Merge branch 'main' into v2.0

2026-08-24 02:34:20 -05:00 · 2025-12-08 10:36:16 -05:00
parent da8b4c83a1 db7c82a1f3
commit 0f96e14bd7
469 changed files with 10667 additions and 403 deletions
@@ -0,0 +1 @@
+blank_issues_enabled: false
@@ -1,3 +1,8 @@
+---
+name: Issue
+about: Create an issue
+---
+
 *** IMPORTANT: THIS ISSUE DATABASE IS NOT FOR SUPPORT ***

 If you think you have found a bug in zrok, or you need help with a specific issue, please reach out for support on the OpenZiti Discourse group at:
@@ -1,4 +1,4 @@
-name: mattermost-ziti-webhook
+name: Send Event to Mattermost with Py SDK
 on:
  create:
  delete:
@@ -23,14 +23,14 @@ jobs:
    runs-on: ubuntu-latest
    name: POST Webhook
    steps:
-    - uses: openziti/ziti-mattermost-action-py@main
+    - uses: openziti/ziti-mattermost-action-py@v1
      if: |
-        github.repository_owner == 'openziti' 
-        && ((github.event_name != 'pull_request_review') 
+        github.repository_owner == 'openziti'
+        && ((github.event_name != 'pull_request_review')
        || (github.event_name == 'pull_request_review' && github.event.review.state == 'approved'))
      with:
        zitiId: ${{ secrets.ZITI_MATTERMOST_IDENTITY }}
-        webhookUrl: ${{ secrets.ZHOOK_URL }}
+        webhookUrl: ${{ secrets.ZHOOK_URL_DEV_NOTIFICATIONS }}
        eventJson: ${{ toJson(github.event) }}
        senderUsername: "GitHubZ"
        destChannel: "dev-notifications"
@@ -37,6 +37,10 @@ CHANGE: All logging migrated from `githhub.com/michaelquigley/pfxlog` and `githu

 FIX: Updated the unique constraint on the `accounts.email` column to only be unique when `is not deleted`. This only fixes PostgreSQL databases; fixing SQLite databases effectively requires rebuilding the entire database, see the comment in the issue for details. (https://github.com/openziti/zrok/issues/1109)

+## v1.1.11
+
+FIX: the `zrok-share.bash` wrapper script for Docker and Linux services was updated to use the new spelling of the `--oauth-email-address-pattern` option (it was `--oauth-email-domains` until v0.4.26 when it changed to `--oauth-email-address-patterns`)
+
 ## v1.1.9

 CHANGE: The `publicProxy` now supports "striped session cookies" to support larger authentication payloads when working with OIDC providers that use larger tokens/payloads. (https://github.com/openziti/zrok/issues/1101)
@@ -173,7 +173,7 @@ docker compose exec zrok-controller zrok admin create account <email> <password>

 You must enable each device environment with the account token obtained when the account was created. This is separate from the account password that's used to log in to the web console.

-Follow [the getting started guide](/docs/getting-started#installing-the-zrok-command) to install the zrok CLI on some device and enable a zrok environment.
+Follow [the getting started guide](https://docs.zrok.io/docs/getting-started#installing-the-zrok-command) to install the zrok CLI on some device and enable a zrok environment.

 1. Configure the environment with the zrok API endpoint:

@@ -0,0 +1 @@
+website/docs
@@ -186,7 +186,7 @@ if [[ -n "${ZROK_OAUTH_PROVIDER:-}" ]]; then
  ZROK_CMD+=" --oauth-provider ${ZROK_OAUTH_PROVIDER}"
  if [[ -n "${ZROK_OAUTH_EMAILS:-}" ]]; then
    for EMAIL in ${ZROK_OAUTH_EMAILS}; do
-      ZROK_CMD+=" --oauth-email-address-patterns ${EMAIL}"
+      ZROK_CMD+=" --oauth-email-address-pattern ${EMAIL}"
    done
  fi
 elif [[ -n "${ZROK_BASIC_AUTH:-}" ]]; then
@@ -1,5 +1,5 @@

