# ZAC User Manual or Tutorial

**URL:** <https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412>\
**Category:** Uncategorized\
**Created:** [April 10, 2024, 1:33am UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412 "2024-04-10T01:33:22Z")\
**Posts on this page:** 20\
**Page:** 2

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [April 16, 2024, 11:09pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/21 "2024-04-16T23:09:44Z")

</div>

Here's a nice guide from a community member. I'm not able to test it, but it should still work

> [@How-to Start an OpenZiti Simple Instance with Docker Compose](https://openziti.discourse.group/t/how-to-start-an-openziti-simple-instance-with-docker-compose/1483):
>
> I compiled my resources and repeated my setup, and wrote a doc for a quick and repeatable docker compose setup. The parts that were confusing to me are in the example doc for the .env file. I wrote this for my testing and team and wanted to share it. This serves as the basis for all the future testing we will do, that is until we outgrow it as a testing environment. How-to Start an OpenZiti Simple Instance with Docker Compose The following how-to will create an OpenZiti instance running on Doc…

---

<div class="post-metadata">

**Author:** ![caspat](https://avatars.discourse-cdn.com/v4/letter/c/df788c/32.png) [@caspat](https://openziti.discourse.group/u/caspat)\
**Post date:** [April 17, 2024, 2:16am UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/22 "2024-04-17T02:16:14Z")

</div>

Yes i had seen this post already, that is exacly the one i'm base on!!  
I know now where port 3022 come from!! 😉

 ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/1/1abcd6ab723ddf7ce7944e5af9d11088f37ffbbb.png)

now i ave my linux tunneler that refuse to work correctly  
is there a script to uninstall completely the linux tunneler

 ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/c/c7bb34a37b7376b4a192c195c4e0e1d5043f9d1b.png)

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [April 17, 2024, 3:02am UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/23 "2024-04-17T03:02:26Z")

</div>

> I know now where port 3022 come from!! 😉

Ok. You can set that port or just use it, if it's using port 3022, that's fine of course, just make sure the firewall allows that port through.

> is there a script to uninstall completely the linux tunneler

you shouldn't need to do that. i don't recall seeing that particular issue before. What you should do is remove the old .jwt/.json files from the identities directory you're using. Usually that will be `/opt/openziti/etc/identities/`. After that you should be able to enroll an identity and the tunneler should work fine. There's no need to uninstall the ziti-edge-tunnel.

---

<div class="post-metadata">

**Author:** ![caspat](https://avatars.discourse-cdn.com/v4/letter/c/df788c/32.png) [@caspat](https://openziti.discourse.group/u/caspat)\
**Post date:** [April 17, 2024, 10:55am UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/24 "2024-04-17T10:55:51Z")

</div>

Are you an AI 😂 responses a so quick!

