mirror of
https://github.com/openziti/ziti.git
synced 2026-10-12 15:28:05 +00:00
Merge pull request #395 from openziti/unify-quickstart-functions
Quickstart updates
This commit is contained in:
dovholuknf
+117
-20
@@ -10,39 +10,121 @@ This quickstart is a barebones guide to running a full developer environment in
|
||||
1. At the bottom of the screen - click the "Review and Launch" button
|
||||
1. In AWS "Step 7. Review Instance Launch", find the "Security Groups" row and expand it if necessary
|
||||
1. Click "Edit security groups"
|
||||
1. Click "Add Rule" and select "Custom TCP Rule" and enter Port Range:"8441" Source: "0.0.0.0/0"
|
||||
1. Click "Add Rule" and select "Custom TCP Rule" and enter Port Range:"8442" Source: "0.0.0.0/0"
|
||||
1. Click "Add Rule" and select "Custom TCP Rule" and enter Port Range:"8443" Source: "0.0.0.0/0"
|
||||
1. Click "Add Rule" and select "Custom TCP Rule" and enter Port Range:"8441" Source: "0.0.0.0/0", Description: "Ziti Controller Port"
|
||||
1. Click "Add Rule" and select "Custom TCP Rule" and enter Port Range:"8442" Source: "0.0.0.0/0", Description: "Ziti Edge Router Port"
|
||||
1. Click "Add Rule" and select "Custom TCP Rule" and enter Port Range:"8443" Source: "0.0.0.0/0", Description: "Ziti Console TLS Port"
|
||||
1. Your console should look like this:
|
||||
|
||||
|
||||
|
||||
1. click "Review and Launch" and then "Launch"
|
||||
1. Select your keypair and choose "Launch Instances"
|
||||
|
||||
## SSH to the Server
|
||||
|
||||
1. After ssh'ing to the new ubuntu machine - run: sudo apt update && sudo apt install jq -y
|
||||
1. Clone the public github repos: git clone https://github.com/openziti/ziti.git
|
||||
1. Set a whole bunch of environment variables. You will need to know the public ip address as well as public dns name. Replace "____EXTERNAL___IP____" and "____EXTERNAL___DNS____" with the proper values:
|
||||
1. After ssh'ing to the new ubuntu machine - run: `sudo apt update && sudo apt install jq -y`
|
||||
1. Set some environment variables which are used to establish a PKI as well as the necessary configuration files. You will need to know the public IPv4 DNS name assigned to this machine. Replace "____EXTERNAL___DNS____" with the proper values. (**IMPORTANT** make sure the name is correct):
|
||||
|
||||
export EXTERNAL_IP="____EXTERNAL___IP____"export EXTERNAL_DNS="____EXTERNAL___DNS____"
|
||||
export EXTERNAL_DNS="____EXTERNAL___DNS______FILLIN example: ec2-3-129-206-186.us-east-2.compute.amazonaws.com"
|
||||
|
||||
export EXTERNAL_IP="$(curl -s eth0.me)"
|
||||
export ZITI_EDGE_CONTROLLER_IP_OVERRIDE="${EXTERNAL_IP}"
|
||||
export ZITI_EDGE_ROUTER_IP_OVERRIDE="${EXTERNAL_IP}"
|
||||
export ZITI_EDGE_CONTROLLER_HOSTNAME="${EXTERNAL_DNS}"
|
||||
export ZITI_EDGE_ROUTER_HOSTNAME="${EXTERNAL_DNS}"
|
||||
export ZITI_EDGE_CONTROLLER_PORT=8441
|
||||
export ZITI_EDGE_ROUTER_PORT=8442
|
||||
1. Start the Ziti Controller and Ziti Edge Router by using the "express" script:
|
||||
|
||||
1. Run this single command to download and bootstrap the ziti-controller and ziti-router (feel free to read the bash script before running if you like):
|
||||
|
||||
~/ziti/quickstart/local/express/express-dev-env.sh
|
||||
1. Test the script worked properly by using a curl statement:
|
||||
source <(wget -qO- https://raw.githubusercontent.com/openziti/ziti/unify-quickstart-functions/quickstart/docker/image/ziti-cli-functions.sh); expressInstall
|
||||
|
||||
curl -k "https://${EXTERNAL_DNS}:${ZITI_EDGE_CONTROLLER_PORT}/version"
|
||||
1. At this point the controller and router are running and can be accessed from anywhere. Confirm both are running by running:
|
||||
|
||||
ps -ef | grep ziti
|
||||
root 2520 1 0 May19 ? 00:00:15 /home/ubuntu/.ziti/quickstart/ip-172-31-22-212/ziti-bin/ziti-v0.20.2/ziti-controller run /home/ubuntu/.ziti/quickstart/ip-172-31-22-212/controller.yaml
|
||||
root 2547 1 0 May19 ? 00:00:10 /home/ubuntu/.ziti/quickstart/ip-172-31-22-212/ziti-bin/ziti-v0.20.2/ziti-router run /home/ubuntu/.ziti/quickstart/ip-172-31-22-212/ip-172-31-22-212-edge-router.yaml
|
||||
|
||||
1. You can also issue this statement from the server and you will see a similar response to this:
|
||||
|
||||
curl -sk "https://${ZITI_EDGE_CONTROLLER_HOSTNAME}:${ZITI_EDGE_CONTROLLER_PORT}/version"
|
||||
{"data":{"apiVersions":{"edge":{"v1":{"path":"/edge/v1"}}},"buildDate":"2021-05-05 20:59:40","revision":"73dd1db42bf4","runtimeVersion":"go1.16.3","version":"v0.19.13"},"meta":{}}
|
||||
|
||||
## Setting up Ziti Controller and Router as a service
|
||||
|
||||
1. Stop ziti-controller and ziti-router if they are running:
|
||||
|
||||
killall ziti-controller ziti-router
|
||||
1. copy the two systemd files and refresh systemd
|
||||
|
||||
sudo cp "${ZITI_HOME}/ziti-controller.service" /etc/systemd/system
|
||||
sudo cp "${ZITI_HOME}/ziti-router-${ZITI_EDGE_ROUTER_RAWNAME}.service" /etc/systemd/system/ziti-router.service
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl start ziti-controller
|
||||
sudo systemctl start ziti-router
|
||||
1. Allow 5 to 10 seconds for the ziti-controller and router to start completely. Run these two commands to verify ziti-controller and ziti-router are running:
|
||||
|
||||
sudo systemctl -q status ziti-controller --lines=0 --no-pager
|
||||
sudo systemctl -q status ziti-router --lines=0 --no-pager
|
||||
|
||||
#sample output:
|
||||
ubuntu@ip-172-31-22-212:~$ sudo systemctl -q status ziti-controller --lines=0 --no-pager
|
||||
● ziti-controller.service - Ziti-Controller
|
||||
Loaded: loaded (/etc/systemd/system/ziti-controller.service; disabled; vendor preset: enabled)
|
||||
Active: active (running) since Thu 2021-05-20 11:24:40 UTC; 5min ago
|
||||
Main PID: 26848 (ziti-controller)
|
||||
Tasks: 7 (limit: 1160)
|
||||
Memory: 50.5M
|
||||
CGroup: /system.slice/ziti-controller.service
|
||||
└─26848 /home/ubuntu/.ziti/quickstart/ip-172-31-22-212/ziti-bin/ziti-v0.20.2/ziti-controller run /home/ubu…
|
||||
|
||||
ubuntu@ip-172-31-22-212:~$ sudo systemctl -q status ziti-router --lines=0 --no-pager
|
||||
● ziti-router.service - Ziti-Router for ip-172-31-22-212-edge-router
|
||||
Loaded: loaded (/etc/systemd/system/ziti-router.service; disabled; vendor preset: enabled)
|
||||
Active: active (running) since Thu 2021-05-20 11:24:42 UTC; 5min ago
|
||||
Main PID: 26864 (ziti-router)
|
||||
Tasks: 7 (limit: 1160)
|
||||
Memory: 28.4M
|
||||
CGroup: /system.slice/ziti-router.service
|
||||
└─26864 /home/ubuntu/.ziti/quickstart/ip-172-31-22-212/ziti-bin/ziti-v0.20.2/ziti-router run /home/ubuntu/…
|
||||
ubuntu@ip-172-31-22-212:~$
|
||||
|
||||
## Setting up the Ziti Admin Console
|
||||
|
||||
1. Install docker on the machine. I followed these instructions https://linuxize.com/post/how-to-install-and-use-docker-on-ubuntu-20-04/ but we'll condense them here for you to copy/paste:
|
||||
### By Cloning from Github
|
||||
|
||||
1. clone the ziti-console repo from github:
|
||||
|
||||
git clone https://github.com/openziti/ziti-console.git "${ZITI_HOME}/ziti-console"
|
||||
1. Install node and npm and get the server ready
|
||||
|
||||
sudo apt install npm nodejs -y
|
||||
npm install
|
||||
1. Use the ziti-controller certificates for the Ziti Console:
|
||||
|
||||
ln -s "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_HOSTNAME}-intermediate/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.chain.pem" "${ZITI_HOME}/ziti-console/server.chain.pem"
|
||||
ln -s "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_HOSTNAME}-intermediate/keys/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.key" "${ZITI_HOME}/ziti-console/server.key"
|
||||
1. Emit the Ziti Console systemd file and update systemd to start the Ziti Console
|
||||
|
||||
createZacSystemdFilesudo cp "${ZITI_HOME}/ziti-console.service" /etc/systemd/system
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl start ziti-console
|
||||
1. Verify the Ziti Console is running