- `proxy` mode forwards requests received by the frontend to the target server ([more](/concepts/http.md))
- `web` mode serves a target folder as a file index web page ([more](/concepts/files.md))
- `drive` mode serves a target folder with WebDAV ([guide](/guides/drives.mdx))
+- `proxy` mode forwards requests received by the frontend to the target server ([more](./http.md))
+- `web` mode serves a target folder as a file index web page ([more](./files.md))
+- `drive` mode serves a target folder with WebDAV ([guide](../guides/drives.mdx))
 - `caddy` mode runs the built-in Caddy server with the targeted Caddyfile ([example](pathname:///simple_reverse_proxy.Caddyfile))
@@ -6,7 +6,7 @@ sidebar_position: 200

 ## Self-Hosted

-`zrok` is not limited to a managed offering. You can [host your own](/guides/self-hosting/linux/index.mdx) instance of `zrok` as well. `zrok` is
+`zrok` is not limited to a managed offering. You can [host your own](../guides/self-hosting/linux/index.mdx) instance of `zrok` as well. `zrok` is
 also freely available as open source software hosted by GitHub under a very permissive Apache v2 license.

 ## Managed Service
@@ -10,4 +10,4 @@ sidebar_position: 25
 Sharing with `zrok` can be either [`public`](./sharing-public.mdx) or [`private`](./sharing-private.mdx).
 Naturally, regular web-based resources can be shared but `zrok` also includes support for sharing raw [TCP](./tunnels.md) and [UDP](./tunnels.md) network connections, and also includes a [website and file sharing](./files.md) feature.

-Learn about `zrok` [hosting here](./hosting.md), including instructions on how to [install your own `zrok` instance](/guides/self-hosting/linux/index.mdx).
+Learn about `zrok` [hosting here](./hosting.md), including instructions on how to [install your own `zrok` instance](../guides/self-hosting/linux/index.mdx).
@@ -2,7 +2,7 @@
 sidebar_position: 0
 ---

-import BackendHttp from '/../docs/concepts/_backend_http.mdx'
+import BackendHttp from './_backend_http.mdx'

