKI Exploration") ](https://www.youtube.com/watch?v=X_bvaZOAh34)

Hope those help.

---

<div class="post-metadata">

**Author:** ![amano](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@amano](https://openziti.discourse.group/u/amano)\
**Post date:** [December 8, 2024, 3:25pm UTC](https://openziti.discourse.group/t/is-there-a-streamlined-configuration-guide/3553/3 "2024-12-08T15:25:52Z")

</div>

Does ziti have commands for bootstrapping its own PKI? Or?

strongswan has its own commands for bootstrapping its own PKI.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [December 8, 2024, 3:31pm UTC](https://openziti.discourse.group/t/is-there-a-streamlined-configuration-guide/3553/4 "2024-12-08T15:31:23Z")

</div>

> [@amano](#):
>
> Does ziti have commands for bootstrapping its own PKI?

Yes, certainly. That's **THE** first step in the quickstart and on that gist. The first 100 lines of that gist are dedicated to setting up the PKI... It's 2/3 of the whole script 🙂

```auto
ziti pki create ca \
  --pki-root="${ZITI_PKI}" \
  --ca-name "${ZITI_ROOT_CA_NAME}" \
  --ca-file "${ZITI_ROOT_CA_NAME}"
  
ziti pki create intermediate \
  --pki-root="${ZITI_PKI}" \
  --ca-name "${ZITI_ROOT_CA_NAME}" \
  --intermediate-name "${ZITI_EXTERNAL_CA_INTERMEDIATE_NAME}" \
  --intermediate-file "${ZITI_EXTERNAL_CA_INTERMEDIATE_NAME}" \
  --max-path-len "2"

...
...
...

```