Introduction

This guide is a walkthrough to set up a BrowZer application to access Prometheus. 

To learn more about BrowZer see Getting started with BrowZer

Prerequisites

• A Cloud Ziti Network is up and running.
• Having a Prometheus instance up and running with an edge router. We use the Ubuntu 22.04 setup. Please follow the Appendix instructions to install the Prometheus instance and autonomous edge router. In this example document, the edge router is named Prometheus-er.
• In this example, the Prometheus server uses the default port 9090. Make sure that the same port is used to configure the Ziti services. 

Deployment 

Part 1: Setup Needed Items to Support a BrowZer Application

Architecture diagram:

In this section:

• Create a WSS-enabled NetFoundry Hosted Edge Router
• Create an Edge Router Policy
• Create the Service
• Create a Service Policy

In the Console, create a NetFoundry Hosted Edge Router with the WSS Listener enabled. BrowZer requires at least one Edge Router with the WSS Listener enabled.  Launching an NF Hosted is recommended. 

Create Service

In the Console, Create the Service that you want to access Prometheus. We recommend using an advanced service. 

• For the case of docker-compose, the forward address uses the docker Container IP or container name. In my case, I use the docker container name prometheus. Use any FQDN to intercept IP.
• The PORT will be the default port on the Prometheus server. In our example, use port 9090.
• Identities are the edge router Prometheus-er.
• Leave the default check yes to Forward Protocol/Port. 

Service Policy

In the Console, Create a Service Policy(AppWan) to allow access to the specified clients that we’ll create later.

Part 2: Auth0 & JWT Signer

In this section:

• Create an Auth0 Account
• Create an Auth0 Application(SPA)
• Add callback & logout
• Create an Auth0 API
• Create an Auth0 Custom Trigger
• Gather Information from Auth0 needed
• Create a new JWT Signer
• Create a new Authentication Policy
• Create or update the Identities(Endpoints)

This tutorial follows the Auth0 settings. Other IDPs must have their own settings. If you don't already have an account you can sign up for a free account at https://auth0.com/signup

Adding a new Application in Auth0

Once you have an account setup you can add a new "Application":

Then click on the "Create Application":

Then Create a "Single Page Web Application":

Adding the callback & logout URL to your BrowZer App(s) you created

https://<APP_NAME>.<NET_NAME>.browzer.cloudziti.io

 https://*.solarapp.browzer.cloudziti.io

Put the same URLs under the "Allowed Logout URLs" also.

Create an API

Now you can add a new "API":

Click on Create API

Fill out the form using the URL

https://<APP_NAME>.<NET_NAME>.browzer.cloudziti.io

 Create a custom trigger

Under Actions select "Triggers":

Click on "post-login":

Click on the + symbol & select "Build from Scratch":

Name the a new Action "Add Email to Access Token":

Remove the prefilled out content & past the following:

/**
* Handler called during a PostLogin flow.
*
* @param {Event} event - Details about the user and the 
* context in which they are logging in.
* @param {PostLoginAPI} api - Interface whose methods can be 
* used to change the behavior of the login.
*/
exports.onExecutePostLogin = async (event, api) => {

if (event.authorization) {
api.accessToken.setCustomClaim(`email`, event.user.email);
}
};

then click on "Deploy":

Return to "post-login" & click on "Custom"

Click and drag your Add Email to Access Token Action onto the Trigger, then drop it into place, then click Apply in the top right.

Gathering Information from Auth0

To set up the new JWT Signer we'll need to get some information from the new Auth0 Application that was just created.

https://<Domain>/ 

Part 3: The BrowZer Application

In this section:

• BrowZer Getting Started
• Create a new BrowZer Application
• Access the Application

Make sure to complete the BrowZer Getting Started by clicking on the BrowZer Apps in the navigation menu.

Create a BrowZer Application

In the MOP Console, Create a new BrowZer Application.

For the App Entry, Select the service you created in Part 1.

For the Public URL, you’ll set a name for your app (APP_NAME), this name creates the whole URL you’ll use to access your service securely. In this case, APP_NAME=private-app, and the URL is

For example:

https://prometheus.solarapp.browzer.cloudziti.io

Set the OIDC Base URL to the “Domain” value from Auth0 in Part2, in the format:

https://<domain> 

(This time without any slash at the end)

Set the ClientID to the "ClientId" value you got from Auth0 in Part 2.

Access your Application

https://prometheus.solarapp.browzer.cloudziti.io

sudo apt update && sudo apt upgrade
sudo apt install docker-compose

• Clone the docker repo for Prometheus.

git clone https://github.com/ninadingole/docker-images

docker-compose.yaml

...

  autonomous-er:
    container_name: netfoundry-er
    image: netfoundry/autonomous-router:latest
    pull_policy: always
    restart: unless-stopped
    environment:
      - VERBOSE=1
      - REG_KEY=<registration_key from console>
    volumes:
      - ./ziti_router:/etc/netfoundry

docker-compose up -d

mkdir cert
sudo openssl genrsa -out prometheus.key 2048
sudo openssl req -new -key prometheus.key -out prometheus.csr
sudo openssl x509 -req -days 365 -in prometheus.csr -signkey prometheus.key -out prometheus.crt

:~/docker-images/prometheus-grafana/prometheus$ cat web.yml
tls_server_config:
cert_file: cert/prometheus.crt # place of the cert file inside the docker container
key_file: cert/prometheus.key # place of the key file inside the docker container

services:
prometheus:
container_name: prometheus
image: prom/prometheus
restart: always
volumes:
- ./prometheus:/etc/prometheus/
- prometheus_data:/prometheus
command:
- '--config.file=/etc/prometheus/prometheus.yml'
- '--web.config.file=/etc/prometheus/web.yml'
- '--storage.tsdb.path=/prometheus'
- '--web.console.libraries=/usr/share/prometheus/console_libraries'
- '--web.console.templates=/usr/share/prometheus/consoles'
ports:
- 9090:9090
links:
- cadvisor:cadvisor
- alertmanager:alertmanager
depends_on:
- cadvisor