 # Private Shares

@@ -50,6 +50,6 @@ zrok share private 80
 ```

 <BackendHttp/>
- `tcpTunnel`, `udpTunnel` modes forward the data payload to the target server ([more](/concepts/tunnels.md))
+- `tcpTunnel`, `udpTunnel` modes forward the data payload to the target server ([more](./tunnels.md))
 - `socks` mode provides a SOCKS5 dynamic proxy on the private access bind port that tunnels TCP payloads to the share backend where they are forwarded to their destinations ([blog](https://blog.openziti.io/the-zrok-socks-backend))
 - `vpn` mode provides a network layer tunnel between the private access and the share backend ([guide](guides/vpn/vpn.md))
@@ -2,7 +2,7 @@
 sidebar_position: 10
 ---

-import BackendHttp from '/../docs/concepts/_backend_http.mdx'
+import BackendHttp from './_backend_http.mdx'

 # Public Shares

@@ -4,10 +4,11 @@ sidebar_label: Getting Started
 sidebar_position: 10
 ---

-import { AssetsProvider } from '@site/src/components/assets-context';
-import DownloadCard from '@site/src/components/download-card';
-import DownloadCardStyles from '@site/src/css/download-card.module.css';
-import InstallCards from '/../docs/guides/install/_install_cards.mdx';
+import { AssetsProvider } from '@zrokroot/src/components/assets-context';
+import DownloadCard from '@zrokroot/src/components/download-card.jsx';
+import DownloadCardStyles from '@zrokroot/src/css/download-card.module.css';
+import InstallCards from '@zrokroot/docs/guides/install/_install_cards.mdx';
+import useBaseUrl from '@docusaurus/useBaseUrl';

 ## Your Secure Internet Sharing Perimeter

@@ -53,7 +54,7 @@ Here's a quick overview of what's involved in getting started with `zrok`:
                Run a zrok instance on Linux, Docker, or Kubernetes.
            </CardBody>
            <CardFooter>
-                <a href="/docs/category/self-hosting/">
+                <a href={useBaseUrl("/docs/zrok/category/self-hosting/")}>
                    <button className='button button--secondary button--block'>Guides</button>
                </a>
            </CardFooter>
@@ -206,7 +207,7 @@ If we try to reload the frontend endpoint in our web browser, we'll see:

 ![Not Found](images/zrok-not-found.png)

-[More about public shares](/concepts/sharing-public.mdx)
+[More about public shares](./concepts/sharing-public.mdx)

 ### Private Shares

@@ -297,7 +298,7 @@ Here's a quick review of the `zrok` mental model and the vocabulary.

 You create an _account_ with a `zrok` _instance_. Your account is identified by a username and a password, which you use to log into the _web console_. Your account also has a _secret token_, which you will use to authenticate from the `zrok` command-line to interact with the _instance_.

-You create a new _account_ with NetFoundry's `zrok` _instance_ by subscribing in [myzrok.io](https://myzrok.io) or in a self-hosted `zrok` _instance_ by running [the `zrok invite` command](/guides/self-hosting/self-service-invite.mdx) or the `zrok admin create account` command.
+You create a new _account_ with NetFoundry's `zrok` _instance_ by subscribing in [myzrok.io](https://myzrok.io) or in a self-hosted `zrok` _instance_ by running [the `zrok invite` command](./guides/self-hosting/self-service-invite.mdx) or the `zrok admin create account` command.

 ### Environment

@@ -321,7 +322,7 @@ You use the `zrok reserve` command to create _reserved shares_. Reserved shares

 ## Self-Hosting an Instance

-Interested in self-hosting your own `zrok` instance? See the [self-hosting guides](/docs/category/self-hosting/)!
+Interested in self-hosting your own `zrok` instance? See the [self-hosting guides](/docs/zrok/category/self-hosting/)!

 ## Resources

@@ -1,6 +1,6 @@
 import LinuxShareInstall from './_linux-share-install.mdx'
 import AnsibleRepoSetup from './install/_ansible_repo_setup.yaml'
-import ConcatenateYamlSnippets from '@site/src/components/cat-yaml.jsx'
+import ConcatenateYamlSnippets from '@zrokroot/src/components/cat-yaml.jsx'

 ## Installation

@@ -1,5 +1,5 @@

-1. Set up `zrok`'s Linux package repository by following [the Linux install guide](/guides/install/linux.mdx#install-zrok-from-the-repository), or run this one-liner to complete the repo setup and install packages.
+1. Set up `zrok`'s Linux package repository by following [the Linux install guide](../guides/install/linux.mdx), or run this one-liner to complete the repo setup and install packages.

    ```bash
    curl -sSLf https://get.openziti.io/install.bash \
@@ -1,5 +1,5 @@

-1. Set up `zrok`'s Linux package repository by following [the Linux install guide](/guides/install/linux.mdx#install-zrok-from-the-repository), or run this one-liner to complete the repo setup and install packages.
+1. Set up `zrok`'s Linux package repository by following [the Linux install guide](../guides/install/linux.mdx), or run this one-liner to complete the repo setup and install packages.

    ```bash
    curl -sSLf https://get.openziti.io/install.bash \
@@ -75,8 +75,8 @@ zrok agent status

 You can keep the Agent running reliably in the background by installing the Agent service in Windows or Linux.

- Windows - [set up the Windows system service](/guides/agent/windows-service/index.mdx)
- Linux - [install the Linux package `zrok-agent`](/guides/agent/linux-service.mdx)
+- Windows - [set up the Windows system service](../../guides/agent/windows-service/index.mdx)
