From ff51ae22b6301567e5262abc6dab2fd46ae838be Mon Sep 17 00:00:00 2001
From: gberl002 <geoff.berl@netfoundry.io>
Date: Wed, 19 Jul 2023 16:33:52 -0400
Subject: [PATCH 01/17] Adding ZITI_CTRL_EDGE_IP_OVERRIDE to the pki IP allow
 list

Signed-off-by: gberl002 <geoff.berl@netfoundry.io>
---
 quickstart/docker/image/ziti-cli-functions.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh
index 5bb1fcf6b..3593a8e9a 100644
--- a/quickstart/docker/image/ziti-cli-functions.sh
+++ b/quickstart/docker/image/ziti-cli-functions.sh
@@ -709,7 +709,7 @@ function getZiti {
 
 # Create a custom PKI
 function createPki {
-  local retVal pki_allow_list_dns pki_allow_list_ip ZITI_SPURIOUS_INTERMEDIATE
+  local retVal pki_allow_list pki_allow_list_ip ZITI_SPURIOUS_INTERMEDIATE
   _check_env_variable ZITI_PKI_CTRL_ROOTCA_NAME ZITI_PKI_CTRL_EDGE_ROOTCA_NAME ZITI_PKI_SIGNER_ROOTCA_NAME \
                       ZITI_PKI_SIGNER_INTERMEDIATE_NAME ZITI_PKI_CTRL_INTERMEDIATE_NAME \
                       ZITI_PKI_CTRL_EDGE_INTERMEDIATE_NAME
@@ -736,6 +736,9 @@ function createPki {
 
   pki_allow_list="${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS},localhost,${ZITI_NETWORK}"
   pki_allow_list_ip="127.0.0.1"
+  if [[ "${ZITI_CTRL_EDGE_IP_OVERRIDE-}" != "" ]]; then
+    pki_allow_list_ip="${pki_allow_list_ip},${ZITI_CTRL_EDGE_IP_OVERRIDE}"
+  fi
   _pki_client_server "${pki_allow_list}" "${ZITI_PKI_CTRL_EDGE_INTERMEDIATE_NAME}" "${pki_allow_list_ip}" "${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS}"
 
   echo -e "$(GREEN "PKI generated successfully")"

From ebf9d98f1b5d30039359e562b96ad0c02a6da1a4 Mon Sep 17 00:00:00 2001
From: gberl002 <geoff.berl@netfoundry.io>
Date: Thu, 27 Jul 2023 15:08:19 -0400
Subject: [PATCH 02/17] Adding IP address detection function Adding ctrl edge
 advertised address to the ctrl's SANs

Signed-off-by: gberl002 <geoff.berl@netfoundry.io>
---
 quickstart/docker/image/ziti-cli-functions.sh | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh
index 3593a8e9a..23237b471 100644
--- a/quickstart/docker/image/ziti-cli-functions.sh
+++ b/quickstart/docker/image/ziti-cli-functions.sh
@@ -92,6 +92,17 @@ function _dedupe_list {
   echo "${list}" | tr "'${delimiter}'" '\n' | sort -u | xargs | tr ' ' ','
 }
 
+# Checks if a value is likely an IP address
+function _is_ip {
+  local param pattern
+  param="${1}"
+  pattern="^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$"
+  if [[ "${param}" =~ $pattern ]]; then
+    return 1
+  fi
+  return 0
+}
+
 function _pki_client_server {
   local retVal dns_allow_list ZITI_CA_NAME_local ip_allow_list file_name
   _check_env_variable ZITI_PKI ZITI_BIN_DIR
@@ -730,7 +741,7 @@ function createPki {
   _pki_create_intermediate "${ZITI_SPURIOUS_INTERMEDIATE}" "${ZITI_PKI_SIGNER_INTERMEDIATE_NAME}" 1
 
   echo " "
-  pki_allow_list="${ZITI_CTRL_ADVERTISED_ADDRESS},localhost,${ZITI_NETWORK}"
+  pki_allow_list="${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS},${ZITI_CTRL_ADVERTISED_ADDRESS},localhost,${ZITI_NETWORK}"
   pki_allow_list_ip="127.0.0.1"
   _pki_client_server "${pki_allow_list}" "${ZITI_PKI_CTRL_INTERMEDIATE_NAME}" "${pki_allow_list_ip}" "${ZITI_CTRL_ADVERTISED_ADDRESS}"
 

From 16aa6fd65aed2ea47bf7f91187a368a8a4cb7cab Mon Sep 17 00:00:00 2001
From: gberl002 <geoff.berl@netfoundry.io>
Date: Tue, 1 Aug 2023 15:05:36 -0400
Subject: [PATCH 03/17] Adding ability to customize the image tag or default to
 latest

Signed-off-by: gberl002 <geoff.berl@netfoundry.io>
---
 quickstart/docker/README.md           | 3 +++
 quickstart/docker/createLocalImage.sh | 2 +-
 quickstart/docker/pushLatestDocker.sh | 8 +++++++-
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/quickstart/docker/README.md b/quickstart/docker/README.md
index 77516fb3e..b6ebbf772 100644
--- a/quickstart/docker/README.md
+++ b/quickstart/docker/README.md
@@ -15,17 +15,20 @@ First, decide what you are trying to do. Are you trying to:
 1. copy the `ziti` CLI to `./ziti-bin`: `cp /path/to/ziti ./ziti-bin`
 1. run the script `./createLocalImage.sh` which will create a `openziti/quickstart:latest` tag
    using the `ziti` CLI located in `./ziti-bin`
+   1. Optionally, you may provide an argument for the image tag. `./createLocalImage.sh <tagname>`
 
 ## Build Docker Image for Docker-related Changes
 1. change to this directory from checkout root: `cd quickstart/docker`
 1. run the script `./createLocalImage.sh` which will create a `openziti/quickstart:latest` tag
    using the latest `ziti` [release from GitHub](https://github.com/openziti/ziti/releases/latest)
+   1. Optionally, you may provide an argument for the image tag. `./createLocalImage.sh <tagname>`
 
 ## Build Docker Image with Specific ziti Version
 1. change to this directory from checkout root: `cd quickstart/docker`
 1. set `ZITI_VERSION_OVERRIDE` to desired version: `export ZITI_VERSION_OVERRIDE=v0.28.4`
 1. run the script `./createLocalImage.sh` which will create a `openziti/quickstart:latest` tag
    using the specified version of `ziti` [from GitHub](https://github.com/openziti/ziti/releases/tag/v0.28.4)
+   1. Optionally, you may provide an argument for the image tag. `./createLocalImage.sh <tagname>`
 
 ## ERROR: existing instance for "ziti-builder"
 When running the `./createLocalImage.sh` script, you might get this error:
diff --git a/quickstart/docker/createLocalImage.sh b/quickstart/docker/createLocalImage.sh
index e1170e45d..42fa9489b 100755
--- a/quickstart/docker/createLocalImage.sh
+++ b/quickstart/docker/createLocalImage.sh
@@ -17,4 +17,4 @@ else
   echo ""
 fi
 
-$SCRIPT_DIR/pushLatestDocker.sh local
\ No newline at end of file
+$SCRIPT_DIR/pushLatestDocker.sh local "${1}"
\ No newline at end of file
diff --git a/quickstart/docker/pushLatestDocker.sh b/quickstart/docker/pushLatestDocker.sh
index 5110ede0e..d93d1780b 100755
--- a/quickstart/docker/pushLatestDocker.sh
+++ b/quickstart/docker/pushLatestDocker.sh
@@ -15,6 +15,12 @@ if [ -z "${ZITI_VERSION}" ]; then
   exit 1
 fi
 
+IMAGE_TAG="${2-}"
+if [ -z "${IMAGE_TAG}" ]; then
+  IMAGE_TAG="latest"
+  echo "image tag name was not provided, using default '${IMAGE_TAG}'"
+fi
+
 docker buildx create --use --name=ziti-builder
 
 if [ "local" == "${1}" ]; then
@@ -28,5 +34,5 @@ fi
 docker buildx build ${_BUILDX_PLATFORM} "${SCRIPT_DIR}/image" \
   --build-arg ZITI_VERSION_OVERRIDE="v${ZITI_VERSION}" \
   --tag "openziti/quickstart:${ZITI_VERSION}" \
-  --tag "openziti/quickstart:latest" \
+  --tag "openziti/quickstart:${IMAGE_TAG}" \
   ${_BUILDX_ACTION}
\ No newline at end of file

From 9c1c4ab3ef6ea242ff70a9f16f8e2e1588ea55a7 Mon Sep 17 00:00:00 2001
From: gberl002 <geoff.berl@netfoundry.io>
Date: Tue, 1 Aug 2023 15:06:05 -0400
Subject: [PATCH 04/17] Fixing race condition with .env file in docker compose

Signed-off-by: gberl002 <geoff.berl@netfoundry.io>
---
 quickstart/docker/docker-compose.yml  | 26 +++++++++++++++++++-------
 quickstart/docker/image/run-router.sh |  8 +-------
 2 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/quickstart/docker/docker-compose.yml b/quickstart/docker/docker-compose.yml
index 13d1f6797..9f0d705bf 100644
--- a/quickstart/docker/docker-compose.yml
+++ b/quickstart/docker/docker-compose.yml
@@ -2,6 +2,11 @@ version: '2.4'
 services:
   ziti-controller:
     image: "${ZITI_IMAGE}:${ZITI_VERSION}"
+    healthcheck:
+      test: curl -m 1 -s -k https://${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS:-ziti-edge-controller}:${ZITI_CTRL_EDGE_ADVERTISED_PORT:-1280}/edge/client/v1/version
+      interval: 1s
+      timeout: 3s
+      retries: 30
     env_file:
       - ./.env
     ports:
@@ -32,7 +37,8 @@ services:
   ziti-controller-init-container:
     image: "${ZITI_IMAGE}:${ZITI_VERSION}"
     depends_on:
-      - ziti-controller
+      ziti-controller:
+        condition: service_healthy
     environment:
       - ZITI_CTRL_EDGE_ADVERTISED_ADDRESS=${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS:-ziti-edge-controller}
       - ZITI_CTRL_EDGE_ADVERTISED_PORT=${ZITI_CTRL_EDGE_ADVERTISED_PORT:-1280}
@@ -57,7 +63,8 @@ services:
     env_file:
       - ./.env
     depends_on:
-      - ziti-controller
+      ziti-controller:
+        condition: service_healthy
     ports:
       - ${ZITI_ROUTER_PORT:-3022}:${ZITI_ROUTER_PORT:-3022}
       - ${ZITI_ROUTER_LISTENER_BIND_PORT:-10080}:${ZITI_ROUTER_LISTENER_BIND_PORT:-10080}
@@ -84,7 +91,8 @@ services:
     env_file:
       - ./.env
     depends_on:
-      - ziti-controller
+      ziti-controller:
+        condition: service_healthy
     ports:
       - ${ZITI_ROUTER_WSS_PORT:-3023}:${ZITI_ROUTER_WSS_PORT:-3023}
       - ${ZITI_ROUTER_LISTENER_BIND_PORT:-10081}:${ZITI_ROUTER_LISTENER_BIND_PORT:-10081}
@@ -113,7 +121,8 @@ services:
     env_file:
       - ./.env
     depends_on:
-      - ziti-controller
+      ziti-controller:
+        condition: service_healthy
     environment:
       - ZITI_CTRL_ADVERTISED_ADDRESS=${ZITI_CTRL_ADVERTISED_ADDRESS:-ziti-controller}
       - ZITI_CTRL_ADVERTISED_PORT=${ZITI_CTRL_ADVERTISED_PORT:-6262}
@@ -135,7 +144,8 @@ services:
     env_file:
       - ./.env
     depends_on:
-      - ziti-controller
+      ziti-controller:
+        condition: service_healthy
     environment:
       - ZITI_CTRL_ADVERTISED_ADDRESS=${ZITI_CTRL_ADVERTISED_ADDRESS:-ziti-controller}
       - ZITI_CTRL_ADVERTISED_PORT=${ZITI_CTRL_ADVERTISED_PORT:-6262}
@@ -156,7 +166,8 @@ services:
     env_file:
       - ./.env
     depends_on:
-      - ziti-controller
+      ziti-controller:
+        condition: service_healthy
     environment:
       - ZITI_CTRL_ADVERTISED_ADDRESS=${ZITI_CTRL_ADVERTISED_ADDRESS:-ziti-controller}
       - ZITI_CTRL_ADVERTISED_PORT=${ZITI_CTRL_ADVERTISED_PORT:-6262}
@@ -194,7 +205,8 @@ services:
       - ZITI_CTRL_NAME=${ZITI_CTRL_NAME:-ziti-edge-controller}
       - PORTTLS=8443
     depends_on:
-      - ziti-controller
+      ziti-controller:
+        condition: service_healthy
     ports:
       - 8443:8443
     volumes:
diff --git a/quickstart/docker/image/run-router.sh b/quickstart/docker/image/run-router.sh
index 2e72ab363..8b31cc83c 100755
--- a/quickstart/docker/image/run-router.sh
+++ b/quickstart/docker/image/run-router.sh
@@ -14,12 +14,6 @@ fi
 
