Step 4: Host the services

The lab needs one service for each IdP group, so step 6 can show that alice reaches only the Engineering Wiki and bob reaches only the HR Portal.

The lab serves both services from one machine, each from its own nginx container with its own page. Each page names the container that serves it, so a request routed to the wrong container shows the wrong page.

1. Save these two pages in the current directory:

   • eng-wiki.html
   • hr-portal.html

2. Start the two containers:

   docker run \
     --detach \
     --name acme-eng-wiki \
     --publish 127.0.0.1:9781:80 \
     --volume "$PWD/eng-wiki.html:/usr/share/nginx/html/index.html:ro" \
     nginx:alpine
   
   docker run \
     --detach \
     --name acme-hr-portal \
     --publish 127.0.0.1:9782:80 \
     --volume "$PWD/hr-portal.html:/usr/share/nginx/html/index.html:ro" \
     nginx:alpine

3. Check that each port serves its own page:

   curl -s http://127.0.0.1:9781 | grep 'served by'
   curl -s http://127.0.0.1:9782 | grep 'served by'

   The first line contains served by acme-eng-wiki, the second served by acme-hr-portal.

Create the services, the host identity, and the Bind policy that lets the host identity host both services. Each service has an intercept.v1 config, the address clients dial, and a host.v1 config, where the host identity sends the traffic:

Service	Intercept address	Intercept port	Host address	Host port
eng-wiki	eng-wiki.acme.ziti	80	127.0.0.1	9781
hr-portal	hr-portal.acme.ziti	80	127.0.0.1	9782

Showing steps as:

ziti CLI

1. Create the eng-wiki service:

   ziti edge create config eng-wiki.intercept intercept.v1 \
     '{
       "protocols": ["tcp"],
       "addresses": ["eng-wiki.acme.ziti"],
       "portRanges": [{"low": 80, "high": 80}]
     }'
   
   ziti edge create config eng-wiki.host host.v1 \
     '{
       "protocol": "tcp",
       "address": "127.0.0.1",
       "port": 9781
     }'
   
   ziti edge create service eng-wiki \
     --configs eng-wiki.intercept,eng-wiki.host

2. Create the hr-portal service:

   ziti edge create config hr-portal.intercept intercept.v1 \
     '{
       "protocols": ["tcp"],
       "addresses": ["hr-portal.acme.ziti"],
       "portRanges": [{"low": 80, "high": 80}]
     }'
   
   ziti edge create config hr-portal.host host.v1 \
     '{
       "protocol": "tcp",
       "address": "127.0.0.1",
       "port": 9782
     }'
   
   ziti edge create service hr-portal \
     --configs hr-portal.intercept,hr-portal.host

3. Create a host identity, and a Bind policy that lets it host both services:

   ziti edge create identity acme-host \
     --role-attributes host \
     -o acme-host.jwt
   
   ziti edge create service-policy acme-host-bind Bind \
     --identity-roles '#host' \
     --service-roles '@eng-wiki,@hr-portal'

ZAC

1. Under Services, click + and pick Create Advanced Service. For each service, add its intercept.v1 and host.v1 configs with Create and Attach, using the values in the table.
2. Under Identities, add acme-host with the host attribute. Download acme-host.jwt from the icon in its Token column.
3. Under Policies > Service Policies, add the Bind policy acme-host-bind for #host, @eng-wiki, and @hr-portal.

Enroll the host identity and run it on the same machine:

ziti-edge-tunnel enroll \
  -j acme-host.jwt \
  -i acme-host.json

ziti-edge-tunnel run-host \
  -i acme-host.json

Done when

• ziti edge list services shows eng-wiki and hr-portal
• ziti edge list terminators shows one terminator for each service