Merge pull request #737 from openziti/quickstart-first-service-fixes

Quickstart first service fixes

CHANGELOG.md

@@ -9,6 +9,8 @@
   - CLI support for enrollments/authenticators/re-enrollment
   - Fix prox-c download
   - ziti-fabric cleanup
+  - Add public attributes and service policies allowing public access to routers in docker-compose quickstart
+  - Add file overwrite checks for the "Local ziti quickstart" script
 - SDK Golang
   - N/A
 

quickstart/docker/docker-compose.yml

@@ -18,6 +18,27 @@ services:
     entrypoint:
       - "/openziti/scripts/run-controller.sh"
 
+  ziti-controller-init-container:
+    image: "${ZITI_IMAGE}:${ZITI_VERSION}"
+    depends_on:
+      - ziti-controller
+    environment:
+      - ZITI_CONTROLLER_RAWNAME="${ZITI_CONTROLLER_RAWNAME}"
+      - ZITI_EDGE_CONTROLLER_RAWNAME="${ZITI_EDGE_CONTROLLER_RAWNAME}"
+    env_file:
+      - ./.env
+    networks:
+      zitiblue:
+        aliases:
+          - ziti-edge-controller-init-container
+      zitired:
+        aliases:
+          - ziti-edge-controller-init-container
+    volumes:
+      - ziti-fs:/openziti
+    entrypoint:
+      - "/openziti/scripts/access-control.sh"
+
   ziti-edge-router:
     image: "${ZITI_IMAGE}:${ZITI_VERSION}"
     depends_on:
@@ -26,6 +47,7 @@ services:
       - ZITI_CONTROLLER_RAWNAME="${ZITI_CONTROLLER_RAWNAME}"
       - ZITI_EDGE_CONTROLLER_RAWNAME="${ZITI_EDGE_CONTROLLER_RAWNAME}"
       - ZITI_EDGE_ROUTER_RAWNAME=ziti-edge-router
+      - ZITI_EDGE_ROUTER_ROLES=public
     ports:
       - "3022:3022"
     networks:
@@ -45,6 +67,7 @@ services:
       - ZITI_EDGE_CONTROLLER_RAWNAME="${ZITI_EDGE_CONTROLLER_RAWNAME}"
       - ZITI_EDGE_ROUTER_RAWNAME=ziti-edge-router-wss
       - ZITI_EDGE_ROUTER_PORT=3023
+      - ZITI_EDGE_ROUTER_ROLES=public
     ports:
       - "3023:3023"
     networks:

quickstart/docker/image/Dockerfile

@@ -25,6 +25,7 @@ COPY --chown=ziti ziti.ignore "${ZITI_BIN_DIR}"
 COPY --chown=ziti ziti-cli-functions.sh "${ZITI_SCRIPTS}/"
 COPY --chown=ziti run-controller.sh "${ZITI_SCRIPTS}/"
 COPY --chown=ziti run-router.sh "${ZITI_SCRIPTS}/"
+COPY --chown=ziti access-control.sh "${ZITI_SCRIPTS}/"
 
 RUN /bin/bash -c "source ${ZITI_SCRIPTS}/ziti-cli-functions.sh; ziti_createEnvFile; echo source ${ZITI_HOME}/ziti.env >> ~/.bashrc"
 