 . ${ZITI_HOME}/ziti.env
 
-# wait for the controller to come online
-_wait_for_controller
-
-# after coming online, give the controller just a second to ramp up in case running via docker compose
-sleep 1
-
 if [[ "${_ZITI_ROUTER_NAME}" != "" ]]; then
   export ZITI_ROUTER_NAME="${_ZITI_ROUTER_NAME}"
   echo "ZITI_ROUTER_NAME set to: ${ZITI_ROUTER_NAME}"
@@ -48,7 +42,7 @@ if [ ! -f "${_UNIQUE_NAME}" ]; then
     createPrivateRouterConfig "${ZITI_ROUTER_NAME}"
   fi
 
-  found=$(ziti edge list edge-routers 'name = "'"${ZITI_ROUTER_NAME}"'"' | grep -c "${ZITI_ROUTER_NAME}")
+  found=$("${ZITI_BIN_DIR-}/ziti" edge list edge-routers 'name = "'"${ZITI_ROUTER_NAME}"'"' | grep -c "${ZITI_ROUTER_NAME}")
   if [[ found -gt 0 ]]; then
     echo "----------  Found existing edge-router ${ZITI_ROUTER_NAME}...."
   else

From 40cd1ccb95e2ccf249476f874567833eec6abd26 Mon Sep 17 00:00:00 2001
From: gberl002 <geoff.berl@netfoundry.io>
Date: Wed, 2 Aug 2023 10:34:35 -0400
Subject: [PATCH 05/17] Adding code back for non docker instances

Signed-off-by: gberl002 <geoff.berl@netfoundry.io>
---
 quickstart/docker/image/run-router.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/quickstart/docker/image/run-router.sh b/quickstart/docker/image/run-router.sh
index 8b31cc83c..87888a831 100755
--- a/quickstart/docker/image/run-router.sh
+++ b/quickstart/docker/image/run-router.sh
@@ -14,6 +14,12 @@ fi
 
 . ${ZITI_HOME}/ziti.env
 
+# wait for the controller to come online
+_wait_for_controller
+
+# after coming online, give the controller just a second to ramp up in case running via docker compose
+sleep 1
+
 if [[ "${_ZITI_ROUTER_NAME}" != "" ]]; then
   export ZITI_ROUTER_NAME="${_ZITI_ROUTER_NAME}"
   echo "ZITI_ROUTER_NAME set to: ${ZITI_ROUTER_NAME}"

From 2d38db2e9332280ffdac771d78963a7353ac5881 Mon Sep 17 00:00:00 2001
From: gberl002 <geoff.berl@netfoundry.io>
Date: Wed, 2 Aug 2023 11:09:57 -0400
Subject: [PATCH 06/17] Adding IP check to avoid adding an IP to the SANs DNS
 list

Signed-off-by: gberl002 <geoff.berl@netfoundry.io>
---
 quickstart/docker/image/ziti-cli-functions.sh | 28 +++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh
index 23237b471..30734083e 100644
--- a/quickstart/docker/image/ziti-cli-functions.sh
+++ b/quickstart/docker/image/ziti-cli-functions.sh
@@ -741,11 +741,35 @@ function createPki {
   _pki_create_intermediate "${ZITI_SPURIOUS_INTERMEDIATE}" "${ZITI_PKI_SIGNER_INTERMEDIATE_NAME}" 1
 
   echo " "
-  pki_allow_list="${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS},${ZITI_CTRL_ADVERTISED_ADDRESS},localhost,${ZITI_NETWORK}"
+  pki_allow_list="localhost,${ZITI_NETWORK}"
+  if [[ "${ZITI_CTRL_ADVERTISED_ADDRESS-}" != "" ]]; then
+    if ! _is_ip "${ZITI_CTRL_ADVERTISED_ADDRESS-}"; then
+      pki_allow_list="${pki_allow_list},${ZITI_CTRL_ADVERTISED_ADDRESS}"
+    else
+      echo -e "$(YELLOW "ZITI_CTRL_ADVERTISED_ADDRESS seems to be an IP address, it will not be added to the SANs DNS list.") "
+    fi
+  fi
+  if [[ "${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS-}" != "" ]]; then
+    if ! _is_ip "${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS-}"; then
+      pki_allow_list="${pki_allow_list},${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS}"
+    else
+      echo -e "$(YELLOW "ZITI_CTRL_EDGE_ADVERTISED_ADDRESS seems to be an IP address, it will not be added to the SANs DNS list.") "
+    fi
+  fi
   pki_allow_list_ip="127.0.0.1"
+  if [[ "${ZITI_CTRL_EDGE_IP_OVERRIDE-}" != "" ]]; then
+    pki_allow_list_ip="${pki_allow_list_ip},${ZITI_CTRL_EDGE_IP_OVERRIDE}"
+  fi
   _pki_client_server "${pki_allow_list}" "${ZITI_PKI_CTRL_INTERMEDIATE_NAME}" "${pki_allow_list_ip}" "${ZITI_CTRL_ADVERTISED_ADDRESS}"
 
-  pki_allow_list="${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS},localhost,${ZITI_NETWORK}"
+  pki_allow_list="localhost,${ZITI_NETWORK}"
+  if [[ "${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS-}" != "" ]]; then
+    if ! _is_ip "${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS-}"; then
+      pki_allow_list="${pki_allow_list},${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS}"
+    else
+      echo -e "$(YELLOW "ZITI_CTRL_EDGE_ADVERTISED_ADDRESS seems to be an IP address, it will not be added to the SANs DNS list.") "
+    fi
+  fi
   pki_allow_list_ip="127.0.0.1"
   if [[ "${ZITI_CTRL_EDGE_IP_OVERRIDE-}" != "" ]]; then
     pki_allow_list_ip="${pki_allow_list_ip},${ZITI_CTRL_EDGE_IP_OVERRIDE}"

From 4bf0d162ce3d220276021a644a4fd4890b1ff0f7 Mon Sep 17 00:00:00 2001
From: gberl002 <geoff.berl@netfoundry.io>
Date: Wed, 2 Aug 2023 11:17:13 -0400
Subject: [PATCH 07/17] flip bool to return success (0) if condition is
 satisfied

Signed-off-by: gberl002 <geoff.berl@netfoundry.io>
---
 quickstart/docker/image/ziti-cli-functions.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh
index 30734083e..071ba17db 100644
--- a/quickstart/docker/image/ziti-cli-functions.sh
+++ b/quickstart/docker/image/ziti-cli-functions.sh
@@ -98,9 +98,9 @@ function _is_ip {
   param="${1}"
   pattern="^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$"
   if [[ "${param}" =~ $pattern ]]; then
-    return 1
+    return 0
   fi
-  return 0
+  return 1
 }
 
 function _pki_client_server {

From 7806d6c1fb5a69a21145ae866ad21d6d394fa3f2 Mon Sep 17 00:00:00 2001
From: gberl002 <geoff.berl@netfoundry.io>
Date: Tue, 8 Aug 2023 13:59:24 -0400
Subject: [PATCH 08/17] Remove IPs from SANs DNS in router config Updated
 template data to user more standard true/false logic for commenting sections.

Signed-off-by: gberl002 <geoff.berl@netfoundry.io>
---
 ziti/cmd/config_templates/router.yml    | 19 +++++++++++--------
 ziti/cmd/create_config.go               | 16 ++++++++++------
 ziti/cmd/create_config_controller.go    |  4 ++--
 ziti/cmd/create_config_router_common.go |  4 ++--
 ziti/cmd/create_config_router_test.go   |  4 ++--
 5 files changed, 27 insertions(+), 20 deletions(-)

diff --git a/ziti/cmd/config_templates/router.yml b/ziti/cmd/config_templates/router.yml
index 810518151..f64ca8a8a 100644
--- a/ziti/cmd/config_templates/router.yml
+++ b/ziti/cmd/config_templates/router.yml
@@ -1,19 +1,20 @@
-{{/*
+{{- /*
  Config Format Version
 
  Whenever a breaking change is made to the semantics of this configuration file, the configuration version
  expected by the router will be incremented. When the controller tries to load a configuration file with
  an incompatible version, it will abort with a message prompting the operator to seek out the breaking changes
- documentation.*/}}v: 3
+ documentation.*/ -}}
+v: 3
 
 identity:
   cert:             "{{ .Router.IdentityCert }}"
   server_cert:      "{{ .Router.IdentityServerCert }}"
   key:              "{{ .Router.IdentityKey }}"
   ca:               "{{ .Router.IdentityCA }}"
-  {{ .Router.AltCertsEnabled }}alt_server_certs:
-  {{ .Router.AltCertsEnabled }}  - server_cert:  "{{ .Router.AltServerCert }}"
-  {{ .Router.AltCertsEnabled }}    server_key:   "{{ .Router.AltServerKey }}"
+{{ if not .Router.AltCertsEnabled }}#{{ end }}alt_server_certs:
+{{ if not .Router.AltCertsEnabled }}#{{ end }}  - server_cert:  "{{ .Router.AltServerCert }}"
+{{ if not .Router.AltCertsEnabled }}#{{ end }}    server_key:   "{{ .Router.AltServerKey }}"
 
 ctrl:
   endpoint:             tls:{{ .Controller.Ctrl.AdvertisedAddress }}:{{ .Controller.Ctrl.AdvertisedPort }}
@@ -50,8 +51,9 @@ csr:
   organizationalUnit: Ziti
   sans:
     dns:
-      - {{ .Router.Edge.AdvertisedHost }}
       - localhost
+{{ if .Router.Edge.CsrSans }}      - {{ .Router.Edge.CsrSans }}{{ end }}
+{{ if ne .Router.Edge.CsrSans .Hostname }}      - {{ .Hostname }}{{ end }}
     ip:
       - "127.0.0.1"
 {{ if .Router.Edge.IPOverride }}      - "{{ .Router.Edge.IPOverride }}"{{ end }}
@@ -65,8 +67,9 @@ edge:
     organizationalUnit: {{ .Router.Edge.CsrOU }}
     sans:
       dns:
-        - {{ .Router.Edge.CsrSans }}
         - localhost
+{{ if .Router.Edge.CsrSans }}        - {{ .Router.Edge.CsrSans }}{{ end }}
+{{ if ne .Router.Edge.CsrSans .Hostname }}        - {{ .Hostname }}{{ end }}
       ip:
         - "127.0.0.1"
 {{ if .Router.Edge.IPOverride }}        - "{{ .Router.Edge.IPOverride }}"{{ end }}
@@ -93,4 +96,4 @@ forwarder:
   xgressDialWorkerCount: {{ .Router.Forwarder.XgressDialWorkerCount }}
   linkDialQueueLength: {{ .Router.Forwarder.LinkDialQueueLength }}
   linkDialWorkerCount: {{ .Router.Forwarder.LinkDialWorkerCount }}
-  
+
diff --git a/ziti/cmd/create_config.go b/ziti/cmd/create_config.go
index b311fc67c..51048870f 100644
--- a/ziti/cmd/create_config.go
+++ b/ziti/cmd/create_config.go
@@ -20,7 +20,7 @@ import (
 	"github.com/openziti/ziti/ziti/cmd/common"
 	cmdHelper "github.com/openziti/ziti/ziti/cmd/helpers"
 	"github.com/openziti/ziti/ziti/constants"
-	"os"
+	"regexp"
 	"time"
 
