# zrok cloud ## What is this? This repo contains a script to create a new version of the zrok cloud containers & push them into the netfoundry dockerhub space. The container is built to consume environmental variables & auto create a config file based on those variables. The configs generated are based on: * https://github.com/openziti/zrok/blob/main/etc/ctrl.yml * https://github.com/openziti/zrok/blob/main/etc/http-frontend.yml The single container is built to run as `ctrl` or `http` ## How to create & push a new tag/version ### Requirements * This script only runs in linux or wsl. * Docker must be installed. * Docker must be logged into dockerhub to push the new image. * You must have access to the NetFoundry dockerhub space. ### Build Examples To create & push a new image based on zrok version 0.4.6: ``` ./push_new_tag.sh 0.4.6 ``` If you want to use the latest, just don't specify a version: ``` ./push_new_tag.sh ``` ### Building a zrok 1.x image `Dockerfile` (and `push_new_tag.sh` / Jenkins) builds on the 2.x base `openziti/zrok2`, so passing a 1.x version fails with `manifest for openziti/zrok2:1.x.y not found`. 1.x images use `1x.Dockerfile`, which builds on `openziti/zrok`. 1. Confirm the upstream 1.x base exists: `docker manifest inspect openziti/zrok:1.1.12` 2. Build and push (tag format `{ZROK_VERSION}-{GIT_SHORT_HASH}`, amd64 only): ``` VERSION=1.1.12 HASH=$(git rev-parse --short HEAD) docker buildx build --platform linux/amd64 -f 1x.Dockerfile \ -t netfoundry/zrok-cloud:$VERSION-$HASH --build-arg IMG_TAG=$VERSION --push . ``` 3. Set the 1.x SSM image parameter to `$VERSION-$HASH` and deploy as usual. To sanity check before pushing, build with `--load` instead of `--push` and run `docker run --rm --entrypoint zrok version`. ### Run Examples: To set the environment minimum variables needed: Copy this to $USER-env.sh & modify the values `cp set_local_env.sh $USER-env.sh` To run a local copy based on zrok version 0.4.6: ``` ./run_local.sh 0.4.6 ``` ## Minimum configuration In order to run the ctrl/http you must set the following variables. ### Ctrl * ZROK_ADMIN_SECRET * ZROK_EMAIL_USERNAME * ZROK_EMAIL_PASSWORD * ZROK_METRICS_AGENT_SOURCE_URL * ZROK_METRICS_INFLUX_URL * ZROK_METRICS_INFLUX_TOKEN * ZROK_STORE_PATH * ZROK_ZITI_API_ENDPOINT * ZROK_ZITI_USERNAME * ZROK_ZITI_PASSWORD V2 Additions: * ZROK_DYNAMIC_PROXY_CONTROLLER_AMQP_URL (use same value as ZROK_METRICS_AGENT_SOURCE_URL ) * ZROK_DYNAMIC_PROXY_CONTROLLER_ZITI_IDENTITY_JSON ### Http * ZROK_COMMAND - Should be "http" * ZROK_ZITI_IDENTITY_JSON * ZROK_HASH_KEY * ZROK_GOOGLE_CLIENTID * ZROK_GOOGLE_CLIENTSECRET * ZROK_GITHUB_CLIENTID * ZROK_GITHUB_CLIENTSECRET V2 Additions for "dynamicProxy" * ZROK_FRONTEND_TOKEN * ZROK_AMQP_URL ## Environmental Variables ### Build specific ZROK_COMMAND - Which command will run once built, currently supports {ctrl,http}. default: `ctrl` ZROK_ZITI_IDENTITY_JSON - The identity json. deafault: `None` ZROK_ZITI_IDENTITY_PATH - The path to write the identity. default: `/home/zrok/.zrok/identities/ctrl.json` ZROK_CONFIG_TEMPLATE - The path to the config template. default: `/home/zrok/ctrl.yml.j2` ZROK_CONFIG_PATH - The path to write the config. default: `/home/zrok/config.yml` ### zrok ctrl specific For an explanation of each variable, please see the [config](https://github.com/openziti/zrok/blob/main/etc/ctrl.yml) in the github repo. ZROK_CONFIG_VERSION default: `3` ZROK_ADMIN_SECRET default: `None` ZROK_ADMIN_TOU_LINK default: `Terms and Conditions` ZROK_ENDPOINT_HOST default: `0.0.0.0` ZROK_ENDPOINT_PORT default: `8080` ZROK_EMAIL_HOST default: `email-smtp.us-east-1.amazonaws.com` ZROK_EMAIL_PORT default: `587` ZROK_EMAIL_USERNAME default: `None` ZROK_EMAIL_PASSWORD