quickstart/docker/image/access-control.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+
+# Should we execute?
+initFile="/openziti/access-control.init"
+if [[ -f "${initFile}" ]]; then
+  echo " "
+  echo "*****************************************************"
+  echo " docker-compose init file has been detected"
+  echo " the initialization of the docker-compose environment has already happened"
+  echo " if you wish to allow this volume to be re-initialized, delete the file"
+  echo " located at ${initFile}"
+  echo "*****************************************************"
+  echo " "
+  exit 0
+fi
+
+# give the controller time to ramp up before running if running in docker-compose
+sleep 5
+
+. "${ZITI_SCRIPTS}/ziti-cli-functions.sh"
+
+if [[ "${ZITI_CONTROLLER_RAWNAME-}" == "" ]]; then export export ZITI_CONTROLLER_RAWNAME="ziti-controller"; fi
+if [[ "${ZITI_EDGE_CONTROLLER_RAWNAME-}" == "" ]]; then export export ZITI_EDGE_CONTROLLER_RAWNAME="ziti-edge-controller"; fi
+if [[ "${ZITI_EDGE_ROUTER_RAWNAME-}" == "" ]]; then export export ZITI_EDGE_ROUTER_RAWNAME="${ZITI_NETWORK-}-edge-router"; fi
+if [[ "${ZITI_EDGE_ROUTER_PORT-}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi
+if [[ "${ZITI_EDGE_ROUTER_HOSTNAME}" == "" ]]; then export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
+if [[ "${ZITI_EDGE_ROUTER_ROLES}" == "" ]]; then export ZITI_EDGE_ROUTER_ROLES="${ZITI_EDGE_ROUTER_RAWNAME}"; fi
+
+. "${ZITI_HOME}"/ziti.env
+
+# Wait for the controller
+# shellcheck disable=SC2091
+until $(curl -s -o /dev/null --fail -k "https://${ZITI_EDGE_CTRL_ADVERTISED_HOST_PORT}"); do
+    echo "waiting for https://${ZITI_EDGE_CTRL_ADVERTISED_HOST_PORT}"
+    sleep 2
+done
+
+echo " "
+echo "*****************************************************"
+#### Add service policies
+
+zitiLogin
+
+# Allow all identities to use any edge router with the "public" attribute
+ziti edge create edge-router-policy all-endpoints-public-routers --edge-router-roles "#public" --identity-roles "#all"
+
+# Allow all edge-routers to access all services
+ziti edge create service-edge-router-policy all-routers-all-services --edge-router-roles "#all" --service-roles "#all"
+
+touch "${initFile}"
+
+echo "This docker volume has been initialized."

quickstart/docker/image/run-controller.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+ziti_controller_cfg='/openziti/ziti-edge-controller.yaml'
+
 export ZITI_CONTROLLER_RAWNAME=ziti-controller
 export ZITI_EDGE_CONTROLLER_RAWNAME=ziti-edge-controller
 
@@ -11,8 +13,17 @@ generateEnvFile
 # create pki
 createPki
 
-# generates the config file for the controller
-createControllerConfig
+if [ ! -f "${ziti_controller_cfg}" ]; then
+  echo " "
+  echo "${ziti_controller_cfg} doesn't exist. Generating config file"
+  echo " "
+  # generates the config file for the controller
+  createControllerConfig
+else
+  echo " "
+  echo "${ziti_controller_cfg} exists. Not overwriting"
+  echo " "
+fi
 
 # initialize the database with the admin user:
 "${ZITI_BIN_DIR}/ziti-controller" edge init "${ZITI_HOME}/ziti-edge-controller.yaml" -u "${ZITI_USER}" -p "${ZITI_PWD}"

quickstart/docker/image/ziti-cli-functions.sh

@@ -756,6 +756,13 @@ function createPrivateRouterConfig {
   fi
 
   output_file="${ZITI_HOME-}/${router_name}.yaml"
+
+  getFileOverwritePermission "${output_file}"
+  retVal=$?
+  if [[ "${retVal}" != 0 ]]; then
+    return 1
+  fi
+
   "${ZITI_BIN_DIR}/ziti" create config router edge --routerName "${router_name}" --private > "${output_file}"
   echo -e "Router configuration file written to: $(BLUE "${output_file}")"
 }
@@ -797,11 +804,6 @@ function createFabricRouterConfig {
     if [[ "${router_name}" == "" ]]; then
       # Check for overwrite of default file
       router_name="${default_router_name}"
-      getFileOverwritePermission "${ZITI_HOME-}/${router_name}.yaml"
-      retVal=$?
-      if [[ "${retVal}" != 0 ]]; then
-        return 1
-      fi
     fi
   fi
 
