# OpenZiti network from scratch **URL:** \ **Category:** General Questions\ **Created:** [February 27, 2024, 6:03pm UTC](https://openziti.discourse.group/t/openziti-network-from-scratch/2168 "2024-02-27T18:03:23Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![nenkoru](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/nenkoru/32/1938_2.png) [@nenkoru](https://openziti.discourse.group/u/nenkoru)\ **Post date:** [February 27, 2024, 6:03pm UTC](https://openziti.discourse.group/t/openziti-network-from-scratch/2168/1 "2024-02-27T18:03:23Z")
Hello there! Are there any good articles on how to build ziti network from scratch? I mean without using docker(-compose), or a helper sh script that comes as ziti-cli-functions. Like by getting hands on of ziti CLI and doing everything manually. PKI intializing, networking, etc. Thanks. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [February 27, 2024, 6:46pm UTC](https://openziti.discourse.group/t/openziti-network-from-scratch/2168/2 "2024-02-27T18:46:22Z")
No. It's a common desire but it's not there yet. There's a discourse post from the past where someone asked you should check out. I narrated a video that's linked on that discourse: - [What does the quickstart do that I need to do myself?](https://openziti.discourse.group/t/what-does-the-quickstart-do-that-i-need-to-do-myself/1600) I also basically plan to do the same thing this week for Ziti TV so you could tune in for that at 11 am ET. I'll field questions too if you want 😉 [![](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/6/6dfd3d04a666641c4254e4acf95b5a4987f6cb2f.jpeg "Ziti TV Mar 01 2024 - OpenZiti step by step!") ](https://www.youtube.com/watch?v=m13qkO6lV9g) Other than that you can just "read the bash". The quickstart script itself is relatively approachable bash. The function you'll want to start with is `expressInstall` [https://get.openziti.io/ziti-cli-functions.sh](https://get.openziti.io/ziti-cli-functions.sh) (or [on github here](https://github.com/openziti/ziti/blob/release-next/quickstart/docker/image/ziti-cli-functions.sh#L1040) ) As I said, I plan to go through all these steps Friday on Ziti TV. For now, those are the best resources I have to share. ---
**Author:** ![nenkoru](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/nenkoru/32/1938_2.png) [@nenkoru](https://openziti.discourse.group/u/nenkoru)\ **Post date:** [February 27, 2024, 7:19pm UTC](https://openziti.discourse.group/t/openziti-network-from-scratch/2168/3 "2024-02-27T19:19:04Z")
The `from-scratch.sh` script is pretty neat. The only thing that I miss is specifically separating the node where controller runs and the node where edge router runs. So that it's more verbose in terms of communications between those nodes and components. Also would be neat to have security best practices recommendations in terms of hardening the controller itself. Like exposing to the Internet only the ports that are used by routers in order to lower the footrpint for the potential attack, apparmor profiles, seccomp, etc. Thank you for replying with the nearest possible solution and finding the time to mention the upcoming stream! ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [February 27, 2024, 7:38pm UTC](https://openziti.discourse.group/t/openziti-network-from-scratch/2168/4 "2024-02-27T19:38:10Z")
Ok. more reading and video watching. In July of 2022 Ken and I did this Ziti TV [![](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/c/c6726e706aa697e67ea975cebc65977a5e4132f0.jpeg "Ziti TV - Making ZAC (and the Management API) DARK!") ](https://www.youtube.com/watch?v=FI4byEDg344) It shows you how to successfully 'harden' the ziti controller by "splitting" the management API off and away from the public internet. This topic was also covered in discourse in 2022 here: [Making ZAC dark - #6 by TheLumberjack](https://openziti.discourse.group/t/making-zac-dark/561/6) and lightly here [OpenZiti configuration files - #5 by TheLumberjack](https://openziti.discourse.group/t/openziti-configuration-files/659/5) and [ZAC On different host than the controller - #2 by TheLumberjack](https://openziti.discourse.group/t/zac-on-different-host-than-the-controller/1396/2) As for separating the node from the controller/router, I might caution not to do that but -- that's also been covered in a recent post here [Building simple network from scratch - Help - #13 by TheLumberjack](https://openziti.discourse.group/t/building-simple-network-from-scratch-help/2098/13) where I demonstrate how to have three totally separate machines interconnect but you can also find other posts of that flavor on discourse too I think. Also, the "docker - no compose" quicsktart very specifically shows you how to accomplish that pretty clearly too imo. [Local - With Docker | OpenZiti](https://openziti.io/docs/learn/quickstarts/network/local-with-docker) One part that's missing (on our 'todo' list) is to update the quickstarts to use ALPN. Right now, you'll see all our quickstart / doc refer to the "control plane port" (where routers communicate to the controller) and the "client api/management api" port (where the REST-based api is). Well now-a-days you can just use the same port and with ALPN ziti will figure out if you meant http traffic or control plane traffic... Same for routers too. Routers need two ports in our quickstarts one for router to router comms (the data plane) and one for edge clients to connect (tunnelers/sdks/etc)... ALPN solves that too.... So that's "out there" but not in our quickstarts yet. hope that helps... ---