Ok i delete the identity, reset enrollement, download the new jwt, here is what i get.

```auto
root@vi-conteneur-01:~# ziti-edge-tunnel add --jwt "$(< ./vi-conteneur-01.jwt)" --identity vi-conteneur-01
failed to connect: -111/connection refusedroot@vi-conteneur-01:~# 
root@vi-conteneur-01:~# 
root@vi-conteneur-01:~# systemctl start ziti-edge-tunnel
Job for ziti-edge-tunnel.service failed because of unavailable resources or another system error.
See "systemctl status ziti-edge-tunnel.service" and "journalctl -xeu ziti-edge-tunnel.service" for details.
root@vi-conteneur-01:~# systemctl status ziti-edge-tunnel.service
● ziti-edge-tunnel.service - Ziti Edge Tunnel
     Loaded: loaded (/lib/systemd/system/ziti-edge-tunnel.service; enabled; vendor preset: enabled)
     Active: activating (auto-restart) (Result: resources) since Wed 2024-04-17 06:45:42 EDT; 2s ago
        CPU: 0
root@vi-conteneur-01:~# journalctl -xeu ziti-edge-tunnel.service -n 15
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░ 
░░ The unit ziti-edge-tunnel.service has entered the 'failed' state with result 'resources'.
Apr 17 06:47:20 vi-conteneur-01 systemd[1]: Failed to start Ziti Edge Tunnel.
░░ Subject: A start job for unit ziti-edge-tunnel.service has failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░ 
░░ A start job for unit ziti-edge-tunnel.service has finished with a failure.
░░ 
░░ The job identifier is 855683 and the job result is failed.
Apr 17 06:47:23 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Scheduled restart job, restart counter is at 10284.
░░ Subject: Automatic restarting of a unit has been scheduled
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░ 
░░ Automatic restarting of the unit ziti-edge-tunnel.service has been scheduled, as the result for
░░ the configured Restart= setting for the unit.
Apr 17 06:47:23 vi-conteneur-01 systemd[1]: Stopped Ziti Edge Tunnel.
░░ Subject: A stop job for unit ziti-edge-tunnel.service has finished
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░ 
░░ A stop job for unit ziti-edge-tunnel.service has finished.
░░ 
░░ The job identifier is 855766 and the job result is done.
Apr 17 06:47:23 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Failed to load environment files: No such file or directory
Apr 17 06:47:23 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Failed to run 'start-pre' task: No such file or directory
Apr 17 06:47:23 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Failed with result 'resources'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░ 
░░ The unit ziti-edge-tunnel.service has entered the 'failed' state with result 'resources'.
Apr 17 06:47:23 vi-conteneur-01 systemd[1]: Failed to start Ziti Edge Tunnel.
░░ Subject: A start job for unit ziti-edge-tunnel.service has failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░ 
░░ A start job for unit ziti-edge-tunnel.service has finished with a failure.
░░ 
░░ The job identifier is 855766 and the job result is failed.
root@vi-conteneur-01:~#

```

---

<div class="post-metadata">

**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\
**Post date:** [April 17, 2024, 1:38pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/25 "2024-04-17T13:38:31Z")

</div>

Hey there @caspat, It looks like your tunneler service was broken somehow. Does your case require customizing the service?

For troubleshooting, let's check the installed version of the package and reinstall it to ensure it's reset. Then, if any customizations are needed, we can layer those on to work with future versions.

1. check version

2. reset the service, ensuring latest is installed

3. check the version again to see if it changed

4. run the service every boot

Do you get the same result? Did the tunneler version change?

---

<div class="post-metadata">

**Author:** ![caspat](https://avatars.discourse-cdn.com/v4/letter/c/df788c/32.png) [@caspat](https://openziti.discourse.group/u/caspat)\
**Post date:** [April 17, 2024, 9:07pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/26 "2024-04-17T21:07:20Z")

</div>

Hi qrkourier, no, nothing special, basic linux tuneller.  
Here is the result of those commands.

root@vi-conteneur-01:~# ziti-edge-tunnel version;  
v0.22.26-local  
root@vi-conteneur-01:~# apt show ziti-edge-tunnel  
Package: ziti-edge-tunnel  
Version: 0.22.26  
Priority: optional  
Section: devel  
Maintainer: [support@netfoundry.io](mailto:support@netfoundry.io)  
Installed-Size: 4,668 kB  
Depends: debconf, iproute2, sed, systemd, libatomic1, libssl3 | libssl1.1 | libssl1.0.0, login, passwd, policykit-1, zlib1g  
Download-Size: 2,029 kB  
APT-Manual-Installed: yes  
APT-Sources: [JFrog](https://packages.openziti.org/zitipax-openziti-deb-stable) jammy/main amd64 Packages  
Description: ziti-tunnel-sdk-c built using CMake

