diff --git a/404.html b/404.html index 09c873a9..090a6335 100644 --- a/404.html +++ b/404.html @@ -9,7 +9,7 @@ - +
diff --git a/assets/images/zrok-getting-started-button-fd443990c600c5af5587c8ebabe0498b.png b/assets/images/zrok-getting-started-button-fd443990c600c5af5587c8ebabe0498b.png new file mode 100644 index 00000000..6382d4d7 Binary files /dev/null and b/assets/images/zrok-getting-started-button-fd443990c600c5af5587c8ebabe0498b.png differ diff --git a/assets/images/zrok-getting-started-modal-9c36a880534a3d25a7815f32020d5c29.png b/assets/images/zrok-getting-started-modal-9c36a880534a3d25a7815f32020d5c29.png new file mode 100644 index 00000000..1facd17b Binary files /dev/null and b/assets/images/zrok-getting-started-modal-9c36a880534a3d25a7815f32020d5c29.png differ diff --git a/assets/images/zrok-not-found-afdfdf335c7b7e28e2439c70529eaf6f.png b/assets/images/zrok-not-found-afdfdf335c7b7e28e2439c70529eaf6f.png new file mode 100644 index 00000000..02a16278 Binary files /dev/null and b/assets/images/zrok-not-found-afdfdf335c7b7e28e2439c70529eaf6f.png differ diff --git a/assets/images/zrok-reserved-not-found-d5a40367dcad5c1e39a1b24c6b959e8e.png b/assets/images/zrok-reserved-not-found-d5a40367dcad5c1e39a1b24c6b959e8e.png new file mode 100644 index 00000000..61145f10 Binary files /dev/null and b/assets/images/zrok-reserved-not-found-d5a40367dcad5c1e39a1b24c6b959e8e.png differ diff --git a/assets/images/zrok-share-public-c8604a242bd6b3426f0658a91e2b0576.png b/assets/images/zrok-share-public-c8604a242bd6b3426f0658a91e2b0576.png new file mode 100644 index 00000000..6eb77983 Binary files /dev/null and b/assets/images/zrok-share-public-c8604a242bd6b3426f0658a91e2b0576.png differ diff --git a/assets/images/zrok-visualizer-enabled-89357d3c376bbd310390602be618737a.png b/assets/images/zrok-visualizer-enabled-89357d3c376bbd310390602be618737a.png new file mode 100644 index 00000000..4d75ff3b Binary files /dev/null and b/assets/images/zrok-visualizer-enabled-89357d3c376bbd310390602be618737a.png differ diff --git a/assets/images/zrok-visualizer-environment-6415b27c0e27123e9f625d38de01afeb.png b/assets/images/zrok-visualizer-environment-6415b27c0e27123e9f625d38de01afeb.png new file mode 100644 index 00000000..744c9a31 Binary files /dev/null and b/assets/images/zrok-visualizer-environment-6415b27c0e27123e9f625d38de01afeb.png differ diff --git a/assets/images/zrok-visualizer-public-share-bb329270aafdad77ddc58fddef0b8c0b.png b/assets/images/zrok-visualizer-public-share-bb329270aafdad77ddc58fddef0b8c0b.png new file mode 100644 index 00000000..5429331e Binary files /dev/null and b/assets/images/zrok-visualizer-public-share-bb329270aafdad77ddc58fddef0b8c0b.png differ diff --git a/assets/images/zrok-visualizer-sparklines-2b56c37bce925c55d99c8f1fdb6d741c.png b/assets/images/zrok-visualizer-sparklines-2b56c37bce925c55d99c8f1fdb6d741c.png new file mode 100644 index 00000000..3fe5367f Binary files /dev/null and b/assets/images/zrok-visualizer-sparklines-2b56c37bce925c55d99c8f1fdb6d741c.png differ diff --git a/assets/js/f888b719.25860f0f.js b/assets/js/f888b719.25860f0f.js new file mode 100644 index 00000000..237fb4ec --- /dev/null +++ b/assets/js/f888b719.25860f0f.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkwebsite=self.webpackChunkwebsite||[]).push([[4470],{2410:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>d,contentTitle:()=>c,default:()=>u,frontMatter:()=>a,metadata:()=>r,toc:()=>l});const r=JSON.parse('{"id":"getting-started","title":"Getting Started","description":"If you\'ve upgraded to v1.0.0 from a previous version and you receive an error message like