default: `None` ZROK_EMAIL_FROM_ADDRESS default: `ziggy@zrok.io` ZROK_INVITES_OPEN default: `True` ZROK_TOKEN_CONTACT default: `invite@zrok.io` ZROK_LIMITS_ENABLED default: `yes` ZROK_LIMITS_ENVIRONMENTS default: `-1` ZROK_LIMITS_SHARES default: `-1` ZROK_LIMITS_BANDWIDTH_PER_ACCOUNT_PERIOD default: `24hr` ZROK_LIMITS_BANDWIDTH_PER_ACCOUNT_WARNING_RX default: `-1` ZROK_LIMITS_BANDWIDTH_PER_ACCOUNT_WARNING_TX default: `-1` ZROK_LIMITS_BANDWIDTH_PER_ACCOUNT_WARNING_TOTAL default: `7500000000` ZROK_LIMITS_BANDWIDTH_PER_ACCOUNT_LIMIT_RX default: `-1` ZROK_LIMITS_BANDWIDTH_PER_ACCOUNT_LIMIT_TX default: `-1` ZROK_LIMITS_BANDWIDTH_PER_ACCOUNT_LIMIT_TOTAL default: `10000000000` ZROK_LIMITS_BANDWIDTH_PER_ENVIRONMENT_PERIOD default: `5m` ZROK_LIMITS_BANDWIDTH_PER_ENVIRONMENT_WARNING_RX default: `-1` ZROK_LIMITS_BANDWIDTH_PER_ENVIRONMENT_WARNING_TX default: `-1` ZROK_LIMITS_BANDWIDTH_PER_ENVIRONMENT_WARNING_TOTAL default: `-1` ZROK_LIMITS_BANDWIDTH_PER_ENVIRONMENT_LIMIT_RX default: `-1` ZROK_LIMITS_BANDWIDTH_PER_ENVIRONMENT_LIMIT_TX default: `-1` ZROK_LIMITS_BANDWIDTH_PER_ENVIRONMENT_LIMIT_TOTAL default: `-1` ZROK_LIMITS_BANDWIDTH_PER_SHARE_PERIOD default: `5m` ZROK_LIMITS_BANDWIDTH_PER_SHARE_WARNING_RX default: `-1` ZROK_LIMITS_BANDWIDTH_PER_SHARE_WARNING_TX default: `-1` ZROK_LIMITS_BANDWIDTH_PER_SHARE_WARNING_TOTAL default: `-1` ZROK_LIMITS_BANDWIDTH_PER_SHARE_LIMIT_RX default: `-1` ZROK_LIMITS_BANDWIDTH_PER_SHARE_LIMIT_TX default: `-1` ZROK_LIMITS_BANDWIDTH_PER_SHARE_LIMIT_TOTAL default: `-1` ZROK_LIMITS_ENFORCING default: `true` ZROK_LIMITS_CYCLE default: `15m` ZROK_MAINTENANCE_REGISTRATION_EXPIRATION_TIMEOUT default: `24hr` ZROK_MAINTENANCE_REGISTRATION_CHECK_FREQUENCY default: `1h` ZROK_MAINTENANCE_REGISTRATION_BATCH_LIMIT default: `500` ZROK_MAINTENANCE_RESET_PASSWORD_EXPIRATION_TIMEOUT default: `15m` ZROK_MAINTENANCE_RESET_PASSWORD_CHECK_FREQUENCY default: `15m` ZROK_MAINTENANCE_RESET_PASSWORD_BATCH_LIMIT default: `500` ZROK_METRICS_AGENT_SOURCE_TYPE default: `amqpSource` ZROK_METRICS_AGENT_SOURCE_URL default: `None` ZROK_METRICS_AGENT_SOURCE_QUEUE_NAME default: `events` ZROK_METRICS_INFLUX_URL default: `None` ZROK_METRICS_INFLUX_BUCKET default: `zrok` ZROK_METRICS_INFLUX_ORG default: `zrok` ZROK_METRICS_INFLUX_TOKEN default: `None` ZROK_REGISTRATION_REGISTRATION_URL_TEMPLATE default: `https://api.zrok.io/register` ZROK_RESET_PASSWORD_RESET_URL_TEMPLATE default: `https://api.zrok.io/resetPassword` ZROK_STORE_PATH default: `None` ZROK_STORE_TYPE default: `postgres` ZROK_ZITI_API_ENDPOINT default: `None` ZROK_ZITI_USERNAME default: `None` ZROK_ZITI_PASSWORD default: `None` ZROK_NAMES_DISABLE_SHARE_TOKEN_PROFANITY_CHECK - Disable profanity checking on share tokens. default: `None` ZROK_NAMES_DISABLE_NAMESPACE_NAME_PROFANITY_CHECK - Disable profanity checking on namespace names. default: `None` ### zrok http specific ZROK_ZITI_IDENTITY_NAME - The zrok name of the identity to use. default: `public` ZROK_FRONTEND_HOST_MATCH - The zrok frontend host match string. default: `share.zrok.io` ZROK_OATH_BIND_ADDRESS - The bind address of the oath default: `0.0.0.0:8181` ZROK_REDIRECT_URL - The zrok oauth redirect url default: `https://oauth.share.zrok.io` ZROK_COOKIE_DOMAIN - The zrok oauth http redirect default: `zrok.io` ZROK_HASH_KEY - The zrok oauth hash key default: `None` ZROK_GOOGLE_CLIENTID - The zrok google oauth client id default: `None` ZROK_GOOGLE_CLIENTSECRET - The zrok google oauth client secret default: `None` ZROK_GITHUB_CLIENTID - The zrok github oauth client id default: `None` ZROK_GITHUB_CLIENTSECRET - The zrok github oauth client secret default: `None` ZROK_404_TEMPLATE_PATH - optional html template for a custom 404 page default: `None`