 	"github.com/openziti/channel/v2"
@@ -117,7 +117,7 @@ type IdentityValues struct {
 	Cert            string
 	AltServerCert   string
 	AltServerKey    string
-	AltCertsEnabled string //a string containing either nothing "" or "#"
+	AltCertsEnabled bool
 }
 
 type WebOptionsValues struct {
@@ -149,7 +149,7 @@ type RouterTemplateValues struct {
 	IdentityCA         string
 	AltServerCert      string
 	AltServerKey       string
-	AltCertsEnabled    string //a string containing either nothing "" or "#"
+	AltCertsEnabled    bool
 	Edge               EdgeRouterTemplateValues
 	Wss                WSSRouterTemplateValues
 	Forwarder          RouterForwarderTemplateValues
@@ -230,15 +230,13 @@ func (options *CreateConfigOptions) addCreateFlags(cmd *cobra.Command) {
 func (data *ConfigTemplateValues) populateConfigValues() {
 
 	// Get and add hostname to the params
-	hostname, err := os.Hostname()
-	handleVariableError(err, "hostname")
+	data.Hostname = cmdHelper.HostnameOrNetworkName()
 
 	// Get and add ziti home to the params
 	zitiHome, err := cmdHelper.GetZitiHome()
 	handleVariableError(err, constants.ZitiHomeVarName)
 
 	data.ZitiHome = zitiHome
-	data.Hostname = hostname
 	// ************* Controller Values ************
 	// Identities are handled in create_config_controller
 	// ctrl:
@@ -290,6 +288,12 @@ func (data *ConfigTemplateValues) populateConfigValues() {
 	data.Router.Edge.CsrO = cmdHelper.GetZitiEdgeRouterO()
 	data.Router.Edge.CsrOU = cmdHelper.GetZitiEdgeRouterOU()
 	data.Router.Edge.CsrSans = cmdHelper.GetRouterSans()
+	// If CSR SANs is an IP, ignore it by setting it blank
+	result, _ := regexp.MatchString("^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}$", data.Router.Edge.CsrSans)
+	if result {
+		logrus.Warnf("DNS provided (%s) appears to be an IP, ignoring for DNS entry", data.Router.Edge.CsrSans)
+		data.Router.Edge.CsrSans = ""
+	}
 	data.Router.Listener.GetSessionTimeout = constants.DefaultGetSessionTimeout
 
 	data.Router.Wss.WriteTimeout = foundation.DefaultWsWriteTimeout
diff --git a/ziti/cmd/create_config_controller.go b/ziti/cmd/create_config_controller.go
index f2cbdc2a0..e60dac746 100644
--- a/ziti/cmd/create_config_controller.go
+++ b/ziti/cmd/create_config_controller.go
@@ -279,7 +279,7 @@ func SetWebIdentityCA(c *ControllerTemplateValues) {
 }
 
 func SetCtrlAltServerCerts(c *ControllerTemplateValues) {
-	c.Web.Identity.AltCertsEnabled = "#"
+	c.Web.Identity.AltCertsEnabled = false
 	altServerCert := os.Getenv(constants.PkiAltServerCertVarName)
 	if altServerCert == "" {
 		return //exit unless both vars are set
@@ -288,7 +288,7 @@ func SetCtrlAltServerCerts(c *ControllerTemplateValues) {
 	if altServerKey == "" {
 		return //exit unless both vars are set
 	}
-	c.Web.Identity.AltCertsEnabled = ""
+	c.Web.Identity.AltCertsEnabled = true
 	c.Web.Identity.AltServerCert = helpers2.NormalizePath(altServerCert)
 	c.Web.Identity.AltServerKey = helpers2.NormalizePath(altServerKey)
 }
diff --git a/ziti/cmd/create_config_router_common.go b/ziti/cmd/create_config_router_common.go
index 4e278faf7..08c44438c 100644
--- a/ziti/cmd/create_config_router_common.go
+++ b/ziti/cmd/create_config_router_common.go
@@ -94,7 +94,7 @@ func validateRouterName(name string) string {
 }
 
 func SetRouterAltServerCerts(c *RouterTemplateValues) {
-	c.AltCertsEnabled = "#"
+	c.AltCertsEnabled = false
 	altServerCert := os.Getenv(constants.PkiAltServerCertVarName)
 	if altServerCert == "" {
 		return //exit unless both vars are set
@@ -103,7 +103,7 @@ func SetRouterAltServerCerts(c *RouterTemplateValues) {
 	if altServerKey == "" {
 		return //exit unless both vars are set
 	}
-	c.AltCertsEnabled = ""
+	c.AltCertsEnabled = true
 	c.AltServerCert = helpers2.NormalizePath(altServerCert)
 	c.AltServerKey = helpers2.NormalizePath(altServerKey)
 }
diff --git a/ziti/cmd/create_config_router_test.go b/ziti/cmd/create_config_router_test.go
index edcdc42b1..f426c84c5 100644
--- a/ziti/cmd/create_config_router_test.go
+++ b/ziti/cmd/create_config_router_test.go
@@ -296,7 +296,7 @@ func TestAltServerCerts(t *testing.T) {
 	SetZitiRouterIdentity(rtv, "routerTest")
 
 	//with only ZITI_ALT_SERVER_CERT set, should be false/blank
-	assert.Equal(t, "#", rtv.AltCertsEnabled)
+	assert.False(t, rtv.AltCertsEnabled)
 	assert.Equal(t, "", rtv.AltServerCert)
 	assert.Equal(t, "", rtv.AltServerKey)
 
@@ -304,7 +304,7 @@ func TestAltServerCerts(t *testing.T) {
 	rtv = &RouterTemplateValues{}
 	SetZitiRouterIdentity(rtv, "routerTest")
 
-	assert.Equal(t, "", rtv.AltCertsEnabled)
+	assert.True(t, rtv.AltCertsEnabled)
 	assert.Equal(t, certPath, rtv.AltServerCert)
 	assert.Equal(t, keyPath, rtv.AltServerKey)
 }

From ba6340449fb748565b596e2c046499e8966f830e Mon Sep 17 00:00:00 2001
From: gberl002 <geoff.berl@netfoundry.io>
Date: Tue, 8 Aug 2023 14:09:16 -0400
Subject: [PATCH 09/17] Updated Changelog

Signed-off-by: gberl002 <geoff.berl@netfoundry.io>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 037c587e2..014236398 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@
 * github.com/openziti/ziti: [v0.29.0 -> v0.29.1](https://github.com/openziti/ziti/compare/v0.29.0...v0.29.1)
   * [Issue #1212](https://github.com/openziti/ziti/issues/1212) - Fixed getZiti function on Mac/ZSH
   * [Issue #1220](https://github.com/openziti/ziti/issues/1220) - Fixed getZiti function not respecting user input for custom path
+  * Added check for IPs provided as a DNS SANs entry, IPs will be ignored and not added as a DNS entry in the expressInstall PKI or router config generation.
 
 # Release 0.29.0
 

From 595e365b16f10bacc8d327e3360763d2addb4505 Mon Sep 17 00:00:00 2001
From: gberl002 <geoff.berl@netfoundry.io>
Date: Wed, 9 Aug 2023 14:27:00 -0400
Subject: [PATCH 10/17] Adding bug ID to changelog

Signed-off-by: gberl002 <geoff.berl@netfoundry.io>
---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 014236398..3a0310507 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@
 * github.com/openziti/ziti: [v0.29.0 -> v0.29.1](https://github.com/openziti/ziti/compare/v0.29.0...v0.29.1)
   * [Issue #1212](https://github.com/openziti/ziti/issues/1212) - Fixed getZiti function on Mac/ZSH
   * [Issue #1220](https://github.com/openziti/ziti/issues/1220) - Fixed getZiti function not respecting user input for custom path
-  * Added check for IPs provided as a DNS SANs entry, IPs will be ignored and not added as a DNS entry in the expressInstall PKI or router config generation.
+  * [Issue #1219](https://github.com/openziti/ziti/issues/1219) - Added check for IPs provided as a DNS SANs entry, IPs will be ignored and not added as a DNS entry in the expressInstall PKI or router config generation.
 
 # Release 0.29.0
 

From 9a873cc71580c6db29f7ee70cd4da57489b3c68d Mon Sep 17 00:00:00 2001
From: Paul Lorenz <paul.lorenz@netfoundry.io>
Date: Wed, 2 Aug 2023 13:09:22 -0400
Subject: [PATCH 11/17] Update deps and changelog for link management changes

---
 CHANGELOG.md    | 131 +++++++++++++++++++++++++++++++++++++++++++++++-
 go.mod          |  30 +++++------
 go.sum          |  59 +++++++++++-----------
 version         |   2 +-
 zititest/go.mod |  30 +++++------
 zititest/go.sum |  59 +++++++++++-----------
 6 files changed, 221 insertions(+), 90 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 037c587e2..c50a53b45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,136 @@
-# Release 0.29.1
+# Release 0.30.0
 