+- Linux - [install the Linux package `zrok-agent`](../../guides/agent/linux-service.mdx)

 ## How the Agent Works

@@ -3,7 +3,7 @@ title: Linux Agent Service
 sidebar_position: 40
 ---

-import LinuxAgentInstall from '/../docs/guides/_linux-agent-install.mdx'
+import LinuxAgentInstall from '../_linux-agent-install.mdx'

 ## Overview

@@ -31,7 +31,7 @@ systemctl --user enable --now zrok-agent.service

 ## Use the agent

-Learn more about using the zrok agent in the [agent guide](/guides/agent/index.mdx).
+Learn more about using the zrok agent in the [agent guide](../../guides/agent/index.mdx).

 ## Troubleshooting

@@ -12,7 +12,7 @@ Privately share a Docker Compose service with a separate zrok environment and a

 With zrok, you can privately share a service that's running in Docker. You need a zrok private share running somewhere that it can reach the service you're sharing, and a zrok private access running somewhere else where you want to use the private share. Together, the private share and private access form a private point-to-point tunnel.

-Here's a short article with an overview of [private sharing with zrok](/concepts/sharing-private.mdx).
+Here's a short article with an overview of [private sharing with zrok](../../concepts/sharing-private.mdx).

 ## Walkthrough Video

@@ -12,7 +12,7 @@ Publicly share a Docker Compose service with a separate zrok environment and a p

 With zrok, you can publicly share a service that's running in Docker. You need a zrok public share running somewhere that it can reach the service you're sharing. As long as that public share is running and your service is available, anyone with the address can use your service.

-Here's a short article with an overview of [public sharing with zrok](/concepts/sharing-public.mdx).
+Here's a short article with an overview of [public sharing with zrok](../../concepts/sharing-public.mdx).

 ## Walkthrough Video

@@ -10,7 +10,7 @@ To follow the guides in this section you will need [Docker](https://docs.docker.

 You have the option to enable a `zrok` account on the Docker host and mount it on the container or you can use the provided Docker Compose project files (`compose.yml`) to enable a separate `zrok` environment for each project.

-This page provides `docker` and `docker compose` examples of mounting the host's `zrok` environment on the container. You'll need to first [enable zrok on the Docker host](/docs/getting-started/#installing-the-zrok-command) to use this approach.
+This page provides `docker` and `docker compose` examples of mounting the host's `zrok` environment on the container. You'll need to first [enable zrok on the Docker host](../../getting-started.mdx#installing-the-zrok-command) to use this approach.

 ## Permanent Public Share

@@ -70,7 +70,7 @@ When the service starts it will:

  <TabItem value="Docker">

-On macOS and Windows, zrok frontdoor is implemented as a Docker Compose project which reserves a public subdomain for your website or service and manages a zrok environment that's separate from the Docker host. [Link to the Docker Public Share Guide](/guides/docker-share/docker_public_share_guide.md)
+On macOS and Windows, zrok frontdoor is implemented as a Docker Compose project which reserves a public subdomain for your website or service and manages a zrok environment that's separate from the Docker host. [Link to the Docker Public Share Guide](../guides/docker-share/docker_public_share_guide.md)

  </TabItem>

@@ -0,0 +1,27 @@
+import { AssetsProvider } from '@zrokroot/src/components/assets-context';
+import DownloadCard from '@zrokroot/src/components/download-card';
+import DownloadCardStyles from '@zrokroot/src/css/download-card.module.css';
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+<AssetsProvider>
+  <div className={DownloadCardStyles.downloadContainer}>
+    <DownloadCard
+      osName="Windows"
+      osLogo={useBaseUrl('/img/logo-windows.svg')}
+      infoText="Download EXE"
+      guideLink={useBaseUrl('/guides/install/windows')}
+    />
+    <DownloadCard
+      osName="macOS"
+      osLogo={useBaseUrl('/img/logo-apple.svg')}
+      infoText="Homebrew or Download"
+      guideLink={useBaseUrl('/guides/install/macos')}
+    />
+    <DownloadCard
+      osName="Linux"
+      osLogo={useBaseUrl('/img/logo-linux.svg')}
+      infoText="RPM/DEB/AUR or Homebrew"
+      guideLink={useBaseUrl('/guides/install/linux')}
+    />
+  </div>
+</AssetsProvider>
@@ -3,12 +3,13 @@ title: Install zrok in Linux
 sidebar_label: Linux
 ---

-import { AssetsProvider } from '@site/src/components/assets-context';
-import DownloadCard from '@site/src/components/download-card';
-import styles from '@site/src/css/download-card.module.css';
+import { AssetsProvider } from '@zrokroot/src/components/assets-context';
+import DownloadCard from '@zrokroot/src/components/download-card';
+import styles from '@zrokroot/src/css/download-card.module.css';
 import AnsibleRepoSetup from './_ansible_repo_setup.yaml'
-import ConcatenateYamlSnippets from '@site/src/components/cat-yaml.jsx'
+import ConcatenateYamlSnippets from '@zrokroot/src/components/cat-yaml.jsx'
 import Homebrew from './_homebrew.mdx';
+import useBaseUrl from '@docusaurus/useBaseUrl';

 ## Package Repository

@@ -19,7 +20,7 @@ curl -sSf https://get.openziti.io/install.bash | sudo bash -s zrok
 ```

