← All modules — full architecture

Meridian Logistics — OpenZiti 2.0 architecture

High-level design — click any component to drill into its low-level design
Module 07: Tunnelers — Ubuntu/Linux fleet (systemd) · verified against OpenZiti v2.0.3 + ziti-edge-tunnel 1.18.7 (field build 2026-09-26)
Read the guide: systemd
M07 · Tunnelers — Ubuntu
✕ Close
Ubuntu tunneler (fleet) Edge router (M04) Controller (M03) · service Policy (M06 · untouched) lines: tokens boot / enroll fabric policy
Data path (reused) M04 public edge → fabric → er-nam Ubuntu fleet — East US M07 snet-tun-eus-01 · 10.10.4.0/24 linux-fleet-01 by hand · #employee linux-fleet-02 cloud-init · #employee linux-fleet-03 cloud-init · #employee run mode · dials out — no inbound Control plane (M03) ctrl1 · ctrl2 · ctrl3 — mints the OTTs Fleet pipeline tofu apply -var fleet_count=3 OTT · cloud-init · auto-enroll ziti-edge-tunnel.service User=ziti · CAP_NET_ADMIN ExecStartPre = auto-enroll DNS / resolver nameserver 100.64.0.2 authoritative → REFUSE misses M06 policy — untouched meridian-yard-dial ← #employee zero policy edits one-time tokens boot → auto-enroll dials out · edge :3022 fabric → er-nam grants Dial er-pub-01/02 #er-pub · edge :3022 meridian-yard yard.meridian.internal · #yard run (client) vs run-host (M08) machine (OTT) vs human (Entra) failures: DNS · service · authz
Tip: click the pipeline, a fleet host, the systemd service, DNS, the M06 policy, the public edge, the yard service, the M03 control plane, or a concept chip.
From the course Enterprise Zero Trust Architecture with OpenZiti 2.0 · cawachlabs.com · Guides Meridian Logistics is a fictional company. © 2026 CawachLabs · by Girish Reddy. All rights reserved. Not affiliated with or endorsed by the OpenZiti project. Icons adapted from Lucide (ISC, parts MIT).
TrademarksMicrosoft, Azure and Microsoft Entra are trademarks of the Microsoft group of companies. Docker is a trademark or registered trademark of Docker, Inc. in the United States and/or other countries. Kubernetes, Helm and SPIFFE are registered trademarks of The Linux Foundation in the United States and/or other countries. OpenTofu is a registered trademark of LF Projects, LLC. Ubuntu is a registered trademark of Canonical Ltd. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. Elasticsearch and Kibana are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries. Grafana is a trademark of Raintank, Inc. dba Grafana Labs. Other names belong to their owners. CawachLabs is independent and not affiliated with or endorsed by these companies.