diff --git a/quickstart/docker/image/create-controller-config.sh b/quickstart/docker/image/create-controller-config.sh index d8bf4a82d..00628c48f 100755 --- a/quickstart/docker/image/create-controller-config.sh +++ b/quickstart/docker/image/create-controller-config.sh @@ -32,43 +32,120 @@ mgmt: # #example: # enabled: false -# delay: 5 +# delay: 5s # By having an 'edge' section defined, the ziti-controller will attempt to parse the edge configuration. Removing this # section, commenting out, or altering the name of the section will cause the edge to not run. edge: # This section represents the configuration of the Edge API that is served over HTTPS api: - # (required) The interface and port that the Edge API should be served on. - listener: 0.0.0.0:${ZITI_EDGE_CONTROLLER_PORT} - # (required) The host/port combination that is reported as publicly accessible for the Edge API - advertise: ${ZITI_EDGE_CONTROLLER_API} - # (optional, defaults to 10) The number of minutes before an Edge API session will timeout. Timeouts are reset by + #(optional, default 90s) Alters how frequently heartbeat and last activity values are persisted + # activityUpdateInterval: 90s + #(optional, default 250) The number of API Sessions updated for last activity per transaction + # activityUpdateBatchSize: 250 + # sessionTimeout - optional, default 10m + # The number of minutes before an Edge API session will timeout. Timeouts are reset by # API requests and connections that are maintained to Edge Routers - sessionTimeoutMinutes: 30 - #(optional, defaults to the root identity) An alternate "identity" to use for the Edge API. If this section is not - # defined the root identity section will be used. This is useful for situations where Edge API will present a - # publicly signed certificate instead of one generated by a private PKI created by ziti pki create - identity: - ca: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert - server_key: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.key - server_cert: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.cert - + sessionTimeout: 30m + # address - required + # The default address (host:port) to use for enrollment for the Client API. This value must match one of the addresses + # defined in this webListener's bindPoints. + address: 0.0.0.0:${ZITI_EDGE_CONTROLLER_PORT} # This section is used to define option that are used during enrollment of Edge Routers, Ziti Edge Identities. enrollment: - # (required) A Ziti Identity configuration section that specifically makes use of the cert and key fields to define - # a signing certificate from the PKI that the Ziti environment is using to sign certificates. The CA is used to - # specify the chain that should be added to the /.well-known CA store that is used to bootstrap trust with the - # Ziti Controller. This chain should be from intermediate to root and can contain multiple chains if necessary. + # signingCert - required + # A Ziti Identity configuration section that specifically makes use of the cert and key fields to define + # a signing certificate from the PKI that the Ziti environment is using to sign certificates. The signingCert.cert + # will be added to the /.well-known CA store that is used to bootstrap trust with the Ziti Controller. signingCert: cert: ${ZITI_PKI}/${ZITI_SIGNING_INTERMEDIATE_NAME}/certs/${ZITI_SIGNING_INTERMEDIATE_NAME}.cert key: ${ZITI_PKI}/${ZITI_SIGNING_INTERMEDIATE_NAME}/keys/${ZITI_SIGNING_INTERMEDIATE_NAME}.key + # edgeIdentity - optional + # A section for identity enrollment specific settings edgeIdentity: - # (optional, defaults to 5) The length of time that a Ziti Edge Identity enrollment should remain valid. After + # durationMinutes - optional, default 5m + # The length of time that a Ziti Edge Identity enrollment should remain valid. After # this duration, the enrollment will expire and not longer be usable. - durationMinutes: 14400 + duration: 14400m + # edgeRouter - Optional + # A section for edge router enrollment specific settings. edgeRouter: - # (optional, defaults to 5) The length of time that a Ziti Edge Router enrollment should remain valid. After + # durationMinutes - optional, default 5m + # The length of time that a Ziti Edge Router enrollment should remain valid. After # this duration, the enrollment will expire and not longer be usable. - durationMinutes: 14400 + duration: 14400m + +# web +# Defines webListeners that will be hosted by the controller. Each webListener can host many APIs and be bound to many +# bind points. +web: + # name - required + # Provides a name for this listener, used for logging output. Not required to be unique, but is highly suggested. + - name: all-apis-localhost + # bindPoints - required + # One or more bind points are required. A bind point specifies an interface (interface:port string) that defines + # where on the host