 :::info
-Check out [zrok frontdoor](/guides/frontdoor.mdx?os=Linux) for running `zrok` as an always-on service.
+Check out [zrok frontdoor](../../guides/frontdoor.mdx?os=Linux) for running `zrok` as an always-on service.
 :::

 <Details>
@@ -49,7 +50,7 @@ Check out [zrok frontdoor](/guides/frontdoor.mdx?os=Linux) for running `zrok` as
  <div className={styles.downloadContainer}>
    <DownloadCard
      osName="Linux"
-      osLogo="/img/logo-linux.svg"
+      osLogo={useBaseUrl('/img/logo-linux.svg')}
    />
  </div>
 </AssetsProvider>
@@ -3,10 +3,11 @@ title: Install zrok in macOS
 sidebar_label: macOS
 ---

-import { AssetsProvider } from '@site/src/components/assets-context';
-import DownloadCard from '@site/src/components/download-card';
-import styles from '@site/src/css/download-card.module.css';
+import { AssetsProvider } from '@zrokroot/src/components/assets-context';
+import DownloadCard from '@zrokroot/src/components/download-card';
+import styles from '@zrokroot/src/css/download-card.module.css';
 import Homebrew from './_homebrew.mdx';
+import useBaseUrl from '@docusaurus/useBaseUrl';

 ## Homebrew

@@ -18,7 +19,7 @@ import Homebrew from './_homebrew.mdx';
  <div className={styles.downloadContainer}>
    <DownloadCard
      osName="macOS"
-      osLogo="/img/logo-apple.svg"
+      osLogo={useBaseUrl("/img/logo-apple.svg")}
    />
  </div>
 </AssetsProvider>
@@ -3,9 +3,10 @@ title: Install zrok in Windows
 sidebar_label: Windows
 ---

-import { AssetsProvider } from '@site/src/components/assets-context';
-import DownloadCard from '@site/src/components/download-card';
-import styles from '@site/src/css/download-card.module.css';
+import { AssetsProvider } from '@zrokroot/src/components/assets-context';
+import DownloadCard from '@zrokroot/src/components/download-card';
+import styles from '@zrokroot/src/css/download-card.module.css';
+import useBaseUrl from '@docusaurus/useBaseUrl';

 ## Windows Binary

@@ -13,7 +14,7 @@ import styles from '@site/src/css/download-card.module.css';
  <div className={styles.downloadContainer}>
    <DownloadCard
      osName="Windows"
-      osLogo="/img/logo-windows.svg"
+      osLogo={useBaseUrl("/img/logo-windows.svg")}
    />
  </div>
 </AssetsProvider>
@@ -57,4 +58,4 @@ import styles from '@site/src/css/download-card.module.css';

 ## Wintun for zrok VPN

-On Windows, you must install Wintun to use zrok's VPN backend mode. See the [VPN guide](/guides/vpn/vpn.md) for more details.
+On Windows, you must install Wintun to use zrok's VPN backend mode. See the [VPN guide](../../guides/vpn/vpn.md) for more details.
@@ -4,6 +4,6 @@ sidebar_label: Docker
 sidebar_position: 45
 ---

-import DockerInstance from '/../docker/compose/zrok-instance/README.md'
+import DockerInstance from '@zrokroot/../docker/compose/zrok-instance/README.md'