this:","source":"@site/../docs/getting-started.mdx","sourceDirName":".","slug":"/getting-started","permalink":"/docs/getting-started","draft":false,"unlisted":false,"editUrl":"https://github.com/openziti/zrok/blob/main/docs/../docs/getting-started.mdx","tags":[],"version":"current","sidebarPosition":10,"frontMatter":{"title":"Getting Started","sidebar_label":"Getting Started","sidebar_position":10},"sidebar":"tutorialSidebar","next":{"title":"Concepts","permalink":"/docs/concepts/"}}');var o=s(4848),i=s(8453),t=(s(8151),s(595),s(1342),s(8477));const a={title:"Getting Started",sidebar_label:"Getting Started",sidebar_position:10},c=void 0,d={},l=[{value:"Your Secure Internet Sharing Perimeter",id:"your-secure-internet-sharing-perimeter",level:2},{value:"What's it for?",id:"whats-it-for",level:2},{value:"Your First Share",id:"your-first-share",level:3},{value:"Installing the zrok Command",id:"installing-the-zrok-command",level:2},...t.RM,{value:"Enabling Your zrok Environment",id:"enabling-your-zrok-environment",level:2},{value:"Sharing",id:"sharing",level:2},{value:"Ephemeral by Default",id:"ephemeral-by-default",level:3},{value:"Public Shares and Frontends",id:"public-shares-and-frontends",level:3},{value:"Private Shares",id:"private-shares",level:3},{value:"Proxy Backend Mode",id:"proxy-backend-mode",level:3},{value:"Web Backend Mode",id:"web-backend-mode",level:3},{value:"Reserved Shares",id:"reserved-shares",level:3},{value:"Concepts Review",id:"concepts-review",level:2},{value:"Instance and Account",id:"instance-and-account",level:3},{value:"Environment",id:"environment",level:3},{value:"Shares",id:"shares",level:3},{value:"Reserved Shares",id:"reserved-shares-1",level:3},{value:"Self-Hosting an Instance",id:"self-hosting-an-instance",level:2},{value:"Resources",id:"resources",level:2}];function h(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,i.R)(),...e.components},{Card:r,CardBody:a,CardFooter:c,CardHeader:d,Column:l,Columns:h}=n;return r||m("Card",!0),a||m("CardBody",!0),c||m("CardFooter",!0),d||m("CardHeader",!0),l||m("Column",!0),h||m("Columns",!0),(0,o.jsxs)(o.Fragment,{children:[(0,o.jsxs)(n.admonition,{type:"note",children:[(0,o.jsxs)(n.p,{children:["If you've upgraded to ",(0,o.jsx)(n.code,{children:"v1.0.0"})," from a previous version and you receive an error message like this:"]}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:"[ERROR]: unable to create share (error getting zrok client: client version error accessing api endpoint 'https://api.zrok.io': [POST /clientVersionCheck] clientVersionCheck (status 404): {}: [POST /clientVersionCheck] clientVersionCheck (status 404): {})\n"})}),(0,o.jsxs)(n.p,{children:["Use the command ",(0,o.jsx)(n.code,{children:"zrok rebase apiEndpoint https://api-v1.zrok.io/"})," to update your environment to the latest zrok endpoint."]})]}),"\n",(0,o.jsx)(n.h2,{id:"your-secure-internet-sharing-perimeter",children:"Your Secure Internet Sharing Perimeter"}),"\n",(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.code,{children:"zrok"})," (",(0,o.jsx)(n.em,{children:"/zi\u02d0\u0279\u0252k/ ZEE-rock"}),") is a secure, open-source, self-hostable sharing platform that simplifies shielding and sharing network services or files.\nThere's a hardened zrok-as-a-service offering available at ",(0,o.jsx)(n.a,{href:"https://myzrok.io",children:"myzrok.io"})," with a generous free tier."]}),"\n",(0,o.jsx)(n.h2,{id:"whats-it-for",children:"What's it for?"}),"\n",(0,o.jsxs)(n.p,{children:["Use ",(0,o.jsx)(n.code,{children:"zrok"})," to share a running service, like a web server or a network socket, or to share a directory of static files. ",(0,o.jsx)(n.code,{children:"zrok"})," goes beyond simple tunneling to provide sharing solutions for a variety of network and storage use cases."]