N: There are 57 additional records. Please use the '-a' switch to see them.  
root@vi-conteneur-01:~# sudo apt update  
Hit:1 [Index of linux/ubuntu/](https://download.docker.com/linux/ubuntu) jammy InRelease  
Hit:2 [Index of /ubuntu](http://security.ubuntu.com/ubuntu) jammy-security InRelease  
Hit:3 [Index of /ubuntu](http://ca.archive.ubuntu.com/ubuntu) jammy InRelease  
Hit:4 [Index of /ubuntu](http://ca.archive.ubuntu.com/ubuntu) jammy-updates InRelease  
Hit:5 [Index of /ubuntu](http://ca.archive.ubuntu.com/ubuntu) jammy-backports InRelease  
Ign:6 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) InRelease  
Ign:7 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Release  
Ign:8 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Packages  
Ign:9 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en\_US  
Ign:10 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en  
Get:8 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Packages  
Ign:9 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en\_US  
Ign:10 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en  
Ign:9 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en\_US  
Ign:10 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en  
Ign:9 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en\_US  
Ign:10 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en  
Ign:9 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en\_US  
Ign:10 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en  
Ign:9 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en\_US  
Ign:10 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en  
Ign:9 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en\_US  
Ign:10 [https://apt.fury.io/netdevops](https://apt.fury.io/netdevops) Translation-en  
Hit:11 [JFrog](https://packages.openziti.org/zitipax-openziti-deb-stable) jammy InRelease  
Fetched 23.7 kB in 1s (42.7 kB/s)  
Reading package lists... Done  
Building dependency tree... Done  
Reading state information... Done  
7 packages can be upgraded. Run 'apt list --upgradable' to see them.  
root@vi-conteneur-01:~# sudo apt install ziti-edge-tunnel --reinstall  
Reading package lists... Done  
Building dependency tree... Done  
Reading state information... Done  
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 7 not upgraded.  
Need to get 0 B/2,029 kB of archives.  
After this operation, 0 B of additional disk space will be used.  
Preconfiguring packages ...  
(Reading database ... 118039 files and directories currently installed.)  
Preparing to unpack .../ziti-edge-tunnel\_0.22.26\_amd64.deb ...  
Unpacking ziti-edge-tunnel (0.22.26) over (0.22.26) ...  
Setting up ziti-edge-tunnel (0.22.26) ...

## --------------------------------------------------------------------------------ziti-edge-tunnel was installed... First install an OpenZiti identity or enroll token in: /opt/openziti/etc/identities then start or restart this systemd service unit.

Scanning processes...  
Scanning linux images...

Running kernel seems to be up-to-date.

No services need to be restarted.

No containers need to be restarted.

No user sessions are running outdated binaries.

No VM guests are running outdated hypervisor (qemu) binaries on this host.  
root@vi-conteneur-01:~# ziti-edge-tunnel version  
v0.22.26-local  
root@vi-conteneur-01:~# apt show ziti-edge-tunnel  
Package: ziti-edge-tunnel  
Version: 0.22.26  
Priority: optional  
Section: devel  
Maintainer: [support@netfoundry.io](mailto:support@netfoundry.io)  
Installed-Size: 4,668 kB  
Depends: debconf, iproute2, sed, systemd, libatomic1, libssl3 | libssl1.1 | libssl1.0.0, login, passwd, policykit-1, zlib1g  
Download-Size: 2,029 kB  
APT-Manual-Installed: yes  
APT-Sources: [JFrog](https://packages.openziti.org/zitipax-openziti-deb-stable) jammy/main amd64 Packages  
Description: ziti-tunnel-sdk-c built using CMake

