[ 0.007] INFO zrok/controller/store.Open: database connected
[ 0.190] INFO zrok/controller/store.(*Store).migrate: applied 20 migrations
[ 0.190] INFO zrok/controller.Bootstrap: connecting to the ziti edge management api
panic: error connecting to the ziti edge management api: Get "https://127.0.0.1:18080/.well-known/est/cacerts": dial tcp 127.0.0.1:18080: connect: connection refused
i'm not sure if it a zrok problem or if its a ziti problem, i think is a ziti problem because the error "panic: error connecting to the ziti edge management api: Get "https://127.0.0.1:18080/.well-known/est/cacerts": dial tcp 127.0.0.1:18080: connect: connection refused"
I think your zrok controller config looks like this:
ziti:
api_endpoint: "https://127.0.0.1:18080"
But api_endpoint needs to point to your ziti controller, not your zrok controller.
The ziti controller has a management API address that is configured, and the zrok controller needs the same address to connect.
You bootstrapped your ziti network with the expressInstall() quickstart, so the ziti api_endpoint in your zrok controller config must be like https://${EXTERNAL_DNS}:${ZITI_CTRL_EDGE_ADVERTISED_PORT}, substituting those two values from your environment, e.g., https://ziti.example.com:8441.
After generating it with the quickstart, I assume you didn't customize the config. You can reference the generated config in the $ZITI_HOME/$(hostname -s).yaml, e.g., ~/.ziti/quickstart/computer1/computer1.yaml.
The ziti config value you are looking for in this file is the address property under the web section near the bottom.
Here's an example snippet of a ziti controller config that shows the address ziti.example.com:8441 in the same spot.
I may have lept to the wrong conclusion when I saw the OIDC part of the URL path that you shared.
I thought you were attempting OAuth with a zrok public share. I see this is an error message emitted by the zrok share public command (or zrok share reserved for a public share), correct?
Let's ensure there are no OAuth configurations in effect because you're not using OAuth. In the zrok frontend's config.yml file, ensure there is not an oauth section. Here's an example config file: zrok/etc/frontend.yml at main · openziti/zrok · GitHub.
I'll ask around to see why else zrok might emit this particular ERROR.
EDIT: follow-on question - were you attempting to log in with OIDC (one type of SSO) through the zrok share URL at the time of the error, e.g., in your web browser?
Let's make sure we're using the same words. Your zrok instance is the stack of zrok controllers and frontends that handle requests from all of your zrok environments.
You enable a zrok enableenvironment on all the devices that will share or access a share.
thouse pem file were generated by certbot --manual
and got the same error
error creating proxy backend (error listening: failed to listen: no apiSession, authentication attempt failed:
.... redirect is not allowed as per DomainCheckRedirectPolicy
│[ 0.756] ERROR main.(*shareReservedCommand).run.func2: error running http web backend: loading new config: http app module: start: listening on zrok/dioeujv52ghg:0: failed to listen: no apiSession, authentication attempt failed: Get "https://api.{myhost}:8441/oidc/authorize?client_id=native&code_challenge=ZfpwdI5mJqOUwvUOQ_ES3yDFWr7sxzfOuljPXRukXT0&code_challenge_method=S256&method=cert&prompt=Welcome+back%21&redirect_uri=http%3A%2F%2F127.0.0.1%3A33349%2Fauth%2Fcallback&response_type=code&scope=openid+offline_access&state=66cbb15b-2a55-4fdf-a259-e331eac79c96": redirect is not allowed as per DomainCheckRedirectPolicy
is a SSL cert problem, i dont know and not sure but if you access to URL containted in the error on the browser got a "Invalid Cert", that it is issued by NetFoundry, my theory is that when the request is sent to the enpoint and got the response as "invalid cert" redirect to http version of the URL. is that posible?
Recent versions of ziti added an endpoint that's causing this issue. The fix for the ziti environment is merged. You have a few options, ranked in the order that I think makes most sense:
open the controller yaml file (probably at $HOME/.ziti/quickstart/$(hostname)/$(hostname).yaml), go to the bottom of the file, remove or comment out these lines and use zrok 0.4.26 without a problem:
- binding: edge-oidc
options: { }
use zrok 0.4.20 for now
wait for a new ziti release and use that release
use an older version of ziti (this is harder to do and i'd recommend you just do one of the above)