}),"\n",(0,o.jsxs)(n.p,{children:["When using ",(0,o.jsx)(n.code,{children:"zrok"})," to ",(0,o.jsx)(n.a,{href:"/docs/concepts/sharing-public",children:"share publicly"}),", you can reserve a public hostname, enable authentication options, or both. Public shares proxy HTTPS to your service or files."]}),"\n",(0,o.jsxs)(n.p,{children:["If ",(0,o.jsx)(n.a,{href:"/docs/concepts/sharing-private",children:"sharing privately"}),", only users with the share token (and the appropriate permission grants) can access your share. In addition to what you can share publicly, private shares can include TCP and UDP services."]}),"\n",(0,o.jsxs)(n.p,{children:["Here's a quick overview of what's involved in getting started with ",(0,o.jsx)(n.code,{children:"zrok"}),":"]}),"\n",(0,o.jsx)(n.h3,{id:"your-first-share",children:"Your First Share"}),"\n",(0,o.jsxs)(n.ol,{children:["\n",(0,o.jsx)(n.li,{children:"Get an account token"}),"\n"]}),"\n",(0,o.jsxs)(h,{className:"text--center getting-started-cards",style:{marginLeft:1},children:[(0,o.jsx)(l,{style:{paddingBottom:20},children:(0,o.jsxs)(r,{shadow:"tl",children:[(0,o.jsx)(d,{children:(0,o.jsx)("h3",{children:"Hosted zrok"})}),(0,o.jsx)(a,{children:(0,o.jsx)(n.p,{children:"Use NetFoundry's public zrok instance."})}),(0,o.jsx)(c,{children:(0,o.jsx)("a",{href:"https://myzrok.io/",children:(0,o.jsx)("button",{className:"button button--secondary button--block",children:"Get an Account"})})})]})}),(0,o.jsx)(l,{style:{paddingBottom:20},children:(0,o.jsxs)(r,{shadow:"tl",children:[(0,o.jsx)(d,{children:(0,o.jsx)("h3",{children:"Self-Hosted zrok"})}),(0,o.jsx)(a,{children:(0,o.jsx)(n.p,{children:"Run a zrok instance on Linux, Docker, or Kubernetes."})}),(0,o.jsx)(c,{children:(0,o.jsx)("a",{href:"/docs/category/self-hosting/",children:(0,o.jsx)("button",{className:"button button--secondary button--block",children:"Guides"})})})]})})]}),"\n",(0,o.jsxs)(n.ol,{start:"2",children:["\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.a,{href:"#installing-the-zrok-command",children:"Download the zrok binary"})}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["Enable zrok for your ",(0,o.jsx)(n.a,{href:"#enabling-your-zrok-environment",children:"environment"})]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-bash",children:"zrok enablezrok
(/ziːɹɒk/ ZEE-rock) is a secure, open-source, self-hostable sharing platform that simplifies shielding and sharing network services or files.
There's a hardened zrok-as-a-service offering available at myzrok.io with a generous free tier.
Use zrok
to share a running service, like a web server or a network socket, or to share a directory of static files. zrok
goes beyond simple tunneling to provide sharing solutions for a variety of network and storage use cases.
When using zrok
to share publicly, you can reserve a public hostname, enable authentication options, or both. Public shares proxy HTTPS to your service or files.
If sharing privately, only users with the share token (and the appropriate permission grants) can access your share. In addition to what you can share publicly, private shares can include TCP and UDP services.
+Here's a quick overview of what's involved in getting started with zrok
:
Enable zrok for your user environment
+Enable zrok for your environment
zrok enable <your_account_token>
zrok shares can be public or private, with different options for backend modes, including:
-zrok
is licensed under Apache 2.0.
Check the roadmap if you're thinking about the future. We would love to hear your ideas for zrok
!
The best ways to engage are Discourse for questions and GitHub Issues for documenting problems.
-Read more about zrok open source.
-zrok
is a Ziti Native Application, built on the OpenZiti platform, and supported by the OpenZiti community and NetFoundry team.
Use zrok
to share a running service, like a web server or a network socket, or to share a directory of static files.