|
||||
sudo systemctl status ziti-console --lines=0 --no-pager
|
||||
|
||||
#sample output of the command:
|
||||
ubuntu@ip-172-31-22-212:~$ sudo systemctl status ziti-console --lines=0 --no-pager
|
||||
● ziti-console.service - Ziti-Console
|
||||
Loaded: loaded (/etc/systemd/system/ziti-console.service; disabled; vendor preset: enabled)
|
||||
Active: active (running) since Wed 2021-05-19 22:04:44 UTC; 13h ago
|
||||
Main PID: 13458 (node)
|
||||
Tasks: 11 (limit: 1160)
|
||||
Memory: 33.4M
|
||||
CGroup: /system.slice/ziti-console.service
|
||||
└─13458 /usr/bin/node /home/ubuntu/.ziti/quickstart/ip-172-31-22-212/ziti-console/server.js
|
||||
|
||||
### By Using Docker
|
||||
|
||||
1. If needed, install docker on the machine. I followed these instructions https://linuxize.com/post/how-to-install-and-use-docker-on-ubuntu-20-04/ but we'll condense them here for you to copy/paste:
|
||||
|
||||
sudo apt update
|
||||
sudo apt install apt-transport-https ca-certificates curl gnupg-agent software-properties-common -y
|
||||
@@ -54,12 +136,14 @@ This quickstart is a barebones guide to running a full developer environment in
|
||||
1. Copy/paste this command to start the Ziti Admin Console in TLS mode:
|
||||
|
||||
docker run -d \
|
||||
--name zac \
|
||||
-p 8443:8443 \
|
||||
-v "/home/ubuntu/.ziti/quickstart/$(hostname)/pki/$(hostname)-intermediate/keys/$(hostname)-server.key":/usr/src/app/server.key \
|
||||
-v "/home/ubuntu/.ziti/quickstart/$(hostname)/pki/$(hostname)-intermediate/certs/$(hostname)-server.chain.pem":/usr/src/app/server.chain.pem \
|
||||
openziti/zac
|
||||
1. At this point you should be able to navigate to both: https://external-dns-name:8443 as well as https://external-ip:8443 and see the ZAC login screen. (The TLS warnings your browser will show you are normal - it's because these steps use a self-signed certificate generated in the install process)
|
||||
--name zac \
|
||||
-p 8443:8443 \
|
||||
-v "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_HOSTNAME}-intermediate/keys/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.key":/usr/src/app/server.key \
|
||||
-v "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_HOSTNAME}-intermediate/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.chain.pem":/usr/src/app/server.chain.pem \
|
||||
openziti/zac
|
||||
|
||||
## Login and use the Ziti Console
|
||||
1. At this point you should be able to navigate to both: https://${ZITI_EDGE_CONTROLLER_HOSTNAME}:8443 as well as https://$(curl -s eth0.me):8443 and see the ZAC login screen. (The TLS warnings your browser will show you are normal - it's because these steps use a self-signed certificate generated in the install process)
|
||||
1. Set the controller as shown:
|
||||
|
||||
|
||||
@@ -69,4 +153,17 @@ This quickstart is a barebones guide to running a full developer environment in
|
||||
|
||||
1. **IMPORTANT!!!** Edit your profile and change the password
|
||||
|
||||
|
||||
|
||||
|
||||
## Adding Environment Variables Back to the Shell
|
||||
|
||||
If you log out and log back in again you can source the '.env' file located at: `. ~/.ziti/quickstart/$(hostname)/$(hostname).env`. Below is an example of logging in, not having ZITI_HOME set, sourcing the .env file and then showing ZITI_HOME set:
|
||||
|
||||
Last login: Thu May 20 11:36:25 2021 from 67.246.244.61
|
||||
ubuntu@ip-172-31-22-212:~$ echo $ZITI_HOME
|
||||
|
||||
ubuntu@ip-172-31-22-212:~$ . ~/.ziti/quickstart/$(hostname)/$(hostname).env
|
||||
|
||||
adding /home/ubuntu/.ziti/quickstart/ip-172-31-22-212/ziti-bin/ziti-v0.20.2 to the path
|
||||
ubuntu@ip-172-31-22-212:~$ echo $ZITI_HOME
|
||||
/home/ubuntu/.ziti/quickstart/ip-172-31-22-212
|
||||
@@ -13,19 +13,16 @@ WORKDIR /openziti
|
||||
|
||||
ENV ZITI_HOME=/openziti
|
||||
ENV ZITI_BIN_DIR="${ZITI_HOME}/ziti-bin"
|
||||
|
||||
# copy the ziti binaries to a directory already on the path
|
||||
#COPY --chown=ziti ziti.ignore /usr/local/bin/
|
||||
COPY --chown=ziti ziti.ignore "${ZITI_BIN_DIR}"
|
||||
COPY --chown=ziti *.sh ./scripts/
|
||||
|
||||
#ENV ZITI_HOME=/openziti
|
||||
#ENV ZITI_BIN_DIR="${ZITI_HOME}/ziti-bin"
|
||||
ENV ZITI_SHARED=${ZITI_HOME}/shared
|
||||
ENV ZITI_SCRIPTS=${ZITI_HOME}/scripts
|
||||
ENV ENV_FILE=${ZITI_HOME}/ziti.env
|
||||
ENV ZITI_SHARED="${ZITI_HOME}/shared"
|
||||
ENV ZITI_SCRIPTS="${ZITI_HOME}/scripts"
|
||||
ENV ENV_FILE="${ZITI_HOME}/ziti.env"
|
||||
ENV ZITI_NETWORK=ziti
|
||||
|
||||
RUN ${ZITI_SCRIPTS}/env.sh && \
|
||||
echo "source ${ZITI_HOME}/ziti.env" >> ~/.bashrc
|
||||
RUN mkdir -p "${ZITI_SCRIPTS}"
|
||||
|
||||
# copy the ziti binaries to a directory already on the path
|
||||
COPY --chown=ziti ziti.ignore "${ZITI_BIN_DIR}"
|
||||
COPY --chown=ziti *.sh "${ZITI_SCRIPTS}/"
|
||||
|
||||
RUN /bin/bash -c "source ${ZITI_SCRIPTS}/ziti-cli-functions.sh; ziti_createEnvFile; echo source ${ZITI_HOME}/ziti.env >> ~/.bashrc"
|
||||
|
||||
|
||||
@@ -1,147 +0,0 @@
|
||||
#!/bin/bash
|
||||
cat > ${ZITI_HOME}/controller.yaml <<HereDocForEdgeConfiguration
|
||||
v: 3
|
||||
|
||||
#trace:
|
||||
# path: "${fabric_controller_name}.trace"
|
||||
|
||||
#profile:
|
||||
# memory:
|
||||
# path: ctrl.memprof
|
||||
|
||||
db: "${ZITI_HOME}/db/ctrl.db"
|
||||
|
||||
identity:
|
||||
cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-client.cert"
|
||||
server_cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-server.chain.pem"
|
||||
key: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_CONTROLLER_HOSTNAME}-server.key"
|
||||
ca: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
|
||||
|
||||
ctrl:
|
||||
listener: tls:0.0.0.0:${ZITI_FAB_CTRL_PORT}
|
||||
|
||||
mgmt:
|
||||
listener: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_MGMT_PORT}
|
||||
|
||||
#metrics:
|
||||
# influxdb:
|
||||
# url: http://localhost:8086
|
||||
# database: ziti
|
||||
|
||||
# xctrl_example
|
||||
#
|
||||
#example:
|
||||
# enabled: false
|
||||
# delay: 5s
|
||||
|
||||
# By having an 'edge' section defined, the ziti-controller will attempt to parse the edge configuration. Removing this
|
||||
# section, commenting out, or altering the name of the section will cause the edge to not run.
|
||||
edge:
|
||||
# This section represents the configuration of the Edge API that is served over HTTPS
|
||||
api:
|
||||
#(optional, default 90s) Alters how frequently heartbeat and last activity values are persisted
|
||||
# activityUpdateInterval: 90s
|
||||
#(optional, default 250) The number of API Sessions updated for last activity per transaction
|
||||
# activityUpdateBatchSize: 250
|
||||
# sessionTimeout - optional, default 10m
|
||||
# The number of minutes before an Edge API session will timeout. Timeouts are reset by
|
||||
# API requests and connections that are maintained to Edge Routers
|
||||
sessionTimeout: 30m
|
||||
# address - required
|
||||
# The default address (host:port) to use for enrollment for the Client API. This value must match one of the addresses
|
||||
# defined in this webListener's bindPoints.
|
||||
address: ${ZITI_EDGE_CONTROLLER_API}
|
||||
# This section is used to define option that are used during enrollment of Edge Routers, Ziti Edge Identities.
|
||||
enrollment:
|
||||
# signingCert - required
|
||||
# A Ziti Identity configuration section that specifically makes use of the cert and key fields to define
|
||||
# a signing certificate from the PKI that the Ziti environment is using to sign certificates. The signingCert.cert
|
||||
# will be added to the /.well-known CA store that is used to bootstrap trust with the Ziti Controller.
|
||||
signingCert:
|
||||
cert: ${ZITI_PKI}/${ZITI_SIGNING_INTERMEDIATE_NAME}/certs/${ZITI_SIGNING_INTERMEDIATE_NAME}.cert
|
||||
key: ${ZITI_PKI}/${ZITI_SIGNING_INTERMEDIATE_NAME}/keys/${ZITI_SIGNING_INTERMEDIATE_NAME}.key
|
||||
# edgeIdentity - optional
|
||||
# A section for identity enrollment specific settings
|
||||
edgeIdentity:
|
||||
# durationMinutes - optional, default 5m
|
||||
# The length of time that a Ziti Edge Identity enrollment should remain valid. After
|
||||
# this duration, the enrollment will expire and not longer be usable.
|
||||
duration: 14400m
|
||||
# edgeRouter - Optional
|
||||
# A section for edge router enrollment specific settings.
|
||||
edgeRouter:
|
||||
# durationMinutes - optional, default 5m
|
||||
# The length of time that a Ziti Edge Router enrollment should remain valid. After
|
||||
# this duration, the enrollment will expire and not longer be usable.
|
||||
duration: 14400m
|
||||
|
||||
# web
|
||||
# Defines webListeners that will be hosted by the controller. Each webListener can host many APIs and be bound to many
|
||||
# bind points.
|
||||
web:
|
||||
# name - required
|
||||
# Provides a name for this listener, used for logging output. Not required to be unique, but is highly suggested.
|
||||
- name: client-management
|
||||
# bindPoints - required
|
||||
# One or more bind points are required. A bind point specifies an interface (interface:port string) that defines
|
||||
# where on the host machine the webListener will listen and the address (host:port) that should be used to
|
||||
# publicly address the webListener(i.e. mydomain.com, localhost, 127.0.0.1). This public address may be used for
|
||||
# incoming address resolution as well as used in responses in the API.
|
||||
bindPoints:
|
||||
#interface - required
|
||||
# A host:port string on which network interface to listen on. 0.0.0.0 will listen on all interfaces
|
||||
- interface: 0.0.0.0:${ZITI_EDGE_CONTROLLER_PORT}
|
||||
# address - required
|
||||
# The public address that external incoming requests will be able to resolve. Used in request processing and
|
||||
# response content that requires full host:port/path addresses.
|
||||
address: ${ZITI_EDGE_CONTROLLER_API}
|
||||
# identity - optional
|
||||
# Allows the webListener to have a specific identity instead of defaulting to the root 'identity' section.
|
||||
identity:
|
||||
ca: "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert"
|
||||
key: "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.key"
|
||||
server_cert: "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.chain.pem"
|
||||
cert: "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-client.cert"
|
||||
# options - optional
|
||||
# Allows the specification of webListener level options - mainly dealing with HTTP/TLS settings. These options are
|
||||
# used for all http servers started by the current webListener.
|
||||
options:
|
||||
# idleTimeoutMs - optional, default 5000ms
|
||||
# The maximum amount of idle time in milliseconds allowed for pipelined HTTP requests. Setting this too high
|
||||
# can cause resources on the host to be consumed as clients remain connected and idle. Lowering this value
|
||||
# will cause clients to reconnect on subsequent HTTPs requests.
|
||||
idleTimeout: 5000ms #http timeouts, new
|
||||
# readTimeoutMs - optional, default 5000ms
|
||||
# The maximum amount of time in milliseconds http servers will wait to read the first incoming requests. A higher
|
||||
# value risks consuming resources on the host with clients that are acting bad faith or suffering from high latency
|
||||
# or packet loss. A lower value can risk losing connections to high latency/packet loss clients.
|
||||
readTimeout: 5000ms
|
||||
# writeTimeoutMs - optional, default 10000ms
|
||||
# The total maximum time in milliseconds that the http server will wait for a single requests to be received and
|
||||
# responded too. A higher value can allow long running requests to consume resources on the host. A lower value
|
||||
# can risk ending requests before the server has a chance to respond.
|
||||
writeTimeout: 100000ms
|
||||
# minTLSVersion - optional, default TSL1.2
|
||||
# The minimum version of TSL to support
|
||||
minTLSVersion: TLS1.2
|
||||
# maxTLSVersion - optional, default TSL1.3
|
||||
# The maximum version of TSL to support
|
||||
maxTLSVersion: TLS1.3
|
||||
# apis - required
|
||||
# Allows one or more APIs to be bound to this webListener
|
||||
apis:
|
||||
# binding - required
|
||||
# Specifies an API to bind to this webListener. Built-in APIs are
|
||||
# - edge-management
|
||||
# - edge-client
|
||||
# - fabric-management
|
||||
- binding: edge-management
|
||||
# options - variable optional/required
|
||||
# This section is used to define values that are specified by the API they are associated with.
|
||||
# These settings are per API. The example below is for the 'edge-api' and contains both optional values and
|
||||
# required values.
|
||||
options: { }
|
||||
- binding: edge-client
|
||||
options: { }
|
||||
|
||||
HereDocForEdgeConfiguration
|
||||
@@ -1,69 +0,0 @@
|
||||
#!/bin/bash
|
||||
cat > ${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml <<HereDocForEdgeRouter
|
||||
v: 3
|
||||
|
||||
identity:
|
||||
cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-client.cert"
|
||||
server_cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-server.cert"
|
||||
key: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_RAWNAME}-server.key"
|
||||
ca: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
|
||||
|
||||
ctrl:
|
||||
endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_CTRL_PORT}
|
||||
|
||||
link:
|
||||
listeners:
|
||||
- binding: transport
|
||||
bind: tls:0.0.0.0:10080
|
||||
advertise: tls:${ZITI_EDGE_ROUTER_HOSTNAME}:10080
|
||||
options:
|
||||
outQueueSize: 16
|
||||
dialers:
|
||||
- binding: transport
|
||||
|
||||
listeners:
|
||||
- binding: tunnel
|
||||
options:
|
||||
mode: host #tproxy|tun|host
|
||||
- binding: edge
|
||||
address: tls:0.0.0.0:${ZITI_EDGE_ROUTER_PORT}
|
||||
options:
|
||||
advertise: ${ZITI_EDGE_ROUTER_HOSTNAME}:${ZITI_EDGE_ROUTER_PORT}
|
||||
connectTimeoutMs: 5000
|
||||
getSessionTimeout: 60s
|
||||
|
||||
edge:
|
||||
csr:
|
||||
country: US
|
||||
province: NC
|
||||
locality: Charlotte
|
||||
organization: NetFoundry
|
||||
organizationalUnit: Ziti
|
||||
sans:
|
||||
dns:
|
||||
- ${ZITI_EDGE_ROUTER_HOSTNAME}
|
||||
- localhost
|
||||
ip:
|
||||
- "127.0.0.1"
|
||||
|
||||
#transport:
|
||||
# ws:
|
||||
# writeTimeout: 10
|
||||
# readTimeout: 5
|
||||
# idleTimeout: 5
|
||||
# pongTimeout: 60
|
||||
# pingInterval: 54
|
||||
# handshakeTimeout: 10
|
||||
# readBufferSize: 4096
|
||||
# writeBufferSize: 4096
|
||||
# enableCompression: true
|
||||
# server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_WSS_ROUTER_HOSTNAME}-router-server.cert
|
||||
# key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_WSS_ROUTER_HOSTNAME}-router-server.key
|
||||
|
||||
forwarder:
|
||||
latencyProbeInterval: 1000
|
||||
xgressDialQueueLength: 1000
|
||||
xgressDialWorkerCount: 128
|
||||
linkDialQueueLength: 1000
|
||||
linkDialWorkerCount: 10
|
||||
HereDocForEdgeRouter
|
||||
@@ -1,69 +0,0 @@
|
||||
#!/bin/bash
|
||||
cat > ${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml <<HereDocForEdgeRouter
|
||||
v: 3
|
||||
|
||||
identity:
|
||||
cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-client.cert"
|
||||
server_cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-server.cert"
|
||||
key: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_RAWNAME}-server.key"
|
||||
ca: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
|
||||
|
||||
ctrl:
|
||||
endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_CTRL_PORT}
|
||||
|
||||
link:
|
||||
listeners:
|
||||
- binding: transport
|
||||
bind: tls:0.0.0.0:10080
|
||||
advertise: tls:${ZITI_EDGE_ROUTER_HOSTNAME}:10080
|
||||
options:
|
||||
outQueueSize: 16
|
||||
dialers:
|
||||
- binding: transport
|
||||
|
||||
listeners:
|
||||
- binding: tunnel
|
||||
options:
|
||||
mode: host #tproxy|tun|host
|
||||
- binding: edge
|
||||
address: ws:0.0.0.0:3023
|
||||
options:
|
||||
advertise: ${ZITI_EDGE_ROUTER_HOSTNAME}:3023
|
||||
connectTimeoutMs: 5000
|
||||
getSessionTimeout: 60s
|
||||
|
||||
edge:
|
||||
csr:
|
||||
country: US
|
||||
province: NC
|
||||
locality: Charlotte
|
||||
organization: NetFoundry
|
||||
organizationalUnit: Ziti
|
||||
sans:
|
||||
dns:
|
||||
- ${ZITI_EDGE_ROUTER_HOSTNAME}
|
||||
- localhost
|
||||
ip:
|
||||
- "127.0.0.1"
|
||||
|
||||
transport:
|
||||
ws:
|
||||
writeTimeout: 10
|
||||
readTimeout: 5
|
||||
idleTimeout: 5
|
||||
pongTimeout: 60
|
||||
pingInterval: 54
|
||||
handshakeTimeout: 10
|
||||
readBufferSize: 4096
|
||||
writeBufferSize: 4096
|
||||
enableCompression: true
|
||||
server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.cert
|
||||
key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.key
|
||||
|
||||
forwarder:
|
||||
latencyProbeInterval: 1000
|
||||
xgressDialQueueLength: 1000
|
||||
xgressDialWorkerCount: 128
|
||||
linkDialQueueLength: 1000
|
||||
linkDialWorkerCount: 10
|
||||
HereDocForEdgeRouter
|
||||
@@ -1,8 +0,0 @@
|
||||
cat > ${ZITI_HOME}/identities.yml <<IdentitiesJsonHereDoc
|
||||
---
|
||||
default:
|
||||
caCert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-server.chain.pem"
|
||||
cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_NETWORK}-dotzeet.cert"
|
||||
key: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_NETWORK}-dotzeet.key"
|
||||
endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_MGMT_PORT}
|
||||
IdentitiesJsonHereDoc
|
||||
@@ -1,69 +0,0 @@
|
||||
#!/bin/bash
|
||||
cat > ${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml <<HereDocForEdgeRouter
|
||||
v: 3
|
||||
|
||||
identity:
|
||||
cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-client.cert"
|
||||
server_cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-server.cert"
|
||||
key: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_RAWNAME}-server.key"
|
||||
ca: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
|
||||
|
||||
ctrl:
|
||||
endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_CTRL_PORT}
|
||||
|
||||
link:
|
||||
listeners:
|
||||
- binding: transport
|
||||
bind: tls:0.0.0.0:10080
|
||||
advertise: tls:${ZITI_EDGE_ROUTER_HOSTNAME}:10080
|
||||
options:
|
||||
outQueueSize: 16
|
||||
dialers:
|
||||
- binding: transport
|
||||
|
||||
listeners:
|
||||
# - binding: tunnel
|
||||
# options:
|
||||
# mode: host #tproxy|tun|host
|
||||
- binding: transport
|
||||
address: tls:0.0.0.0:${ZITI_EDGE_ROUTER_PORT}
|
||||
options:
|
||||
advertise: ${ZITI_EDGE_ROUTER_HOSTNAME}:${ZITI_EDGE_ROUTER_PORT}
|
||||
connectTimeoutMs: 5000
|
||||
getSessionTimeout: 60s
|
||||
|
||||
#edge:
|
||||
csr:
|
||||
country: US
|
||||
province: NC
|
||||
locality: Charlotte
|
||||
organization: NetFoundry
|
||||
organizationalUnit: Ziti
|
||||
sans:
|
||||
dns:
|
||||
- ${ZITI_EDGE_ROUTER_HOSTNAME}
|
||||
- localhost
|
||||
ip:
|
||||
- "127.0.0.1"
|
||||
|
||||
#transport:
|
||||
# ws:
|
||||
# writeTimeout: 10
|
||||
# readTimeout: 5
|
||||
# idleTimeout: 5
|
||||
# pongTimeout: 60
|
||||
# pingInterval: 54
|
||||
# handshakeTimeout: 10
|
||||
# readBufferSize: 4096
|
||||
# writeBufferSize: 4096
|
||||
# enableCompression: true
|
||||
# server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_WSS_ROUTER_HOSTNAME}-router-server.cert
|
||||
# key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_WSS_ROUTER_HOSTNAME}-router-server.key
|
||||
|
||||
forwarder:
|
||||
latencyProbeInterval: 1000
|
||||
xgressDialQueueLength: 1000
|
||||
xgressDialWorkerCount: 128
|
||||
linkDialQueueLength: 1000
|
||||
linkDialWorkerCount: 10
|
||||
HereDocForEdgeRouter
|
||||
@@ -1,28 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
source ${ZITI_SCRIPTS}/pki-functions.sh
|
||||
|
||||
pki_create_ca "${ZITI_CONTROLLER_ROOTCA_NAME}"
|
||||
pki_create_ca "${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}"
|
||||
pki_create_ca "${ZITI_SIGNING_ROOTCA_NAME}"
|
||||
|
||||
ZITI_SPURIOUS_INTERMEDIATE="${ZITI_SIGNING_INTERMEDIATE_NAME}_spurious_intermediate"
|
||||
pki_create_intermediate "${ZITI_CONTROLLER_ROOTCA_NAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" 1
|
||||
pki_create_intermediate "${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" 1
|
||||
pki_create_intermediate "${ZITI_SIGNING_ROOTCA_NAME}" "${ZITI_SPURIOUS_INTERMEDIATE}" 2
|
||||
pki_create_intermediate "${ZITI_SPURIOUS_INTERMEDIATE}" "${ZITI_SIGNING_INTERMEDIATE_NAME}" 1
|
||||
|
||||
if ! test -f "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_NETWORK}-dotzeet.key"; then
|
||||
echo "Creating ziti-fabric client certificate for network: ${ZITI_NETWORK}"
|
||||
"${ZITI_BIN_DIR}/ziti" pki create client --pki-root="${ZITI_PKI}" --ca-name="${ZITI_CONTROLLER_INTERMEDIATE_NAME}" \
|
||||
--client-file="${ZITI_NETWORK}-dotzeet" \
|
||||
--client-name "${ZITI_NETWORK} Management"
|
||||
else
|
||||
echo "Creating ziti-fabric client certificate for network: ${ZITI_NETWORK}"
|
||||
echo "key exists"
|
||||
fi
|
||||
echo " "
|
||||
|
||||
pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE}"
|
||||
pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE}"
|
||||
#pki_client_server "${ZITI_EDGE_ROUTER_HOSTNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE}"
|
||||
@@ -1,69 +0,0 @@
|
||||
#!/bin/bash
|
||||
cat > ${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml <<HereDocForEdgeRouter
|
||||
v: 3
|
||||
|
||||
identity:
|
||||
cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-client.cert"
|
||||
server_cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-server.cert"
|
||||
key: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_RAWNAME}-server.key"
|
||||
ca: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
|
||||
|
||||
ctrl:
|
||||
endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_CTRL_PORT}
|
||||
|
||||
link:
|
||||
# listeners:
|
||||
# - binding: transport
|
||||
# bind: tls:0.0.0.0:10080
|
||||
# advertise: tls:${ZITI_EDGE_ROUTER_HOSTNAME}:10080
|
||||
# options:
|
||||
# outQueueSize: 16
|
||||
dialers:
|
||||
- binding: transport
|
||||
|
||||
listeners:
|
||||
# - binding: tunnel
|
||||
# options:
|
||||
# mode: host #tproxy|tun|host
|
||||
# - binding: transport
|
||||
# address: tls:0.0.0.0:${ZITI_EDGE_ROUTER_PORT}
|
||||
# options:
|
||||
# advertise: ${ZITI_EDGE_ROUTER_HOSTNAME}:${ZITI_EDGE_ROUTER_PORT}
|
||||
# connectTimeoutMs: 5000
|
||||
# getSessionTimeout: 60s
|
||||
|
||||
#edge:
|
||||
csr:
|
||||
country: US
|
||||
province: NC
|
||||
locality: Charlotte
|
||||
organization: NetFoundry
|
||||
organizationalUnit: Ziti
|
||||
sans:
|
||||
dns:
|
||||
- ${ZITI_EDGE_ROUTER_HOSTNAME}
|
||||
- localhost
|
||||
ip:
|
||||
- "127.0.0.1"
|
||||
|
||||
#transport:
|
||||
# ws:
|
||||
# writeTimeout: 10
|
||||
# readTimeout: 5
|
||||
# idleTimeout: 5
|
||||
# pongTimeout: 60
|
||||
# pingInterval: 54
|
||||
# handshakeTimeout: 10
|
||||
# readBufferSize: 4096
|
||||
# writeBufferSize: 4096
|
||||
# enableCompression: true
|
||||
# server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_WSS_ROUTER_HOSTNAME}-router-server.cert
|
||||
# key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_WSS_ROUTER_HOSTNAME}-router-server.key
|
||||
|
||||
forwarder:
|
||||
latencyProbeInterval: 1000
|
||||
xgressDialQueueLength: 1000
|
||||
xgressDialWorkerCount: 128
|
||||
linkDialQueueLength: 1000
|
||||
linkDialWorkerCount: 10
|
||||
HereDocForEdgeRouter
|
||||
@@ -1,5 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
source ${ZITI_SCRIPTS}/pki-functions.sh
|
||||
|
||||
pki_client_server "${ZITI_EDGE_ROUTER_RAWNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE}"
|
||||
@@ -1,80 +0,0 @@
|
||||
#!/bin/bash
|
||||
if [[ "${ZITI_HOME}" == "" ]]; then
|
||||
echo "ERROR: ZITI_HOME HAS NOT BEEN DECLARED!"
|
||||
exit 1
|
||||
fi
|
||||
if [[ "${ENV_FILE}" == "" ]]; then
|
||||
echo "ERROR: ENV_FILE HAS NOT BEEN DECLARED!"