 ## What's New
 
+* Link management is now delegated to routers
+
+## Link Management Updates
+
+Previously, the controller would do its best to determine where links needed to be established.
+It would send messages to the routers, telling them which addresses to dial on other routes.
+The routers would in turn let the controller know if link establishment was successful or
+if the router already had a link to the given endpoint.
+
+With this release, the controller will only let routers know which routers exist, whether they 
+are currently connected to the controller, and what link listeners they are advertising. The 
+routers will now decide which links to make and let the controllers know as links are created 
+and broken.
+
+### Link Groups
+
+Both dialers and listeners can now specify a set of groups. If no groups are specified, the 
+dialer or listener will be placed in the `default` group. Dialers will only attempt to dial 
+listeners who have at least one group in common with them.
+
+
+### Failed Links
+
+Previously when a link failed, the controller would show it in the link list as failed for a time
+before removing it. Now failed links are removed immediately. There are existing link events for
+link creation and link failure which can be used for forensics. 
+
+### Duplicate Links
+
+There is a new link status `Duplicate` used when a router receives a link request and determines
+that it's a duplicate of an existing link. This happens when two routers both have listeners
+and dialers. They will often dial each other at the same time, resulting in a duplicate link.
+
+### Compatibility
+
+If you use a 0.30+ controller with older routers, the controller will still do link calculation
+and send dial messages, as long as the `enableLegacyLinkMgmt` setting is set to true.
+
+If you use a pre 0.30.0 controller with newer routers, the new routers will still accept the
+dial messages.
+
+### New Configuration
+
+#### Controller
+
+The controller has three new options:
+
+```
+network:
+    routerMessaging:
+        queueSize: 100
+        maxWorkers: 100
+    enableLegacyLinkMgmt: true
+```
+
+When a router connects or disconnects from the controller, we send two sets of updates. 
+
+1. If a router has connected we send it the the state of the other routers
+1. We send all the other routers the updated state of the connecting/disconnecting router
+
+These messages are sent using a worker pool. The size of the queue feeding the worker pool is controlled with
+ `routerMessaging.queueSize`. The max size of the worker pool is controlled used the `routerMessaging.maxWorkers` 
+option.
+
+* queueSize
+    * Min value: 0
+    * Max value: 1,000,000
+    * Default: 100
+* maxWorkers
+    * Min value: 1
+    * Max value: 10,000
+    * Default: 100
+
+If you have routers older than 0.30.0, the controller will calculate which links to dial. This can be disabled
+by setting `enableLegacyLinkMgmt` to false. This setting currently defaults to true, but will default to false
+in a future release. In a subsequent release this functionality will be removed all together.
+
+#### Router
+
+The router has new configuration options for link dialing. 
+
+```
+link:
+   dialers:
+       - binding: transport
+         groups: 
+             - public
+             - vpc1234
+         healthyDialBackoff:
+             retryBackoffFactor: 1.5
+             minRetryInterval: 5s
+             maxRetryInterval: 5m
+         unhealthyDialBackoff:
+             retryBackoffFactor: 10
+             minRetryInterval: 1m
+             maxRetryInterval: 1h
+    listeners:
+        - binding: transport
+          groups: vpc1234
+```
+
+**Groups**
+
+See above for a description of link groups work. 
+
+Default value: `default`
+
+**Dial Back-off**
+
+Dialers can be configured with custom back-off behavior. Each dialer has a back-off policy for dialing
+healthy routers (those that are connected to a controller) and a separate policy for unhealthy routers.
+
+The back-off policies have the following attributes:
+
+* minRetryInterval - duration specifying the minimum time between dial attempts
+    * Min value: 10ms 
+    * Max value: 24h
+    * Default: 5s for healthy, 1m for unhealthy
+    * Format: Golang Durations, see: https://pkg.go.dev/maze.io/x/duration#ParseDuration
+* maxRetryInterval - duration specifying the maximum time between dial attempts
+    * Min value: 10ms
+    * Max value: 24h
+    * Default: 5m for healthy, 1h for unhealthy
+    * Format: Golang duration, see: https://pkg.go.dev/maze.io/x/duration#ParseDuration
+* retryBackoffFactor - factor by which to increase the retry interval between failed dial attempts
+    * Min value: 1
+    * Max value: 100
+    * Default: 1.5 for healthy, 100 for unhealthy
+
 ## Component Updates and Bug Fixes
 * github.com/openziti/ziti: [v0.29.0 -> v0.29.1](https://github.com/openziti/ziti/compare/v0.29.0...v0.29.1)
   * [Issue #1212](https://github.com/openziti/ziti/issues/1212) - Fixed getZiti function on Mac/ZSH
diff --git a/go.mod b/go.mod
index 2e5f37c98..c7a9afecf 100644
--- a/go.mod
+++ b/go.mod
@@ -18,18 +18,18 @@ require (
 	github.com/jedib0t/go-pretty/v6 v6.4.0
 	github.com/michaelquigley/pfxlog v0.6.10
 	github.com/openziti/agent v1.0.15
-	github.com/openziti/channel/v2 v2.0.89
-	github.com/openziti/edge v0.24.374
+	github.com/openziti/channel/v2 v2.0.91
+	github.com/openziti/edge v0.24.381
 	github.com/openziti/edge-api v0.25.31
-	github.com/openziti/fabric v0.23.52
-	github.com/openziti/foundation/v2 v2.0.28
-	github.com/openziti/identity v1.0.59
-	github.com/openziti/runzmd v1.0.28
-	github.com/openziti/sdk-golang v0.20.87
-	github.com/openziti/storage v0.2.11
-	github.com/openziti/transport/v2 v2.0.97
+	github.com/openziti/fabric v0.24.2
+	github.com/openziti/foundation/v2 v2.0.29
+	github.com/openziti/identity v1.0.60
+	github.com/openziti/runzmd v1.0.29
+	github.com/openziti/sdk-golang v0.20.90
+	github.com/openziti/storage v0.2.12
+	github.com/openziti/transport/v2 v2.0.99
 	github.com/openziti/xweb/v2 v2.1.0
-	github.com/openziti/ziti-db-explorer v1.1.1
+	github.com/openziti/ziti-db-explorer v1.1.3
 	github.com/pkg/errors v0.9.1
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
 	github.com/russross/blackfriday v1.5.2
@@ -135,7 +135,7 @@ require (
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/openziti/dilithium v0.3.3 // indirect
 	github.com/openziti/jwks v1.0.3 // indirect
-	github.com/openziti/metrics v1.2.30 // indirect
+	github.com/openziti/metrics v1.2.31 // indirect
 	github.com/openziti/secretstream v0.1.10 // indirect
 	github.com/openziti/x509-claims v1.0.3 // indirect
 	github.com/orcaman/concurrent-map/v2 v2.0.1 // indirect
@@ -156,7 +156,7 @@ require (
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/subosito/gotenv v1.2.0 // indirect
 	github.com/teris-io/shortid v0.0.0-20201117134242-e59966efd125 // indirect
-	github.com/tklauser/go-sysconf v0.3.11 // indirect
+	github.com/tklauser/go-sysconf v0.3.12 // indirect
 	github.com/tklauser/numcpus v0.6.1 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
@@ -164,17 +164,17 @@ require (
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.3 // indirect
-	github.com/zitadel/oidc/v2 v2.6.4 // indirect
+	github.com/zitadel/oidc/v2 v2.7.0 // indirect
 	go.mongodb.org/mongo-driver v1.12.1 // indirect
 	go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 // indirect
 	go.opentelemetry.io/otel v1.16.0 // indirect
 	go.opentelemetry.io/otel/metric v1.16.0 // indirect
 	go.opentelemetry.io/otel/trace v1.16.0 // indirect
 	golang.org/x/crypto v0.12.0 // indirect
-	golang.org/x/exp v0.0.0-20230807204917-050eac23e9de // indirect
+	golang.org/x/exp v0.0.0-20230809150735-7b3493d9a819 // indirect
 	golang.org/x/image v0.11.0 // indirect
 	golang.org/x/mod v0.11.0 // indirect
-	golang.org/x/oauth2 v0.9.0 // indirect
+	golang.org/x/oauth2 v0.10.0 // indirect
 	golang.org/x/sync v0.3.0 // indirect
 	golang.org/x/sys v0.11.0 // indirect
 	golang.org/x/term v0.11.0 // indirect
diff --git a/go.sum b/go.sum
index 5ca1a95a3..a8edee572 100644
--- a/go.sum
+++ b/go.sum
@@ -705,40 +705,40 @@ github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTm
 github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw=
 github.com/openziti/agent v1.0.15 h1:NW4egpS3Mw1RQBZWfUEvrmBh9kn/SU/dU5fndsyyhZ4=
 github.com/openziti/agent v1.0.15/go.mod h1:zfm53+PVWoGFzjGGgQdKby5749G6VRYHe+eQJmoVKy4=
-github.com/openziti/channel/v2 v2.0.89 h1:L6Efndhsb0YgvD5LkU6QAB6si2VP4h0Kn0BmY2iBfjQ=
-github.com/openziti/channel/v2 v2.0.89/go.mod h1:O7wkSjV7CuebQQKLHYUL/wPL+8RuZkGQDzd1L7/+8qk=
+github.com/openziti/channel/v2 v2.0.91 h1:HKD7uniGOfiQfbzaP1AJ0JGvls7oejC+fMj6gLJOlW8=
+github.com/openziti/channel/v2 v2.0.91/go.mod h1:2uJzEV3pX4soPPl07l8ScONNGuSQTQzUqAYkgATA3Rk=
 github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAPD8k=
 github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo=
-github.com/openziti/edge v0.24.374 h1:L1Z3EDrEOHxOj5hip1rTFJAlLuoB7lXKVdb3Jbp+URI=
-github.com/openziti/edge v0.24.374/go.mod h1:bPFyx5/N3acmNVODDkGrTyGxYLviO3I52j0Owj8MQvs=
+github.com/openziti/edge v0.24.381 h1:8Uklh0w9+EFMhBkzDC7kFm0c09NAZbUHuLuWZekZY0M=
+github.com/openziti/edge v0.24.381/go.mod h1:sFJbZLfBU2kFsc70LkzUW4eizZye9ejVMOtu8iI8pq8=
