mirror of
https://github.com/zerotier/ZeroTierOne.git
synced 2026-09-22 15:29:03 -07:00
Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 dimitriy-dade
|
a3dfa18ba9 | ||
 Adam Ierymenko
|
377462e776 |
No files matched your search
+47
-46
@@ -4,71 +4,72 @@ BreakBeforeBraces: Stroustrup
|
||||
IndentWidth: 4
|
||||
TabWidth: 4
|
||||
AlignAfterOpenBracket: AlwaysBreak
|
||||
AlignConsecutiveMacros: "true"
|
||||
AlignConsecutiveAssignments: "false"
|
||||
AlignConsecutiveDeclarations: "false"
|
||||
AlignConsecutiveMacros: 'true'
|
||||
AlignConsecutiveAssignments: 'false'
|
||||
AlignConsecutiveDeclarations: 'false'
|
||||
AlignEscapedNewlines: Right
|
||||
AlignOperands: "true"
|
||||
AlignTrailingComments: "true"
|
||||
AllowAllArgumentsOnNextLine: "false"
|
||||
AllowAllConstructorInitializersOnNextLine: "false"
|
||||
AllowAllParametersOfDeclarationOnNextLine: "false"
|
||||
AllowShortBlocksOnASingleLine: "true"
|
||||
AllowShortCaseLabelsOnASingleLine: "false"
|
||||
AlignOperands: 'true'
|
||||
AlignTrailingComments: 'true'
|
||||
AllowAllArgumentsOnNextLine: 'false'
|
||||
AllowAllConstructorInitializersOnNextLine: 'false'
|
||||
AllowAllParametersOfDeclarationOnNextLine: 'false'
|
||||
AllowShortBlocksOnASingleLine: 'true'
|
||||
AllowShortCaseLabelsOnASingleLine: 'false'
|
||||
AllowShortFunctionsOnASingleLine: None
|
||||
AllowShortIfStatementsOnASingleLine: Never
|
||||
AlwaysBreakAfterReturnType: None
|
||||
BinPackArguments: "true"
|
||||
BinPackParameters: OnePerLine
|
||||
BinPackArguments: 'false'
|
||||
BinPackParameters: 'false'
|
||||
BreakBeforeBinaryOperators: NonAssignment
|
||||
BreakBeforeTernaryOperators: "true"
|
||||
BreakBeforeTernaryOperators: 'true'
|
||||
BreakConstructorInitializers: BeforeComma
|
||||
BreakInheritanceList: BeforeComma
|
||||
CompactNamespaces: "false"
|
||||
ConstructorInitializerAllOnOneLineOrOnePerLine: "true"
|
||||
ConstructorInitializerIndentWidth: "4"
|
||||
ContinuationIndentWidth: "4"
|
||||
Cpp11BracedListStyle: "false"
|
||||
FixNamespaceComments: "true"
|
||||
CompactNamespaces: 'false'
|
||||
ConstructorInitializerAllOnOneLineOrOnePerLine: 'true'
|
||||
ConstructorInitializerIndentWidth: '4'
|
||||
ContinuationIndentWidth: '4'
|
||||
Cpp11BracedListStyle: 'false'
|
||||
FixNamespaceComments: 'true'
|
||||
IncludeBlocks: Regroup
|
||||
IndentCaseLabels: "true"
|
||||
IndentCaseLabels: 'true'
|
||||
IndentPPDirectives: None
|
||||
IndentWrappedFunctionNames: "false"
|
||||
KeepEmptyLinesAtTheStartOfBlocks: "false"
|
||||
MaxEmptyLinesToKeep: "1"
|
||||
IndentWrappedFunctionNames: 'false'
|
||||
KeepEmptyLinesAtTheStartOfBlocks: 'false'
|
||||
MaxEmptyLinesToKeep: '1'
|
||||
NamespaceIndentation: None
|
||||
PointerAlignment: Left
|
||||
ReflowComments: "true"
|
||||
SortIncludes: "true"
|
||||
SortUsingDeclarations: "true"
|
||||
SpaceAfterCStyleCast: "false"
|
||||
SpaceAfterLogicalNot: "true"
|
||||
SpaceAfterTemplateKeyword: "true"
|
||||
SpaceBeforeAssignmentOperators: "true"
|
||||
SpaceBeforeCpp11BracedList: "true"
|
||||
SpaceBeforeCtorInitializerColon: "true"
|
||||
SpaceBeforeInheritanceColon: "true"
|
||||
ReflowComments: 'true'
|
||||
SortIncludes: 'true'
|
||||
SortUsingDeclarations: 'true'
|
||||
SpaceAfterCStyleCast: 'false'
|
||||
SpaceAfterLogicalNot: 'true'
|
||||
SpaceAfterTemplateKeyword: 'true'
|
||||
SpaceBeforeAssignmentOperators: 'true'
|
||||
SpaceBeforeCpp11BracedList: 'true'
|
||||
SpaceBeforeCtorInitializerColon: 'true'
|
||||
SpaceBeforeInheritanceColon: 'true'
|
||||
SpaceBeforeParens: ControlStatements
|
||||
SpaceBeforeRangeBasedForLoopColon: "true"
|
||||
SpaceInEmptyParentheses: "false"
|
||||
SpacesBeforeTrailingComments: "3"
|
||||
SpacesInAngles: "false"
|
||||
SpacesInCStyleCastParentheses: "false"
|
||||
SpacesInContainerLiterals: "true"
|
||||
SpacesInParentheses: "false"
|
||||
SpacesInSquareBrackets: "false"
|
||||
UseTab: "Always"
|
||||
SpaceBeforeRangeBasedForLoopColon: 'true'
|
||||
SpaceInEmptyParentheses: 'false'
|
||||
SpacesBeforeTrailingComments: '3'
|
||||
SpacesInAngles: 'false'
|
||||
SpacesInCStyleCastParentheses: 'false'
|
||||
SpacesInContainerLiterals: 'true'
|
||||
SpacesInParentheses: 'false'
|
||||
SpacesInSquareBrackets: 'false'
|
||||
UseTab: 'Always'
|
||||
|
||||
---
|
||||
Language: Cpp
|
||||
Standard: Cpp03
|
||||
ColumnLimit: "120"
|
||||
ColumnLimit: '240'
|
||||
---
|
||||
Language: ObjC
|
||||
ColumnLimit: "120"
|
||||
ColumnLimit: '240'
|
||||
---
|
||||
Language: Java
|
||||
ColumnLimit: "120"
|
||||
ColumnLimit: '240'
|
||||
---
|
||||
Language: CSharp
|
||||
ColumnLimit: "120"
|
||||
ColumnLimit: '240'
|
||||
...
|
||||
@@ -1,12 +1,2 @@
|
||||
.git/
|
||||
workspace/
|
||||
# Local from-source dependency builds (scripts/bootstrap-deps.sh) and CMake output;
|
||||
# never ship these into an image -- they are host-specific and large.
|
||||
.deps/
|
||||
.deps-build/
|
||||
build/
|
||||
build-*/
|
||||
out/
|
||||
# Dockerfiles are supplied via -f; keeping them out of the context means editing
|
||||
# them does not invalidate the COPY layers (and the heavy build cache).
|
||||
ext/central-controller-docker/Dockerfile*
|
||||
@@ -0,0 +1,67 @@
|
||||
name: Central Controller CV1 Build and Push
|
||||
|
||||
on:
|
||||
push:
|
||||
pull_request:
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
central_controller:
|
||||
name: Central Controller CV1 Build
|
||||
strategy:
|
||||
matrix:
|
||||
runner: [gha-runner-x64, gha-runner-arm64]
|
||||
runs-on: ${{ matrix.runner }}
|
||||
steps:
|
||||
- name: checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Docker Auth
|
||||
run: echo "${{ secrets.PORTUS_PW }}" | docker login registry.zerotier.com -u ${{ secrets.PORTUS_USER }} --password-stdin
|
||||
|
||||
- name: Get branch name and sanitize
|
||||
id: branch
|
||||
run: |
|
||||
BRANCH_NAME="${GITHUB_REF##*/}"
|
||||
SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
|
||||
echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Get short git commit SHA
|
||||
id: sha
|
||||
run: |
|
||||
calculatedSha=$(git rev-parse --short ${{ github.sha }})
|
||||
echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
|
||||
|
||||
- name: Build & Push Docker Image
|
||||
run: |
|
||||
docker build --provenance false --no-cache -t registry.zerotier.com/zerotier-central/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-${{ runner.arch }} -f ext/central-controller-docker/Dockerfile . --push
|
||||
|
||||
multi-arch-docker:
|
||||
runs-on: gha-runner-x64
|
||||
needs: central_controller
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Docker Auth
|
||||
run: echo "${{ secrets.PORTUS_PW }}" | docker login registry.zerotier.com -u ${{ secrets.PORTUS_USER }} --password-stdin
|
||||
|
||||
- name: Get branch name and sanitize
|
||||
id: branch
|
||||
run: |
|
||||
BRANCH_NAME="${GITHUB_REF##*/}"
|
||||
SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
|
||||
echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Get short git commit SHA
|
||||
id: sha
|
||||
run: |
|
||||
calculatedSha=$(git rev-parse --short ${{ github.sha }})
|
||||
echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
|
||||
|
||||
- name: Create and push multi-arch manifest
|
||||
run: |
|
||||
docker manifest create registry.zerotier.com/zerotier-central/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }} \
|
||||
--amend registry.zerotier.com/zerotier-central/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-X64 \
|
||||
--amend registry.zerotier.com/zerotier-central/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-ARM64
|
||||
docker manifest push registry.zerotier.com/zerotier-central/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}
|
||||
@@ -1,104 +0,0 @@
|
||||
# on:
|
||||
# workflow_dispatch:
|
||||
on:
|
||||
push:
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
central_controller:
|
||||
name: Central Controller Build
|
||||
strategy:
|
||||
matrix:
|
||||
runner: [gha-runner-x64, gha-runner-arm64]
|
||||
runs-on: ${{ matrix.runner }}
|
||||
steps:
|
||||
- name: checkout
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: GCP Auth
|
||||
uses: google-github-actions/auth@v3
|
||||
with:
|
||||
credentials_json: ${{ secrets.DOCKER_REGISTRY_WRITER}}
|
||||
|
||||
- name: Set up GCloud CLI
|
||||
uses: google-github-actions/setup-gcloud@v3
|
||||
with:
|
||||
# v3 no longer uses the tool cache by default; restore the prior caching
|
||||
# behavior on these self-hosted runners (perf: avoids re-fetching the SDK).
|
||||
cache: true
|
||||
|
||||
- name: Docker Auth
|
||||
run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
|
||||
|
||||
- name: Get branch name and sanitize
|
||||
id: branch
|
||||
run: |
|
||||
BRANCH_NAME="${GITHUB_REF##*/}"
|
||||
SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
|
||||
echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Get short git commit SHA
|
||||
id: sha
|
||||
run: |
|
||||
calculatedSha=$(git rev-parse --short ${{ github.sha }})
|
||||
echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v4
|
||||
|
||||
- name: Build & Push Docker Image
|
||||
# Registry layer cache (mode=max) so the expensive builder stage -- which
|
||||
# builds opentelemetry-cpp + google-cloud-cpp from source -- is reused across
|
||||
# runs and fresh runners. The cache invalidates automatically when the
|
||||
# bootstrap inputs change. Cache is per-arch (the deps layer is arch-specific).
|
||||
run: |
|
||||
CACHE=us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller-buildcache:${{ runner.arch }}
|
||||
docker buildx build \
|
||||
-t us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-${{ runner.arch }} \
|
||||
-f ext/central-controller-docker/Dockerfile \
|
||||
--cache-from type=registry,ref=$CACHE \
|
||||
--cache-to type=registry,ref=$CACHE,mode=max \
|
||||
--provenance false \
|
||||
--push .
|
||||
|
||||
multi-arch-docker:
|
||||
runs-on: gha-runner-x64
|
||||
needs: central_controller
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: GCP Auth
|
||||
uses: google-github-actions/auth@v3
|
||||
with:
|
||||
credentials_json: ${{ secrets.DOCKER_REGISTRY_WRITER}}
|
||||
|
||||
- name: Set up GCloud CLI
|
||||
uses: google-github-actions/setup-gcloud@v3
|
||||
with:
|
||||
# v3 no longer uses the tool cache by default; restore the prior caching
|
||||
# behavior on these self-hosted runners (perf: avoids re-fetching the SDK).
|
||||
cache: true
|
||||
|
||||
- name: Docker Auth
|
||||
run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
|
||||
|
||||
- name: Get branch name and sanitize
|
||||
id: branch
|
||||
run: |
|
||||
BRANCH_NAME="${GITHUB_REF##*/}"
|
||||
SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
|
||||
echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Get short git commit SHA
|
||||
id: sha
|
||||
run: |
|
||||
calculatedSha=$(git rev-parse --short ${{ github.sha }})
|
||||
echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
|
||||
|
||||
- name: Create and push multi-arch manifest
|
||||
run: |
|
||||
docker manifest create us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }} \
|
||||
--amend us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-X64 \
|
||||
--amend us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-ARM64
|
||||
docker manifest push us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}
|
||||
+2
-7
@@ -143,11 +143,6 @@ __pycache__
|
||||
*.pyc
|
||||
*_source.tar.bz2
|
||||
snap/.snapcraft
|
||||
build/
|
||||
|
||||
# Local dependency bootstrap output (scripts/bootstrap-deps.sh): the install
|
||||
# prefix and the build/clone scratch dir. Large + host-specific; never commit.
|
||||
.deps/
|
||||
.deps-build/
|
||||
|
||||
.claude/*.local.*
|
||||
# local Claude configurations
|
||||
.claude/*.local.*
|
||||
@@ -1,28 +0,0 @@
|
||||
# Central Controller build dependencies for macOS development.
|
||||
#
|
||||
# brew bundle # install the deps below
|
||||
# ZT_CONTROLLER_DEPS=1 scripts/bootstrap-deps.sh # build the two pinned controller deps (full OTel + google-cloud-cpp)
|
||||
#
|
||||
# The two version-sensitive C++ libraries (opentelemetry-cpp, google-cloud-cpp)
|
||||
# are NOT taken from Homebrew -- they are pinned and built from source by
|
||||
# scripts/bootstrap-deps.sh so every dev/CI machine uses the same versions
|
||||
# (the role conda previously filled). Everything below is stable enough to take
|
||||
# from Homebrew.
|
||||
|
||||
brew "cmake"
|
||||
brew "ninja"
|
||||
brew "pkg-config"
|
||||
brew "rustup-init" # then: rustup-init -y && rustup default stable
|
||||
|
||||
brew "libpqxx"
|
||||
brew "libpq" # keg-only; add $(brew --prefix libpq) to CMAKE_PREFIX_PATH so find_package(PostgreSQL) resolves
|
||||
brew "hiredis"
|
||||
brew "jemalloc"
|
||||
brew "nlohmann-json"
|
||||
brew "openssl@3"
|
||||
brew "abseil"
|
||||
brew "protobuf"
|
||||
brew "grpc"
|
||||
brew "googletest" # google-cloud-cpp requires GTest/GMock at configure (builds its *_mocks libs)
|
||||
brew "curl"
|
||||
brew "inja"
|
||||
+7
-676
File diff suppressed because it is too large.
Load diff
@@ -1,167 +0,0 @@
|
||||
{
|
||||
"version": 3,
|
||||
"cmakeMinimumRequired": { "major": 3, "minor": 21, "patch": 0 },
|
||||
"configurePresets": [
|
||||
{
|
||||
"name": "unix-base",
|
||||
"hidden": true,
|
||||
"generator": "Unix Makefiles",
|
||||
"binaryDir": "${sourceDir}/build-${presetName}",
|
||||
"cacheVariables": {
|
||||
"CMAKE_PREFIX_PATH": "${sourceDir}/.deps",
|
||||
"CMAKE_BUILD_TYPE": "Release"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "linux-base",
|
||||
"hidden": true,
|
||||
"inherits": "unix-base",
|
||||
"condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Linux" }
|
||||
},
|
||||
{
|
||||
"name": "macos-base",
|
||||
"hidden": true,
|
||||
"inherits": "unix-base",
|
||||
"condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Darwin" },
|
||||
"cacheVariables": {
|
||||
"CMAKE_PREFIX_PATH": "${sourceDir}/.deps;$env{HOMEBREW_PREFIX};$env{HOMEBREW_PREFIX}/opt/openssl@3;$env{HOMEBREW_PREFIX}/opt/libpq"
|
||||
}
|
||||
},
|
||||
|
||||
{ "name": "linux-release", "inherits": "linux-base", "displayName": "Linux daemon (Release)" },
|
||||
{ "name": "linux-debug", "inherits": "linux-base", "displayName": "Linux daemon (Debug)", "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
|
||||
{ "name": "linux-controller-release", "inherits": "linux-base", "displayName": "Linux Central Controller (Release)", "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON" } },
|
||||
{ "name": "linux-controller-debug", "inherits": "linux-base", "displayName": "Linux Central Controller (Debug)", "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON", "CMAKE_BUILD_TYPE": "Debug" } },
|
||||
{ "name": "linux-free-release", "inherits": "linux-base", "displayName": "Linux daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
|
||||
{ "name": "linux-free-debug", "inherits": "linux-base", "displayName": "Linux daemon, free / no controller (Debug)", "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
|
||||
|
||||
{ "name": "macos-release", "inherits": "macos-base", "displayName": "macOS daemon (Release)" },
|
||||
{ "name": "macos-debug", "inherits": "macos-base", "displayName": "macOS daemon (Debug)", "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
|
||||
{ "name": "macos-controller-release", "inherits": "macos-base", "displayName": "macOS Central Controller (Release)", "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON" } },
|
||||
{ "name": "macos-controller-debug", "inherits": "macos-base", "displayName": "macOS Central Controller (Debug)", "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON", "CMAKE_BUILD_TYPE": "Debug" } },
|
||||
{ "name": "macos-free-release", "inherits": "macos-base", "displayName": "macOS daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
|
||||
{ "name": "macos-free-debug", "inherits": "macos-base", "displayName": "macOS daemon, free / no controller (Debug)", "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
|
||||
{ "name": "macos-universal-release", "inherits": "macos-base", "displayName": "macOS universal daemon (arm64 + x86_64, Release)", "cacheVariables": { "CMAKE_OSX_ARCHITECTURES": "arm64;x86_64" } },
|
||||
{ "name": "macos-universal-debug", "inherits": "macos-base", "displayName": "macOS universal daemon (arm64 + x86_64, Debug)", "cacheVariables": { "CMAKE_OSX_ARCHITECTURES": "arm64;x86_64", "CMAKE_BUILD_TYPE": "Debug" } },
|
||||
|
||||
{
|
||||
"name": "freebsd-base",
|
||||
"hidden": true,
|
||||
"inherits": "unix-base",
|
||||
"condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "FreeBSD" }
|
||||
},
|
||||
{
|
||||
"name": "openbsd-base",
|
||||
"hidden": true,
|
||||
"inherits": "unix-base",
|
||||
"condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "OpenBSD" }
|
||||
},
|
||||
{
|
||||
"name": "netbsd-base",
|
||||
"hidden": true,
|
||||
"inherits": "unix-base",
|
||||
"condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "NetBSD" }
|
||||
},
|
||||
|
||||
{ "name": "freebsd-release", "inherits": "freebsd-base", "displayName": "FreeBSD daemon (Release)" },
|
||||
{ "name": "freebsd-debug", "inherits": "freebsd-base", "displayName": "FreeBSD daemon (Debug)", "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
|
||||
{ "name": "freebsd-free-release", "inherits": "freebsd-base", "displayName": "FreeBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
|
||||
{ "name": "freebsd-free-debug", "inherits": "freebsd-base", "displayName": "FreeBSD daemon, free / no controller (Debug)", "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
|
||||
|
||||
{ "name": "openbsd-release", "inherits": "openbsd-base", "displayName": "OpenBSD daemon (Release)" },
|
||||
{ "name": "openbsd-debug", "inherits": "openbsd-base", "displayName": "OpenBSD daemon (Debug)", "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
|
||||
{ "name": "openbsd-free-release", "inherits": "openbsd-base", "displayName": "OpenBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
|
||||
{ "name": "openbsd-free-debug", "inherits": "openbsd-base", "displayName": "OpenBSD daemon, free / no controller (Debug)", "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
|
||||
|
||||
{ "name": "netbsd-release", "inherits": "netbsd-base", "displayName": "NetBSD daemon (Release)" },
|
||||
{ "name": "netbsd-debug", "inherits": "netbsd-base", "displayName": "NetBSD daemon (Debug)", "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
|
||||
{ "name": "netbsd-free-release", "inherits": "netbsd-base", "displayName": "NetBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
|
||||
{ "name": "netbsd-free-debug", "inherits": "netbsd-base", "displayName": "NetBSD daemon, free / no controller (Debug)", "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
|
||||
|
||||
{
|
||||
"name": "windows-x64",
|
||||
"displayName": "Windows x64 daemon (MSVC + vcpkg)",
|
||||
"generator": "Visual Studio 17 2022",
|
||||
"architecture": "x64",
|
||||
"binaryDir": "${sourceDir}/build-${presetName}",
|
||||
"condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Windows" },
|
||||
"cacheVariables": {
|
||||
"CMAKE_TOOLCHAIN_FILE": "$env{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake",
|
||||
"VCPKG_TARGET_TRIPLET": "x64-windows-static",
|
||||
"CMAKE_PREFIX_PATH": "${sourceDir}/.deps/x64"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "windows-arm64",
|
||||
"inherits": "windows-x64",
|
||||
"displayName": "Windows ARM64 daemon (MSVC + vcpkg)",
|
||||
"architecture": "ARM64",
|
||||
"cacheVariables": { "VCPKG_TARGET_TRIPLET": "arm64-windows-static", "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/ARM64" }
|
||||
},
|
||||
{
|
||||
"name": "windows-x86",
|
||||
"inherits": "windows-x64",
|
||||
"displayName": "Windows x86 daemon (MSVC + vcpkg)",
|
||||
"architecture": "Win32",
|
||||
"cacheVariables": { "VCPKG_TARGET_TRIPLET": "x86-windows-static", "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/Win32" }
|
||||
},
|
||||
{
|
||||
"name": "windows-x64-free",
|
||||
"inherits": "windows-x64",
|
||||
"displayName": "Windows x64 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
|
||||
"cacheVariables": { "ZT_NONFREE": "OFF" }
|
||||
},
|
||||
{
|
||||
"name": "windows-arm64-free",
|
||||
"inherits": "windows-arm64",
|
||||
"displayName": "Windows ARM64 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
|
||||
"cacheVariables": { "ZT_NONFREE": "OFF" }
|
||||
},
|
||||
{
|
||||
"name": "windows-x86-free",
|
||||
"inherits": "windows-x86",
|
||||
"displayName": "Windows x86 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
|
||||
"cacheVariables": { "ZT_NONFREE": "OFF" }
|
||||
}
|
||||
],
|
||||
"buildPresets": [
|
||||
{ "name": "linux-release", "configurePreset": "linux-release" },
|
||||
{ "name": "linux-debug", "configurePreset": "linux-debug" },
|
||||
{ "name": "linux-controller-release", "configurePreset": "linux-controller-release" },
|
||||
{ "name": "linux-controller-debug", "configurePreset": "linux-controller-debug" },
|
||||
{ "name": "linux-free-release", "configurePreset": "linux-free-release" },
|
||||
{ "name": "linux-free-debug", "configurePreset": "linux-free-debug" },
|
||||
{ "name": "macos-release", "configurePreset": "macos-release" },
|
||||
{ "name": "macos-debug", "configurePreset": "macos-debug" },
|
||||
{ "name": "macos-controller-release", "configurePreset": "macos-controller-release" },
|
||||
{ "name": "macos-controller-debug", "configurePreset": "macos-controller-debug" },
|
||||
{ "name": "macos-free-release", "configurePreset": "macos-free-release" },
|
||||
{ "name": "macos-free-debug", "configurePreset": "macos-free-debug" },
|
||||
{ "name": "macos-universal-release", "configurePreset": "macos-universal-release" },
|
||||
{ "name": "macos-universal-debug", "configurePreset": "macos-universal-debug" },
|
||||
{ "name": "freebsd-release", "configurePreset": "freebsd-release" },
|
||||
{ "name": "freebsd-debug", "configurePreset": "freebsd-debug" },
|
||||
{ "name": "freebsd-free-release", "configurePreset": "freebsd-free-release" },
|
||||
{ "name": "freebsd-free-debug", "configurePreset": "freebsd-free-debug" },
|
||||
{ "name": "openbsd-release", "configurePreset": "openbsd-release" },
|
||||
{ "name": "openbsd-debug", "configurePreset": "openbsd-debug" },
|
||||
{ "name": "openbsd-free-release", "configurePreset": "openbsd-free-release" },
|
||||
{ "name": "openbsd-free-debug", "configurePreset": "openbsd-free-debug" },
|
||||
{ "name": "netbsd-release", "configurePreset": "netbsd-release" },
|
||||
{ "name": "netbsd-debug", "configurePreset": "netbsd-debug" },
|
||||
{ "name": "netbsd-free-release", "configurePreset": "netbsd-free-release" },
|
||||
{ "name": "netbsd-free-debug", "configurePreset": "netbsd-free-debug" },
|
||||
{ "name": "windows-x64-release", "configurePreset": "windows-x64", "configuration": "Release" },
|
||||
{ "name": "windows-x64-debug", "configurePreset": "windows-x64", "configuration": "Debug" },
|
||||
{ "name": "windows-arm64-release", "configurePreset": "windows-arm64", "configuration": "Release" },
|
||||
{ "name": "windows-arm64-debug", "configurePreset": "windows-arm64", "configuration": "Debug" },
|
||||
{ "name": "windows-x86-release", "configurePreset": "windows-x86", "configuration": "Release" },
|
||||
{ "name": "windows-x86-debug", "configurePreset": "windows-x86", "configuration": "Debug" },
|
||||
{ "name": "windows-x64-free-release", "configurePreset": "windows-x64-free", "configuration": "Release" },
|
||||
{ "name": "windows-x64-free-debug", "configurePreset": "windows-x64-free", "configuration": "Debug" },
|
||||
{ "name": "windows-arm64-free-release", "configurePreset": "windows-arm64-free", "configuration": "Release" },
|
||||
{ "name": "windows-arm64-free-debug", "configurePreset": "windows-arm64-free", "configuration": "Debug" },
|
||||
{ "name": "windows-x86-free-release", "configurePreset": "windows-x86-free", "configuration": "Release" },
|
||||
{ "name": "windows-x86-free-debug", "configurePreset": "windows-x86-free", "configuration": "Debug" }
|
||||
]
|
||||
}
|
||||
@@ -31,79 +31,6 @@ To build on Mac and Linux just type `make`. On FreeBSD and OpenBSD `gmake` (GNU
|
||||
- GNU make is required. Type `gmake` to build.
|
||||
- Rust for x86_64 and ARM64 targets *if SSO is enabled in the build*.
|
||||
|
||||
### Building with CMake (optional)
|
||||
|
||||
> **Note:** CMake is an *alternative* build path, offered as a convenience. The official
|
||||
> builds are still produced by the platform makefiles (above) and the Visual Studio solution
|
||||
> in `windows/`.
|
||||
|
||||
#### Prerequisites
|
||||
|
||||
- **CMake** 3.15 or newer.
|
||||
- The same compiler/toolchain (and Rust, if SSO is enabled) as the makefile build for your
|
||||
platform — see *Platform Requirements* above.
|
||||
- The header-only **OpenTelemetry API** must be present on `CMAKE_PREFIX_PATH`. Populate it
|
||||
into `./.deps` by running the bootstrap script once, in its **default** (quick, header-only)
|
||||
mode — i.e. *without* `ZT_CONTROLLER_DEPS=1`, which is the heavyweight controller-only path:
|
||||
|
||||
```bash
|
||||
scripts/bootstrap-deps.sh # default mode: header-only OTel API into ./.deps
|
||||
```
|
||||
|
||||
The script prints the exact `-DCMAKE_PREFIX_PATH` to use when it finishes.
|
||||
|
||||
#### Free vs. default (non-free) builds
|
||||
|
||||
By default the daemon is built **with the bundled FileDB network controller**, which lives
|
||||
under `nonfree/` and is "source available" (non-free) — this matches what ships in official
|
||||
builds (`ZT_NONFREE=ON`). To produce a **purely free** daemon (MPL-2.0 `node/`, `osdep/`,
|
||||
`service/` only, with no `nonfree/` code compiled or linked), set **`-DZT_NONFREE=OFF`** — or
|
||||
use one of the `*-free-*` presets, which set it for you.
|
||||
|
||||
#### Using presets (recommended)
|
||||
|
||||
`cmake --list-presets` shows the presets for your OS. The daemon presets are:
|
||||
|
||||
| Preset | Build |
|
||||
| --- | --- |
|
||||
| `macos-release` / `linux-release` | Default daemon (**includes** the non-free bundled controller) |
|
||||
| `macos-free-release` / `linux-free-release` | **Free** daemon (`ZT_NONFREE=OFF`, no non-free code) |
|
||||
| `macos-debug` / `linux-debug` (and `*-free-debug`) | Debug variants of the above |
|
||||
| `macos-universal-release` | macOS universal (arm64 + x86_64) daemon |
|
||||
| `freebsd-release` / `openbsd-release` / `netbsd-release` (and `*-free-release`, `*-debug`) | BSD daemon / free variant |
|
||||
| `windows-x64-release` (and `windows-x64-free`) | Windows daemon / free variant |
|
||||
|
||||
```bash
|
||||
# Default (non-free) daemon:
|
||||
cmake --preset macos-release
|
||||
cmake --build --preset macos-release
|
||||
|
||||
# Purely free daemon:
|
||||
cmake --preset macos-free-release
|
||||
cmake --build --preset macos-free-release
|
||||
```
|
||||
|
||||
Each preset builds into its own directory, `build-<presetName>/`, so the binary lands at e.g.
|
||||
`build-macos-free-release/zerotier-one`. (macOS/Linux presets use single-config Unix Makefiles,
|
||||
so the build type is baked into the preset name — there's no `Release/` subdirectory.)
|
||||
|
||||
#### Manual invocation
|
||||
|
||||
The equivalent without presets:
|
||||
|
||||
```bash
|
||||
# Default (non-free) daemon — .deps holds the OTel API from bootstrap-deps.sh:
|
||||
cmake -DCMAKE_PREFIX_PATH="$PWD/.deps" -S . -B build
|
||||
cmake --build build -j8
|
||||
|
||||
# Purely free daemon:
|
||||
cmake -DZT_NONFREE=OFF -DCMAKE_PREFIX_PATH="$PWD/.deps" -S . -B build
|
||||
cmake --build build -j8
|
||||
```
|
||||
|
||||
The binary is `build/zerotier-one`. (On macOS, append the Homebrew prefixes to
|
||||
`CMAKE_PREFIX_PATH` if your dependencies come from Homebrew, as the presets do.)
|
||||
|
||||
### Testing
|
||||
|
||||
Typing `make selftest` will build a *zerotier-selftest* binary which unit tests various internals and reports on a few aspects of the build environment. It's a good idea to try this on novel platforms or architectures.
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
set -e
|
||||
|
||||
cmake -DCMAKE_BUILD_TYPE=Release -DZT1_CENTRAL_CONTROLLER=1 -DCMAKE_INSTALL_PREFIX=$PWD -S . -B build/ -DCMAKE_INSTALL_PREFIX=$(shell pwd)/build-out
|
||||
cmake --build build/ --target all -j4 --verbose
|
||||
|
||||
ARCH=$(uname -m)
|
||||
if [ "$ARCH" = "x86_64" ]; then
|
||||
ARCH="amd64"
|
||||
elif [ "$ARCH" = "aarch64" ]; then
|
||||
ARCH="arm64"
|
||||
fi
|
||||
|
||||
if [ -z "$TARGET_DOCKER_REPO" ]; then
|
||||
TARGET_DOCKER_REPO="us-central1-docker.pkg.dev/zerotier-421eb9/docker-images"
|
||||
fi
|
||||
|
||||
docker build -platform linux/$ARCH -t $TARGET_DOCKER_REPO/ztcentral-controller:$(git rev-parse --short HEAD)-$ARCH -f ext/central-controller/docker/Dockerfile.central-controller . --load --push
|
||||
@@ -1,28 +0,0 @@
|
||||
|
||||
set(FETCHCONTENT_QUIET OFF)
|
||||
|
||||
FetchContent_Declare(
|
||||
cpp-httplib
|
||||
GIT_REPOSITORY https://github.com/yhirose/cpp-httplib.git
|
||||
# v0.47.0+: supports 32-bit Windows. v0.25.0 had a `#warning` refusing 32-bit
|
||||
# Windows that MSVC's default preprocessor escalates to a fatal C1021 (breaks
|
||||
# the windows-x86 build).
|
||||
GIT_TAG v0.47.0
|
||||
GIT_SHALLOW ON
|
||||
)
|
||||
set(BUILD_SHARED_LIBS OFF CACHE INTERNAL "")
|
||||
set(HTTPLIB_COMPILE OFF CACHE INTERNAL "")
|
||||
set(HTTPLIB_USE_ZLIB_IF_AVAILABLE ON CACHE INTERNAL "Use zlib if available")
|
||||
set(HTTPLIB_USE_BROTLI_IF_AVAILABLE ON CACHE INTERNAL "Use brotli if available")
|
||||
# The ZeroTier control plane is plain HTTP on localhost (no httplib SSLServer/SSLClient
|
||||
# anywhere), and outbound SSO/OIDC TLS lives in rustybits (native-tls), so httplib never
|
||||
# needs OpenSSL. Keeping this ON would link OpenSSL purely as dead weight -- which also
|
||||
# blocks universal macOS builds (Homebrew OpenSSL is single-arch).
|
||||
set(HTTPLIB_USE_OPENSSL_IF_AVAILABLE OFF CACHE INTERNAL "ZeroTier uses httplib for plain HTTP only")
|
||||
set(HTTPLIB_USE_ZSTD_IF_AVAILABLE ON CACHE INTERNAL "Use zstd if available")
|
||||
FetchContent_MakeAvailable(cpp-httplib)
|
||||
|
||||
if (NOT TARGET httplib::httplib)
|
||||
message(FATAL_ERROR "A required cpp-httplib target (cpp-httplib) was not imported")
|
||||
endif()
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
# inja -- header-only C++ templating engine used by service/OneService.cpp
|
||||
# (`#include <inja/inja.hpp>`). Homebrew ships no usable CMake config and Debian
|
||||
# has no package, so we vendor the headers via FetchContent. We populate the
|
||||
# source only and skip inja's own CMakeLists (its build/test/json machinery) by
|
||||
# pointing SOURCE_SUBDIR at a non-existent directory. inja consumes
|
||||
# nlohmann::json, which the build already provides via find_package(nlohmann_json)
|
||||
# and links into the targets that use inja; we only need inja's headers on the
|
||||
# include path here (header-only, no link), matching the previous conda setup.
|
||||
include(FetchContent)
|
||||
FetchContent_Declare(inja
|
||||
GIT_REPOSITORY https://github.com/pantor/inja.git
|
||||
GIT_TAG v3.4.0
|
||||
GIT_SHALLOW ON
|
||||
SOURCE_SUBDIR _skip_inja_cmakelists_) # populate only; no add_subdirectory
|
||||
FetchContent_MakeAvailable(inja)
|
||||
|
||||
# inja ships an amalgamated header under single_include/inja/inja.hpp.
|
||||
include_directories("${inja_SOURCE_DIR}/single_include")
|
||||
@@ -1,32 +0,0 @@
|
||||
set(FETCHCONTENT_QUIET OFF)
|
||||
|
||||
FetchContent_Declare(
|
||||
miniupnpc
|
||||
URL https://github.com/miniupnp/miniupnp/releases/download/miniupnpc_2_3_3/miniupnpc-2.3.3.tar.gz
|
||||
DOWNLOAD_EXTRACT_TIMESTAMP TRUE
|
||||
)
|
||||
set(UPNPC_BUILD_TESTS FALSE CACHE INTERNAL "Build tests" FORCE)
|
||||
set(UPNPC_BUILD_SHARED FALSE CACHE INTERNAL "Build shared library" FORCE)
|
||||
set(UPNPC_BUILD_STATIC TRUE CACHE INTERNAL "Build static library" FORCE)
|
||||
set(UPNPC_BUILD_SAMPLE FALSE CACHE INTERNAL "Build sample" FORCE)
|
||||
|
||||
FetchContent_MakeAvailable(miniupnpc)
|
||||
|
||||
if (NOT TARGET miniupnpc::miniupnpc)
|
||||
message(FATAL_ERROR "A required miniupnpc target (miniupnpc::miniupnpc) was not imported")
|
||||
endif()
|
||||
add_definitions(-DZT_USE_MINIUPNPC)
|
||||
|
||||
FetchContent_Declare(
|
||||
libnatpmp
|
||||
GIT_REPOSITORY https://github.com/miniupnp/libnatpmp.git
|
||||
GIT_TAG master
|
||||
GIT_SHALLOW ON
|
||||
PATCH_COMMAND git apply ${CMAKE_SOURCE_DIR}/ext/cmake-patches/libnatpmp.patch
|
||||
UPDATE_DISCONNECTED TRUE
|
||||
)
|
||||
FetchContent_MakeAvailable(libnatpmp)
|
||||
|
||||
if (NOT TARGET natpmp)
|
||||
message(FATAL_ERROR "A required libnatpmp target (natpmp) was not imported")
|
||||
endif()
|
||||
@@ -1,28 +0,0 @@
|
||||
set(FETCHCONTENT_QUIET OFF)
|
||||
|
||||
FetchContent_Declare(
|
||||
redis-plus-plus
|
||||
GIT_REPOSITORY https://github.com/sewenew/redis-plus-plus.git
|
||||
GIT_TAG 1.3.15
|
||||
GIT_SHALLOW ON
|
||||
)
|
||||
set(REDIS_PLUS_PLUS_BUILD_STATIC ON CACHE INTERNAL "Build static library" FORCE)
|
||||
# We only link redis++::redis++_static, so skip the unused shared library.
|
||||
set(REDIS_PLUS_PLUS_BUILD_SHARED OFF CACHE INTERNAL "Build shared library" FORCE)
|
||||
set(REDIS_PLUS_PLUS_BUILD_TEST OFF CACHE INTERNAL "Build tests" FORCE)
|
||||
set(REDIS_PLUS_PLUS_BUILD_STATIC_WITH_PIC ON CACHE INTERNAL "Build static library with PIC" FORCE)
|
||||
set(BUILD_SHARED_LIBS OFF CACHE INTERNAL "Build shared libraries" FORCE)
|
||||
|
||||
FetchContent_MakeAvailable(redis-plus-plus)
|
||||
if(NOT TARGET redis++::redis++_static)
|
||||
message(FATAL_ERROR "A required redis-plus-plus target (redis++::redis++_static) was not imported")
|
||||
endif()
|
||||
|
||||
# redis++'s static library calls into hiredis but does not propagate that
|
||||
# dependency to consumers, so the final link fails with undefined hiredis
|
||||
# symbols (redisAppendCommand, redisFree, freeReplyObject, ...). Attach hiredis
|
||||
# to the static target's interface. find_library (not find_package(hiredis))
|
||||
# because Debian's libhiredis-dev ships no CMake config.
|
||||
find_library(HIREDIS_LIB hiredis REQUIRED)
|
||||
target_link_libraries(redis++_static INTERFACE ${HIREDIS_LIB})
|
||||
message(STATUS "redis-plus-plus imported (hiredis: ${HIREDIS_LIB})")
|
||||
@@ -1,12 +0,0 @@
|
||||
cmake_minimum_required(VERSION 3.13)
|
||||
project(ext)
|
||||
|
||||
file(GLOB_RECURSE PROM_CORE_HEADERS ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/core/include/*.h )
|
||||
set(PROMETHEUS_CPP_LITE_HEADERS ${PROM_CORE_HEADERS} ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/simpleapi/include)
|
||||
|
||||
|
||||
add_library(prometheus-cpp-lite INTERFACE)
|
||||
target_sources(prometheus-cpp-lite INTERFACE ${PROMETHEUS_CPP_LITE_HEADERS})
|
||||
target_include_directories(prometheus-cpp-lite INTERFACE ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/simpleapi/include ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/core/include)
|
||||
add_custom_target(prometheus-cpp-lite-ide SOURCES ${PROMETHEUS_CPP_LITE_HEADERS})
|
||||
set(prometheus-cpp-lite_INCLUDE ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/simpleapi/include ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/core/include PARENT_SCOPE)
|
||||
@@ -1,68 +1,21 @@
|
||||
# Central Controller -- conda-free, CMake-based, Debian trixie. Multi-stage:
|
||||
# builder : apt deps + scripts/bootstrap-deps.sh (OTel 1.27 + google-cloud-cpp
|
||||
# 2.38 from source) + CMake build of zerotier-one
|
||||
# go_base : golang-migrate
|
||||
# runtime : slim trixie with exactly the runtime libs the binary needs
|
||||
#
|
||||
# Build (context = repo root, see .dockerignore):
|
||||
# docker build -f ext/central-controller-docker/Dockerfile -t ztctl .
|
||||
FROM debian:trixie AS builder
|
||||
# Dockerfile for ZeroTier Central Controllers
|
||||
FROM registry.zerotier.com/zerotier/ctlbuild:2025-07-14 AS builder
|
||||
ADD . /ZeroTierOne
|
||||
RUN export PATH=$PATH:~/.cargo/bin && cd ZeroTierOne && make clean && make central-controller -j8
|
||||
|
||||
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
|
||||
build-essential cmake ninja-build git pkg-config ca-certificates curl \
|
||||
libpqxx-dev libpq-dev libhiredis-dev libjemalloc-dev nlohmann-json3-dev \
|
||||
libabsl-dev libprotobuf-dev protobuf-compiler protobuf-compiler-grpc libgrpc++-dev \
|
||||
libgtest-dev libgmock-dev libssl-dev libcurl4-openssl-dev \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
|
||||
| sh -s -- -y --default-toolchain 1.89.0 --profile minimal
|
||||
ENV PATH="/root/.cargo/bin:${PATH}"
|
||||
|
||||
WORKDIR /ZeroTierOne
|
||||
|
||||
# Pinned from-source deps -> /opt/zt-deps, against apt's abseil/protobuf/grpc.
|
||||
# ZT_CONTROLLER_DEPS=1 builds the full controller set (OTel SDK + OTLP exporters +
|
||||
# google-cloud-cpp); without it the script only builds the header-only OTel API.
|
||||
# Copy only the bootstrap script first so this expensive layer stays cached across
|
||||
# changes to the rest of the tree.
|
||||
COPY scripts/bootstrap-deps.sh scripts/bootstrap-deps.sh
|
||||
RUN ZT_CONTROLLER_DEPS=1 bash scripts/bootstrap-deps.sh /opt/zt-deps
|
||||
|
||||
COPY . .
|
||||
RUN cmake -DCMAKE_BUILD_TYPE=Release -DZT1_CENTRAL_CONTROLLER=1 \
|
||||
-DCMAKE_PREFIX_PATH=/opt/zt-deps -S . -B build-cmake -G Ninja \
|
||||
&& cmake --build build-cmake -j"$(nproc)"
|
||||
|
||||
# Compute the exact runtime apt packages the binary links (robust against the
|
||||
# trixie t64 package renames). The two non-apt OTel proto .so's are copied
|
||||
# explicitly in the runtime stage, so dpkg-S misses there are expected.
|
||||
# readlink -f resolves the usrmerge /lib -> /usr/lib symlinks so dpkg -S can
|
||||
# attribute each .so to its package (and naturally picks up the trixie t64 names).
|
||||
RUN ldd build-cmake/zerotier-one | awk '/=> \//{print $3}' | xargs -r readlink -f \
|
||||
| xargs -r dpkg -S 2>/dev/null | cut -d: -f1 | tr ',' '\n' | sort -u > /opt/runtime-pkgs.txt \
|
||||
&& echo "--- runtime packages ---" && cat /opt/runtime-pkgs.txt
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
FROM golang:1.24-bookworm AS go_base
|
||||
RUN GOFLAGS='-p=1' go install -tags 'postgres' github.com/golang-migrate/migrate/v4/cmd/migrate@latest
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
FROM debian:trixie AS runtime
|
||||
COPY --from=builder /opt/runtime-pkgs.txt /opt/runtime-pkgs.txt
|
||||
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
|
||||
$(cat /opt/runtime-pkgs.txt) \
|
||||
libjemalloc2 postgresql-client netcat-openbsd ca-certificates \
|
||||
&& rm -rf /var/lib/apt/lists/* /opt/runtime-pkgs.txt
|
||||
|
||||
COPY --from=builder /ZeroTierOne/build-cmake/zerotier-one /usr/local/bin/zerotier-one
|
||||
# The only dynamically-linked from-source libs (OTel/gcloud are otherwise static).
|
||||
COPY --from=builder /opt/zt-deps/lib/libopentelemetry_proto.so /opt/zt-deps/lib/libopentelemetry_proto_grpc.so /usr/local/lib/
|
||||
RUN echo /usr/local/lib > /etc/ld.so.conf.d/zerotier.conf && ldconfig
|
||||
FROM golang:1.24.1-bookworm AS go_base
|
||||
RUN GONOSUMDB=* GOFLAGS='-p=1' go install -tags 'postgres' github.com/golang-migrate/migrate/v4/cmd/migrate@latest
|
||||
|
||||
FROM registry.zerotier.com/zerotier/ctlrun:2025-07-14 AS run_base
|
||||
COPY --from=builder /ZeroTierOne/zerotier-one /usr/local/bin/zerotier-one
|
||||
COPY --from=builder /ZeroTierOne/ext/opentelemetry-cpp-1.21.0/localinstall/lib/*.so /usr/local/lib64/
|
||||
COPY --from=go_base /go/bin/migrate /usr/local/bin/migrate
|
||||
COPY ext/central-controller-docker/migrations /migrations
|
||||
COPY ext/central-controller-docker/main.sh /main.sh
|
||||
RUN chmod +x /usr/local/bin/zerotier-one /usr/local/bin/migrate /main.sh
|
||||
|
||||
ENTRYPOINT ["/main.sh"]
|
||||
RUN chmod a+x /usr/local/bin/zerotier-one
|
||||
RUN echo "/usr/local/lib64" > /etc/ld.so.conf.d/usr-local-lib64.conf && ldconfig
|
||||
|
||||
ADD ext/central-controller-docker/main.sh /
|
||||
RUN chmod a+x /main.sh
|
||||
|
||||
ENTRYPOINT /main.sh
|
||||
@@ -0,0 +1,34 @@
|
||||
# Dockerfile for building ZeroTier Central Controllers
|
||||
FROM debian:bookworm
|
||||
|
||||
RUN apt update && apt upgrade -y
|
||||
RUN apt -y install \
|
||||
build-essential \
|
||||
pkg-config \
|
||||
bash \
|
||||
clang \
|
||||
libjemalloc2 \
|
||||
libjemalloc-dev \
|
||||
libpq5 \
|
||||
libpq-dev \
|
||||
openssl \
|
||||
libssl-dev \
|
||||
postgresql-client \
|
||||
postgresql-client-common \
|
||||
curl \
|
||||
libcurl4-openssl-dev \
|
||||
google-perftools \
|
||||
libgoogle-perftools-dev \
|
||||
protobuf-compiler \
|
||||
protobuf-compiler-grpc \
|
||||
protobuf-c-compiler \
|
||||
grpc-proto \
|
||||
libgrpc++1.51 \
|
||||
libgrpc++-dev \
|
||||
libgrpc-dev \
|
||||
libgrpc29 \
|
||||
cmake \
|
||||
git
|
||||
|
||||
|
||||
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
|
||||
@@ -0,0 +1,19 @@
|
||||
FROM debian:bookworm
|
||||
|
||||
|
||||
|
||||
RUN apt update && apt upgrade -y
|
||||
RUN apt -y install \
|
||||
netcat-traditional \
|
||||
postgresql-client \
|
||||
postgresql-client-common \
|
||||
libjemalloc2 \
|
||||
libpq5 \
|
||||
curl \
|
||||
binutils \
|
||||
perf-tools-unstable \
|
||||
google-perftools \
|
||||
gnupg \
|
||||
libgrpc++1.51 \
|
||||
libgrpc29
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
registry = registry.zerotier.com/zerotier
|
||||
|
||||
all: controller-builder controller-runbase
|
||||
|
||||
buildx:
|
||||
@echo "docker buildx create"
|
||||
# docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
|
||||
docker run --privileged --rm tonistiigi/binfmt --install all
|
||||
@echo docker buildx create --name multiarch --driver docker-container --use
|
||||
@echo docker buildx inspect --bootstrap
|
||||
|
||||
controller-builder: buildx
|
||||
docker buildx build --no-cache --platform linux/amd64,linux/arm64 -t $(registry)/ctlbuild:$(shell date +"%Y-%m-%d") -f Dockerfile.builder . --push
|
||||
|
||||
controller-runbase: buildx
|
||||
docker buildx build --no-cache --platform linux/amd64,linux/arm64 -t $(registry)/ctlrun:$(shell date +"%Y-%m-%d") -f Dockerfile.run_base . --push
|
||||
@@ -20,6 +20,9 @@ if [ -z "$ZT_DB_PASSWORD" ]; then
|
||||
echo '*** FAILED: ZT_DB_PASSWORD environment variable not defined'
|
||||
exit 1
|
||||
fi
|
||||
if [ -z "$ZT_DB_TYPE" ]; then
|
||||
ZT_DB_TYPE="postgres"
|
||||
fi
|
||||
|
||||
REDIS=""
|
||||
if [ "$ZT_USE_REDIS" == "true" ]; then
|
||||
@@ -38,7 +41,7 @@ if [ "$ZT_USE_REDIS" == "true" ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
REDIS=", \"redis\": {
|
||||
REDIS="\"redis\": {
|
||||
\"hostname\": \"${ZT_REDIS_HOST}\",
|
||||
\"port\": ${ZT_REDIS_PORT},
|
||||
\"clusterMode\": ${ZT_REDIS_CLUSTER_MODE},
|
||||
@@ -46,7 +49,7 @@ if [ "$ZT_USE_REDIS" == "true" ]; then
|
||||
}
|
||||
"
|
||||
else
|
||||
REDIS=", \"redis\": null"
|
||||
REDIS="\"redis\": null"
|
||||
fi
|
||||
|
||||
mkdir -p /var/lib/zerotier-one
|
||||
@@ -57,9 +60,8 @@ if [ -d "$ZT_IDENTITY_PATH" ]; then
|
||||
|
||||
ln -s $ZT_IDENTITY_PATH/identity.public identity.public
|
||||
ln -s $ZT_IDENTITY_PATH/identity.secret identity.secret
|
||||
if [ -L "$ZT_IDENTITY_PATH/authtoken.secret" ] && [ -e "$ZT_IDENTITY_PATH/authtoken.secret" ]; then
|
||||
if [ -f "$ZT_IDENTITY_PATH/authtoken.secret" ]; then
|
||||
ln -s $ZT_IDENTITY_PATH/authtoken.secret authtoken.secret
|
||||
ln -s $ZT_IDENTITY_PATH/authtoken.secret metricstoken.secret
|
||||
fi
|
||||
fi
|
||||
popd
|
||||
@@ -69,90 +71,9 @@ DEFAULT_LB_MODE=false
|
||||
|
||||
APP_NAME="controller-$(cat /var/lib/zerotier-one/identity.public | cut -d ':' -f 1)"
|
||||
|
||||
BIGTABLE_CONF=""
|
||||
if [ "$ZT_USE_BIGTABLE" == "true" ]; then
|
||||
if [ -z "$ZT_BIGTABLE_PROJECT" ] || [ -z "$ZT_BIGTABLE_INSTANCE" ] || [ -z "$ZT_BIGTABLE_TABLE" ]; then
|
||||
echo '*** FAILED: ZT_BIGTABLE_PROJECT, ZT_BIGTABLE_INSTANCE, and ZT_BIGTABLE_TABLE environment variables must all be defined to use Bigtable as a controller backend'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
BIGTABLE_CONF=", \"bigtable\": {
|
||||
\"project_id\": \"${ZT_BIGTABLE_PROJECT}\",
|
||||
\"instance_id\": \"${ZT_BIGTABLE_INSTANCE}\",
|
||||
\"table_id\": \"${ZT_BIGTABLE_TABLE}\"
|
||||
}
|
||||
"
|
||||
fi
|
||||
|
||||
|
||||
PUBSUB_CONF=""
|
||||
if [ "$ZT_USE_PUBSUB" == "true" ]; then
|
||||
if [ -z "$ZT_PUBSUB_PROJECT" ]; then
|
||||
echo '*** FAILED: ZT_PUBSUB_PROJECT environment variable must be defined to use PubSub as a controller backend'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z "$ZT_PUBSUB_MEMBER_CHANGE_RECV_TOPIC" ] || [ -z "$ZT_PUBSUB_MEMBER_CHANGE_SEND_TOPIC" ] || [ -z "$ZT_PUBSUB_NETWORK_CHANGE_RECV_TOPIC" ] || [ -z "$ZT_PUBSUB_NETWORK_CHANGE_SEND_TOPIC" ]; then
|
||||
echo '*** FAILED: ZT_PUBSUB_MEMBER_CHANGE_RECV_TOPIC, ZT_PUBSUB_MEMBER_CHANGE_SEND_TOPIC, ZT_PUBSUB_NETWORK_CHANGE_RECV_TOPIC, and ZT_PUBSUB_NETWORK_CHANGE_SEND_TOPIC environment variables must all be defined to use PubSub as a controller backend'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
PUBSUB_CONF=", \"pubsub\": {
|
||||
\"project_id\": \"${ZT_PUBSUB_PROJECT}\",
|
||||
\"member_change_recv_topic\": \"${ZT_PUBSUB_MEMBER_CHANGE_RECV_TOPIC}\",
|
||||
\"member_change_send_topic\": \"${ZT_PUBSUB_MEMBER_CHANGE_SEND_TOPIC}\",
|
||||
\"network_change_recv_topic\": \"${ZT_PUBSUB_NETWORK_CHANGE_RECV_TOPIC}\",
|
||||
\"network_change_send_topic\": \"${ZT_PUBSUB_NETWORK_CHANGE_SEND_TOPIC}\",
|
||||
\"sso_nonce_publish_topic\": \"${ZT_PUBSUB_SSO_NONCE_PUBLISH_TOPIC}\",
|
||||
\"sso_auth_subscribe_topic\": \"${ZT_PUBSUB_SSO_AUTH_SUBSCRIBE_TOPIC}\"
|
||||
}
|
||||
"
|
||||
fi
|
||||
|
||||
# Backwards compatibility: if the per-frontend URLs aren't set but the legacy
|
||||
# ZT_SSO_REDIRECT_URL and ZT_ASSIGNED_CENTRAL_VERSION are both populated, map
|
||||
# the legacy URL into the new format keyed by the assigned Central version.
|
||||
if [ -z "$ZT_SSO_REDIRECT_URL_CV1" ] && [ -z "$ZT_SSO_REDIRECT_URL_CV2" ]; then
|
||||
if [ -n "$ZT_SSO_REDIRECT_URL" ] && [ -n "$ZT_ASSIGNED_CENTRAL_VERSION" ]; then
|
||||
case "$ZT_ASSIGNED_CENTRAL_VERSION" in
|
||||
cv1)
|
||||
ZT_SSO_REDIRECT_URL_CV1="$ZT_SSO_REDIRECT_URL"
|
||||
;;
|
||||
cv2)
|
||||
ZT_SSO_REDIRECT_URL_CV2="$ZT_SSO_REDIRECT_URL"
|
||||
;;
|
||||
all)
|
||||
echo '*** FAILED: controllers assigned to "all" must define ZT_SSO_REDIRECT_URL_CV1 and ZT_SSO_REDIRECT_URL_CV2; the legacy ZT_SSO_REDIRECT_URL cannot serve both Central versions'
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
fi
|
||||
|
||||
# Per-frontend Central SSO redirect URLs. SSO-enabled networks are routed to the
|
||||
# SSO endpoint of the Central version ("cv1" or "cv2") they belong to.
|
||||
SSO_REDIRECT_URLS_CONF=""
|
||||
if [ -n "$ZT_SSO_REDIRECT_URL_CV1" ] || [ -n "$ZT_SSO_REDIRECT_URL_CV2" ]; then
|
||||
SSO_REDIRECT_URLS=""
|
||||
if [ -n "$ZT_SSO_REDIRECT_URL_CV1" ]; then
|
||||
SSO_REDIRECT_URLS="\"cv1\": \"${ZT_SSO_REDIRECT_URL_CV1}\""
|
||||
fi
|
||||
if [ -n "$ZT_SSO_REDIRECT_URL_CV2" ]; then
|
||||
if [ -n "$SSO_REDIRECT_URLS" ]; then
|
||||
SSO_REDIRECT_URLS="${SSO_REDIRECT_URLS},
|
||||
"
|
||||
fi
|
||||
SSO_REDIRECT_URLS="${SSO_REDIRECT_URLS}\"cv2\": \"${ZT_SSO_REDIRECT_URL_CV2}\""
|
||||
fi
|
||||
SSO_REDIRECT_URLS_CONF=", \"ssoRedirectURLs\": {
|
||||
${SSO_REDIRECT_URLS}
|
||||
}
|
||||
"
|
||||
fi
|
||||
|
||||
echo "{
|
||||
\"settings\": {
|
||||
\"controllerDbPath\": \"postgres:host=${ZT_DB_HOST} port=${ZT_DB_PORT} dbname=${ZT_DB_NAME} user=${ZT_DB_USER} password=${ZT_DB_PASSWORD} application_name=${APP_NAME} sslmode=prefer sslcert=${DB_CLIENT_CERT} sslkey=${DB_CLIENT_KEY} sslrootcert=${DB_SERVER_CA}\",
|
||||
\"controllerDbPath\": \"${ZT_DB_TYPE}:host=${ZT_DB_HOST} port=${ZT_DB_PORT} dbname=${ZT_DB_NAME} user=${ZT_DB_USER} password=${ZT_DB_PASSWORD} application_name=${APP_NAME} sslmode=prefer sslcert=${DB_CLIENT_CERT} sslkey=${DB_CLIENT_KEY} sslrootcert=${DB_SERVER_CA}\",
|
||||
\"portMappingEnabled\": true,
|
||||
\"softwareUpdate\": \"disable\",
|
||||
\"interfacePrefixBlacklist\": [
|
||||
@@ -162,48 +83,38 @@ echo "{
|
||||
\"lowBandwidthMode\": ${ZT_LB_MODE:-$DEFAULT_LB_MODE},
|
||||
\"ssoRedirectURL\": \"${ZT_SSO_REDIRECT_URL}\",
|
||||
\"allowManagementFrom\": [\"127.0.0.1\", \"::1\", \"10.0.0.0/8\"],
|
||||
\"enableMetrics\": ${ZT_ENABLE_METRICS:-true},
|
||||
\"otel\": {
|
||||
\"exporterEndpoint\": \"${ZT_EXPORTER_ENDPOINT}\",
|
||||
\"exporterSampleRate\": ${ZT_EXPORTER_SAMPLE_RATE:-0}
|
||||
}
|
||||
},
|
||||
${REDIS}
|
||||
},
|
||||
\"controller\": {
|
||||
\"listenMode\": \"${ZT_LISTEN_MODE:-pgsql}\",
|
||||
\"statusMode\": \"${ZT_STATUS_MODE:-pgsql}\",
|
||||
\"assignedCentralVersion\": \"${ZT_ASSIGNED_CENTRAL_VERSION:-all}\",
|
||||
\"ssoEnabled\": ${ZT_SSO_ENABLED:-false}
|
||||
${SSO_REDIRECT_URLS_CONF}
|
||||
${REDIS}
|
||||
${BIGTABLE_CONF}
|
||||
${PUBSUB_CONF}
|
||||
}
|
||||
}
|
||||
}
|
||||
" > /var/lib/zerotier-one/local.conf
|
||||
|
||||
if [ -n "$DB_SERVER_CA" ]; then
|
||||
echo "secret list"
|
||||
chmod 600 /secrets/db/*.pem
|
||||
ls -l /secrets/db/
|
||||
until pg_isready -h ${ZT_DB_HOST} -p ${ZT_DB_PORT} -d "sslmode=prefer sslcert=${DB_CLIENT_CERT} sslkey=${DB_CLIENT_KEY} sslrootcert=${DB_SERVER_CA}"; do
|
||||
until /usr/bin/pg_isready -h ${ZT_DB_HOST} -p ${ZT_DB_PORT} -d "sslmode=prefer sslcert=${DB_CLIENT_CERT} sslkey=${DB_CLIENT_KEY} sslrootcert=${DB_SERVER_CA}"; do
|
||||
echo "Waiting for PostgreSQL...";
|
||||
sleep 2;
|
||||
done
|
||||
else
|
||||
until pg_isready -h ${ZT_DB_HOST} -p ${ZT_DB_PORT}; do
|
||||
until /usr/bin/pg_isready -h ${ZT_DB_HOST} -p ${ZT_DB_PORT}; do
|
||||
echo "Waiting for PostgreSQL...";
|
||||
sleep 2;
|
||||
done
|
||||
fi
|
||||
|
||||
|
||||
# echo "Migrating database (if needed)..."
|
||||
# if [ -n "$DB_SERVER_CA" ]; then
|
||||
# /usr/local/bin/migrate -source file:///migrations -database "postgres://$ZT_DB_USER:$ZT_DB_PASSWORD@$ZT_DB_HOST:$ZT_DB_PORT/$ZT_DB_NAME?x-migrations-table=controller_migrations&sslmode=verify-full&sslrootcert=$DB_SERVER_CA&sslcert=$DB_CLIENT_CERT&sslkey=$DB_CLIENT_KEY" up
|
||||
# else
|
||||
# /usr/local/bin/migrate -source file:///migrations -database "postgres://$ZT_DB_USER:$ZT_DB_PASSWORD@$ZT_DB_HOST:$ZT_DB_PORT/$ZT_DB_NAME?x-migrations-table=controller_migrations&sslmode=disable" up
|
||||
# fi
|
||||
if [ "$ZT_DB_TYPE" == "cv2" ]; then
|
||||
echo "Migrating database (if needed)..."
|
||||
if [ -n "$DB_SERVER_CA" ]; then
|
||||
/usr/local/bin/migrate -source file:///migrations -database "postgres://$ZT_DB_USER:$ZT_DB_PASSWORD@$ZT_DB_HOST:$ZT_DB_PORT/$ZT_DB_NAME?x-migrations-table=controller_migrations&sslmode=verify-full&sslrootcert=$DB_SERVER_CA&sslcert=$DB_CLIENT_CERT&sslkey=$DB_CLIENT_KEY" up
|
||||
else
|
||||
/usr/local/bin/migrate -source file:///migrations -database "postgres://$ZT_DB_USER:$ZT_DB_PASSWORD@$ZT_DB_HOST:$ZT_DB_PORT/$ZT_DB_NAME?x-migrations-table=controller_migrations&sslmode=disable" up
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -n "$ZT_TEMPORAL_HOST" ] && [ -n "$ZT_TEMPORAL_PORT" ]; then
|
||||
echo "waiting for temporal..."
|
||||
@@ -214,16 +125,7 @@ if [ -n "$ZT_TEMPORAL_HOST" ] && [ -n "$ZT_TEMPORAL_PORT" ]; then
|
||||
echo "Temporal is up"
|
||||
fi
|
||||
|
||||
cat /var/lib/zerotier-one/local.conf
|
||||
|
||||
export GOOGLE_CLOUD_CPP_ENABLE_CLOG=yes
|
||||
export LIBC_FATAL_STDERR_=1
|
||||
export GLIBCXX_FORCE_NEW=1
|
||||
export GLIBCPP_FORCE_NEW=1
|
||||
# Preload jemalloc, located arch-agnostically (libjemalloc2 installs it under the
|
||||
# multiarch dir, e.g. /usr/lib/<triple>/libjemalloc.so.2). Skip if not present.
|
||||
JEMALLOC="$(ldconfig -p 2>/dev/null | awk '/libjemalloc\.so\.2/ {print $NF; exit}')"
|
||||
if [ -n "$JEMALLOC" ]; then
|
||||
export LD_PRELOAD="$JEMALLOC"
|
||||
fi
|
||||
export LD_PRELOAD="/usr/lib/x86_64-linux-gnu/libjemalloc.so.2"
|
||||
exec /usr/local/bin/zerotier-one -p${ZT_CONTROLLER_PORT:-$DEFAULT_PORT} /var/lib/zerotier-one
|
||||
Loaded 20 of 1403 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user