|
||||
exit 1
|
||||
fi
|
||||
if [[ "${network_name}" != "" ]]; then
|
||||
export ZITI_NETWORK=${network_name}
|
||||
fi
|
||||
if [[ "${ZITI_NETWORK}" == "" ]]; then
|
||||
if [[ "${1}" != "" ]]; then
|
||||
export ZITI_NETWORK=${1}
|
||||
fi
|
||||
if [[ "${ZITI_NETWORK}" = "" ]]; then
|
||||
echo "WARN: ZITI_NETWORK HAS NOT BEEN DECLARED! USING hostname: $(hostname)"
|
||||
export ZITI_NETWORK=$(hostname)
|
||||
fi
|
||||
fi
|
||||
echo "ZITI_NETWORK set to: ${ZITI_NETWORK}"
|
||||
|
||||
export ZITI_USER="admin"
|
||||
export ZITI_PWD="admin"
|
||||
export ZITI_DOMAIN_SUFFIX=".openziti.org"
|
||||
export ZITI_DOMAIN_SUFFIX=""
|
||||
export ZITI_ID="${ZITI_HOME}/identities.yml"
|
||||
export ZITI_FAB_MGMT_PORT="10000"
|
||||
export ZITI_FAB_CTRL_PORT="6262"
|
||||
|
||||
if [[ "${ZITI_CONTROLLER_RAWNAME}" == "" ]]; then export ZITI_CONTROLLER_RAWNAME="${ZITI_NETWORK}-controller"; fi
|
||||
if [[ "${ZITI_EDGE_CONTROLLER_RAWNAME}" == "" ]]; then export ZITI_EDGE_CONTROLLER_RAWNAME="${ZITI_NETWORK}-edge-controller"; fi
|
||||
|
||||
export ZITI_PKI="${ZITI_SHARED}/pki"
|
||||
if [[ "${ZITI_EDGE_CONTROLLER_PORT}" == "" ]]; then export ZITI_EDGE_CONTROLLER_PORT="1280"; fi
|
||||
|
||||
if [[ "${ZITI_CONTROLLER_HOSTNAME}" == "" ]]; then export ZITI_CONTROLLER_HOSTNAME="${ZITI_CONTROLLER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
|
||||
if [[ "${ZITI_EDGE_CONTROLLER_HOSTNAME}" == "" ]]; then export ZITI_EDGE_CONTROLLER_HOSTNAME="${ZITI_EDGE_CONTROLLER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
|
||||
if [[ "${ZITI_ZAC_HOSTNAME}" == "" ]]; then export ZITI_ZAC_HOSTNAME="${ZITI_ZAC_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
|
||||
if [[ "${ZITI_EDGE_CONTROLLER_API}" == "" ]]; then export ZITI_EDGE_CONTROLLER_API="${ZITI_EDGE_CONTROLLER_HOSTNAME}:${ZITI_EDGE_CONTROLLER_PORT}"; fi
|
||||
|
||||
export ZITI_SIGNING_CERT_NAME="${ZITI_NETWORK}-signing"
|
||||
|
||||
export ZITI_CONTROLLER_ROOTCA_NAME="${ZITI_CONTROLLER_HOSTNAME}-root-ca"
|
||||
export ZITI_CONTROLLER_INTERMEDIATE_NAME="${ZITI_CONTROLLER_HOSTNAME}-intermediate"
|
||||
|
||||
export ZITI_EDGE_CONTROLLER_ROOTCA_NAME="${ZITI_EDGE_CONTROLLER_HOSTNAME}-root-ca"
|
||||
export ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME="${ZITI_EDGE_CONTROLLER_HOSTNAME}-intermediate"
|
||||
|
||||
export ZITI_SIGNING_ROOTCA_NAME="${ZITI_SIGNING_CERT_NAME}-root-ca"
|
||||
export ZITI_SIGNING_INTERMEDIATE_NAME="${ZITI_SIGNING_CERT_NAME}-intermediate"
|
||||
|
||||
export ZITI_BIN_ROOT="${ZITI_HOME}/ziti-bin"
|
||||
|
||||
mkdir -p ${ZITI_BIN_ROOT}
|
||||
mkdir -p ${ZITI_HOME}/db
|
||||
mkdir -p ${ZITI_PKI}
|
||||
|
||||
echo "" > "${ENV_FILE}"
|
||||
for zEnvVar in $(set -o posix ; set | grep ZITI_ | sort); do echo "export ${zEnvVar}" >> "${ENV_FILE}"; done
|
||||
|
||||
export PFXLOG_NO_JSON=true
|
||||
echo "export PFXLOG_NO_JSON=true" >> "${ENV_FILE}"
|
||||
|
||||
echo "alias zec='ziti edge controller'" >> "${ENV_FILE}"
|
||||
echo "alias zlogin='ziti edge controller login \"${ZITI_EDGE_CONTROLLER_API}\" -u \"${ZITI_USER}\" -p \"${ZITI_PWD}\" -c \"${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert\"'" >> "${ENV_FILE}"
|
||||
echo "alias psz='ps -ef | grep ziti'" >> "${ENV_FILE}"
|
||||
|
||||
#when sourcing the emitted file add the bin folder to the path
|
||||
tee -a "${ENV_FILE}" > /dev/null <<'heredoc'
|
||||
echo " "
|
||||
if [[ ! "$(echo "$PATH"|grep -q "${ZITI_BIN_DIR}" && echo "yes")" == "yes" ]]; then
|
||||
echo "adding ${ZITI_BIN_DIR} to the path"
|
||||
export PATH=$PATH:"${ZITI_BIN_DIR}"
|
||||
else
|
||||
echo " ziti binaries are located at: ${ZITI_BIN_DIR}"
|
||||
echo -e 'add this to your path if you want by executing: export PATH=$PATH:'"${ZITI_BIN_DIR}"
|
||||
fi
|
||||
heredoc
|
||||
@@ -1,103 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
function pki_client_server {
|
||||
name_local=$1
|
||||
ZITI_CA_NAME_local=$2
|
||||
ip_local=$3
|
||||
|
||||
if [[ "${ip_local}" == "" ]]; then
|
||||
ip_local="127.0.0.1"
|
||||
fi
|
||||
|
||||
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-server.key"; then
|
||||
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
|
||||
"${ZITI_BIN_DIR}/ziti" pki create server --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \
|
||||
--server-file "${name_local}-server" \
|
||||
--dns "${name_local},localhost" --ip "${ip_local}" \
|
||||
--server-name "${name_local} server certificate"
|
||||
else
|
||||
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
|
||||
echo "key exists"
|
||||
fi
|
||||
|
||||
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-client.key"; then
|
||||
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
|
||||
"${ZITI_BIN_DIR}/ziti" pki create client --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \
|
||||
--client-file "${name_local}-client" \
|
||||
--key-file "${name_local}-server" \
|
||||
--client-name "${name_local}"
|
||||
else
|
||||
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
|
||||
echo "key exists"
|
||||
fi
|
||||
echo " "
|
||||
}
|
||||
|
||||
function pki_create_ca {
|
||||
if ! test -f "${ZITI_PKI}/${1}/keys/${1}.key"; then
|
||||
echo "Creating CA: ${1}"
|
||||
"${ZITI_BIN_DIR}/ziti" pki create ca --pki-root="${ZITI_PKI}" --ca-file="${1}" --ca-name="${1} Root CA"
|
||||
else
|
||||
echo "Creating CA: ${1}"
|
||||
echo "key exists"
|
||||
fi
|
||||
echo " "
|
||||
}
|
||||
|
||||
function pki_create_intermediate {
|
||||
if ! test -f "${ZITI_PKI}/${2}/keys/${2}.key"; then
|
||||
echo "Creating intermediate: ${1} ${2} ${3}"
|
||||
"${ZITI_BIN_DIR}/ziti" pki create intermediate --pki-root "${ZITI_PKI}" --ca-name "${1}" \
|
||||
--intermediate-name "${2}" \
|
||||
--intermediate-file "${2}" --max-path-len ${3}
|
||||
else
|
||||
echo "Creating intermediate: ${1} ${2} ${3}"
|
||||
echo "key exists"
|
||||
fi
|
||||
echo " "
|
||||
}
|
||||
function yaml2json()
|
||||
{
|
||||
ruby -ryaml -rjson -e 'puts JSON.pretty_generate(YAML.load(ARGF))' $*
|
||||
}
|
||||
|
||||
function printUsage()
|
||||
{
|
||||
echo "Usage: $1 [cert to test] [ca pool to use]"
|
||||
}
|
||||
|
||||
function verifyCertAgainstPool()
|
||||
{
|
||||
if [[ "" == "$1" ]]
|
||||
then
|
||||
printUsage "verifyCertAgainstPool"
|
||||
return 1
|
||||
fi
|
||||
|
||||
if [[ "" == "$2" ]]
|
||||
then
|
||||
printUsage "verifyCertAgainstPool"
|
||||
return 1
|
||||
fi
|
||||
|
||||
echo " Verifying that this certificate:"
|
||||
echo " - $1"
|
||||
echo " is valid for this ca pool:"
|
||||
echo " - $2"
|
||||
echo ""
|
||||
openssl verify -partial_chain -CAfile "$2" "$1"
|
||||
if [ $? -eq 0 ]; then
|
||||
echo ""
|
||||
echo "============ SUCCESS! ============"
|
||||
else
|
||||
echo ""
|
||||
echo "============ FAILED TO VALIDATE ============"
|
||||
fi
|
||||
}
|
||||
|
||||
function showIssuerAndSubjectForPEM()
|
||||
{
|
||||
echo "Displaying Issuer and Subject for cert pool:"
|
||||
echo " $1"
|
||||
openssl crl2pkcs7 -nocrl -certfile $1 | openssl pkcs7 -print_certs -text -noout | grep -E "(Subject|Issuer)"
|
||||
}
|
||||
@@ -1,14 +1,15 @@
|
||||
#!/bin/bash
|
||||
|
||||
. ${ZITI_SCRIPTS}/env.sh
|
||||
. "${ZITI_SCRIPTS}/ziti-cli-functions.sh"
|
||||
|
||||
ziti_createEnvFile
|
||||
. ${ZITI_HOME}/ziti.env
|
||||
|
||||
"${ZITI_SCRIPTS}/create-pki.sh"
|
||||
|
||||
# create pki
|
||||
createPki
|
||||
|
||||
# generates the config file for the controller
|