 github.com/openziti/edge-api v0.25.31 h1:KiM4pQVIqy/0CN/FW2AgoN7PcejB+y8FdgjN86Jn83Q=
 github.com/openziti/edge-api v0.25.31/go.mod h1:7fyXLqNcyC5IG29GuI8danhhppAaxRV6HiCLwN1Kk64=
-github.com/openziti/fabric v0.23.52 h1:8F4jt00RDrZJz6YiKliJ8UGnknE3jSuWwxsK3641ehE=
-github.com/openziti/fabric v0.23.52/go.mod h1:wLYKhlnhthLR7FBqfGlfdCZ0hbQCcSnr5b2wpjA4/vM=
-github.com/openziti/foundation/v2 v2.0.28 h1:AAdHhtUj1tCIXollSpbDlKwPKRasNAgADpTZAF1WCOQ=
-github.com/openziti/foundation/v2 v2.0.28/go.mod h1:psKxxQw/zRo5+oKN7AR+MKYaeR3mbBPhb65qq8rqB0U=
-github.com/openziti/identity v1.0.59 h1:YShXqxa9nTbCnPtIAji10hx7BG1nQukg4ddUJExNXa8=
-github.com/openziti/identity v1.0.59/go.mod h1:9vQjDHH2Z3kFmkwmHsVKfI9EdcXjUiwAiR8Sc6Qzmbk=
+github.com/openziti/fabric v0.24.2 h1:fb7fE/d3it6OrwhJqfr0RKQ41VUV9VKFsOOl98zdoRY=
+github.com/openziti/fabric v0.24.2/go.mod h1:rXhb73v5rgoUV1AbRDXF8gAcbualabJU9YyLMkiB0yw=
+github.com/openziti/foundation/v2 v2.0.29 h1:E63p5/esqOJ/OSMePR3fKYHb3Wq2BR4PLkDFynESij8=
+github.com/openziti/foundation/v2 v2.0.29/go.mod h1:MpXSCSn4MABvtIXzfTBFqhK5pNsNXHWnR8xxVrfxn0g=
+github.com/openziti/identity v1.0.60 h1:6gvBXY9J6F7SbuksdxsUA1t1WmtsFfY61Oqm/00ijGU=
+github.com/openziti/identity v1.0.60/go.mod h1:pUfQ1Rf6TJvpBULXKPAO4014Qd6g+uf6V/vqjUscipU=
 github.com/openziti/jwks v1.0.3 h1:hf8wkb+Cg4nH/HM0KROFd7u+C3DkRVcFZJ7tDV+4icc=
 github.com/openziti/jwks v1.0.3/go.mod h1:t4xxq8vlXGsPn29kiQVnZBBDDnEoOFqtJoHibkJunQQ=
-github.com/openziti/metrics v1.2.30 h1:0ZV9UWPupcBvHigzET1wf47idrTflYSHInNgDtZqkIQ=
-github.com/openziti/metrics v1.2.30/go.mod h1:8xSr4Rl0527Lyp5IKvUYwPNObIFkO8AS3nO2RjvDPSQ=
-github.com/openziti/runzmd v1.0.28 h1:8VNgENRAm1pfp0YoJWYoW6uBtyMD6ccVTsC24kx2gpk=
-github.com/openziti/runzmd v1.0.28/go.mod h1:4r4uNOK34lKbilrV7yaiDiPwRGIvj1XQSl6E6U8NmAw=
-github.com/openziti/sdk-golang v0.20.87 h1:hhJd0/msZf/2vC15xXZ4xF3zbR+Bmx1gmgM4K0l4JxI=
-github.com/openziti/sdk-golang v0.20.87/go.mod h1:gszOnLHB9RAuAw5F86uI8fIYNdh3d6+KRHo5zP+uzTU=
+github.com/openziti/metrics v1.2.31 h1:nEO9FAqCnpfuvxGYfy9/W46p2SaEcZ6vlRyz4fcipoY=
+github.com/openziti/metrics v1.2.31/go.mod h1:SU2w3WW36O+ocVy+ka2UHA0cweTg3T8CQiqz4ZT4Umc=
+github.com/openziti/runzmd v1.0.29 h1:skS9Ea8TIYZ28V4yEz3KoWafnto4RAOwv8M2Z4bM8Wo=
+github.com/openziti/runzmd v1.0.29/go.mod h1:rAvUIRGlIWYsHtWRX7lbV8LZPUjsifjZd72xUEfEuTw=
+github.com/openziti/sdk-golang v0.20.90 h1:QXWa1Ti1Sky9D2uv3kAxmybwicZLJH6hgyDpXkdZcYc=
+github.com/openziti/sdk-golang v0.20.90/go.mod h1:IorK7wik0unGAGBuYjdb9ZPFX7ENACtxFpWuTBPOT9Q=
 github.com/openziti/secretstream v0.1.10 h1:aLheoP6vVAv96mItwkXxWr9Ym0tTooJ5o9H1j2fAh04=
 github.com/openziti/secretstream v0.1.10/go.mod h1:HrS6P9G0jjHNHuKESMaybNdxBHjD1b0SzxSi0rDzshY=
-github.com/openziti/storage v0.2.11 h1:Ws23any7NtbEKQroFJt6DJmeEFGMPjZqjAK2/Re9LIE=
-github.com/openziti/storage v0.2.11/go.mod h1:M46XIxPYwTDTgaamI6o9cyEJkYvUYfhJjwvZtQu4tUQ=
-github.com/openziti/transport/v2 v2.0.97 h1:BgsxDYdyzBf6sIIicT6X7WV1S2HMXQA1upmo5UFNYfU=
-github.com/openziti/transport/v2 v2.0.97/go.mod h1:zXB5jNtmTIe3gMCgLuk2RUEsvc8ysVLExnfrRdSg11M=
+github.com/openziti/storage v0.2.12 h1:ghQkt3SCLwRuiTeRLOUWgNL69XQNp9Gx8K3eVw0QTQY=
+github.com/openziti/storage v0.2.12/go.mod h1:RxWIe9FyQg9LZQFZ4FuUROf0lhnfUW2XeWfTbHAMGeY=
+github.com/openziti/transport/v2 v2.0.99 h1:+/DYNzaUrzSSaoKEBNFumXJsXMDEUNiWbWZfX48Z2vc=
+github.com/openziti/transport/v2 v2.0.99/go.mod h1:bV9XKtxnmqW8crReZB2z+cJhSNLl6EsyoouTkyUY8mk=
 github.com/openziti/x509-claims v1.0.3 h1:HNdQ8Nf1agB3lBs1gahcO6zfkeS4S5xoQ2/PkY4HRX0=
 github.com/openziti/x509-claims v1.0.3/go.mod h1:Z0WIpBm6c4ecrpRKrou6Gk2wrLWxJO/+tuUwKh8VewE=
 github.com/openziti/xweb/v2 v2.1.0 h1:Xhh3C2pZkq/Prr65V+SfFSibLDYteoc4f62KQCcTZF4=
 github.com/openziti/xweb/v2 v2.1.0/go.mod h1:wPkjm5y45RYCV8AafjcAXP/ZM4DBOofXhRwSGgjF8w8=
-github.com/openziti/ziti-db-explorer v1.1.1 h1:G0eoTby+aIjjt5TxEfR+FMI2CWd4RvZFjzaIMX2lEBw=
-github.com/openziti/ziti-db-explorer v1.1.1/go.mod h1:h76h7Tsb+khb0v+CqYKL6ifUfJbUMjGBFU2IvupfBE4=
+github.com/openziti/ziti-db-explorer v1.1.3 h1:9JER16MJzagtYPdGEhgDcw2p/BXNCVbf9IgA/sMB52w=
+github.com/openziti/ziti-db-explorer v1.1.3/go.mod h1:pMIMNJoTRSTbkO2e7cZWiBokA3jMdeiGAILP3QhU+v8=
 github.com/oracle/oci-go-sdk v24.2.0+incompatible/go.mod h1:VQb79nF8Z2cwLkLS35ukwStZIg5F66tcBccjip/j888=
 github.com/orcaman/concurrent-map/v2 v2.0.1 h1:jOJ5Pg2w1oeB6PeDurIYf6k9PQ+aTITr/6lP/L/zp6c=
 github.com/orcaman/concurrent-map/v2 v2.0.1/go.mod h1:9Eq3TG2oBe5FirmYWQfYO5iH1q0Jv47PLaNK++uCdOM=
@@ -927,8 +927,9 @@ github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cb
 github.com/teris-io/shortid v0.0.0-20201117134242-e59966efd125 h1:3SNcvBmEPE1YlB1JpVZouslJpI3GBNoiqW7+wb0Rz7w=
 github.com/teris-io/shortid v0.0.0-20201117134242-e59966efd125/go.mod h1:M8agBzgqHIhgj7wEn9/0hJUZcrvt9VY+Ln+S1I5Mha0=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
-github.com/tklauser/go-sysconf v0.3.11 h1:89WgdJhk5SNwJfu+GKyYveZ4IaJ7xAkecBo+KdJV0CM=
 github.com/tklauser/go-sysconf v0.3.11/go.mod h1:GqXfhXY3kiPa0nAXPDIQIWzJbMCB7AmcWpGR8lSZfqI=
+github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
+github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/numcpus v0.6.0/go.mod h1:FEZLMke0lhOUG6w2JadTzp0a+Nl8PF/GFkQ5UVIcaL4=
 github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
 github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
@@ -973,8 +974,8 @@ github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=
 github.com/yusufpapurcu/wmi v1.2.3/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-github.com/zitadel/oidc/v2 v2.6.4 h1:bruA+KOFHcGpxr++WgtvR82ZlH54kKituu5xE4wpF7o=
-github.com/zitadel/oidc/v2 v2.6.4/go.mod h1:owrsdzRqGvIZjBCY9LY1ZUYJ0mRUbGkQpZ3OskXL4wM=
+github.com/zitadel/oidc/v2 v2.7.0 h1:IGX4EDk6tegTjUSsZDWeTfLseFU0BdJ/Glf1tgys2lU=
+github.com/zitadel/oidc/v2 v2.7.0/go.mod h1:zkUkVJS0sDVy9m0UA9RgO3f8i/C0rtjvXU36UJj7T+0=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.etcd.io/bbolt v1.3.7 h1:j+zJOnnEjF/kyHlDDgGnVL/AIqIJPq8UoB2GSNfkUfQ=
 go.etcd.io/bbolt v1.3.7/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw=
@@ -1054,8 +1055,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20230807204917-050eac23e9de h1:l5Za6utMv/HsBWWqzt4S8X17j+kt1uVETUX5UFhn2rE=
-golang.org/x/exp v0.0.0-20230807204917-050eac23e9de/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
+golang.org/x/exp v0.0.0-20230809150735-7b3493d9a819 h1:EDuYyU/MkFXllv9QF9819VlI9a4tzGuCbhG0ExK9o1U=
+golang.org/x/exp v0.0.0-20230809150735-7b3493d9a819/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -1162,8 +1163,8 @@ golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.9.0 h1:BPpt2kU7oMRq3kCHAA1tbSEshXRw1LpG2ztgDwrzuAs=
-golang.org/x/oauth2 v0.9.0/go.mod h1:qYgFZaFiu6Wg24azG8bdV52QJXJGbZzIIsRCdVKzbLw=
+golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8=
+golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
 golang.org/x/perf v0.0.0-20180704124530-6e6d33e29852/go.mod h1:JLpeXjPJfIyPr5TlbXLkXWLhP8nz10XfvxElABhCtcw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
diff --git a/version b/version
index eec15f902..f7c6c31b6 100644
--- a/version
+++ b/version
@@ -1 +1 @@
-0.29
+0.30
diff --git a/zititest/go.mod b/zititest/go.mod
index 13fd3e452..984b6bb20 100644
--- a/zititest/go.mod
+++ b/zititest/go.mod
@@ -9,15 +9,15 @@ require (
 	github.com/Jeffail/gabs/v2 v2.7.0
 	github.com/google/uuid v1.3.0
 	github.com/michaelquigley/pfxlog v0.6.10
-	github.com/openziti/channel/v2 v2.0.89
-	github.com/openziti/edge v0.24.374
+	github.com/openziti/channel/v2 v2.0.91
+	github.com/openziti/edge v0.24.381
 	github.com/openziti/fablab v0.5.5
-	github.com/openziti/fabric v0.23.52
-	github.com/openziti/foundation/v2 v2.0.28
-	github.com/openziti/identity v1.0.59
-	github.com/openziti/sdk-golang v0.20.87
-	github.com/openziti/storage v0.2.11
-	github.com/openziti/transport/v2 v2.0.97
+	github.com/openziti/fabric v0.24.2
+	github.com/openziti/foundation/v2 v2.0.29
+	github.com/openziti/identity v1.0.60
+	github.com/openziti/sdk-golang v0.20.90
+	github.com/openziti/storage v0.2.12
+	github.com/openziti/transport/v2 v2.0.99
 	github.com/openziti/ziti v0.28.3
 	github.com/pkg/errors v0.9.1
 	github.com/sirupsen/logrus v1.9.3
@@ -128,12 +128,12 @@ require (
 	github.com/openziti/agent v1.0.15 // indirect
 	github.com/openziti/edge-api v0.25.31 // indirect
 	github.com/openziti/jwks v1.0.3 // indirect
-	github.com/openziti/metrics v1.2.30 // indirect
-	github.com/openziti/runzmd v1.0.28 // indirect
+	github.com/openziti/metrics v1.2.31 // indirect
+	github.com/openziti/runzmd v1.0.29 // indirect
 	github.com/openziti/secretstream v0.1.10 // indirect
 	github.com/openziti/x509-claims v1.0.3 // indirect
 	github.com/openziti/xweb/v2 v2.1.0 // indirect
-	github.com/openziti/ziti-db-explorer v1.1.1 // indirect
+	github.com/openziti/ziti-db-explorer v1.1.3 // indirect
 	github.com/orcaman/concurrent-map/v2 v2.0.1 // indirect
 	github.com/parallaxsecond/parsec-client-go v0.0.0-20221025095442-f0a77d263cf9 // indirect
 	github.com/pelletier/go-toml v1.9.4 // indirect
@@ -159,7 +159,7 @@ require (
 	github.com/spf13/viper v1.10.0 // indirect
 	github.com/subosito/gotenv v1.2.0 // indirect
 	github.com/teris-io/shortid v0.0.0-20201117134242-e59966efd125 // indirect
-	github.com/tklauser/go-sysconf v0.3.11 // indirect
