gsadmin/ziti
1
0
Fork 0
mirror of https://github.com/openziti/ziti.git synced 2026-10-26 05:30:03 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
backcompat-validation
ziti/etc/ctrl.with.edge.yml
T
Andrew Martinez f64b6879cf fixes GHSA-whjr-3j94-gw3c constrain external jwt signer JWKS fetching 
- adds HardenedJwksResolver, a jwks.Resolver that fetches an external jwt signer's
  jwksEndpoint with an http/https-only scheme check, a total timeout and a redirect cap
- adds JwksFetchPolicy, gating a fetch on both the URL hostname and the address being
  connected to, applied to the first request and to every redirect hop
- hostname gate: deniedHostnames blocks, allowedHostnames is exclusive when set; entries
  are an exact hostname or a '*.suffix' wildcard that matches subdomains at any depth but
  never the suffix itself, normalized to lower case punycode without a trailing dot
- address gate: built-in blocked (metadata, link-local, link-local multicast,
  unspecified), then deniedIPs, then allowedIPs, then blockPrivateAddresses,
  first-match-wins with deny over allow
- keeps the gates independent, so neither can authorize what the other refuses; the
  address check runs in the dialer against the resolved address, so a hostname that
  resolves to a blocked address is refused
- adds the [edge.externalJwtSigners.jwksFetch] config section with compatible defaults:
  empty hostname lists, blockPrivateAddresses false, timeout 5s, maxRedirects 5
- takes IP lists as a flat address or a CIDR block, hostname lists as names only, and
  rejects an entry belonging to the other list at startup
- rejects a jwksEndpoint the policy refuses when an external jwt signer is created or
  updated, and logs an existing signer whose endpoint the configuration now refuses
  when the token issuer cache loads
- documents both gates, their deny-wins precedence, the accepted entry forms and the
  wildcard matching rules in etc/ctrl.with.edge.yml and CHANGELOG.md
2026-08-20 15:12:56 -04:00

585 lines
26 KiB
YAML
Raw Permalink Blame History

v: 3
network:
# Sets router minimum cost. Defaults to 10
minRouterCost: 10
# Sets how often a new control channel connection can take over for a router with an existing control channel connection
# Defaults to 1 minute
routerConnectChurnLimit: 1m
# `trustDomain` is used to name and uniquely identify a network. Its main use is as a trust domain in SPIFFE ids.
# Defining it here is only for single controller environments that are not configured for high
# availability. Deployments with high availability MUST be configured via x509 certificate URI SANs.
#
# For more information on SPIFFE IDs see: https://github.com/spiffe/spiffe/blob/main/standards/X509-SVID.md
#
# A trust domain is required, but where it is defined depends on how the network was deployed. The preference is for it
# to come from SPIFFE ids embedded within x509 certificates. The trust domain is derived from the closest SPIFFE id
# looking at server cert > intermediate CA > root CA.
#
# For non-HA environments, a trust domain will deterministically be generated for you from the root CA if it is not
# specified. The controller log will have warnings with this value on startup.
#
# Trust Domain Resolution:
# - Single Controllers Non-HA:
# - Preference for future continuity is that SPIFFE ids are defined on all CAs and leafs, sharing the same trust domain.
# - For pre-existing networks without SPIFFE ids, use of the `trustDomain` file configuration value.
# - In situations where `trustDomain` is defined within the configuration and in a SPIFFE id, the SPIFFE id take precedent.