||||
"${ZITI_SCRIPTS}/create-controller-config.sh"
|
||||
createControllerConfig
|
||||
|
||||
# initialize the database with the admin user:
|
||||
"${ZITI_BIN_DIR}/ziti-controller" edge init "${ZITI_HOME}/controller.yaml" -u "${ZITI_USER}" -p "${ZITI_PWD}"
|
||||
@@ -16,8 +17,9 @@
|
||||
# create a place for the internal db
|
||||
mkdir -p $ZITI_HOME/db
|
||||
|
||||
"${ZITI_SCRIPTS}/create-fabric-identity.sh"
|
||||
#"${ZITI_SCRIPTS}/create-fabric-identity.sh"
|
||||
createFabricIdentity
|
||||
|
||||
"${ZITI_BIN_DIR}/ziti-controller" run "${ZITI_HOME}/controller.yaml"
|
||||
|
||||
${ZITI_HOME}/pki/ziti-controller-intermediate/keys/ziti-dotzeet.key
|
||||
${ZITI_HOME}/pki/ziti-controller-intermediate/keys/ziti-dotzeet.key
|
||||
|
||||
@@ -1,6 +1,8 @@
|
||||
#!/bin/bash
|
||||
|
||||
. ${ZITI_SCRIPTS}/env.sh
|
||||
. "${ZITI_SCRIPTS}/ziti-cli-functions.sh"
|
||||
|
||||
ziti_createEnvFile
|
||||
. ${ZITI_HOME}/ziti.env
|
||||
|
||||
until $(curl -s -o /dev/null --fail -k "https://${ZITI_EDGE_CONTROLLER_API}"); do
|
||||
@@ -11,26 +13,26 @@ done
|
||||
if [[ "${ZITI_EDGE_ROUTER_HOSTNAME}" == "" ]]; then export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
|
||||
if [[ "${ZITI_EDGE_ROUTER_PORT}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi
|
||||
|
||||
"${ZITI_SCRIPTS}/create-router-pki.sh"
|
||||
createRouterPki
|
||||
|
||||
echo "logging into ziti controller: ${ZITI_EDGE_API_HOSTNAME}"
|
||||
"${ZITI_BIN_DIR}/ziti" edge login "${ZITI_EDGE_CONTROLLER_API}" -u "${ZITI_USER}" -p "${ZITI_PWD}" -c "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert"
|
||||
|
||||
if [[ "$1" == "edge" ]]; then
|
||||
echo "CREATING EDGE ROUTER CONFIG"
|
||||
"${ZITI_SCRIPTS}/create-edge-router-config.sh"
|
||||
createEdgeRouterConfig
|
||||
fi
|
||||
if [[ "$1" == "wss" ]]; then
|
||||
echo "CREATING EDGE ROUTER WSS CONFIG"
|
||||
"${ZITI_SCRIPTS}/create-edge-router-wss-config.sh"
|
||||
createEdgeRouterWssConfig
|
||||
fi
|
||||
if [[ "$1" == "fabric" ]]; then
|
||||
echo "CREATING FABRIC ROUTER CONFIG"
|
||||
"${ZITI_SCRIPTS}/create-fabric-router-config.sh"
|
||||
createFabricRouterConfig
|
||||
fi
|
||||
if [[ "$1" == "private" ]]; then
|
||||
echo "CREATING PRIVATE ROUTER CONFIG"
|
||||
"${ZITI_SCRIPTS}/create-private-router-config.sh"
|
||||
createPrivateRouterConfig
|
||||
fi
|
||||
|
||||
echo "---------- Creating edge-router ${ZITI_EDGE_ROUTER_HOSTNAME}...."
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -26,9 +26,9 @@ if [ -d "${ZITI_BIN_ROOT}/image/ziti.ignore" ]; then
|
||||
fi
|
||||
|
||||
docker run --rm -it openziti/quickstart /openziti/ziti-bin/ziti version
|
||||
if [ -f "${ZITI_BIN_ROOT}/ziti-*tar.gz" ]; then
|
||||
rm "${ZITI_BIN_ROOT}/ziti-*tar.gz"
|
||||
fi
|
||||
#if [ -f "${ZITI_BIN_ROOT}/ziti-*tar.gz" ]; then
|
||||
# rm "${ZITI_BIN_ROOT}/ziti-*tar.gz"
|
||||
#fi
|
||||
if [ -d "${ZITI_BIN_ROOT}/ziti-bin" ]; then
|
||||
rm -rf "${ZITI_BIN_ROOT}/ziti-bin"
|
||||
fi
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 44 KiB |
@@ -1 +0,0 @@
|
||||
../docker/image/create-controller-config.sh
|
||||
@@ -1 +0,0 @@
|
||||
../docker/image/create-edge-router-config.sh
|
||||
@@ -1 +0,0 @@
|
||||
../docker/image/create-pki.sh
|
||||
@@ -1 +0,0 @@
|
||||
../docker/image/create-router-pki.sh
|
||||
@@ -1,5 +0,0 @@
|
||||
# Express Dev Env
|
||||
|
||||
This script is meant to provide a very quick method of deploying an absolute minimum ziti setup: one controller, one edge-router.
|
||||
|
||||
This environment is entirely suitable for local development against the ziti apis. This is not a recommended configuration production configuration.
|
||||
@@ -1,194 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
ZITI_SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
|
||||
ZITI_QUICKSTART_ENVROOT="${HOME}/.ziti/quickstart"
|
||||
ZITI_QUICKSTART_SCRIPT_ROOT="$(realpath "${ZITI_SCRIPT_DIR}/../../")"
|
||||
. "${ZITI_QUICKSTART_SCRIPT_ROOT}/ziti-cli-functions.sh"
|
||||
|
||||
function issueGreeting {
|
||||
#echo "-------------------------------------------------------------"
|
||||
echo " "
|
||||
echo " _ _ _"
|
||||
echo " ____ (_) | |_ (_)"
|
||||
echo " |_ / | | | __| | |"
|
||||
echo " / / | | | |_ | |"
|
||||
echo " /___| |_| \__| |_|"
|
||||
echo "-------------------------------------------------------------"
|
||||
echo " "
|
||||
echo "This script will make it trivial to setup a very simple environment locally which will allow you to start"
|
||||
echo "learning ziti. This environment is suitable for development work only and is not a decent representation of"
|
||||
echo "a fully redundant production-caliber network."
|
||||
echo ""
|
||||
echo "Please note that this script will write files to your home directory into a directory named .ziti."
|
||||
echo -n "For you this location will be: "
|
||||
echo -e "$(BLUE "${ZITI_QUICKSTART_ENVROOT}")"
|
||||
echo " "
|
||||
}
|
||||
|
||||
function setupZitiNetwork {
|
||||
if [[ "$1" == "" ]]; then
|
||||
echo " "
|
||||
echo "Creating a controller is effectively creating a network. The name of the network will be used when writing"
|
||||
echo "configuration files locally. Choose the name of your network now. The format of the network name should resemble"
|
||||
echo -n "what a hostname looks like. A good choice is to actually use your system's hostname: "
|
||||
echo -e "$(BLUE $(hostname))"
|
||||
echo " "
|
||||
read -p "$(echo -ne "Network Name [$(BLUE $(hostname))]: ")" ZITI_NETWORK
|
||||
echo " "
|
||||
if checkControllerName; then
|
||||
: #clear to continue
|
||||
if [[ "ZITI_NETWORK" == "" ]]; then
|
||||
ZITI_NETWORK="$(hostname)"
|
||||
fi
|
||||
echo "name: ${ZITI_NETWORK}"
|
||||
else
|
||||
echo " "
|
||||
echo "nah bro"
|
||||
return 1
|
||||
fi
|
||||
echo " "
|
||||
else
|
||||
ZITI_NETWORK="$1"
|
||||
fi
|
||||
}
|
||||
|
||||
function setupZitiHome {
|
||||
export ZITI_HOME="${HOME}/.ziti/quickstart/${ZITI_NETWORK}"
|
||||
}
|
||||
|
||||
function generateEnvFile {
|
||||
|
||||
echo -e "Generating new network with name: $(BLUE "${ZITI_NETWORK}")"
|
||||
|
||||
if [[ "${ZITI_CONTROLLER_RAWNAME}" == "" ]]; then export export ZITI_CONTROLLER_RAWNAME="${ZITI_NETWORK}-controller"; fi
|
||||
if [[ "${ZITI_CONTROLLER_HOSTNAME}" == "" ]]; then export export ZITI_CONTROLLER_HOSTNAME="${ZITI_NETWORK}"; fi
|
||||
if [[ "${ZITI_EDGE_CONTROLLER_RAWNAME}" == "" ]]; then export export ZITI_EDGE_CONTROLLER_RAWNAME="${ZITI_NETWORK}-edge-controller"; fi
|
||||
if [[ "${ZITI_EDGE_CONTROLLER_HOSTNAME}" == "" ]]; then export export ZITI_EDGE_CONTROLLER_HOSTNAME="${ZITI_NETWORK}"; fi
|
||||
if [[ "${ZITI_ZAC_RAWNAME}" == "" ]]; then export export ZITI_ZAC_RAWNAME="${ZITI_NETWORK}"; fi
|
||||
if [[ "${ZITI_ZAC_HOSTNAME}" == "" ]]; then export export ZITI_ZAC_HOSTNAME="${ZITI_NETWORK}"; fi
|
||||
if [[ "${ZITI_EDGE_ROUTER_RAWNAME}" == "" ]]; then export export ZITI_EDGE_ROUTER_RAWNAME="${ZITI_NETWORK}-edge-router"; fi
|
||||
if [[ "${ZITI_EDGE_ROUTER_HOSTNAME}" == "" ]]; then export export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_NETWORK}"; fi
|
||||
if [[ "${ZITI_EDGE_ROUTER_PORT}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi
|
||||
|
||||
if [[ "${ZITI_BIN_ROOT}" == "" ]]; then
|
||||
export ZITI_BIN_ROOT="${ZITI_HOME}/ziti-bin"
|
||||
fi
|
||||
|
||||
export ZITI_SCRIPTS="$(realpath "${ZITI_SCRIPT_DIR}/..")"