machine the webListener will listen and the address (host:port) that should be used to + # publicly address the webListener(i.e. mydomain.com, localhost, 127.0.0.1). This public address may be used for + # incoming address resolution as well as used in responses in the API. + bindPoints: + #interface - required + # A host:port string on which network interface to listen on. 0.0.0.0 will listen on all interfaces + - interface: 0.0.0.0:1280 + # address - required + # The public address that external incoming requests will be able to resolve. Used in request processing and + # response content that requires full host:port/path addresses. + address: 0.0.0.0:1280 + # identity - optional + # Allows the webListener to have a specific identity instead of defaulting to the root 'identity' section. + identity: + ca: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert + key: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.key + server_cert: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.cert + cert: ${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-client.cert + # options - optional + # Allows the specification of webListener level options - mainly dealing with HTTP/TLS settings. These options are + # used for all http servers started by the current webListener. + options: + # idleTimeoutMs - optional, default 5000ms + # The maximum amount of idle time in milliseconds allowed for pipelined HTTP requests. Setting this too high + # can cause resources on the host to be consumed as clients remain connected and idle. Lowering this value + # will cause clients to reconnect on subsequent HTTPs requests. + idleTimeout: 5000ms #http timeouts, new + # readTimeoutMs - optional, default 5000ms + # The maximum amount of time in milliseconds http servers will wait to read the first incoming requests. A higher + # value risks consuming resources on the host with clients that are acting bad faith or suffering from high latency + # or packet loss. A lower value can risk losing connections to high latency/packet loss clients. + readTimeout: 5000ms + # writeTimeoutMs - optional, default 10000ms + # The total maximum time in milliseconds that the http server will wait for a single requests to be received and + # responded too. A higher value can allow long running requests to consume resources on the host. A lower value + # can risk ending requests before the server has a chance to respond. + writeTimeout: 100000ms + # minTLSVersion - optional, default TSL1.2 + # The minimum version of TSL to support + minTLSVersion: TLS1.2 + # maxTLSVersion - optional, default TSL1.3 + # The maximum version of TSL to support + maxTLSVersion: TLS1.3 + # apis - required + # Allows one or more APIs to be bound to this webListener + apis: + # binding - required + # Specifies an API to bind to this webListener. Built-in APIs are + # - edge-management + # - edge-client + # - fabric-management + - binding: edge-management + # options - variable optional/required + # This section is used to define values that are specified by the API they are associated with. + # These settings are per API. The example below is for the 'edge-api' and contains both optional values and + # required values. + options: { } + - binding: edge-client + options: { } + apis: + - binding: edge-management + options: { } + - binding: edge-client + options: { } HereDocForEdgeConfiguration diff --git a/quickstart/docker/image/run-edge-router.sh b/quickstart/docker/image/run-edge-router.sh index 37bbac3ea..62b38b029 100755 --- a/quickstart/docker/image/run-edge-router.sh +++ b/quickstart/docker/image/run-edge-router.sh @@ -11,9 +11,6 @@ done if [[ "${ZITI_EDGE_ROUTER_HOSTNAME}" == "" ]]; then export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi if [[ "${ZITI_EDGE_ROUTER_PORT}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi -#echo 'export ZITI_EDGE_ROUTER_RAWNAME="'"${ZITI_EDGE_ROUTER_RAWNAME}"'"' > "${ZITI_EDGE_ROUTER_HOSTNAME}.env" -#echo 'export ZITI_EDGE_ROUTER_HOSTNAME="'"${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"'"' >> "${ZITI_EDGE_ROUTER_HOSTNAME}.env" - "${ZITI_SCRIPTS}/create-router-pki.sh" echo "logging into ziti controller: ${ZITI_EDGE_API_HOSTNAME}" diff --git a/quickstart/local/express/express-dev-env.sh b/quickstart/local/express/express-dev-env.sh index b52ec7af6..5ab688a93 100755 --- a/quickstart/local/express/express-dev-env.sh +++ b/quickstart/local/express/express-dev-env.sh @@ -86,6 +86,9 @@ function expressConfiguration { fi export ZITI_EDGE_ROUTER_RAWNAME="public-edge-router" export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}" + if [[ "${ZITI_EDGE_ROUTER_HOSTNAME}" == "" ]]; then export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi + if [[ "${ZITI_EDGE_ROUTER_PORT}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi + generateEnvFile "${nw}" #checkHostsFile getLatestZiti "yes"