N: There are 57 additional records. Please use the '-a' switch to see them.  
root@vi-conteneur-01:~# sudo systemctl enable --now ziti-edge-tunnel.service  
Job for ziti-edge-tunnel.service failed because of unavailable resources or another system error.  
See "systemctl status ziti-edge-tunnel.service" and "journalctl -xeu ziti-edge-tunnel.service" for details.  
root@vi-conteneur-01:~# systemctl status ziti-edge-tunnel.service  
● ziti-edge-tunnel.service - Ziti Edge Tunnel  
Loaded: loaded (/lib/systemd/system/ziti-edge-tunnel.service; enabled; vendor preset: enabled)  
Active: activating (auto-restart) (Result: resources) since Wed 2024-04-17 17:03:51 EDT; 1s ago  
CPU: 0  
root@vi-conteneur-01:~# journalctl -xeu ziti-edge-tunnel.service -n15  
░░ A stop job for unit ziti-edge-tunnel.service has finished.  
░░  
░░ The job identifier is 1789641 and the job result is done.  
Apr 17 17:04:08 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Failed to load environment files: No such file or directory  
Apr 17 17:04:08 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Failed to run 'start-pre' task: No such file or directory  
Apr 17 17:04:08 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Failed with result 'resources'.  
░░ Subject: Unit failed  
░░ Defined-By: systemd  
░░ Support: [Enterprise open source support | Ubuntu](http://www.ubuntu.com/support)  
░░  
░░ The unit ziti-edge-tunnel.service has entered the 'failed' state with result 'resources'.  
Apr 17 17:04:08 vi-conteneur-01 systemd[1]: Failed to start Ziti Edge Tunnel.  
░░ Subject: A start job for unit ziti-edge-tunnel.service has failed  
░░ Defined-By: systemd  
░░ Support: [Enterprise open source support | Ubuntu](http://www.ubuntu.com/support)  
░░  
░░ A start job for unit ziti-edge-tunnel.service has finished with a failure.  
░░  
░░ The job identifier is 1789641 and the job result is failed.  
Apr 17 17:04:11 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Scheduled restart job, restart counter is at 10.  
░░ Subject: Automatic restarting of a unit has been scheduled  
░░ Defined-By: systemd  
░░ Support: [Enterprise open source support | Ubuntu](http://www.ubuntu.com/support)  
░░  
░░ Automatic restarting of the unit ziti-edge-tunnel.service has been scheduled, as the result for  
░░ the configured Restart= setting for the unit.  
Apr 17 17:04:11 vi-conteneur-01 systemd[1]: Stopped Ziti Edge Tunnel.  
░░ Subject: A stop job for unit ziti-edge-tunnel.service has finished  
░░ Defined-By: systemd  
░░ Support: [Enterprise open source support | Ubuntu](http://www.ubuntu.com/support)  
░░  
░░ A stop job for unit ziti-edge-tunnel.service has finished.  
░░  
░░ The job identifier is 1789724 and the job result is done.  
Apr 17 17:04:11 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Failed to load environment files: No such file or directory  
Apr 17 17:04:11 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Failed to run 'start-pre' task: No such file or directory  
Apr 17 17:04:11 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Failed with result 'resources'.  
░░ Subject: Unit failed  
░░ Defined-By: systemd  
░░ Support: [Enterprise open source support | Ubuntu](http://www.ubuntu.com/support)  
░░  
░░ The unit ziti-edge-tunnel.service has entered the 'failed' state with result 'resources'.  
Apr 17 17:04:11 vi-conteneur-01 systemd[1]: Failed to start Ziti Edge Tunnel.  
░░ Subject: A start job for unit ziti-edge-tunnel.service has failed  
░░ Defined-By: systemd  
░░ Support: [Enterprise open source support | Ubuntu](http://www.ubuntu.com/support)  
░░  
░░ A start job for unit ziti-edge-tunnel.service has finished with a failure.  
░░  
░░ The job identifier is 1789724 and the job result is failed.

---

<div class="post-metadata">

**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\
**Post date:** [April 17, 2024, 9:15pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/27 "2024-04-17T21:15:28Z")

</div>

> [@caspat](#):
>
> root@vi-conteneur-01:~# systemctl status ziti-edge-tunnel.service  
> ● ziti-edge-tunnel.service - Ziti Edge Tunnel  
> Loaded: loaded (/lib/systemd/system/ziti-edge-tunnel.service; enabled; vendor preset: enabled)  
> Active: activating (auto-restart) (Result: resources) since Wed 2024-04-17 17:03:51 EDT; 1s ago  
> CPU: 0

This might mean the device doesn't have enough CPUshares for the service to start. The [service unit template](https://github.com/openziti/ziti-tunnel-sdk-c/blob/main/programs/ziti-edge-tunnel/package/systemd/ziti-edge-tunnel.service.in) doesn't specify a minimum, but there may still be a systemd default minimum.

What's the systemd version and what's the load average and memory free?