# - If no SPIFFE ids are detected, a trust domain will be deterministically generated from the root CA and warnings
# will appear in the controller log on startup
#
# - High Availability Controllers:
# - Must have SPIFFE ids defined on all CAs and leafs for controllers.
# - The `trustDomain` configuration value is always ignored.
# - If a trust domain cannot be determined the controller will not start.
trustDomain: ""
# `additionalTrustDomains` is an array of string trust domains that should additionally be trusted. If certificates
# have been issued through router/identity enrollment with the default generated trust domain or other trust domains
# previously used, and they should continue to function, they should be added here.
additionalTrustDomains: []
#trace:
# path: ctrl.trace
profile:
# cpu:
# path: ${TMPDIR}/ziti.ctrl.cpu.pprof
# memory:
# path: ctrl.memprof
db: ${ZITI_DATA}/db/ctrl.db
identity:
cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem
server_cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem
key: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/private/ctrl.key.pem
ca: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ca-chain.cert.pem
# the endpoint that routers will connect to the controller over.
ctrl:
listener: tls:127.0.0.1:6262
options:
advertiseAddress: tls:127.0.0.1:6262
# (optional) settings
# set the maximum number of connect requests that are buffered and waiting to be acknowledged (1 to 5000, default 1000)
#maxQueuedConnects: 50
# the maximum number of connects that have begun hello synchronization (1 to 1000, default 16)
#maxOutstandingConnects: 100
# the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms)
#connectTimeoutMs: 3000
# Sets the control channel write timeout. A write timeout will close the control channel, so the router will reconnect
#writeTimeout: 15s
# A listener address which will be sent to connecting routers in order to change their configured controller
# address. If defined, routers will update address configuration to immediately use the new address for future
# connections. The value of newListener must be resolvable both via DNS and validate via certificates
#newListener: tls:localhost:6262
events:
jsonLogger:
subscriptions:
# - type: apiSession
# - type: authentication
# - type: circuit
# - type: connect
# - type: sdk
# - type: entityChange
# include:
# - services
# - identities
# - type: entityCount
- type: link
# - type: metrics
# sourceFilter: .*
# metricFilter: .*
# - type: router
# - type: session
# - type: services
# - type: terminator
# - type: usage
# version: 3
# - type: usage
# version: 2
# include:
# - ingress.rx
# - egress.rx
# interval: 5s
handler:
type: file
format: json
path: ${TMPDIR}/ziti-events.log
# usageLogger:
# subscriptions:
# - type: fabric.usage
# interval: 5s
# handler:
# type: amqp
# format: json
# url: "amqp://localhost:5672"
# queue: ziti
# durable: true //default:true
# autoDelete: false //default:false
# exclusive: false //default:false
# noWait: false //default:false
# bufferSize: 50 //default:50
# serviceBusLogger:
# subscriptions:
# - type: apiSession
# - type: authentication
# - type: circuit
# - type: connect
# - type: sdk
# - type: entityChange
# include:
# - services
# - identities
# - type: entityCount
# - type: link
# - type: metrics
# sourceFilter: .*
# metricFilter: .*
# - type: router
# - type: session
# - type: services
# - type: terminator
# - type: usage
# version: 3
# - type: usage
# version: 2
# include:
# - ingress.rx
# - egress.rx
# interval: 5s
# handler:
# type: servicebus
# format: json
# connectionString: "Endpoint=sb://your-namespace.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=your-key"
# topic: "ziti-events"
# bufferSize: 100
# Alternative configuration with queue instead of topic
# events:
# serviceBusQueueLogger:
# subscriptions:
# - type: fabric.circuits
# - type: edge.sessions
# handler:
# type: servicebus
# format: json
# connectionString: "Endpoint=sb://your-namespace.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=your-key"
# queue: "ziti-events-queue"
# bufferSize: 50
# xctrl_example
#
#example:
# enabled: false
# delay: 5
# tls configures TLS handshake settings for incoming connections
#tls:
# handshakeTimeout: 10s
# rateLimiter:
# # if disabled, no tls handshake rate limiting will be enforced
# enabled: true
# # the smallest window size for concurrent tls handshakes
# minSize: 5
# # the largest allowed window size for concurrent tls handshakes
# maxSize: 250
# # how long before incomplete handshake work is assumed to have failed
# timeout: 30s
# # success rate threshold above which window will grow, below which it will shrink
# successThreshold: 0.9
# # multiplier applied to window size when growing
# increaseFactor: 1.02
# # multiplier applied to window size when shrinking
# decreaseFactor: 0.9
# # number of successes between window increase checks
# increaseCheckInterval: 10
# # number of backoffs between window decrease checks
# decreaseCheckInterval: 10
healthChecks:
boltCheck:
# How often to try entering a bolt read tx. Defaults to 30 seconds
interval: 30s
# When to timeout the check. Defaults to 15 seconds
timeout: 15s
# How long to wait before starting the check. Defaults to 15 seconds
initialDelay: 15s
# By having an 'edge' section defined, the ziti-controller will attempt to parse the edge configuration. Removing this
# section, commenting out, or altering the name of the section will cause the edge to not run.
edge:
# This section allows configuring the rate limiter for auth attempts
authRateLimiter:
# if disabled, no auth rate limiting with be enforced
enabled: true
# the smallest window size for auth attempts
minSize: 5
# the largest allowed window size for auth attempts
maxSize: 100
oidc:
# (optional, default 30m) Sets the time OIDC issued access JWTs are valid for. Must be greater than 1m and must be 1m less
# than `refreshTokenDuration`
accessTokenDuration: 30m
# (optional, default 30m) Sets the time OIDC issued id JWTs are valid for. Must be greater than 1m.
idTokenDuration: 30m
# (optional, default 24hr)
refreshTokenDuration: 24h
# --- Refresh-token revocation tuning ---
#
# When a session is refreshed the old refresh token is revoked on a best-effort basis.
# The settings below control when and how those revocations are created.
# (optional, default unset) If set, skip creating a revocation for refresh tokens that
# expire within this duration — they will become invalid on their own. Must be less than
# 50% of refreshTokenDuration. Unset means always revoke.
# revocationMinTokenLifetime: 2m
# (optional, default 1m) The bucket window for batching refresh-token revocations before
# flushing them through raft. A longer interval means fewer raft entries but a larger
# window where the old token has not yet been formally revoked.
# revocationBucketInterval: 1m
# (optional, default 200) Maximum number of revocations per raft log entry / DB transaction
# when flushing. Larger values reduce raft overhead at the cost of bigger individual writes.
# revocationBucketMaxSize: 200
# (optional, default 25000) Maximum number of revocations that can accumulate in memory
# before new ones are dropped. Acts as a safety valve under extreme load.
# revocationMaxQueued: 25000
# (optional, default 1m) How often the controller purges expired revocation records from the
# database. Only runs on the raft leader.
# revocationEnforcerFrequency: 1m
# externalJwtSigners - optional
# Settings that govern how the controller interacts with external JWT signers.
externalJwtSigners:
# jwksFetch - optional
# Controls the controller's fetch of an external JWT signer's jwksEndpoint. That fetch is
# made by the controller, from the controller's own network position, to a URL supplied by
# whoever can write an external JWT signer. These settings constrain where it may go.
#
# A fetch is allowed only if it passes TWO GATES, and both gates are applied to the first
# request AND to every redirect that is followed:
#
# the HOSTNAME gate - checked against the hostname in the URL
# the ADDRESS gate - checked against the resolved address at connection time, so a
# hostname that resolves to a blocked address is still blocked
#
# NEITHER GATE CAN AUTHORIZE WHAT THE OTHER REFUSES. Hostname matching only ever narrows what
# may be fetched: allowedHostnames does not make a blocked address reachable, and
# allowedIPs does not make a blocked hostname reachable.
#
# HOSTNAME gate, first-match-wins. DENY WINS OVER ALLOW:
#
# 1. deniedHostnames - blocked
# 2. allowedHostnames - when set, ONLY these hostnames may be fetched; anything else is
# blocked
# 3. anything else - passes to the address gate
#
# ADDRESS gate, first-match-wins. DENY WINS OVER ALLOW:
#
# 1. built-in blocked addresses - always blocked, allowedIPs CANNOT override:
# cloud instance metadata (169.254.169.254, 169.254.170.2, fd00:ec2::254)
# link-local (169.254.0.0/16, fe80::/10)
# link-local multicast (224.0.0.0/24, ff02::/16)
# unspecified (0.0.0.0, ::)
# 2. deniedIPs - blocked, allowedIPs CANNOT override
# 3. allowedIPs - allowed; this is a carve-out of tier 4 ONLY
# 4. blockPrivateAddresses, and the address is private or loopback - blocked
# 5. anything else - allowed
#
# ENTRY FORMS. The two kinds of list do not accept each other's values.
#
# deniedIPs and allowedIPs take IP addresses only, in either of two forms:
#
# a flat IP address - 192.168.5.5 or fd00:1234::1
# matches that one address only (the same as /32 or /128)
# a CIDR block - 10.10.0.0/16 or fd00:1234::/64
# matches every address in the block
#
# Both IPv4 and IPv6 are accepted in either form. A hostname in one of these lists is a
# configuration error and the controller will not start: the address gate runs against the
# address actually being connected to, so there is no hostname there to compare against.
#
# deniedHostnames and allowedHostnames take hostnames only, in either of two forms:
#
# an exact hostname - idp.example.com
# matches that hostname only
# a wildcard suffix - '*.example.com'
# matches any subdomain of example.com, AT ANY DEPTH, but NEVER
# example.com itself
#
# Wildcard matching, spelled out, because the last part surprises people:
#
# '*.sub.host.com' MATCHES idp.sub.host.com
# MATCHES a.b.sub.host.com (any depth below the suffix)
# DOES NOT sub.host.com (the suffix itself is NOT matched)
# DOES NOT other.host.com
# DOES NOT xsub.host.com (a whole label must be replaced)
#
# To cover both a domain and its subdomains, list them both:
#
# - sub.host.com
# - '*.sub.host.com'
#
# The '*' is only supported as the entire leading label, written exactly as '*.'. Anything
# else (idp.*.example.com, *idp.example.com, a bare *) is a configuration error. Quote any
# entry that starts with '*', or YAML will reject it as an alias. Matching ignores case and
# a trailing dot, and a unicode hostname is compared in its punycode form. An IP address in
# one of these lists is a configuration error - use deniedIPs or allowedIPs.
jwksFetch:
# deniedHostnames - optional, default empty
# Tier 1 of the HOSTNAME gate: hostnames that may not be fetched. Takes exact hostnames
# and '*.suffix' wildcards, per ENTRY FORMS above.
# This narrows only, it is not a boundary on its own: the same target can be reached
# under a different name or as a literal IP, which is what the address gate is for.
# deniedHostnames:
# - old-idp.example.com
# - '*.internal.example.com'
# allowedHostnames - optional, default empty
# Tier 2 of the HOSTNAME gate: when this list is non-empty, these are the ONLY hostnames that
# may be fetched, on the first request and on every redirect hop. Same entry forms as
# deniedHostnames, and deniedHostnames still wins. It cannot widen the address gate: a listed
# hostname whose address is blocked stays blocked. Note that while this list is set, an
# endpoint written as a literal IP address can never satisfy it.
# allowedHostnames:
# - idp.example.com
# - '*.idp.example.org'
# blockPrivateAddresses - optional, default false
# Tier 4 of the ADDRESS gate: blocks private and loopback addresses
# (127.0.0.0/8, ::1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7). Defaults to
# false so a deployment whose IdP is on an internal address keeps working. Tier 1 is
# blocked either way, so the metadata service is never reachable. For the strictest
# posture set this to true, list any internal IdP address in allowedIPs, and list
# the IdP hostnames in allowedHostnames.
# blockPrivateAddresses: false
# deniedIPs - optional, default empty
# Tier 2 of the ADDRESS gate: addresses that are always blocked. Takes flat IP addresses
# and CIDR blocks, per ENTRY FORMS above. Nothing in allowedIPs or allowedHostnames can
# re-enable an address listed here, so this is the right place for internal ranges that
# must never be fetched.
# deniedIPs:
# - 10.10.0.0/16 # a CIDR block
# - 192.168.5.5 # a flat IP address
# - fd00:1234::/64 # IPv6 is accepted in either form
# allowedIPs - optional, default empty
# Tier 3 of the ADDRESS gate: a carve-out of tier 4 ONLY. Same entry forms as deniedIPs.
# Listing an address here allows it despite blockPrivateAddresses; it does NOT override
# tier 1 or deniedIPs, and it does NOT satisfy the hostname gate. Use it to reach a
# specific internal IdP while blockPrivateAddresses is true.
# allowedIPs:
# - 10.20.30.0/24
# - 10.20.40.7
# timeout - optional, default 5s
# The total time allowed for a single JWKS fetch, including any redirects. Must be
# greater than zero.
# timeout: 5s
# maxRedirects - optional, default 5
# How many redirects a JWKS fetch will follow. Every hop passes through both gates. Set
# to 0 to refuse to follow redirects at all.
# maxRedirects: 5
# Set to true to disable posture check functionality
disablePostureChecks: false
# This section represents the configuration of the Edge API that is served over HTTPS
api:
#(optional, default 90s) Alters how frequently heartbeat and last activity values are persisted
# activityUpdateInterval: 90s
#(optional, default 250) The number of API Sessions updated for last activity per transaction
# activityUpdateBatchSize: 250
# sessionTimeout - optional, default 10m
# The number of minutes before an Edge API session will timeout. Timeouts are reset by
# API requests and connections that are maintained to Edge Routers
sessionTimeout: 30m
# address - required
# The default address (host:port) to use for enrollment for the Client API. This value must match one of the addresses
# defined in a bind point's address field for the `edge-client` API in the web section.
address: 127.0.0.1:1280
# disableOidcAutoBinding - optional, default false
# By default the controller automatically adds the edge-oidc API binding to any web listener hosting
# edge-client, even when edge-oidc is not explicitly configured. Set to true to suppress this behaviour
# and require edge-oidc to be explicitly listed in the web section.
# disableOidcAutoBinding: false
# enrollment - required
# A section containing settings pertaining to enrollment.
enrollment:
# signingCert - required
# A Ziti Identity configuration section that specifically makes use of the cert and key fields to define
# a signing certificate from the PKI that the Ziti environment is using to sign certificates. The signingCert.cert
# will be added to the /.well-known CA store that is used to bootstrap trust with the Ziti Controller.
signingCert:
cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/intermediate.cert.pem
key: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/private/intermediate.key.decrypted.pem
# edgeIdentity - optional
# A section for identity enrollment specific settings
edgeIdentity:
# duration - optional, default 5m
# The length of time that a Ziti Edge Identity enrollment should remain valid. After
# this duration, the enrollment will expire and not longer be usable.
duration: 5m
# edgeRouter - Optional
# A section for edge router enrollment specific settings.
edgeRouter:
# duration - optional, default 5m
# The length of time that a Ziti Edge Router enrollment should remain valid. After
# this duration, the enrollment will expire and not longer be usable.
duration: 5m
# web - optional
# Defines webListeners that will be hosted by the controller. Each webListener can host many APIs and be bound to many
# bind points.
web:
# name - required
# Provides a name for this listener, used for logging output. Not required to be unique, but is highly suggested.
- name: all-apis-localhost
# bindPoints - required
# One or more bind points are required. A bind point specifies an interface (interface:port string) that defines
# where on the host machine the webListener will listen and the address (host:port) that should be used to
# publicly address the webListener(i.e. mydomain.com, localhost, 127.0.0.1). This public address may be used for
# incoming address resolution as well as used in responses in the API.
bindPoints:
#interface - required
# A host:port string on which network interface to listen on. 0.0.0.0 will listen on all interfaces
- interface: 127.0.0.1:1280
# address - required
# The public address that external incoming requests will be able to resolve. Used in request processing and
# response content that requires full host:port/path addresses.
address: 127.0.0.1:1280
# newAddress - optional
# A host:port string which will be sent out as an HTTP header "ziti-new-address" if specified. If the header
# is present, clients should update location configuration to immediately use the new address for future
# connections. The value of newAddress must be resolvable both via DNS and validate via certificates
newAddress: localhost:1280
# identity - optional
# Allows the webListener to have a specific identity instead of defaulting to the root `identity` section.
# identity:
# cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem
# server_cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem
# key: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/private/ctrl.key.pem
# ca: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ca-chain.cert.pem
# options - optional
# Allows the specification of webListener level options - mainly dealing with HTTP/TLS settings. These options are
# used for all http servers started by the current webListener.
options:
# idleTimeout - optional, default 5000ms
# The maximum amount of idle time in milliseconds allowed for pipelined HTTP requests. Setting this too high
# can cause resources on the host to be consumed as clients remain connected and idle. Lowering this value
# will cause clients to reconnect on subsequent HTTPs requests.
idleTimeout: 5000ms #http timeouts, new
# readTimeout - optional, default 5000ms
# The maximum amount of time in milliseconds http servers will wait to read the first incoming requests. A higher
# value risks consuming resources on the host with clients that are acting bad faith or suffering from high latency
# or packet loss. A lower value can risk losing connections to high latency/packet loss clients.
readTimeout: 5000ms
# writeTimeout - optional, default 10000ms
# The total maximum time in milliseconds that the http server will wait for a single requests to be received and
# responded too. A higher value can allow long running requests to consume resources on the host. A lower value
# can risk ending requests before the server has a chance to respond.
writeTimeout: 100000ms
# minTLSVersion - optional, default TSL1.2
# The minimum version of TSL to support
minTLSVersion: TLS1.2
# maxTLSVersion - optional, default TSL1.3
# The maximum version of TSL to support
maxTLSVersion: TLS1.3
# apis - required
# Allows one or more APIs to be bound to this webListener
apis:
# binding - required
# Specifies an API to bind to this webListener. Built-in APIs are
# - health-checks
# - edge-management
# - edge-client
# - fabric-management
- binding: health-checks
- binding: fabric
- binding: edge-management
- binding: edge-client
- binding: edge-oidc
options:
# allowedHostnames (optional): a wildcard server-cert SAN serves OIDC only for the exact hostnames listed here.
# allowedHostnames:
# - ctrl.example.com
redirectURIs:
- "http://localhost:*/auth/callback"
- "http://127.0.0.1:*/auth/callback"
# cluster configures HA cluster settings (HA deployments only)
#cluster:
# advertiseAddress: tls:localhost:1380
# bindAddress: tls:0.0.0.0:1380
# dataDir: /tmp/ziti-cluster-data
# # preferredLeader - optional, default false
# # If set to true, this controller will be preferred as the raft cluster leader. If the current leader is not a
# # preferred leader, it will transfer leadership to a preferred leader if one is available.
# #preferredLeader: true
# dialer:
# # minRetryInterval - optional, default 1s
# # The minimum time between peer dial retry attempts.
# minRetryInterval: 1s
# # maxRetryInterval - optional, default 1m
# # The maximum time between peer dial retry attempts.
# maxRetryInterval: 1m
# # retryBackoffFactor - optional, default 2.0
# # The multiplier applied to the retry interval after each failed dial attempt.
# retryBackoffFactor: 2.0
# # fastFailureWindow - optional, default 30s
# # After a successful connection, the dialer will re-check the peer after this duration. If the
# # connection was lost within this window, it applies backoff instead of resetting the retry delay.
# fastFailureWindow: 30s
# # dialTimeout - optional, default 10s
# # The maximum time a single peer dial attempt is allowed to run before being abandoned.
# dialTimeout: 10s
# # scanInterval - optional, default 30s
# # Period of the dialer's full scan that reconciles dial state against current membership.
# scanInterval: 30s
# # queueCheckInterval - optional, default 5s
# # How often the dialer pops expired entries from its retry heap. Effectively the
# # resolution at which MinRetryInterval is honored.
# queueCheckInterval: 5s
# # nonMemberGrace - optional, default 1m
# # How long the leader will allow a TLS-valid but non-member controller to stay connected
# # to the mesh before dropping it.
# nonMemberGrace: 1m
# rateLimiter:
# enabled: true
# minSize: 5
# maxSize: 250
# timeout: 30s
# successThreshold: 0.9
# increaseFactor: 1.02
# decreaseFactor: 0.9
# increaseCheckInterval: 10
# decreaseCheckInterval: 10
commandRateLimiter:
enabled: true
maxQueued: 100
Reference in New Issue View Git Blame Copy Permalink