@@ -812,6 +814,13 @@ function createFabricRouterConfig {
   fi
 
   output_file="${ZITI_HOME}/${router_name}.yaml"
+
+  getFileOverwritePermission "${output_file}"
+  retVal=$?
+  if [[ "${retVal}" != 0 ]]; then
+    return 1
+  fi
+
   "${ZITI_BIN_DIR}/ziti" create config router fabric --routerName "${router_name}" > "${output_file}"
   echo -e "Fabric router configuration file written to: $(BLUE "${output_file}")"
 }
@@ -847,6 +856,13 @@ function createEdgeRouterWssConfig {
   fi
 
   output_file="${ZITI_HOME-}/${router_name}.yaml"
+
+  getFileOverwritePermission "${output_file}"
+  retVal=$?
+  if [[ "${retVal}" != 0 ]]; then
+    return 1
+  fi
+
   "${ZITI_BIN_DIR}/ziti" create config router edge --wss --routerName "${router_name}" > "${output_file}"
   echo -e "WSS Edge router wss configuration file written to: $(BLUE "${output_file}")"
 }
@@ -884,6 +900,12 @@ function createEdgeRouterConfig {
 
   output_file="${ZITI_HOME}/${router_name}.yaml"
 
+  getFileOverwritePermission "${output_file}"
+  retVal=$?
+  if [[ "${retVal}" != 0 ]]; then
+    return 1
+  fi
+
   "${ZITI_BIN_DIR}/ziti" create config router edge --routerName "${router_name}" > "${output_file}"
   echo -e "edge router configuration file written to: $(BLUE "${output_file}")"
 }
@@ -920,6 +942,13 @@ function createControllerConfig {
   echo -e "wrote CA file to: $(BLUE "${ZITI_CTRL_IDENTITY_CA}")"
 
   output_file="${ZITI_HOME}/${controller_name}.yaml"
+
+  getFileOverwritePermission "${output_file}"
+  retVal=$?
+  if [[ "${retVal}" != 0 ]]; then
+    return 1
+  fi
+
   "${ZITI_BIN_DIR}/ziti" create config controller > "${output_file}"
 
   echo -e "Controller configuration file written to: $(BLUE "${output_file}")"
@@ -1091,7 +1120,14 @@ function createControllerSystemdFile {
     return 1
   fi
 
-output_file="${ZITI_HOME}/${controller_name}.service"
+  output_file="${ZITI_HOME}/${controller_name}.service"
+
+  getFileOverwritePermission "${output_file}"
+  retVal=$?
+  if [[ "${retVal}" != 0 ]]; then
+    return 1
+  fi
+
 cat > "${output_file}" <<HeredocForSystemd
 [Unit]
 Description=Ziti-Controller
@@ -1141,7 +1177,14 @@ function createRouterSystemdFile {
     return 1
   fi
 
-output_file="${ZITI_HOME}/${router_name}.service"
+  output_file="${ZITI_HOME}/${router_name}.service"
+
+  getFileOverwritePermission "${output_file}"
+  retVal=$?
+  if [[ "${retVal}" != 0 ]]; then
+    return 1
+  fi
+
 cat > "${output_file}" <<HeredocForSystemd
 [Unit]
 Description=Ziti-Router for ${router_name}
@@ -1188,7 +1231,14 @@ function createControllerLaunchdFile {
     return 1
   fi
 
-output_file="${ZITI_HOME}/${controller_name}.plist"
+  output_file="${ZITI_HOME}/${controller_name}.plist"
+
+  getFileOverwritePermission "${output_file}"
+  retVal=$?
+  if [[ "${retVal}" != 0 ]]; then
+    return 1
+  fi
+
 cat > "${output_file}" <<HeredocForLaunchd
 <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -1254,7 +1304,14 @@ function createRouterLaunchdFile {
     return 1
   fi
 
-output_file="${ZITI_HOME-}/${router_name}.plist"
+  output_file="${ZITI_HOME-}/${router_name}.plist"
+
+  getFileOverwritePermission "${output_file}"
+  retVal=$?
+  if [[ "${retVal}" != 0 ]]; then
+    return 1
+  fi
+
 cat > "${output_file}" <<HeredocForLaunchd
 <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -1306,7 +1363,14 @@ function createZacSystemdFile {
     return 1
   fi
 
-output_file="${ZITI_HOME}/ziti-console.service"
+  output_file="${ZITI_HOME}/ziti-console.service"
+
+  getFileOverwritePermission "${output_file}"
+  retVal=$?
+  if [[ "${retVal}" != 0 ]]; then
+    return 1
+  fi
+
 cat > "${output_file}" <<HeredocForSystemd
 [Unit]
 Description=Ziti-Console