If sharing publicly, you can reserve a subdomain, enable authentication options, or both. Public shares proxy HTTPS to your service or files.
-If sharing privately, only users with the share token can access your share. In addition to what you can share publicly, private shares can include TCP and UDP services.
+Here's a deeper, more thorough look at getting started with zrok
:
After you have an account, you can enable your zrok
environment.
A zrok environment usually refers to an enabled device where shares and accesses can be created, .e.g., ~/.zrok
on a Unix machine. It can be a specific user's environment or a system-wide agent's environment owned by the administrator.
When your zrok
account was created, the service generated a secret token that identifies and authenticates in a single step. Protect your secret token as if it were a password, or an important account number; it's a secret, protect it.
When we left off you had downloaded, extracted, and configured your zrok
environment. In order to use that environment with your account, you'll need to enable
it. Enabling an environment generates a secure identity and the necessary underlying security policies with the OpenZiti network hosting the zrok
service.
From the web console, click on your email address in the upper right corner of the header. That drop down menu contains an Enable Your Environment
link. Click that link and a modal dialog will be shown like this:
This dialog box shows you the zrok enable
command that you can use to enable any shell to work with your zrok
account with a single command.
Let's copy that command and paste it into your shell:
- +When your zrok
account was created, the service generated an account token that identifies and authenticates in a single step. Protect your account token as if it were a password, or an important account number; it's a secret, protect it.
When we left off you had downloaded, extracted, and configured your zrok
software. In order to use that environment with your account, you'll need to enable
an environment on your system. Enabling an environment generates a secure identity and the necessary underlying security policies with the OpenZiti network hosting the zrok
service so that you can begin sharing.
Log into the API console at:
+ +When you first log into your account on the API console, your interface will look like this:
+In the toolbar, there is a big green button that says "CLICK HERE TO GET STARTED!". If you click that button, you'll see the getting started wizard, which looks like this:
+This wizard is broken into multiple steps. The first step we've already covered, which gets the zrok software installed onto your system.
+Below "step 2" is a command: zrok enable 7g3K6gVKikWb
(your account will have a different account token, other than 7g3K6gVKikWb
). You'll want to copy this command into your shell and execute it:
$ zrok enable 7g3K6gVKikWb
⣻ contacting the zrok service...
After a few seconds, the message will change and indicate that the enable operation succeeded:
- +$ zrok enable 7g3K6gVKikWb
⣻ the zrok environment was successfully enabled...
Now, if we run a zrok status
command, you will see the details of your environment:
zrok status
$ zrok status
Config:
CONFIG VALUE SOURCE
apiEndpoint https://api-v1.zrok.io env
defaultFrontend public binary
headless false binary
Environment:
PROPERTY VALUE
Account Token <<SET>>
Ziti Identity <<SET>>
Excellent... our environment is now fully enabled.
-If we return to the web console, we'll now see the new environment reflected in the explorer view:
-In my case, the environment is named michael@ziti-lx
, which is the username of my shell and the hostname of the system the shell is running on.
If we return to the API console, we'll now see the new environment reflected in the API console visualizer:
+In my case, the environment is named michael@testing
, which is the username of my shell and the hostname of the system the shell is running on.
Should you want to use a non-default name for your environment, you can pass the -d
option to the zrok enable
command. See zrok enable --help
for details.
If you click on the environment node in the explorer in the web console, the details panel shown at the bottom of the page will change:
-The explorer supports clicking, dragging, mouse wheel zooming, and selecting the nodes in the graph for more information (and available actions) for the selected node. If you ever get lost in the explorer, click the zoom to fit icon in the lower right corner of the explorer.
If we click on the Detail
tab for our environment, we'll see something like:
With your zrok
account you can zrok enable
multiple environments. This will allow you to run zrok share
in one environment, and zrok access
in other environments.
The visualizer supports clicking, dragging, mouse wheel zooming, and selecting the nodes in the graph for more information (and available actions) for the selected node. If you ever get lost in the visualizer, click the zoom to fit icon in the lower right corner of the explorer.
With your zrok
account you can zrok enable
multiple environments. This will allow you to share (and access your shares) from multiple environments simultaneously.
Your environment is fully ready to go. Now we can move on to the fun stuff...
zrok
is designed to make sharing resources as effortless as possible, while providing a high degree of security and control.
Resources that are shared publicly are exposed to any users on the internet who have access to the zrok
instance's "frontend".
A frontend is an HTTPS listener exposed to the internet, that lets any user with your ephemeral share token access your publicly shared resources.
-For example, I might create a public share using the zrok share public
command, which results in my zrok
instance exposing a URL like https://2ptgbr8tlfvk.share.zrok.io
to access my resources.
In this case, my share was given the "share token" of 2ptgbr8tlfvk
. That URL can be given to any user, allowing them to immediately access the shared resources directly from my local environment, all without exposing any access to my private, secure environment. The physical network location of my environment is not exposed to anonymous consumers of my resources.
Here is the --help
output from zrok share public
:
zrok share public
<target>
defines the path to the local resource that you intend to share. The form of <target>
depends on the --backend-mode
that you're using.
In the case of --backend-mode proxy
, <target>
should be a URL to an HTTP endpoint.
In the case of --backend-mode web
, <target>
is the path to a file on disk that serves as the "root" of the file tree to be shared.
For example, I might create a public share using the zrok share public
command, which results in my zrok
instance exposing a URL like https://xxr2b7tzfx64.share.zrok.io
to access my resources.
$ zrok share public --backend-mode web .
In this case, my share was given the "share token" of xxr2b7tzfx64
. That URL can be given to any user, allowing them to immediately access the shared resources directly from my local environment, all without exposing any access to my private, secure environment. The physical network location of my environment is not exposed to anonymous consumers of my resources.
If we return to the web console, we see our share in the explorer:
-If we click on our new share in the explorer, we can see the share details:
-
If we click on the frontend endpoint a new browser tab opens and we see the content of our share:
If we click on the environment in the explorer, we're shown all of the shares for that environment (including our new share), along with a spark line that shows the activity:
-When we start accessing our share, notice the sparkline graphs showing the activity:
+And as soon as I terminate the zrok share
client, the resources are removed from the zrok
environment.
If we try to reload the frontend endpoint in our web browser, we'll see:
-zrok
also provides a powerful private sharing model. If I execute the following command:
The zrok
service will respond with the following:
Rather than allowing access to your service through a public frontend, a private share is only exposed to the underlying OpenZiti network, and can only be accessed using the zrok access
command.
$ zrok reserve public --backend-mode web v0.3_getting_started
[ 0.275] INFO main.(*reserveCommand).run: your reserved share token is 'mltwsinym1s2'
[ 0.275] INFO main.(*reserveCommand).run: reserved frontend endpoint: https://mltwsinym1s2.share.zrok.io
$ zrok reserve public --backend-mode web v0.3_getting_started
[ 0.275] INFO main.(*reserveCommand).run: your reserved share token is 'mltwsinym1s2'
[ 0.275] INFO main.(*reserveCommand).run: reserved frontend endpoint: https://mltwsinym1s2.share.zrok.io
I'm asking the zrok
service to reserve a share with a web
backend mode, pointing at my local docs
folder.
You'll want to remember the share token (mltwsinym1s2
in this case), and the frontend endpoint URL. If this were a private reserved share, there would not be a frontend URL.
If we do nothing else, and then point a web browser at the frontend endpoint, we get:
-This is the 404
error message returned by the zrok
frontend. We're getting this because we haven't yet started up a zrok share
for the service. Let's do that:
This command:
-$ zrok share reserved mltwsinym1s2
$ zrok share reserved mltwsinym1s2
...results in a new share backend starting up and connecting to the existing reserved share:
And now if we refresh the frontend endpoint URL in the web browser, we'll see an index of the docs
directory:
With the reserved share, we're free to stop and restart the zrok share reserved
command as many times as we want, without losing the token for our share.
When we're done with the reserved share, we can release it using this command:
-$ zrok release mltwsinym1s2
[ 0.230] INFO main.(*releaseCommand).run: reserved share 'mltwsinym1s2' released
$ zrok release mltwsinym1s2
[ 0.230] INFO main.(*releaseCommand).run: reserved share 'mltwsinym1s2' released
In summary, zrok
lets you easily and securely share resources with both general internet users (through public sharing) and also with other zrok
users (through private sharing).