+	github.com/tklauser/go-sysconf v0.3.12 // indirect
 	github.com/tklauser/numcpus v0.6.1 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
@@ -167,17 +167,17 @@ require (
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.3 // indirect
-	github.com/zitadel/oidc/v2 v2.6.4 // indirect
+	github.com/zitadel/oidc/v2 v2.7.0 // indirect
 	go.mongodb.org/mongo-driver v1.12.1 // indirect
 	go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 // indirect
 	go.opentelemetry.io/otel v1.16.0 // indirect
 	go.opentelemetry.io/otel/metric v1.16.0 // indirect
 	go.opentelemetry.io/otel/trace v1.16.0 // indirect
 	golang.org/x/crypto v0.12.0 // indirect
-	golang.org/x/exp v0.0.0-20230807204917-050eac23e9de // indirect
+	golang.org/x/exp v0.0.0-20230809150735-7b3493d9a819 // indirect
 	golang.org/x/image v0.11.0 // indirect
 	golang.org/x/mod v0.11.0 // indirect
-	golang.org/x/oauth2 v0.9.0 // indirect
+	golang.org/x/oauth2 v0.10.0 // indirect
 	golang.org/x/sync v0.3.0 // indirect
 	golang.org/x/sys v0.11.0 // indirect
 	golang.org/x/term v0.11.0 // indirect
diff --git a/zititest/go.sum b/zititest/go.sum
index 47c1d847e..038886865 100644
--- a/zititest/go.sum
+++ b/zititest/go.sum
@@ -649,40 +649,40 @@ github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYr
 github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw=
 github.com/openziti/agent v1.0.15 h1:NW4egpS3Mw1RQBZWfUEvrmBh9kn/SU/dU5fndsyyhZ4=
 github.com/openziti/agent v1.0.15/go.mod h1:zfm53+PVWoGFzjGGgQdKby5749G6VRYHe+eQJmoVKy4=
-github.com/openziti/channel/v2 v2.0.89 h1:L6Efndhsb0YgvD5LkU6QAB6si2VP4h0Kn0BmY2iBfjQ=
-github.com/openziti/channel/v2 v2.0.89/go.mod h1:O7wkSjV7CuebQQKLHYUL/wPL+8RuZkGQDzd1L7/+8qk=
-github.com/openziti/edge v0.24.374 h1:L1Z3EDrEOHxOj5hip1rTFJAlLuoB7lXKVdb3Jbp+URI=
-github.com/openziti/edge v0.24.374/go.mod h1:bPFyx5/N3acmNVODDkGrTyGxYLviO3I52j0Owj8MQvs=
+github.com/openziti/channel/v2 v2.0.91 h1:HKD7uniGOfiQfbzaP1AJ0JGvls7oejC+fMj6gLJOlW8=
+github.com/openziti/channel/v2 v2.0.91/go.mod h1:2uJzEV3pX4soPPl07l8ScONNGuSQTQzUqAYkgATA3Rk=
+github.com/openziti/edge v0.24.381 h1:8Uklh0w9+EFMhBkzDC7kFm0c09NAZbUHuLuWZekZY0M=
+github.com/openziti/edge v0.24.381/go.mod h1:sFJbZLfBU2kFsc70LkzUW4eizZye9ejVMOtu8iI8pq8=
 github.com/openziti/edge-api v0.25.31 h1:KiM4pQVIqy/0CN/FW2AgoN7PcejB+y8FdgjN86Jn83Q=
 github.com/openziti/edge-api v0.25.31/go.mod h1:7fyXLqNcyC5IG29GuI8danhhppAaxRV6HiCLwN1Kk64=
 github.com/openziti/fablab v0.5.5 h1:wz5rkuGhdDbmNPXC8XtsyHhWk6WJtxCgfhXt5XVWXmY=
 github.com/openziti/fablab v0.5.5/go.mod h1:xkvaXX6C+bGHH5R4G8/vkz1pbBlwS1EzghF37wcNetM=
-github.com/openziti/fabric v0.23.52 h1:8F4jt00RDrZJz6YiKliJ8UGnknE3jSuWwxsK3641ehE=
-github.com/openziti/fabric v0.23.52/go.mod h1:wLYKhlnhthLR7FBqfGlfdCZ0hbQCcSnr5b2wpjA4/vM=
-github.com/openziti/foundation/v2 v2.0.28 h1:AAdHhtUj1tCIXollSpbDlKwPKRasNAgADpTZAF1WCOQ=
-github.com/openziti/foundation/v2 v2.0.28/go.mod h1:psKxxQw/zRo5+oKN7AR+MKYaeR3mbBPhb65qq8rqB0U=
-github.com/openziti/identity v1.0.59 h1:YShXqxa9nTbCnPtIAji10hx7BG1nQukg4ddUJExNXa8=
-github.com/openziti/identity v1.0.59/go.mod h1:9vQjDHH2Z3kFmkwmHsVKfI9EdcXjUiwAiR8Sc6Qzmbk=
+github.com/openziti/fabric v0.24.2 h1:fb7fE/d3it6OrwhJqfr0RKQ41VUV9VKFsOOl98zdoRY=
+github.com/openziti/fabric v0.24.2/go.mod h1:rXhb73v5rgoUV1AbRDXF8gAcbualabJU9YyLMkiB0yw=
+github.com/openziti/foundation/v2 v2.0.29 h1:E63p5/esqOJ/OSMePR3fKYHb3Wq2BR4PLkDFynESij8=
+github.com/openziti/foundation/v2 v2.0.29/go.mod h1:MpXSCSn4MABvtIXzfTBFqhK5pNsNXHWnR8xxVrfxn0g=
+github.com/openziti/identity v1.0.60 h1:6gvBXY9J6F7SbuksdxsUA1t1WmtsFfY61Oqm/00ijGU=
+github.com/openziti/identity v1.0.60/go.mod h1:pUfQ1Rf6TJvpBULXKPAO4014Qd6g+uf6V/vqjUscipU=
 github.com/openziti/jwks v1.0.3 h1:hf8wkb+Cg4nH/HM0KROFd7u+C3DkRVcFZJ7tDV+4icc=
 github.com/openziti/jwks v1.0.3/go.mod h1:t4xxq8vlXGsPn29kiQVnZBBDDnEoOFqtJoHibkJunQQ=
-github.com/openziti/metrics v1.2.30 h1:0ZV9UWPupcBvHigzET1wf47idrTflYSHInNgDtZqkIQ=
-github.com/openziti/metrics v1.2.30/go.mod h1:8xSr4Rl0527Lyp5IKvUYwPNObIFkO8AS3nO2RjvDPSQ=
-github.com/openziti/runzmd v1.0.28 h1:8VNgENRAm1pfp0YoJWYoW6uBtyMD6ccVTsC24kx2gpk=
-github.com/openziti/runzmd v1.0.28/go.mod h1:4r4uNOK34lKbilrV7yaiDiPwRGIvj1XQSl6E6U8NmAw=
-github.com/openziti/sdk-golang v0.20.87 h1:hhJd0/msZf/2vC15xXZ4xF3zbR+Bmx1gmgM4K0l4JxI=
-github.com/openziti/sdk-golang v0.20.87/go.mod h1:gszOnLHB9RAuAw5F86uI8fIYNdh3d6+KRHo5zP+uzTU=
+github.com/openziti/metrics v1.2.31 h1:nEO9FAqCnpfuvxGYfy9/W46p2SaEcZ6vlRyz4fcipoY=
+github.com/openziti/metrics v1.2.31/go.mod h1:SU2w3WW36O+ocVy+ka2UHA0cweTg3T8CQiqz4ZT4Umc=
+github.com/openziti/runzmd v1.0.29 h1:skS9Ea8TIYZ28V4yEz3KoWafnto4RAOwv8M2Z4bM8Wo=
+github.com/openziti/runzmd v1.0.29/go.mod h1:rAvUIRGlIWYsHtWRX7lbV8LZPUjsifjZd72xUEfEuTw=
+github.com/openziti/sdk-golang v0.20.90 h1:QXWa1Ti1Sky9D2uv3kAxmybwicZLJH6hgyDpXkdZcYc=
+github.com/openziti/sdk-golang v0.20.90/go.mod h1:IorK7wik0unGAGBuYjdb9ZPFX7ENACtxFpWuTBPOT9Q=
 github.com/openziti/secretstream v0.1.10 h1:aLheoP6vVAv96mItwkXxWr9Ym0tTooJ5o9H1j2fAh04=
 github.com/openziti/secretstream v0.1.10/go.mod h1:HrS6P9G0jjHNHuKESMaybNdxBHjD1b0SzxSi0rDzshY=
-github.com/openziti/storage v0.2.11 h1:Ws23any7NtbEKQroFJt6DJmeEFGMPjZqjAK2/Re9LIE=
-github.com/openziti/storage v0.2.11/go.mod h1:M46XIxPYwTDTgaamI6o9cyEJkYvUYfhJjwvZtQu4tUQ=
-github.com/openziti/transport/v2 v2.0.97 h1:BgsxDYdyzBf6sIIicT6X7WV1S2HMXQA1upmo5UFNYfU=
-github.com/openziti/transport/v2 v2.0.97/go.mod h1:zXB5jNtmTIe3gMCgLuk2RUEsvc8ysVLExnfrRdSg11M=
+github.com/openziti/storage v0.2.12 h1:ghQkt3SCLwRuiTeRLOUWgNL69XQNp9Gx8K3eVw0QTQY=
+github.com/openziti/storage v0.2.12/go.mod h1:RxWIe9FyQg9LZQFZ4FuUROf0lhnfUW2XeWfTbHAMGeY=
+github.com/openziti/transport/v2 v2.0.99 h1:+/DYNzaUrzSSaoKEBNFumXJsXMDEUNiWbWZfX48Z2vc=
+github.com/openziti/transport/v2 v2.0.99/go.mod h1:bV9XKtxnmqW8crReZB2z+cJhSNLl6EsyoouTkyUY8mk=
 github.com/openziti/x509-claims v1.0.3 h1:HNdQ8Nf1agB3lBs1gahcO6zfkeS4S5xoQ2/PkY4HRX0=
 github.com/openziti/x509-claims v1.0.3/go.mod h1:Z0WIpBm6c4ecrpRKrou6Gk2wrLWxJO/+tuUwKh8VewE=
 github.com/openziti/xweb/v2 v2.1.0 h1:Xhh3C2pZkq/Prr65V+SfFSibLDYteoc4f62KQCcTZF4=
 github.com/openziti/xweb/v2 v2.1.0/go.mod h1:wPkjm5y45RYCV8AafjcAXP/ZM4DBOofXhRwSGgjF8w8=
-github.com/openziti/ziti-db-explorer v1.1.1 h1:G0eoTby+aIjjt5TxEfR+FMI2CWd4RvZFjzaIMX2lEBw=
-github.com/openziti/ziti-db-explorer v1.1.1/go.mod h1:h76h7Tsb+khb0v+CqYKL6ifUfJbUMjGBFU2IvupfBE4=
+github.com/openziti/ziti-db-explorer v1.1.3 h1:9JER16MJzagtYPdGEhgDcw2p/BXNCVbf9IgA/sMB52w=
+github.com/openziti/ziti-db-explorer v1.1.3/go.mod h1:pMIMNJoTRSTbkO2e7cZWiBokA3jMdeiGAILP3QhU+v8=
 github.com/oracle/oci-go-sdk v24.2.0+incompatible/go.mod h1:VQb79nF8Z2cwLkLS35ukwStZIg5F66tcBccjip/j888=
 github.com/orcaman/concurrent-map/v2 v2.0.1 h1:jOJ5Pg2w1oeB6PeDurIYf6k9PQ+aTITr/6lP/L/zp6c=
 github.com/orcaman/concurrent-map/v2 v2.0.1/go.mod h1:9Eq3TG2oBe5FirmYWQfYO5iH1q0Jv47PLaNK++uCdOM=
@@ -830,8 +830,9 @@ github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69
 github.com/teris-io/shortid v0.0.0-20201117134242-e59966efd125 h1:3SNcvBmEPE1YlB1JpVZouslJpI3GBNoiqW7+wb0Rz7w=
 github.com/teris-io/shortid v0.0.0-20201117134242-e59966efd125/go.mod h1:M8agBzgqHIhgj7wEn9/0hJUZcrvt9VY+Ln+S1I5Mha0=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
-github.com/tklauser/go-sysconf v0.3.11 h1:89WgdJhk5SNwJfu+GKyYveZ4IaJ7xAkecBo+KdJV0CM=
 github.com/tklauser/go-sysconf v0.3.11/go.mod h1:GqXfhXY3kiPa0nAXPDIQIWzJbMCB7AmcWpGR8lSZfqI=
+github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
+github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/numcpus v0.6.0/go.mod h1:FEZLMke0lhOUG6w2JadTzp0a+Nl8PF/GFkQ5UVIcaL4=
 github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
 github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
@@ -870,8 +871,8 @@ github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=
 github.com/yusufpapurcu/wmi v1.2.3/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-github.com/zitadel/oidc/v2 v2.6.4 h1:bruA+KOFHcGpxr++WgtvR82ZlH54kKituu5xE4wpF7o=
-github.com/zitadel/oidc/v2 v2.6.4/go.mod h1:owrsdzRqGvIZjBCY9LY1ZUYJ0mRUbGkQpZ3OskXL4wM=
+github.com/zitadel/oidc/v2 v2.7.0 h1:IGX4EDk6tegTjUSsZDWeTfLseFU0BdJ/Glf1tgys2lU=
+github.com/zitadel/oidc/v2 v2.7.0/go.mod h1:zkUkVJS0sDVy9m0UA9RgO3f8i/C0rtjvXU36UJj7T+0=
 go.etcd.io/bbolt v1.3.7 h1:j+zJOnnEjF/kyHlDDgGnVL/AIqIJPq8UoB2GSNfkUfQ=
 go.etcd.io/bbolt v1.3.7/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw=
 go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
@@ -938,8 +939,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20230807204917-050eac23e9de h1:l5Za6utMv/HsBWWqzt4S8X17j+kt1uVETUX5UFhn2rE=
-golang.org/x/exp v0.0.0-20230807204917-050eac23e9de/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
+golang.org/x/exp v0.0.0-20230809150735-7b3493d9a819 h1:EDuYyU/MkFXllv9QF9819VlI9a4tzGuCbhG0ExK9o1U=
+golang.org/x/exp v0.0.0-20230809150735-7b3493d9a819/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -1040,8 +1041,8 @@ golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.9.0 h1:BPpt2kU7oMRq3kCHAA1tbSEshXRw1LpG2ztgDwrzuAs=
-golang.org/x/oauth2 v0.9.0/go.mod h1:qYgFZaFiu6Wg24azG8bdV52QJXJGbZzIIsRCdVKzbLw=
+golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8=
+golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

