mirror of
https://github.com/openziti/ziti.git
synced 2026-10-12 15:28:05 +00:00
initial round of changes
This commit is contained in:
dovholuknf
@@ -32,43 +32,120 @@ mgmt:
|
||||
#
|
||||
#example:
|
||||
# enabled: false
|
||||
# delay: 5
|
||||
# delay: 5s
|
||||
|
||||
# By having an 'edge' section defined, the ziti-controller will attempt to parse the edge configuration. Removing this
|
||||
# section, commenting out, or altering the name of the section will cause the edge to not run.
|
||||
edge:
|
||||
# This section represents the configuration of the Edge API that is served over HTTPS
|
||||
api:
|
||||
# (required) The interface and port that the Edge API should be served on.
|
||||
listener: 0.0.0.0:${ZITI_EDGE_CONTROLLER_PORT}
|
||||
# (required) The host/port combination that is reported as publicly accessible for the Edge API
|
||||
advertise: ${ZITI_EDGE_CONTROLLER_API}
|
||||
# (optional, defaults to 10) The number of minutes before an Edge API session will timeout. Timeouts are reset by
|
||||
#(optional, default 90s) Alters how frequently heartbeat and last activity values are persisted
|
||||
# activityUpdateInterval: 90s
|
||||
#(optional, default 250) The number of API Sessions updated for last activity per transaction
|
||||
# activityUpdateBatchSize: 250
|
||||
# sessionTimeout - optional, default 10m
|
||||
# The number of minutes before an Edge API session will timeout. Timeouts are reset by
|
||||
# API requests and connections that are maintained to Edge Routers
|
||||
sessionTimeoutMinutes: 30
|
||||
#(optional, defaults to the root identity) An alternate "identity" to use for the Edge API. If this section is not
|
||||
# defined the root identity section will be used. This is useful for situations where Edge API will present a
|
||||
# publicly signed certificate instead of one generated by a private PKI created by ziti pki create
|
||||
identity:
|
||||
ca: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert
|
||||
server_key: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.key
|
||||
server_cert: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.cert
|
||||
|
||||
sessionTimeout: 30m
|
||||
# address - required
|
||||
# The default address (host:port) to use for enrollment for the Client API. This value must match one of the addresses
|
||||
# defined in this webListener's bindPoints.
|
||||
address: 0.0.0.0:${ZITI_EDGE_CONTROLLER_PORT}
|
||||
# This section is used to define option that are used during enrollment of Edge Routers, Ziti Edge Identities.
|
||||
enrollment:
|
||||
# (required) A Ziti Identity configuration section that specifically makes use of the cert and key fields to define
|
||||
# a signing certificate from the PKI that the Ziti environment is using to sign certificates. The CA is used to
|
||||
# specify the chain that should be added to the /.well-known CA store that is used to bootstrap trust with the
|
||||
# Ziti Controller. This chain should be from intermediate to root and can contain multiple chains if necessary.
|
||||
# signingCert - required
|
||||
# A Ziti Identity configuration section that specifically makes use of the cert and key fields to define
|
||||
# a signing certificate from the PKI that the Ziti environment is using to sign certificates. The signingCert.cert
|
||||
# will be added to the /.well-known CA store that is used to bootstrap trust with the Ziti Controller.
|
||||
signingCert:
|
||||
cert: ${ZITI_PKI}/${ZITI_SIGNING_INTERMEDIATE_NAME}/certs/${ZITI_SIGNING_INTERMEDIATE_NAME}.cert
|
||||
key: ${ZITI_PKI}/${ZITI_SIGNING_INTERMEDIATE_NAME}/keys/${ZITI_SIGNING_INTERMEDIATE_NAME}.key
|
||||
# edgeIdentity - optional
|
||||
# A section for identity enrollment specific settings
|
||||
edgeIdentity:
|
||||
# (optional, defaults to 5) The length of time that a Ziti Edge Identity enrollment should remain valid. After
|
||||
# durationMinutes - optional, default 5m
|
||||
# The length of time that a Ziti Edge Identity enrollment should remain valid. After
|
||||
# this duration, the enrollment will expire and not longer be usable.
|
||||
durationMinutes: 14400
|
||||
duration: 14400m
|
||||
# edgeRouter - Optional
|
||||
# A section for edge router enrollment specific settings.
|
||||
edgeRouter:
|
||||
# (optional, defaults to 5) The length of time that a Ziti Edge Router enrollment should remain valid. After
|
||||
# durationMinutes - optional, default 5m
|
||||
# The length of time that a Ziti Edge Router enrollment should remain valid. After
|
||||
# this duration, the enrollment will expire and not longer be usable.
|
||||
durationMinutes: 14400
|
||||
duration: 14400m
|
||||
|
||||
# web
|
||||
# Defines webListeners that will be hosted by the controller. Each webListener can host many APIs and be bound to many
|
||||
# bind points.
|
||||
web:
|
||||
# name - required
|
||||
# Provides a name for this listener, used for logging output. Not required to be unique, but is highly suggested.
|
||||
- name: all-apis-localhost
|
||||
# bindPoints - required
|
||||
# One or more bind points are required. A bind point specifies an interface (interface:port string) that defines
|
||||
# where on the host machine the webListener will listen and the address (host:port) that should be used to
|
||||
# publicly address the webListener(i.e. mydomain.com, localhost, 127.0.0.1). This public address may be used for
|
||||
# incoming address resolution as well as used in responses in the API.
|
||||
bindPoints:
|
||||
#interface - required
|
||||
# A host:port string on which network interface to listen on. 0.0.0.0 will listen on all interfaces
|
||||
- interface: 0.0.0.0:1280
|
||||
# address - required
|
||||
# The public address that external incoming requests will be able to resolve. Used in request processing and
|
||||
# response content that requires full host:port/path addresses.
|
||||
address: 0.0.0.0:1280
|
||||
# identity - optional
|
||||
# Allows the webListener to have a specific identity instead of defaulting to the root 'identity' section.
|
||||
identity:
|
||||
ca: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert
|
||||
key: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.key
|
||||
server_cert: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.cert
|
||||
cert: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-client.cert
|
||||
# options - optional
|
||||
# Allows the specification of webListener level options - mainly dealing with HTTP/TLS settings. These options are
|
||||
# used for all http servers started by the current webListener.
|
||||
options:
|
||||
# idleTimeoutMs - optional, default 5000ms
|
||||
# The maximum amount of idle time in milliseconds allowed for pipelined HTTP requests. Setting this too high
|
||||
# can cause resources on the host to be consumed as clients remain connected and idle. Lowering this value
|
||||
# will cause clients to reconnect on subsequent HTTPs requests.
|
||||
idleTimeout: 5000ms #http timeouts, new
|
||||
# readTimeoutMs - optional, default 5000ms
|
||||
# The maximum amount of time in milliseconds http servers will wait to read the first incoming requests. A higher
|
||||
# value risks consuming resources on the host with clients that are acting bad faith or suffering from high latency
|
||||
# or packet loss. A lower value can risk losing connections to high latency/packet loss clients.
|
||||
readTimeout: 5000ms
|
||||
# writeTimeoutMs - optional, default 10000ms
|
||||
# The total maximum time in milliseconds that the http server will wait for a single requests to be received and
|
||||
# responded too. A higher value can allow long running requests to consume resources on the host. A lower value
|
||||
# can risk ending requests before the server has a chance to respond.
|
||||
writeTimeout: 100000ms
|
||||
# minTLSVersion - optional, default TSL1.2
|
||||
# The minimum version of TSL to support
|
||||
minTLSVersion: TLS1.2
|
||||
# maxTLSVersion - optional, default TSL1.3
|
||||
# The maximum version of TSL to support
|
||||
maxTLSVersion: TLS1.3
|
||||
# apis - required
|
||||
# Allows one or more APIs to be bound to this webListener
|
||||
apis:
|
||||
# binding - required
|
||||
# Specifies an API to bind to this webListener. Built-in APIs are
|
||||
# - edge-management
|
||||
# - edge-client
|
||||
# - fabric-management
|
||||
- binding: edge-management
|
||||
# options - variable optional/required
|
||||
# This section is used to define values that are specified by the API they are associated with.
|
||||
# These settings are per API. The example below is for the 'edge-api' and contains both optional values and
|
||||
# required values.
|
||||
options: { }
|
||||
- binding: edge-client
|
||||
options: { }
|
||||
apis:
|
||||
- binding: edge-management
|
||||
options: { }
|
||||
- binding: edge-client
|
||||
options: { }
|
||||
HereDocForEdgeConfiguration
|
||||
|
||||
@@ -11,9 +11,6 @@ done
|
||||
if [[ "${ZITI_EDGE_ROUTER_HOSTNAME}" == "" ]]; then export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
|
||||
if [[ "${ZITI_EDGE_ROUTER_PORT}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi
|
||||
|
||||
#echo 'export ZITI_EDGE_ROUTER_RAWNAME="'"${ZITI_EDGE_ROUTER_RAWNAME}"'"' > "${ZITI_EDGE_ROUTER_HOSTNAME}.env"
|
||||
#echo 'export ZITI_EDGE_ROUTER_HOSTNAME="'"${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"'"' >> "${ZITI_EDGE_ROUTER_HOSTNAME}.env"
|
||||
|
||||
"${ZITI_SCRIPTS}/create-router-pki.sh"
|
||||
|
||||
echo "logging into ziti controller: ${ZITI_EDGE_API_HOSTNAME}"
|
||||
|
||||
@@ -86,6 +86,9 @@ function expressConfiguration {
|
||||
fi
|
||||
export ZITI_EDGE_ROUTER_RAWNAME="public-edge-router"
|
||||
export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"
|
||||
if [[ "${ZITI_EDGE_ROUTER_HOSTNAME}" == "" ]]; then export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
|
||||
if [[ "${ZITI_EDGE_ROUTER_PORT}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi
|
||||
|
||||
generateEnvFile "${nw}"
|
||||
#checkHostsFile
|
||||
getLatestZiti "yes"
|
||||
|
||||
Reference in New Issue
Block a user