---

<div class="post-metadata">

**Author:** ![caspat](https://avatars.discourse-cdn.com/v4/letter/c/df788c/32.png) [@caspat](https://openziti.discourse.group/u/caspat)\
**Post date:** [April 17, 2024, 9:25pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/28 "2024-04-17T21:25:11Z")

</div>

Voilà!

> [@qrkourier](#):
>
> What's the systemd version and what's the load average and memory free?

root@vi-conteneur-01:~# uptime  
17:21:30 up 19:51, 3 users, load average: 0.04, 0.01, 0.00  
root@vi-conteneur-01:~# free  
total used free shared buff/cache available  
Mem: 32862676 1336512 29721372 32636 1804792 31018936  
Swap: 8388604 0 8388604  
root@vi-conteneur-01:~# lscpu  
Architecture: x86\_64  
CPU op-mode(s): 32-bit, 64-bit  
Address sizes: 43 bits physical, 48 bits virtual  
Byte Order: Little Endian  
CPU(s): 8  
On-line CPU(s) list: 0-7  
Vendor ID: GenuineIntel  
Model name: Intel(R) Xeon(R) Gold 6138 CPU @ 2.00GHz  
CPU family: 6  
Model: 85  
Thread(s) per core: 1  
Core(s) per socket: 1  
Socket(s): 8  
Stepping: 4  
BogoMIPS: 3990.62  
Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss syscall nx pdpe1gb rdtscp lm constant\_tsc arch\_perfmon nopl xtopolo  
gy tsc\_reliable nonstop\_tsc cpuid tsc\_known\_freq pni pclmulqdq ssse3 fma cx16 pcid sse4\_1 sse4\_2 x2apic movbe popcnt tsc\_deadline\_timer aes xsave avx f16c rdrand hyperv  
isor lahf\_lm abm 3dnowprefetch cpuid\_fault invpcid\_single pti ssbd ibrs ibpb stibp fsgsbase tsc\_adjust bmi1 avx2 smep bmi2 invpcid avx512f avx512dq rdseed adx smap clfl  
ushopt clwb avx512cd avx512bw avx512vl xsaveopt xsavec xsaves arat pku ospke md\_clear flush\_l1d arch\_capabilities  
Virtualization features:  
Hypervisor vendor: VMware  
Virtualization type: full  
Caches (sum of all):  
L1d: 256 KiB (8 instances)  
L1i: 256 KiB (8 instances)  
L2: 8 MiB (8 instances)  
L3: 220 MiB (8 instances)  
NUMA:  
NUMA node(s): 1  
NUMA node0 CPU(s): 0-7  
Vulnerabilities:  
Gather data sampling: Unknown: Dependent on hypervisor status  
Itlb multihit: KVM: Mitigation: VMX unsupported  
L1tf: Mitigation; PTE Inversion  
Mds: Mitigation; Clear CPU buffers; SMT Host state unknown  
Meltdown: Mitigation; PTI  
Mmio stale data: Mitigation; Clear CPU buffers; SMT Host state unknown  
Retbleed: Mitigation; IBRS  
Spec rstack overflow: Not affected  
Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl and seccomp  
Spectre v1: Mitigation; usercopy/swapgs barriers and \_\_user pointer sanitization  
Spectre v2: Mitigation; IBRS, IBPB conditional, STIBP disabled, RSB filling, PBRSB-eIBRS Not affected  
Srbds: Not affected  
Tsx async abort: Not affected  
root@vi-conteneur-01:~# systemctl --version  
systemd 249 (249.11-0ubuntu3.12)  
+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY -P11KIT -QRENCODE +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified  
root@vi-conteneur-01:~#

---

<div class="post-metadata">

**Author:** ![caspat](https://avatars.discourse-cdn.com/v4/letter/c/df788c/32.png) [@caspat](https://openziti.discourse.group/u/caspat)\
**Post date:** [April 17, 2024, 9:29pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/29 "2024-04-17T21:29:37Z")

</div>

This VM run 3 test docker container, not in prod.

 ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/4/4a3c1d85416a30d17ea3436efff1d9f119895ab9.png)

---

<div class="post-metadata">

**Author:** ![scareything](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/scareything/32/106_2.png) [@scareything](https://openziti.discourse.group/u/scareything)\
**Post date:** [April 18, 2024, 10:06am UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/30 "2024-04-18T10:06:15Z")

</div>

> [@caspat](#):
>
> Apr 17 17:04:08 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Failed to load environment files: No such file or directory  
> Apr 17 17:04:08 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Failed to run 'start-pre' task: No such file or directory  
> Apr 17 17:04:08 vi-conteneur-01 systemd[1]: ziti-edge-tunnel.service: Failed with result 'resources'.

This suggests to me that something isn't quite right with the systemd service file(s). Could you please `systemctl cat ziti-edge-tunnel.service` and share the output here?

You should see `EnvironmentFile` and `ExecStartPre` directives in the output. Can you verify that those files exist?

Thanks!

---

<div class="post-metadata">

**Author:** ![caspat](https://avatars.discourse-cdn.com/v4/letter/c/df788c/32.png) [@caspat](https://openziti.discourse.group/u/caspat)\
**Post date:** [April 18, 2024, 11:36am UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/31 "2024-04-18T11:36:31Z")

</div>

I think you have found the problem...

The `EnvironmentFile` is missing, ExecStartPre is present.  
Is the EnvironmentFile generic or i need to create or generate one?

root@vi-conteneur-01:~$ systemctl cat ziti-edge-tunnel.service

# /lib/systemd/system/ziti-edge-tunnel.service

[Unit]  
Description=Ziti Edge Tunnel  
After=network-online.target

[Service]  
Type=simple  
EnvironmentFile=/opt/openziti/etc/ziti-edge-tunnel.env  
User=ziti  
UMask=0007  
AmbientCapabilities=CAP\_NET\_ADMIN  
ExecStartPre=/opt/openziti/bin/ziti-edge-tunnel.sh  
ExecStart=/opt/openziti/bin/ziti-edge-tunnel run --verbose=${ZITI\_VERBOSE} --dns-ip-range=${ZITI\_DNS\_IP\_RANGE} --identity-dir=${ZITI\_IDENTITY\_DIR}  
Restart=always  
RestartSec=3

[Install]  
WantedBy=multi-user.target

---

<div class="post-metadata">

**Author:** ![scareything](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/scareything/32/106_2.png) [@scareything](https://openziti.discourse.group/u/scareything)\
**Post date:** [April 18, 2024, 1:36pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/32 "2024-04-18T13:36:09Z")

</div>

The template for the environment file is [here](https://github.com/openziti/ziti-tunnel-sdk-c/blob/main/programs/ziti-edge-tunnel/package/systemd/ziti-edge-tunnel.env.in). You can create one yourself based on that template, but it _should_ have been generated when the package was installed. If there were any errors logged during the installation then I'm guessing they are long gone by now. Maybe @qrkourier has some ideas on what might have gone wrong there.

---

<div class="post-metadata">

**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\
**Post date:** [April 18, 2024, 1:38pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/33 "2024-04-18T13:38:43Z")

</div>

It's the first time I've seen that env file fail to appear in the expected location. It's always placed there by the Debian package during install or upgrade. Is `/opt` writable on this Ubuntu Jammy host?

Here's an example showing the typical identities dir populated in that tempalte.

```bash
# all enrollment tokens named *.jwt are consumed and replaced with identity JSON files to be loaded at startup
ZITI_IDENTITY_DIR='/opt/openziti/etc/identities'

# reserved dynamic IP range for proxied services
ZITI_DNS_IP_RANGE='100.64.0.1/10'

# the log level specified in /var/lib/ziti/config.json has higher precedence than this env var; delete or modify that
# file or set via IPC "ziti-edge-tunnel set_log_level --loglevel DEBUG"
ZITI_VERBOSE=2

```

EDIT: probably tangential, but this reminds me that some immutable OSs require writable paths appear in specific places within the FHS, sometimes excluding `/opt`, which may force us to stop using `/opt` in order to avoid switching logic in the scriptlets, not to mention documentation.