**Author:** ![nenkoru](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/nenkoru/32/1938_2.png) [@nenkoru](https://openziti.discourse.group/u/nenkoru)\ **Post date:** [February 28, 2024, 5:02pm UTC](https://openziti.discourse.group/t/openziti-network-from-scratch/2168/5 "2024-02-28T17:02:53Z")
Any infornation on why not to separate controller from the edge controller? Do you think this schema will work? ![openziti](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/b/bbeffefcae427881b085a9deac3b01b53d7970a5.png) ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [February 28, 2024, 5:09pm UTC](https://openziti.discourse.group/t/openziti-network-from-scratch/2168/6 "2024-02-28T17:09:57Z")
I knew I should have just expanded on that part of my original reply ... 🙂 so the schema you have shown WILL definitely work, yes! The challenge you'll face is that accessing the management API will only be possible from the Cloud Provider C -\> VPC -\> VM! That's exactly why I would keep that router in the controller actually. When you split off the API you'll no longer be able to access it so your `ziti` CLI commands, or your ZAC if you install it, will only work if they are local to that VM. Now, if you had an edge router on that VM, you could use it to offload a service to 127.0.0.1:20000 (or whatever port you picked)!! That's why I was cautioning you from removing it, because it would be very useful to be able to administer the overlay --- via the overlay. Relying on local ziti commands only as a last resort if the overlay is somehow unresponsive. I figured this question was coming, but you got there much faster than i expected!!! 😃 So that's why. Other than that - there's no reason why your schema won't work perfectly fine. ---
**Author:** ![nenkoru](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/nenkoru/32/1938_2.png) [@nenkoru](https://openziti.discourse.group/u/nenkoru)\ **Post date:** [February 28, 2024, 5:43pm UTC](https://openziti.discourse.group/t/openziti-network-from-scratch/2168/7 "2024-02-28T17:43:20Z")
I see now why. Thanks for the clarification! Basically a VM with a controller becomes it's own local silo with a local ziti cli to administer the network. edited: updated the schema above with comments ---
**Author:** ![nenkoru](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/nenkoru/32/1938_2.png) [@nenkoru](https://openziti.discourse.group/u/nenkoru)\ **Post date:** [February 28, 2024, 6:00pm UTC](https://openziti.discourse.group/t/openziti-network-from-scratch/2168/8 "2024-02-28T18:00:36Z")
I wonder, would this problem be remediated if I just deploy private router next to the controller? edited: something like this? edited2: updated diagram ![openziti](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/7/725922e91aaf0cd543539decbf1d792628d08d37.png) ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [February 28, 2024, 6:18pm UTC](https://openziti.discourse.group/t/openziti-network-from-scratch/2168/9 "2024-02-28T18:18:43Z")
You got it! That's a very reasonable thing to do indeed! 🙂 ---
**Author:** ![nenkoru](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/nenkoru/32/1938_2.png) [@nenkoru](https://openziti.discourse.group/u/nenkoru)\ **Post date:** [June 7, 2024, 8:32am UTC](https://openziti.discourse.group/t/openziti-network-from-scratch/2168/10 "2024-06-07T08:32:13Z")
I finally found time to wrap up everything I did in terms of PKI for OpenZiti Here is a repo containing a full hands-on tutorial on bootstrapping trust for OpenZiti using only OpenSSL. > **[GitHub - nenkoru/openziti\_manual\_pki: Bootstrap PKI for OpenZiti manually](https://github.com/nenkoru/openziti_manual_pki/tree/main)** > > main @TheLumberjack, could you please take a brief look and tell me if I am missing anything? Thanks in advance. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [June 7, 2024, 10:14am UTC](https://openziti.discourse.group/t/openziti-network-from-scratch/2168/11 "2024-06-07T10:14:42Z")
This is amazing and exciting to see!!! I'm so excited that I'll be going through this live today on Ziti TV!!! (A Livestream I do on Fridays when I have a good topic to cover). It'll start about 5.5 hours from now, at 11 am ET/1500 UTC ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [June 7, 2024, 4:08pm UTC](https://openziti.discourse.group/t/openziti-network-from-scratch/2168/12 "2024-06-07T16:08:45Z")
Link to the Ziti TV where I walked through this here: [![](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/1/129d9691ab25e4e0986924b970b16eaee6a39d3a.jpeg "Ziti TV Jun 07 2024 - OpenZiti PKI Exploration") ](https://www.youtube.com/watch?v=X_bvaZOAh34) Again great job @nenkoru. It was a breeze to get working!