Linux Local Docker Compose Quick Start Service - Client Tunnel Connection Issues/Confusion

Support General Questions
1

Hi,

I'll preface this by saying I'm new to self-hosting/docker/openziti so I feel like I'm probably missing something obvious. My initial goal is to setup a main self-hosted server with all/most of the services I need in docker containers, which I connect to from other devices remotely using openziti to connect securely.

I'm going to explain all the steps I've taken in case there is something I've done wrong that I've missed but (I think) my issue is with the tunneling client connection (step 10), and so my main question is:

In Linux, how do I correctly setup the tunneler in this case and how can I verify both systemd-resolve and ziti-edge-tunnel are correctly configured/enrolled/running?

For reference I've also modified the "hosts" file adding the edge routers (I think I had to do this to get the ZAC working)

I have been following the quick start guide and I've been struggling with "Create your first service". Following the steps in the guide here's what I've done. The only steps that deviate are 2, 4, 7, 10 and 11.

  1. Created an identity for the HTTP client and assign an attribute "http-clients" by running:
    ziti edge create identity http-client -a 'http-clients' -o http.client.jwt

  2. Skipped "Create an identity for http-server" due to following Docker compose quick-start, so the tunneling server identities already exist

  3. (Exact same as guide) Create an intercept.v1 config with command:
    ziti edge create config http.intercept.v1 intercept.v1 '{"protocols":["tcp"],"addresses":["http.ziti"], "portRanges":[{"low":80, "high":80}]}'

  4. Created a host.v1 config, making sure to set the port to 8000 to match the port assigned by compose and change "${http_server}" to "web.test.blue"
    ziti edge create config http.host.v1 host.v1 '{"protocol":"tcp", "address":"web.test.blue", "port":8000}'

  5. Created a service to associate the two configs created previously into a service.
    ziti edge create service http.svc --configs http.intercept.v1,http.host.v1

  6. Created Dial service with:
    ziti edge create service-policy http.policy.dial Dial --service-roles "@http.svc" --identity-roles '#http-clients'

  7. Create a service-policy to authorize the relevant server id, in this case ziti-private-blue
    ziti edge create service-policy http.policy.bind Bind --service-roles '@http.svc' --identity-roles "@ziti-private-blue"
    (I also tried this with the ID value from list identities but changed the value based on the another thread and the openziti uploaded youtube video I'll link below)

  8. Created edge-router-policy with:
    ziti edge create edge-router-policy "all-routers-all-identities" --edge-router-roles '#all' --identity-roles '#all'

  9. Create all router all service service-edge-router-policy:
    ziti edge create service-edge-router-policy "all-routers-all-services" --edge-router-roles '#all' --service-roles '#all'

  10. Skipped due to docker-compose pre-setup tunneling, not sure if I'm missing something here. (Also small note in the guide here it says to skip to 9 but guessing that's just not been updated to 11)

  11. Start the client-side tunneler using the HTTP client identity. Here's where I think I am getting confused. At first I was trying using android client app by scanning the QR for the http-client jwt in the ZAC. I thought because I was connected on the same local network it would work but I think I was wrong about that. The app said "unavailable" anyway.
          Instead I followed the guide to install the Linux tunneler service (the RPM for fedora in this case) on the server machine. I was trying to use the youtube video here but was struggling to translate the steps with the different environments. I copied the jwt to openziti/etc/identities. This enrolled the identity at first, but then I tried restarting ziti-edge-tunnel and the service failed to start again with the single-use token still in the identities directory, so I removed it and restarted the service. How do I correctly setup the tunneler in this case and how can I verify both systemd-resolve and ziti-edge-tunnel are correctly configured/enrolled/running?

  12. [Fail] I am unable to ping/access http.ziti from anywhere.

Sorry if this is meandering a bit, I've been trying to get it going for a few days now whenever I've had the time so I'm struggling to remember what I've tried and understand how everything works. Would love it if someone could just point me in the right direction. Thanks.

References: