API token for zeronsd

[whitestrake]

Howdy! I'm having trouble with the Zero-UI central API token and feeding that to zeronsd.

Relevant:

• https://github.com/zerotier/zeronsd
• feat: zeronsd support #14
• Using zero-ui API #11

So, I've been mucking around getting zeronsd up and running lately; there's very little info on getting this working on self-hosted with something like Zero-UI in front. I have the following compose services:

   zerotier:
     image: zyclonite/zerotier:latest
     restart: unless-stopped
     devices:
       - /dev/net/tun
     cap_add:
       - NET_ADMIN
       - SYS_ADMIN
     volumes:
       - ./conf/zerotier/controller:/var/lib/zerotier-one
     environment:
       ZT_OVERRIDE_LOCAL_CONF: "true"
       ZT_ALLOW_MANAGEMENT_FROM: "0.0.0.0/0"
     ports:
       - 9993:9993

   zero-ui:
     image: dec0dos/zero-ui:latest
     restart: unless-stopped
     depends_on:
       - zerotier
     volumes:
       - ./conf/zerotier/controller:/var/lib/zerotier-one
       - ./conf/zerotier/ui:/app/backend/data
     environment:
       ZU_CONTROLLER_ENDPOINT: "http://zerotier:9993/"
       ZU_SECURE_HEADERS: "true"
       ZU_DEFAULT_USERNAME: "whitestrake"
       ZU_DEFAULT_PASSWORD: "[snip]"

   zeronsd:
     image: zerotier/zeronsd:latest
     network_mode: "service:zerotier"
     command: "start -t /token.txt [network-id]"
     volumes:
       - ./conf/zerotier/controller:/var/lib/zerotier-one
       - ./conf/zerotier/nsd/token.txt:/token.txt
     depends_on:
       - zerotier
       - zero-ui
     environment:
       ZEROTIER_CENTRAL_INSTANCE: "https://[snip]/api"
       ZEROTIER_CENTRAL_TOKEN: "[snip]"

With the exception of zeronsd (mucking around recently), Zerotier and Zero-UI have been serving me exceptionally well for quite some time and I have a decent collection of nodes using it.

Although I've worked out a number of kinks getting the exact things zeronsd seems to require in place, I've hit a snag:

kairos-zero-ui-1  | GET /app/network/[snip] 200 71.454 ms - 769
kairos-zero-ui-1  | GET /api/network/[snip] 200 32.492 ms - -
kairos-zero-ui-1  | GET /api/network/[snip]/member 200 76.003 ms - -
kairos-zero-ui-1  | GET /app/favicon.ico 304 2.594 ms - -
kairos-zero-ui-1  | GET /api/network/[snip]/member 200 99.222 ms - -
kairos-zero-ui-1  | GET /api/network/[snip]/member 200 52.638 ms - -
kairos-zero-ui-1  | GET /api/network/[snip] 401 14.832 ms - 25

In the above logs, we can see a successful request to /app/network/[my network] and then /api/network/[my network] with 200 responses; a logged-on access via the web UI that appears to have authenticated just fine.

At the end, though, there is a 401 for the same URI. This occurs whenever I attempt to compose up zeronsd; on the zeronsd side, I get:

Attaching to kairos-zeronsd-1
kairos-zeronsd-1  | Apr 29 12:19:23.192  INFO zeronsd::init: Welcome to ZeroNS!
kairos-zeronsd-1  | Error: Error Response
kairos-zeronsd-1 exited with code 1

This makes me think the API token I've provided is wrong. I got it from grep -A2 whitestrake conf/zerotier/ui/db.json and copied the "token": "[snip]" field out, and I've provided it both via environmental variable AND volume mounting into the container with the zeronsd -t flag, as documented over on their repo.

Am I getting the API token I need, supposedly, from the correct location? Or is there somewhere else I should be looking? Or might this be a zeronsd issue (or a dumb operator issue) instead of a Zero-UI issue?

Thanks!

[dec0dOS]

Hello, @whitestrake!

I still have no experience with running zeronsd with ZeroUI. We have to dig into zeronsd source code to find the issue. I've made some research a long time ago on the authorization with ZeroTier clients (zeronsd, windows client node auth control) and ZeroTier Central server, they don't always follow the bearer authentication token standard correctly.