From 5ec465f0ea4e85bf6706f7908354d95de2582b2d Mon Sep 17 00:00:00 2001
From: Paul Lorenz <paul.lorenz@netfoundry.io>
Date: Wed, 9 Aug 2023 15:44:23 -0400
Subject: [PATCH 12/17] Fix enrollment listing. Fixes #1199

---
 CHANGELOG.md          | 34 +++++++++++++++++++++++++++++++---
 ziti/cmd/edge/list.go |  2 +-
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c50a53b45..d469b7ace 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -132,9 +132,37 @@ The back-off policies have the following attributes:
     * Default: 1.5 for healthy, 100 for unhealthy
 
 ## Component Updates and Bug Fixes
-* github.com/openziti/ziti: [v0.29.0 -> v0.29.1](https://github.com/openziti/ziti/compare/v0.29.0...v0.29.1)
-  * [Issue #1212](https://github.com/openziti/ziti/issues/1212) - Fixed getZiti function on Mac/ZSH
-  * [Issue #1220](https://github.com/openziti/ziti/issues/1220) - Fixed getZiti function not respecting user input for custom path
+* github.com/openziti/agent: [v1.0.14 -> v1.0.15](https://github.com/openziti/agent/compare/v1.0.14...v1.0.15)
+* github.com/openziti/channel/v2: [v2.0.84 -> v2.0.91](https://github.com/openziti/channel/compare/v2.0.84...v2.0.91)
+    * [Issue #108](https://github.com/openziti/channel/issues/108) - Reconnecting underlay not returning headers from hello message
+
+* github.com/openziti/edge: [v0.24.364 -> v0.24.381](https://github.com/openziti/edge/compare/v0.24.364...v0.24.381)
+    * [Issue #1548](https://github.com/openziti/edge/issues/1548) - Panic in edge@v0.24.326/controller/sync_strats/sync_instant.go:194
+
+* github.com/openziti/edge-api: [v0.25.30 -> v0.25.31](https://github.com/openziti/edge-api/compare/v0.25.30...v0.25.31)
+* github.com/openziti/fabric: [v0.23.45 -> v0.24.2](https://github.com/openziti/fabric/compare/v0.23.45...v0.24.2)
+    * [Issue #766](https://github.com/openziti/fabric/issues/766) - Lookup of terminators with same instance id isn't filtering by instance id 
+    * [Issue #692](https://github.com/openziti/fabric/issues/692) - Add ability to control link formation between devices more granularly
+    * [Issue #749](https://github.com/openziti/fabric/issues/749) - Move link control to router
+    * [Issue #343](https://github.com/openziti/fabric/issues/343) - Link state Failed on startup
+
+* github.com/openziti/foundation/v2: [v2.0.28 -> v2.0.29](https://github.com/openziti/foundation/compare/v2.0.28...v2.0.29)
+* github.com/openziti/identity: [v1.0.59 -> v1.0.60](https://github.com/openziti/identity/compare/v1.0.59...v1.0.60)
+* github.com/openziti/runzmd: [v1.0.28 -> v1.0.29](https://github.com/openziti/runzmd/compare/v1.0.28...v1.0.29)
+* github.com/openziti/sdk-golang: [v0.20.78 -> v0.20.90](https://github.com/openziti/sdk-golang/compare/v0.20.78...v0.20.90)
+* github.com/openziti/storage: [v0.2.11 -> v0.2.12](https://github.com/openziti/storage/compare/v0.2.11...v0.2.12)
+* github.com/openziti/transport/v2: [v2.0.93 -> v2.0.99](https://github.com/openziti/transport/compare/v2.0.93...v2.0.99)
+* github.com/openziti/xweb/v2: [v2.0.2 -> v2.1.0](https://github.com/openziti/xweb/compare/v2.0.2...v2.1.0)
+* github.com/openziti/ziti-db-explorer: [v1.1.1 -> v1.1.3](https://github.com/openziti/ziti-db-explorer/compare/v1.1.1...v1.1.3)
+    * [Issue #4](https://github.com/openziti/ziti-db-explorer/issues/4) - db explore timeout error is uninformative
+
+* github.com/openziti/metrics: [v1.2.30 -> v1.2.31](https://github.com/openziti/metrics/compare/v1.2.30...v1.2.31)
+* github.com/openziti/ziti: [v0.29.0 -> v0.30.0](https://github.com/openziti/ziti/compare/v0.29.0...v0.30.0)
+    * [Issue #1199](https://github.com/openziti/ziti/issues/1199) - ziti edge list enrollments - CLI gets 404
+    * [Issue #1135](https://github.com/openziti/ziti/issues/1135) - Edge Router: Support multiple protocols on the same listener port
+    * [Issue #65](https://github.com/openziti/ziti/issues/65) - Add ECDSA support to PKI subcmd
+    * [Issue #1212](https://github.com/openziti/ziti/issues/1212) - getZiti fails on Mac OS
+    * [Issue #1220](https://github.com/openziti/ziti/issues/1220) - Fixed getZiti function not respecting user input for custom path
 
 # Release 0.29.0
 
diff --git a/ziti/cmd/edge/list.go b/ziti/cmd/edge/list.go
index d411cf955..fbba3bf18 100644
--- a/ziti/cmd/edge/list.go
+++ b/ziti/cmd/edge/list.go
@@ -684,7 +684,7 @@ func outputEnrollments(o *api.Options, children []*gabs.Container, pagingInfo *a
 }
 
 func runListEnrollments(o *api.Options) error {
-	children, pagingInfo, err := listEntitiesWithOptions("ext-jwt-signers", o)
+	children, pagingInfo, err := listEntitiesWithOptions("enrollments", o)
 	if err != nil {
 		return err
 	}

From f55c1b41d996766bf1079da2da07acb16a822256 Mon Sep 17 00:00:00 2001
From: gberl002 <geoff.berl@netfoundry.io>
Date: Thu, 10 Aug 2023 10:03:44 -0400
Subject: [PATCH 13/17] Missed a few similar spots for alt_server_certs
 formatting

Signed-off-by: gberl002 <geoff.berl@netfoundry.io>
---
 ziti/cmd/config_templates/controller.yml | 12 ++++++------
 ziti/cmd/config_templates/router.yml     | 12 ++++++------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/ziti/cmd/config_templates/controller.yml b/ziti/cmd/config_templates/controller.yml
index c2ed00994..cd421a677 100644
--- a/ziti/cmd/config_templates/controller.yml
+++ b/ziti/cmd/config_templates/controller.yml
@@ -14,9 +14,9 @@ identity:
   server_cert: "{{ .Controller.Identity.ServerCert }}"
   key:         "{{ .Controller.Identity.Key }}"
   ca:          "{{ .Controller.Identity.Ca }}"
-  {{ .Controller.Web.Identity.AltCertsEnabled }}alt_server_certs:
-  {{ .Controller.Web.Identity.AltCertsEnabled }}  - server_cert:  "{{ .Controller.Web.Identity.AltServerCert }}"
-  {{ .Controller.Web.Identity.AltCertsEnabled }}    server_key:   "{{ .Controller.Web.Identity.AltServerKey }}"
+  {{ if not .Controller.Web.Identity.AltCertsEnabled }}#{{ end }}alt_server_certs:
+  {{ if not .Controller.Web.Identity.AltCertsEnabled }}#{{ end }}  - server_cert:  "{{ .Controller.Web.Identity.AltServerCert }}"
+  {{ if not .Controller.Web.Identity.AltCertsEnabled }}#{{ end }}    server_key:   "{{ .Controller.Web.Identity.AltServerKey }}"
 
 # Network Configuration
 #
@@ -168,9 +168,9 @@ web:
       key:         "{{ .Controller.Web.Identity.Key }}"
       server_cert: "{{ .Controller.Web.Identity.ServerCert }}"
       cert:        "{{ .Controller.Web.Identity.Cert }}"
-      {{ .Controller.Web.Identity.AltCertsEnabled }}alt_server_certs:
-      {{ .Controller.Web.Identity.AltCertsEnabled }}- server_cert: "{{ .Controller.Web.Identity.AltServerCert }}"
-      {{ .Controller.Web.Identity.AltCertsEnabled }}  server_key:  "{{ .Controller.Web.Identity.AltServerKey }}"
+      {{ if not .Controller.Web.Identity.AltCertsEnabled }}#{{ end }}alt_server_certs:
+      {{ if not .Controller.Web.Identity.AltCertsEnabled }}#{{ end }}- server_cert: "{{ .Controller.Web.Identity.AltServerCert }}"
+      {{ if not .Controller.Web.Identity.AltCertsEnabled }}#{{ end }}  server_key:  "{{ .Controller.Web.Identity.AltServerKey }}"
       
     # options - optional
     # Allows the specification of webListener level options - mainly dealing with HTTP/TLS settings. These options are
diff --git a/ziti/cmd/config_templates/router.yml b/ziti/cmd/config_templates/router.yml
index f64ca8a8a..c383e1c4f 100644
--- a/ziti/cmd/config_templates/router.yml
+++ b/ziti/cmd/config_templates/router.yml
@@ -12,9 +12,9 @@ identity:
   server_cert:      "{{ .Router.IdentityServerCert }}"
   key:              "{{ .Router.IdentityKey }}"
   ca:               "{{ .Router.IdentityCA }}"
-{{ if not .Router.AltCertsEnabled }}#{{ end }}alt_server_certs:
-{{ if not .Router.AltCertsEnabled }}#{{ end }}  - server_cert:  "{{ .Router.AltServerCert }}"
-{{ if not .Router.AltCertsEnabled }}#{{ end }}    server_key:   "{{ .Router.AltServerKey }}"
+  {{ if not .Router.AltCertsEnabled }}#{{ end }}alt_server_certs:
+  {{ if not .Router.AltCertsEnabled }}#{{ end }}  - server_cert:  "{{ .Router.AltServerCert }}"
+  {{ if not .Router.AltCertsEnabled }}#{{ end }}    server_key:   "{{ .Router.AltServerKey }}"
 
 ctrl:
   endpoint:             tls:{{ .Controller.Ctrl.AdvertisedAddress }}:{{ .Controller.Ctrl.AdvertisedPort }}
@@ -87,9 +87,9 @@ edge:
 {{ if not .Router.IsWss }}#{{ end }}    enableCompression: {{ .Router.Wss.EnableCompression }}
 {{ if not .Router.IsWss }}#{{ end }}    server_cert: {{ .Router.IdentityServerCert }}
 {{ if not .Router.IsWss }}#{{ end }}    key: {{ .Router.IdentityKey }}
-{{ .Router.AltCertsEnabled }}alt_server_certs:
-{{ .Router.AltCertsEnabled }}  - server_cert:  "{{ .Router.AltServerCert }}"
-{{ .Router.AltCertsEnabled }}    server_key:   "{{ .Router.AltServerKey }}"
+{{ if not .Router.AltCertsEnabled }}#{{ end }}alt_server_certs:
+{{ if not .Router.AltCertsEnabled }}#{{ end }}  - server_cert:  "{{ .Router.AltServerCert }}"
+{{ if not .Router.AltCertsEnabled }}#{{ end }}    server_key:   "{{ .Router.AltServerKey }}"
 forwarder:
   latencyProbeInterval: {{ .Router.Forwarder.LatencyProbeInterval.Seconds }}
   xgressDialQueueLength: {{ .Router.Forwarder.XgressDialQueueLength }}