 <DockerInstance />
@@ -55,7 +55,7 @@ Debian and RPM packages are available for `zrok`.
 sudo apt install zrok
 ```

-Follow [the Linux installation guide](/guides/install/linux.mdx) to install the `zrok` package from the repository or manually install the binary for your platform.
+Follow [the Linux installation guide](../../../guides/install/linux.mdx) to install the `zrok` package from the repository or manually install the binary for your platform.

 ## Configure the Controller

@@ -68,7 +68,7 @@ Create a `zrok` controller configuration file in `etc/ctrl.yml`. The controller
 #   /___|_|  \___/|_|\_\
 # controller configuration

-v:                  3
+v:                  4

 admin:
  # generate these admin tokens from a source of randomness, e.g. 
@@ -109,15 +109,15 @@ The `ziti` section defines how the `zrok` controller should communicate with you

 :::note

-Be sure to see the [reference configuration at `etc/ctrl.yml`](../../../../../../etc/ctrl.yml) for the complete documentation of the current configuration file format for the `zrok` controller and service instance components.
+Be sure to see the [reference configuration at `etc/ctrl.yml`](https://github.com/openziti/zrok/blob/main/etc/ctrl.yml) for the complete documentation of the current configuration file format for the `zrok` controller and service instance components.

-See the separate guides on [configuring metrics](/guides/self-hosting/metrics-and-limits/configuring-metrics.md) and [configuring limits](/guides/self-hosting/metrics-and-limits/configuring-limits.md) for details about both of these specialized areas of service instance configuration.
+See the separate guides on [configuring metrics](../../../guides/self-hosting/metrics-and-limits/configuring-metrics.md) and [configuring limits](../../../guides/self-hosting/metrics-and-limits/configuring-limits.md) for details about both of these specialized areas of service instance configuration.

 :::

 ## Environment Variables

-The `zrok` binaries are configured to work with the global `zrok.io` service, and default to using `api.zrok.io` as the endpoint for communicating with the service.
+The `zrok` binaries are configured to work with the global `zrok.io` service, and default to using `api-v1.zrok.io` as the endpoint for communicating with the service.

 To work with a self-hosted `zrok` deployment, you'll need to set the `ZROK_API_ENDPOINT` environment variable to point to the address where your `zrok` controller will be listening, according to `endpoint` in the configuration file above.

@@ -127,7 +127,7 @@ In my case, I've set:
 export ZROK_API_ENDPOINT=http://127.0.0.1:18080
 ```

-[Read more about configuring your self-hosted `zrok` instance](/guides/self-hosting/instance-configuration.mdx).
+[Read more about configuring your self-hosted `zrok` instance](../../../guides/self-hosting/instance-configuration.mdx).

 ## Bootstrap OpenZiti for zrok

@@ -233,7 +233,7 @@ This frontend config file has a `host_match` pattern that represents the DNS zon

 The frontend does not provide server TLS, but you may front the server with a reverse proxy. The reverse proxy must forward the `Host` header supplied by the viewer. This example will expose the non-TLS listener for the frontend.

-You can also specify an `oauth` configuration in this file, full details of are found in [OAuth Public Frontend Configuration](/guides/self-hosting/oauth/configuring-oauth.md#configuring-your-public-frontend).
+You can also specify an `oauth` configuration in this file, full details of are found in [OAuth Public Frontend Configuration](../../../guides/self-hosting/oauth/configuring-oauth.md#configuring-your-public-frontend).

 ## Start Public Frontend

@@ -11,7 +11,7 @@ sidebar_label: NGINX TLS

 ## Before You Begin

-I'll assume you have a running `zrok` controller and frontend and wish to front both with NGINX providing server TLS. Go back to [Self-Hosting Guide](/guides/self-hosting/linux/index.mdx) if you still need to spin those up.
+I'll assume you have a running `zrok` controller and frontend and wish to front both with NGINX providing server TLS. Go back to [Self-Hosting Guide](../../../guides/self-hosting/linux/index.mdx) if you still need to spin those up.

 ## Choose a Reverse Proxy Address

--- a/Show More
+++ b/Show More