$ show openziti/zrok
zrok is a production-grade, self-hostable secure resource sharing platform built on OpenZiti overlay networking. It enables users to share web services, files, TCP/UDP tunnels, and VPN connections through firewalls and NAT without requiring inbound connectivity. The system supports both public and private sharing modes, OAuth authentication (GitHub, Google, OIDC), and includes a full REST API (v2), a CLI tool (`zrok2`), a React web console, a background agent daemon with gRPC remote control, and SDKs in Go, Python, and Node.js. Architecturally, zrok follows a controller-agent pattern. The controller is a Go REST server that manages accounts, environments, shares, accesses, frontends, namespaces, organizations, and bandwidth limits. It uses SQLite3 or PostgreSQL for persistence with versioned migrations, and integrates with InfluxDB for usage metrics and RabbitMQ (AMQP) for dynamic proxy mapping updates. The agent runs as a background process on the user's machine, managing child processes for each share/access and exposing a gRPC API for remote management. Frontend proxies (public, dynamic, socks, Caddy) handle incoming traffic with OAuth, basic auth, and interstitial pages. Key entry points include the CLI commands under `cmd/zrok2/` (e.g., `share`, `access`, `enable`, `admin`), the controller REST handlers in `controller/`, the agent gRPC service in `agent/agentGrpc/`, and the SDK packages in `sdk/golang/sdk`, `sdk/python/src/zrok2`, and `sdk/nodejs/sdk`. The system also includes a canary testing framework for continuous health validation and a comprehensive metrics/limits engine for bandwidth enforcement. External dependencies include OpenZiti (overlay network), InfluxDB (metrics), RabbitMQ (messaging), Caddy (optional web server), and various OAuth providers. The project is actively maintained with frequent commits, automated CI/CD, and multi-platform release pipelines (Linux, macOS, Windows, Docker).
The LLM identified 5 files worth highlighting for reuse:
Provides a generic BaseResourceManager interface and implementations for managing Ziti resources (identities, services, configs, policies). The pattern uses Go generics to abstract CRUD operations over any Ziti resource type, with helper functions like GetByID. This is reusable for any project that needs to manage a set of external API resources with consistent create/read/update/delete semantics.
Implements a cross-platform child process tree manager. On Unix it uses exec and signal handling; on Windows it uses job objects to manage process groups. Provides StartChild, WaitChild, StopChild methods with proper cleanup. This is a self-contained utility that can be extracted for any Go application needing reliable subprocess lifecycle management across platforms.
A simple but robust TCP relay function that copies data bidirectionally between two net.Conn connections using io.Copy with error handling and connection closure. It handles the common pattern of proxying TCP streams with proper cleanup. This is a reusable building block for any TCP proxy or tunnel implementation.
Defines an AccountAction interface with Limit and Relax methods, implemented by bandwidth limiters, resource count limiters, and warning email senders. The package reads usage data from InfluxDB and applies configurable limit classes (scoped/unscoped). This pattern of pluggable enforcement actions can be reused for any metered service that needs to apply graduated limits based on usage thresholds.
Defines a Target interface for file system operations (ReadDir, ReadFile, WriteFile, Delete, MkdirAll) and provides implementations for local filesystem, WebDAV, and zrok shares. The OneWay sync function compares source and destination trees and copies modified files. This abstraction is reusable for any project needing to synchronize files across different storage backends.