---

<div class="post-metadata">

**Author:** ![caspat](https://avatars.discourse-cdn.com/v4/letter/c/df788c/32.png) [@caspat](https://openziti.discourse.group/u/caspat)\
**Post date:** [April 18, 2024, 4:25pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/34 "2024-04-18T16:25:06Z")

</div>

What are the permissions that is suppose to have on /opt/openziti ?

Have created the env file and the service start, but having warning:

WARN ziti-edge-tunnel:ziti-edge-tunnel.c:1686 make\_socket\_path() failed to set ownership of /tmp/.ziti to 998:998: Operation not permitted (errno=1)  
Apr 18 12:16:04 vi-conteneur-01 ziti-edge-tunnel[39322]: (39322)[0.000] WARN ziti-edge-tunnel:ziti-edge-tunnel.c:1730 run\_tunneler\_loop() One or more socket servers did not properly start.

---

<div class="post-metadata">

**Author:** ![caspat](https://avatars.discourse-cdn.com/v4/letter/c/df788c/32.png) [@caspat](https://openziti.discourse.group/u/caspat)\
**Post date:** [April 18, 2024, 5:19pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/35 "2024-04-18T17:19:31Z")

</div>

Ok i deleted le .ziti folder in tmp directory, the service recreate it and the error is gone.

---

<div class="post-metadata">

**Author:** ![caspat](https://avatars.discourse-cdn.com/v4/letter/c/df788c/32.png) [@caspat](https://openziti.discourse.group/u/caspat)\
**Post date:** [April 18, 2024, 5:54pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/36 "2024-04-18T17:54:54Z")

</div>

still get : ☹

ERROR ziti-sdk:channel.c:899 on\_channel\_connect\_internal() ch[0] failed to connect to ER[ziti-edge-router] [-3001/temporary failure]

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [April 18, 2024, 7:02pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/37 "2024-04-18T19:02:52Z")

</div>

Can you confirm what the advertised address is for your router and can you verify you can openssl -connect to that address?

---

<div class="post-metadata">

**Author:** ![caspat](https://avatars.discourse-cdn.com/v4/letter/c/df788c/32.png) [@caspat](https://openziti.discourse.group/u/caspat)\
**Post date:** [April 18, 2024, 9:02pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/38 "2024-04-18T21:02:49Z")

</div>

get openssl response but verification error:

```auto
subject=C = US, ST = NC, L = Charlotte, O = NetFoundry, OU = Ziti, CN = nYfzDmgOn
issuer=C = US, L = Charlotte, O = NetFoundry, OU = ADV-DEV, CN = ziti-signing-intermediate
---
No client certificate CA names sent
Requested Signature Algorithms: RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA384:ECDSA+SHA512:RSA+SHA1:ECDSA+SHA1
Shared Requested Signature Algorithms: RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA384:ECDSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2360 bytes and written 416 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Server public key is 4096 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)
---
DONE
root@vi-conteneur-01:~#

```

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [April 18, 2024, 9:04pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/39 "2024-04-18T21:04:08Z")

</div>

I also asked for you to confirm your router's adveritsed address. Can you post the router's relevant config section?

---

<div class="post-metadata">

**Author:** ![caspat](https://avatars.discourse-cdn.com/v4/letter/c/df788c/32.png) [@caspat](https://openziti.discourse.group/u/caspat)\
**Post date:** [April 18, 2024, 9:07pm UTC](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412/40 "2024-04-18T21:07:41Z")

</div>

Sorry here is the info:

#ZITI\_ROUTER\_NAME=ziti-edge-router  
ZITI\_ROUTER\_ADVERTISED\_ADDRESS=router.x.x.ca  
ZITI\_ROUTER\_PORT=8442  
#ZITI\_ROUTER\_IP\_OVERRIDE=10.10.10.10  
ZITI\_ROUTER\_LISTENER\_BIND\_PORT=8444  
ZITI\_ROUTER\_ROLES=public

[Previous page](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412.md?page=1)

[Next page](https://openziti.discourse.group/t/zac-user-manual-or-tutorial/2412.md?page=3)