share.example.com, then your wildcard record is *.share.example.com.The included Caddy container can automatically manage a wildcard certificate for your zrok instance. You can enable Caddy in this compose project by renaming caddy.compose.override.yml as compose.override.yml.
The included Caddy container can automatically manage a wildcard certificate for your zrok instance. You can enable Caddy in this compose project by renaming compose.caddy.yml as compose.override.yml.
example.com or share.example.com and create the zone on your DNS provider's platform.Create an .env file in the working directory.
ZROK_DNS_ZONE=share.example.com
ZROK_USER_EMAIL=me@example.com
ZROK_USER_PWD=zrokuserpw
ZITI_PWD=zitiadminpw
ZROK_ADMIN_TOKEN=zroktoken
# Caddy TLS option: rename caddy.compose.override.yml to compose.override.yml and set these vars; allow 80,443 in firewall
# plugin name for your DNS provider
CADDY_DNS_PLUGIN=cloudflare
# API token from your DNS provider
CADDY_DNS_PLUGIN_TOKEN=abcd1234
# use the staging API until you're sure everything is working to avoid hitting the rate limit
CADDY_ACME_API=https://acme-staging-v02.api.letsencrypt.org/directory
# no TLS option: publish the insecure ports to the internet and allow them in the firewall
ZROK_INSECURE_INTERFACE=0.0.0.0
ZROK_CTRL_PORT=18080
ZROK_FRONTEND_PORT=8080
ZROK_OAUTH_PORT=8081
# ziti ports must be published to the internet and allowed by firewall
ZITI_CTRL_ADVERTISED_PORT=1280
ZITI_ROUTER_PORT=3022
# configure oauth for public shares
ZROK_OAUTH_HASH_KEY=oauthhashkeysecret
ZROK_OAUTH_GITHUB_CLIENT_ID=abcd1234
ZROK_OAUTH_GITHUB_CLIENT_SECRET=abcd1234
ZROK_OAUTH_GOOGLE_CLIENT_ID=abcd1234
ZROK_OAUTH_GOOGLE_CLIENT_SECRET=abcd1234
# zrok version, e.g., 1.0.0
ZROK_CLI_TAG=latest
# ziti version, e.g., 1.0.0
ZITI_CLI_TAG=latest
# Caddy TLS option: rename compose.caddy.yml to compose.override.yml and set these vars; allow 80,443 in firewall
# plugin name for your DNS provider
CADDY_DNS_PLUGIN=cloudflare
# API token from your DNS provider
CADDY_DNS_PLUGIN_TOKEN=abcd1234
# use the staging API until you're sure everything is working to avoid hitting the rate limit
CADDY_ACME_API=https://acme-staging-v02.api.letsencrypt.org/directory
# no TLS option: publish the insecure ports to the internet and allow them in the firewall
ZROK_INSECURE_INTERFACE=0.0.0.0
ZROK_CTRL_PORT=18080
ZROK_FRONTEND_PORT=8080
ZROK_OAUTH_PORT=8081
# ziti ports must be published to the internet and allowed by firewall
ZITI_CTRL_ADVERTISED_PORT=1280
ZITI_ROUTER_PORT=3022
# configure oauth for public shares
ZROK_OAUTH_HASH_KEY=oauthhashkeysecret
ZROK_OAUTH_GITHUB_CLIENT_ID=abcd1234
ZROK_OAUTH_GITHUB_CLIENT_SECRET=abcd1234
ZROK_OAUTH_GOOGLE_CLIENT_ID=abcd1234
ZROK_OAUTH_GOOGLE_CLIENT_SECRET=abcd1234
# zrok version, e.g., 1.0.0
ZROK_CLI_TAG=latest
# ziti version, e.g., 1.0.0
ZITI_CLI_TAG=latest
This step creates a user account. You will log in to the zrok web console with the account password created in this step. The ZROK_USER_EMAIL and ZROK_USER_PWD variables are set in the .env file. You can create more user accounts the same way by substituting a different email and password.
docker compose exec zrok-controller bash -xc 'zrok admin create account /etc/zrok-controller/config.yml ${ZROK_USER_EMAIL} ${ZROK_USER_PWD}'
docker compose exec zrok-controller bash -xc 'zrok admin create account ${ZROK_USER_EMAIL} ${ZROK_USER_PWD}'
Create additional users by running the command again with a different email and password.
-docker compose exec zrok-controller zrok admin create account /etc/zrok-controller/config.yml <email> <password>
docker compose exec zrok-controller zrok admin create account <email> <password>
You must enable each device environment with the account token obtained when the account was created. This is separate from the account password that's used to log in to the web console.
Follow the getting started guide to install the zrok CLI on some device and enable a zrok environment.
diff --git a/docs/guides/self-hosting/instance-configuration/index.html b/docs/guides/self-hosting/instance-configuration/index.html index ff84ba4d..9dbe138b 100644 --- a/docs/guides/self-hosting/instance-configuration/index.html +++ b/docs/guides/self-hosting/instance-configuration/index.html @@ -9,7 +9,7 @@ - + diff --git a/docs/guides/self-hosting/interstitial-page/index.html b/docs/guides/self-hosting/interstitial-page/index.html index 6968af45..3989d216 100644 --- a/docs/guides/self-hosting/interstitial-page/index.html +++ b/docs/guides/self-hosting/interstitial-page/index.html @@ -9,7 +9,7 @@ - + diff --git a/docs/guides/self-hosting/linux/index.html b/docs/guides/self-hosting/linux/index.html index a30ff3df..b3339a53 100644 --- a/docs/guides/self-hosting/linux/index.html +++ b/docs/guides/self-hosting/linux/index.html @@ -9,7 +9,7 @@ - + @@ -104,7 +104,7 @@Create an http frontend configuration file in etc/http-frontend.yml.
v: 3
host_match: zrok.quigley.com
address: 0.0.0.0:8080
This frontend config file has a host_match pattern that represents the DNS zone you're using with this instance of zrok. Incoming HTTP requests with a matching Host header will be handled by this frontend. You may also specify the interface address where the frontend will listen for public access requests.
The frontend does not provide server TLS, but you may front the server with a reverse proxy. It is essential the reverse proxy forwards the Host header supplied by the viewer. This example will expose the non-TLS listener for the frontend.
The frontend does not provide server TLS, but you may front the server with a reverse proxy. The reverse proxy must forward the Host header supplied by the viewer. This example will expose the non-TLS listener for the frontend.
You can also specify an oauth configuration in this file, full details of are found in OAuth Public Frontend Configuration.
In another terminal window, run:
@@ -112,7 +112,7 @@The zrok frontend uses the public identity created during the bootstrap process to securely access zrok backends. to provide public access for the zrok deployment. It is expected that the configured listener for this frontend corresponds to the DNS template specified when creating the public frontend record above.
With our ZROK_ADMIN_TOKEN and ZROK_API_ENDPOINT environment variables set, we can create our first user account.
zrok admin create account etc/ctrl.yml <email> <password>
zrok admin create account <email> <password>
The output is the account token you will use to enable each device's zrok environment.