From 289394ff3e1127621cb24045f9f7f6c79866d0d9 Mon Sep 17 00:00:00 2001
From: Eugene K <eugene.kobyakov@netfoundry.io>
Date: Thu, 10 Aug 2023 10:24:01 -0400
Subject: [PATCH 14/17] update CHANGELOG with single port feature

---
 CHANGELOG.md | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d469b7ace..721de7f37 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
 ## What's New
 
 * Link management is now delegated to routers
+* Controller and routers can operate with a single listening port
 
 ## Link Management Updates
 
@@ -131,6 +132,35 @@ The back-off policies have the following attributes:
     * Max value: 100
     * Default: 1.5 for healthy, 100 for unhealthy
 
+
+## Single Sort Changes
+Ziti Controller and Routers can operate with a single open port. In order to implement this feature we use 
+ALPN ([Application Layer Protocol Negotiation](https://en.wikipedia.org/wiki/Application-Layer_Protocol_Negotiation)) 
+TLS extension. It allows TLS client to request and TLS server to select appropriate application protocol handler during 
+TLS handshake.
+
+### Protocol Details
+
+The following protocol identifiers are defined:
+
+| id        | purpose |
+| --------- | ------- |
+| ziti-ctrl | Control plane connections             |
+| ziti-link | Fabric link  connections              |
+| ziti-edge | Client SDK connection to Edge Routers |
+
+Standard HTTP protocol identifiers (`h2`, `http/1.1`) are used for Controller REST API and Websocket listeners.
+
+### Backward Compatibility
+
+This feature is designed to be backward compatible with SDK clients: older client will still be able to connect without
+requesting `ziti-edge` protocol.
+
+**Breaking** 
+
+Older routers won't be able to establish control channel or fabric links with updated network.
+However, newer Edge Routers should be able to join older network in some circumstances -- only outbound links from new Routers would work.
+
 ## Component Updates and Bug Fixes
 * github.com/openziti/agent: [v1.0.14 -> v1.0.15](https://github.com/openziti/agent/compare/v1.0.14...v1.0.15)
 * github.com/openziti/channel/v2: [v2.0.84 -> v2.0.91](https://github.com/openziti/channel/compare/v2.0.84...v2.0.91)

From 964d425de9e49b4714d6460406bf18834149d259 Mon Sep 17 00:00:00 2001
From: gberl002 <geoff.berl@netfoundry.io>
Date: Thu, 10 Aug 2023 14:00:11 -0400
Subject: [PATCH 15/17] Reverting the healthchecks, adding a wait-for-file
 routing instead

Signed-off-by: gberl002 <geoff.berl@netfoundry.io>
---
 quickstart/docker/docker-compose.yml  | 26 +++++++-------------------
 quickstart/docker/image/run-router.sh |  6 ++++++
 2 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/quickstart/docker/docker-compose.yml b/quickstart/docker/docker-compose.yml
index 9f0d705bf..13d1f6797 100644
--- a/quickstart/docker/docker-compose.yml
+++ b/quickstart/docker/docker-compose.yml
@@ -2,11 +2,6 @@ version: '2.4'
 services:
   ziti-controller:
     image: "${ZITI_IMAGE}:${ZITI_VERSION}"
-    healthcheck:
-      test: curl -m 1 -s -k https://${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS:-ziti-edge-controller}:${ZITI_CTRL_EDGE_ADVERTISED_PORT:-1280}/edge/client/v1/version
-      interval: 1s
-      timeout: 3s
-      retries: 30
     env_file:
       - ./.env
     ports:
@@ -37,8 +32,7 @@ services:
   ziti-controller-init-container:
     image: "${ZITI_IMAGE}:${ZITI_VERSION}"
     depends_on:
-      ziti-controller:
-        condition: service_healthy
+      - ziti-controller
     environment:
       - ZITI_CTRL_EDGE_ADVERTISED_ADDRESS=${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS:-ziti-edge-controller}
       - ZITI_CTRL_EDGE_ADVERTISED_PORT=${ZITI_CTRL_EDGE_ADVERTISED_PORT:-1280}
@@ -63,8 +57,7 @@ services:
     env_file:
       - ./.env
     depends_on:
-      ziti-controller:
-        condition: service_healthy
+      - ziti-controller
     ports:
       - ${ZITI_ROUTER_PORT:-3022}:${ZITI_ROUTER_PORT:-3022}
       - ${ZITI_ROUTER_LISTENER_BIND_PORT:-10080}:${ZITI_ROUTER_LISTENER_BIND_PORT:-10080}
@@ -91,8 +84,7 @@ services:
     env_file:
       - ./.env
     depends_on:
-      ziti-controller:
-        condition: service_healthy
+      - ziti-controller
     ports:
       - ${ZITI_ROUTER_WSS_PORT:-3023}:${ZITI_ROUTER_WSS_PORT:-3023}
       - ${ZITI_ROUTER_LISTENER_BIND_PORT:-10081}:${ZITI_ROUTER_LISTENER_BIND_PORT:-10081}
@@ -121,8 +113,7 @@ services:
     env_file:
       - ./.env
     depends_on:
-      ziti-controller:
-        condition: service_healthy
+      - ziti-controller
     environment:
       - ZITI_CTRL_ADVERTISED_ADDRESS=${ZITI_CTRL_ADVERTISED_ADDRESS:-ziti-controller}
       - ZITI_CTRL_ADVERTISED_PORT=${ZITI_CTRL_ADVERTISED_PORT:-6262}
@@ -144,8 +135,7 @@ services:
     env_file:
       - ./.env
     depends_on:
-      ziti-controller:
-        condition: service_healthy
+      - ziti-controller
     environment:
       - ZITI_CTRL_ADVERTISED_ADDRESS=${ZITI_CTRL_ADVERTISED_ADDRESS:-ziti-controller}
       - ZITI_CTRL_ADVERTISED_PORT=${ZITI_CTRL_ADVERTISED_PORT:-6262}
@@ -166,8 +156,7 @@ services:
     env_file:
       - ./.env
     depends_on:
-      ziti-controller:
-        condition: service_healthy
+      - ziti-controller
     environment:
       - ZITI_CTRL_ADVERTISED_ADDRESS=${ZITI_CTRL_ADVERTISED_ADDRESS:-ziti-controller}
       - ZITI_CTRL_ADVERTISED_PORT=${ZITI_CTRL_ADVERTISED_PORT:-6262}
@@ -205,8 +194,7 @@ services:
       - ZITI_CTRL_NAME=${ZITI_CTRL_NAME:-ziti-edge-controller}
       - PORTTLS=8443
     depends_on:
-      ziti-controller:
-        condition: service_healthy
+      - ziti-controller
     ports:
       - 8443:8443
     volumes:
diff --git a/quickstart/docker/image/run-router.sh b/quickstart/docker/image/run-router.sh
index 87888a831..f38bfc664 100755
--- a/quickstart/docker/image/run-router.sh
+++ b/quickstart/docker/image/run-router.sh
@@ -12,6 +12,12 @@ if [[ "${ZITI_ROUTER_NAME-}" != "" ]]; then
   echo "_ZITI_ROUTER_NAME set to: ${_ZITI_ROUTER_NAME}"
 fi
 
+# Wait until the file exists, then give one more second for the file to be completely written
+until [ -f "${ZITI_HOME}/ziti.env" ]
+do
+     sleep 1
+done
+sleep 1
 . ${ZITI_HOME}/ziti.env
 
 # wait for the controller to come online

From 6daebdb06a26b1115889bc2a4d2d8c0bc8d964a7 Mon Sep 17 00:00:00 2001
From: Kenneth Bingham <kenneth.bingham@netfoundry.io>
Date: Fri, 11 Aug 2023 10:09:44 -0400
Subject: [PATCH 16/17] cancel older redundant builds on the same branch

---
 .github/workflows/codeql.yml                    | 5 +++++
 .github/workflows/golangci-lint.yml             | 5 +++++
 .github/workflows/jenkins-nightly-smoketest.yml | 5 +++++
 .github/workflows/jenkins-smoketest.yml         | 5 +++++
 .github/workflows/main.yml                      | 5 +++++
 .github/workflows/publish-docker-images.yml     | 5 +++++
 .github/workflows/push-quickstart.yml           | 6 ++++++
 7 files changed, 36 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 59726cc9f..9a678153a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -17,6 +17,11 @@ on:
   schedule:
     - cron: '36 20 * * 3'
 
+# cancel older, redundant runs of same workflow on same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 86b714d3a..3188b338a 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -6,6 +6,11 @@ permissions:
   # Optional: allow read access to pull request. Use with `only-new-issues` option.
   # pull-requests: read
 
+# cancel older, redundant runs of same workflow on same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   golangci:
     name: lint
diff --git a/.github/workflows/jenkins-nightly-smoketest.yml b/.github/workflows/jenkins-nightly-smoketest.yml
index d23d44e4e..360399473 100644
--- a/.github/workflows/jenkins-nightly-smoketest.yml
+++ b/.github/workflows/jenkins-nightly-smoketest.yml
@@ -5,6 +5,11 @@ on:
     # Runs "at minute 28 past every 0400 GMT from GitHub main branch"
     - cron: '28 4 * * *'
 
+# cancel older, redundant runs of same workflow on same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   jenkins-nightly-smoketest:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/jenkins-smoketest.yml b/.github/workflows/jenkins-smoketest.yml
index 798971e83..ccaca3988 100644
--- a/.github/workflows/jenkins-smoketest.yml
+++ b/.github/workflows/jenkins-smoketest.yml
@@ -13,6 +13,11 @@ on:
         type: string
         required: false   # this allows manually triggering the smoketest with the UNKNOWN version default
 
+# cancel older, redundant runs of same workflow on same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   jenkins-smoketest:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index d9de884b8..4b5098230 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -9,6 +9,11 @@ on:
   pull_request:
   workflow_dispatch:
 
+# cancel older, redundant runs of same workflow on same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 env:
   GOFLAGS: "-trimpath"
   GOX_OUTPUT: "release/{{.Arch}}/{{.OS}}/{{.Dir}}"
diff --git a/.github/workflows/publish-docker-images.yml b/.github/workflows/publish-docker-images.yml
index fc9fce4c2..13fa1e385 100644
--- a/.github/workflows/publish-docker-images.yml
+++ b/.github/workflows/publish-docker-images.yml
@@ -8,6 +8,11 @@ on:
         type: string
         required: true
 
+# cancel older, redundant runs of same workflow on same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   publish-docker-images:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/push-quickstart.yml b/.github/workflows/push-quickstart.yml
index 9cebda1ea..4e96a8894 100644
--- a/.github/workflows/push-quickstart.yml
+++ b/.github/workflows/push-quickstart.yml
@@ -2,6 +2,12 @@ name: Deploy Quickstart Container
 
 on:
   workflow_dispatch:
+
+# cancel older, redundant runs of same workflow on same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   build:
     runs-on: ubuntu-latest

From 03111336a1a1964e8024661377bb4b9a7fe4b7c8 Mon Sep 17 00:00:00 2001
From: Kenneth Bingham <kenneth.bingham@netfoundry.io>
Date: Fri, 11 Aug 2023 13:33:35 -0400
Subject: [PATCH 17/17] resolve concurrency deadlock by dropping constraint on
 jenkins smoketest workflow that is typically called, not triggered

---
 .github/workflows/jenkins-smoketest.yml | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/.github/workflows/jenkins-smoketest.yml b/.github/workflows/jenkins-smoketest.yml
index ccaca3988..798971e83 100644
--- a/.github/workflows/jenkins-smoketest.yml
+++ b/.github/workflows/jenkins-smoketest.yml
@@ -13,11 +13,6 @@ on:
         type: string
         required: false   # this allows manually triggering the smoketest with the UNKNOWN version default
 
-# cancel older, redundant runs of same workflow on same branch
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: true
-
 jobs:
   jenkins-smoketest:
     runs-on: ubuntu-latest