|
||||
export ZITI_SHARED=${ZITI_HOME}
|
||||
export ENV_FILE="${ZITI_HOME}/${ZITI_NETWORK}.env"
|
||||
"${ZITI_QUICKSTART_SCRIPT_ROOT}/docker/image/env.sh"
|
||||
echo -e "environment file created and sourced from: $(BLUE "${ENV_FILE}")"
|
||||
source "${ENV_FILE}"
|
||||
}
|
||||
|
||||
function expressConfiguration {
|
||||
echo " "
|
||||
echo "___________ _______________________________________^__"
|
||||
echo " ___ ___ ||| ___ ___ ___ ___ ___ | __ ,----\ "
|
||||
echo "| | | |||| | | | | | | | | | | | | |_____\ "
|
||||
echo "|___| |___|||| |___| |___| |___| | O | O | | | | \ "
|
||||
echo " ||| ===== EXPRESS ==== |___|___| | |__| )"
|
||||
echo "___________|||______________________________|______________/"
|
||||
echo " ||| /--------"
|
||||
echo "-----------'''---------------------------------------'"
|
||||
echo ""
|
||||
|
||||
if [[ "$1" == "" ]]; then
|
||||
nw="$(hostname)"
|
||||
else
|
||||
nw="$1"
|
||||
fi
|
||||
|
||||
setupZitiNetwork "${nw}"
|
||||
setupZitiHome
|
||||
|
||||
getLatestZiti "no"
|
||||
generateEnvFile
|
||||
#checkHostsFile
|
||||
|
||||
generatePki
|
||||
generateControllerConfig
|
||||
initializeController
|
||||
startZitiController
|
||||
echo "starting the ziti controller to enroll the edge router"
|
||||
sleep 2
|
||||
|
||||
zitiLogin
|
||||
|
||||
echo -e "---------- Creating an edge router policy allowing all identities to connect to routers with a $(GREEN "#public") attribute"
|
||||
unused=$("${ZITI_BIN_DIR}/ziti" edge delete edge-router-policy allEdgeRouters)
|
||||
unused=$("${ZITI_BIN_DIR}/ziti" edge create edge-router-policy allEdgeRouters --edge-router-roles '#public' --identity-roles '#all' )
|
||||
|
||||
echo -e "---------- Creating a service edge router policy allowing all services to use $(GREEN "#public") edge routers"
|
||||
unused=$("${ZITI_BIN_DIR}/ziti" edge delete service-edge-router-policy allSvcPublicRouters)
|
||||
unused=$("${ZITI_BIN_DIR}/ziti" edge create service-edge-router-policy allSvcPublicRouters --edge-router-roles '#public' --service-roles '#all')
|
||||
|
||||
"${ZITI_SCRIPTS}/create-router-pki.sh"
|
||||
generateEdgeRouterConfig
|
||||
|
||||
echo "---------- Creating edge-router ${ZITI_EDGE_ROUTER_RAWNAME}...."
|
||||
unused=$("${ZITI_BIN_DIR}/ziti" edge delete edge-router "${ZITI_EDGE_ROUTER_RAWNAME}")
|
||||
unused=$("${ZITI_BIN_DIR}/ziti" edge create edge-router "${ZITI_EDGE_ROUTER_RAWNAME}" -o "${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" -t)
|
||||
sleep 1
|
||||
echo "---------- Enrolling edge-router ${ZITI_EDGE_ROUTER_RAWNAME}...."
|
||||
|
||||
unused=$("${ZITI_BIN_DIR}/ziti-router" enroll "${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" --jwt "${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" &> "${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.enrollment.log")
|
||||
echo ""
|
||||
sleep 1
|
||||
unused=$("${ZITI_BIN_DIR}/ziti-router" run "${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" > "${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.log" 2>&1 &)
|
||||
}
|
||||
|
||||
function decideOperation {
|
||||
if [[ "$1" != "" ]]; then
|
||||
yn=$1
|
||||
fi
|
||||
while true
|
||||
do
|
||||
if [[ "${yn}" == "" ]]; then
|
||||
echo "What sort of operation are you looking to perform?"
|
||||
echo " 1.) Express configuration - a simple overlay will be spawned containing one controller and two edge routers"
|
||||
echo " 2.) Create Controller configuration - answer a few questions and a controller config will be emitted"
|
||||
echo " 3.) Create Edge Router configuration - answer a few questions and an edge router config will be emitted"
|
||||
echo " 4.) Start a network with the provided name"
|
||||
echo " "
|
||||
read -p "Select an action: " yn
|
||||
fi
|
||||
case $yn in
|
||||
[1]* )
|
||||
expressConfiguration "$2"
|
||||
break;;
|
||||
[2]* )
|
||||
generateEnvFile
|
||||
|
||||
;;
|
||||
[3]* )
|
||||
echo "333 has been chosen"
|
||||
echo " "
|
||||
;;
|
||||
[4]* )
|
||||
echo "4444 has been chosen"
|
||||
echo " "
|
||||
;;
|
||||
[yYqQeE]* )
|
||||
break
|
||||
;;
|
||||
[Nn]* )
|
||||
echo ""; echo "Ok - come back when you're ready."
|
||||
exit;;
|
||||
* ) echo "Please answer yes or no. (yes/NO)";;
|
||||
esac
|
||||
yn=
|
||||
done
|
||||
echo " "
|
||||
}
|
||||
|
||||
#greet the user with the banner and quick blurb about what to expect
|
||||
issueGreeting
|
||||
|
||||
#make sure the user has all the necessary commands to be successful
|
||||
checkPrereqs
|
||||
|
||||
#prompt the user for input and do what they want/need
|
||||
decideOperation 1 "$1"
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
../docker/image/pki-functions.sh
|
||||
@@ -9,7 +9,7 @@ else
|
||||
export network_name="${USER}"
|
||||
fi
|
||||
|
||||
source ${curdir}/env.sh
|
||||
ziti_createEnvFile
|
||||
|
||||
DIRNAME=$(dirname $0)
|
||||
[[ ${USE_DNSMASQ:-} -eq 1 ]] && source ${DIRNAME}/run-dns.sh
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 55 KiB |
@@ -1,197 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
export ZITI_QUICKSTART_SCRIPT_ROOT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
|
||||
export ZITI_QUICKSTART_ENVROOT="${HOME}/.ziti/quickstart"
|
||||
|
||||
ASCI_WHITE='\033[01;37m'
|
||||
ASCI_RESTORE='\033[0m'
|
||||
ASCI_RED='\033[00;31m'
|
||||
ASCI_GREEN='\033[00;32m'
|
||||
ASCI_YELLOW='\033[00;33m'
|
||||
ASCI_BLUE='\033[00;34m'
|
||||
ASCI_MAGENTA='\033[00;35m'
|
||||
ASCI_PURPLE='\033[00;35m'
|
||||
ASCI_CYAN='\033[00;36m'
|
||||
ASCI_LIGHTGRAY='\033[00;37m'
|
||||
ASCI_LRED='\033[01;31m'
|
||||
ASCI_LGREEN='\033[01;32m'
|
||||
ASCI_LYELLOW='\033[01;33m'
|
||||
ASCI_LBLUE='\033[01;34m'
|
||||
ASCI_LMAGENTA='\033[01;35m'
|
||||
ASCI_LPURPLE='\033[01;35m'
|
||||
ASCI_LCYAN='\033[01;36m'
|
||||
|
||||
function WHITE {
|
||||
echo "${ASCI_WHITE}$1${ASCI_RESTORE}"
|
||||
}
|
||||
function RED {
|
||||
echo "${ASCI_RED}$1${ASCI_RESTORE}"
|
||||
}
|
||||
function GREEN {
|
||||
echo "${ASCI_GREEN}$1${ASCI_RESTORE}"
|
||||
}
|
||||
function YELLOW {
|
||||
echo "${ASCI_YELLOW}$1${ASCI_RESTORE}"
|
||||
}
|
||||
function BLUE {
|
||||
echo "${ASCI_BLUE}$1${ASCI_RESTORE}"
|
||||
}
|
||||
|
||||
function zitiLogin {
|
||||
unused=$("${ZITI_BIN_DIR}/ziti" edge login "${ZITI_EDGE_CONTROLLER_API}" -u "${ZITI_USER}" -p "${ZITI_PWD}" -c "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert")
|
||||
}
|
||||
function reinitializeZitiController {
|
||||
cleanZitiController
|
||||
}
|
||||
function cleanZitiController {
|
||||
rm -rf "${ZITI_HOME}/db"
|
||||
mkdir "${ZITI_HOME}/db"
|
||||
initializeController
|
||||
}
|
||||
function generateControllerConfig {
|
||||
"${ZITI_QUICKSTART_SCRIPT_ROOT}/docker/image/create-controller-config.sh"
|
||||
}
|
||||
function generateEdgeRouterConfig {
|
||||
echo "RUNNING: ${ZITI_QUICKSTART_SCRIPT_ROOT}/docker/image/create-edge-router-config.sh"
|
||||
"${ZITI_QUICKSTART_SCRIPT_ROOT}/docker/image/create-edge-router-config.sh"
|
||||
}
|
||||
function initializeController {
|
||||
"${ZITI_BIN_DIR}/ziti-controller" edge init "${ZITI_HOME}/controller.yaml" -u "${ZITI_USER}" -p "${ZITI_PWD}" &> "${ZITI_HOME}/controller-init.log"
|
||||
echo -e "ziti-controller initialized. see $(BLUE ${ZITI_HOME}/controller-init.log) for details"
|
||||
}
|
||||
function startZitiController {
|
||||
# shellcheck disable=SC2034
|
||||
unused=$("${ZITI_BIN_DIR}/ziti-controller" run "${ZITI_HOME}/controller.yaml" > "${ZITI_HOME}/ziti-edge-controller.log" 2>&1 &)
|
||||
echo -e "ziti-controller started. log located at: $(BLUE ${ZITI_HOME}/ziti-edge-controller.log)"
|
||||
}
|
||||
function stopZitiController {
|
||||
killall ziti-controller
|
||||
}
|
||||
function checkHostsFile {
|
||||
ctrlexists=$(grep -c ${ZITI_CONTROLLER_HOSTNAME} /etc/hosts)
|
||||
edgectrlexists=$(grep -c ${ZITI_EDGE_CONTROLLER_HOSTNAME} /etc/hosts)
|
||||
erexists=$(grep -c ${ZITI_EDGE_ROUTER_HOSTNAME} /etc/hosts)
|
||||
|
||||
if [[ "0" = "${ctrlexists}" ]] || [[ "0" = "${edgectrlexists}" ]] || [[ "0" = "${erexists}" ]]; then
|
||||
echo " "
|
||||
echo -e "$(YELLOW "Ziti is generally used to create an overlay network. Generally speaking this will involve more than one host")"
|
||||
echo -e "$(YELLOW "Since this is a script geared towards setting up a very minimal development environment it needs to make some")"
|
||||
echo -e "$(YELLOW "assumptions. One of these assumptions is that the three specific entries are entered onto your hosts file.")"
|
||||
echo -e "$(YELLOW "One or more of these are missing:")"
|
||||
echo " "
|
||||
if [[ "0" == "${ctrlexists}" ]]; then
|
||||
echo -e " * $(RED "MISSING: ${ZITI_EDGE_CONTROLLER_HOSTNAME}") "
|
||||
else
|
||||
echo -e " * $(GREEN " FOUND: ${ZITI_EDGE_CONTROLLER_HOSTNAME}") "
|
||||
fi
|
||||
if [[ "0" == "${edgectrlexists}" ]]; then
|
||||
echo -e " * $(RED "MISSING: ${ZITI_EDGE_CONTROLLER_HOSTNAME}") "
|
||||
else
|
||||
echo -e " * $(GREEN " FOUND: ${ZITI_EDGE_CONTROLLER_HOSTNAME}") "
|
||||
fi
|
||||
if [[ "0" == "${erexists}" ]]; then
|
||||
echo -e " * $(RED "MISSING: ${ZITI_EDGE_ROUTER_HOSTNAME}") "
|
||||
else
|
||||
echo -e " * $(GREEN " FOUND: ${ZITI_EDGE_ROUTER_HOSTNAME}") "
|
||||
fi
|
||||
|
||||
echo " "
|
||||
echo "The easiest way to correct this is to run the following command:"
|
||||
echo " echo \"127.0.0.1 ${ZITI_CONTROLLER_HOSTNAME} ${ZITI_EDGE_CONTROLLER_HOSTNAME} ${ZITI_EDGE_ROUTER_HOSTNAME}\" | sudo tee -a /etc/hosts"
|
||||
echo " "
|
||||
echo "add these entries to your hosts file, and rerun the script when ready"
|
||||
return
|
||||
fi
|
||||
}
|
||||
|
||||
function getLatestZitiVersion {
|
||||
if [[ "${ZITI_BINARIES_VERSION}" == "" ]]; then
|
||||
zitilatest=$(curl -s https://api.github.com/repos/openziti/ziti/releases/latest)
|
||||
echo ${zitilatest} > /mnt/v/temp/a.txt
|
||||
export ZITI_BINARIES_TARFILE=$(echo "${zitilatest}" | jq -r '.assets[] | select(.name | startswith("ziti-linux-amd")) | .name')
|
||||
# shellcheck disable=SC2155
|
||||
export ZITI_BINARIES_VERSION=$(echo "${zitilatest}" | jq -r '.tag_name')
|
||||
fi
|
||||
#echo -e 'Ziti tar.gz: '"$(BLUE "${ZITI_BINARIES_TARFILE}")"
|
||||
#echo -e 'Latest ziti is: '"$(BLUE "${ZITI_BINARIES_VERSION}")"
|
||||
}
|
||||
|
||||
function getLatestZiti {
|
||||
if [[ "${ZITI_HOME}" == "" ]]; then
|
||||
echo "ERROR: ZITI_HOME is not set!"
|
||||
return
|
||||
fi
|
||||
if [[ "${ZITI_BIN_ROOT}" == "" ]]; then
|
||||
export ZITI_BIN_ROOT="${ZITI_HOME}/ziti-bin"
|
||||
fi
|
||||
mkdir -p "${ZITI_BIN_ROOT}"
|
||||
getLatestZitiVersion
|
||||
export ZITI_BIN_DIR="${ZITI_BIN_ROOT}/ziti-${ZITI_BINARIES_VERSION}"
|
||||
|
||||
ZITI_BINARIES_TARFILE_ABSPATH="${ZITI_HOME}/ziti-bin/${ZITI_BINARIES_TARFILE}"
|
||||
if ! test -f "${ZITI_BINARIES_TARFILE_ABSPATH}"; then
|
||||
echo -e 'Downloading '"$(BLUE "${ZITI_BINARIES_TARFILE}")"' to '"$(BLUE "${ZITI_BINARIES_TARFILE_ABSPATH}")"
|
||||
zitidl="https://github.com/openziti/ziti/releases/download/${ZITI_BINARIES_VERSION}/${ZITI_BINARIES_TARFILE}"
|
||||
wget -q "${zitidl}" -O "${ZITI_BINARIES_TARFILE_ABSPATH}"
|
||||
else
|
||||
echo -e "$(YELLOW 'Already Downloaded ')""$(BLUE "${ZITI_BINARIES_TARFILE}")"' at: '"${ZITI_BINARIES_TARFILE_ABSPATH}"
|
||||
fi
|
||||
|
||||
echo -e 'UNZIPPING '"$(BLUE "${ZITI_BINARIES_TARFILE_ABSPATH}")"' into: '"$(GREEN ${ZITI_BIN_DIR})"
|
||||
rm -rf "${ZITI_BIN_ROOT}/ziti-${ZITI_BINARIES_VERSION}"
|
||||
tar -xf "${ZITI_BINARIES_TARFILE_ABSPATH}" --directory "${ZITI_BIN_ROOT}"
|
||||
mv "${ZITI_BIN_ROOT}/ziti" "${ZITI_BIN_DIR}"
|
||||
|
||||
if [[ "$1" == "yes" ]]; then
|
||||
echo "Adding ${ZITI_BIN_DIR} to the path if necessary:"
|
||||
if [[ "$(echo "$PATH"|grep -q "${ZITI_BIN_DIR}" && echo "yes")" == "yes" ]]; then
|
||||
echo -e "$(GREEN "${ZITI_BIN_DIR}") is already on the path"
|
||||
else
|
||||
echo -e "adding $(RED "${ZITI_BIN_DIR}") to the path"
|
||||
export PATH=$PATH:"${ZITI_BIN_DIR}"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
function generatePki {
|
||||
echo "Generating PKI"
|
||||
"${ZITI_QUICKSTART_SCRIPT_ROOT}/docker/image/create-pki.sh"
|
||||
}
|
||||
|
||||
function checkPrereqs {
|
||||
commands_to_test=(curl jq wget)
|
||||
|
||||
# verify all the commands required in the automation exist before trying to run the full suite
|
||||
for cmd in "${commands_to_test[@]}"
|
||||
do
|
||||
# checking all commands are on the path before continuing...
|
||||
if ! [[ -x "$(command -v ${cmd})" ]]; then
|
||||
missing_requirements="${missing_requirements} * ${cmd}\n"
|
||||
fi
|
||||
done
|
||||
# are requirements ? if yes, stop here and help 'em out
|
||||
if ! [[ "" = "${missing_requirements}" ]]; then
|
||||
echo " "
|
||||
echo "You're missing one or more commands that are used in this script."
|
||||
echo "Please ensure the commands listed are on the path and then try again."
|
||||
printf "\n${missing_requirements}"
|
||||
echo " "
|
||||
echo " "
|
||||
return
|
||||
fi
|
||||
echo "Let's get stated creating your local development network!"
|
||||
echo ""
|
||||
echo ""
|
||||
}
|
||||
|
||||
function checkControllerName {
|
||||
if [[ ${ZITI_EDGE_CONTROLLER_HOSTNAME} == *['!'@#\$%^\&*()_+]* ]]; then
|
||||
echo -e "$(RED " - The provided Network name contains an invalid character: '!'@#\$%^\&*()_+")"
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
function unsetZitiEnv {
|
||||
for zEnvVar in $(set -o posix ; set | grep -e "^ZITI_" | sort); do envvar="$(echo "${zEnvVar}" | cut -d '=' -f1)"; echo unsetting "[${envvar}]${zEnvVar}"; unset "${envvar}"; done
|
||||
}
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
docker/image/ziti-cli-functions.sh
|
||||
Reference in New Issue
Block a user