### Install ztncui DEB on Debian/Ubuntu

Source: https://key-networks.com/ztncui

Commands to download and install the ztncui package on Debian-based systems.

```bash
curl -O https://s3-us-west-1.amazonaws.com/key-networks/deb/ztncui/1/x86_64/ztncui_0.8.14_amd64.deb
```

```bash
sudo apt install ./ztncui_0.8.14_amd64.deb
```

--------------------------------

### Install ztncui RPM on EL8/9

Source: https://key-networks.com/ztncui

Commands to install the ztncui release package and the application on RHEL or AlmaLinux systems.

```bash
sudo yum install https://download.key-networks.com/el7/ztncui/1/ztncui-release-1-1.noarch.rpm -y
```

```bash
sudo yum install ztncui -y
```

--------------------------------

### Configure ztncui Environment Variables

Source: https://key-networks.com/ztncui

Commands to set the ZeroTier token, HTTPS port, and production environment mode in the .env file.

```bash
sudo sh -c "echo ZT_TOKEN=`sudo cat /var/lib/zerotier-one/authtoken.secret` > /opt/key-networks/ztncui/.env"
```

```bash
sudo sh -c "echo HTTPS_PORT=3443 >> /opt/key-networks/ztncui/.env"
```

```bash
sudo sh -c "echo NODE_ENV=production >> /opt/key-networks/ztncui/.env"
```

--------------------------------

### Set ztncui File Permissions and Service Restart

Source: https://key-networks.com/ztncui

Commands to secure the .env file and restart the ztncui service.

```bash
sudo chmod 400 /opt/key-networks/ztncui/.env
```

```bash
sudo chown ztncui.ztncui /opt/key-networks/ztncui/.env
```

```bash
sudo systemctl restart ztncui
```

--------------------------------

### Link Let's Encrypt Certificate to ztncui

Source: https://key-networks.com/ztncui

Commands to link the generated Let's Encrypt files to the ztncui TLS directory. Ensure the ztncui user has read access to these files.

```bash
sudo -i
```

```bash
cd /opt/key-networks/ztncui/etc/tls
```

```bash
rm -f privkey.pem fullchain.pem
```

```bash
ln -s /etc/letsencrypt/live/[network_controller_fqdn]/fullchain.pem
```

```bash
ln -s /etc/letsencrypt/live/[network_controller_fqdn]/privkey.pem
```

--------------------------------

### Generate Let's Encrypt Certificate with Certbot

Source: https://key-networks.com/ztncui

Commands to generate a certificate using Certbot in webroot mode. Replace [network_controller_fqdn] with your actual FQDN.

```bash
sudo -i
```

```bash
cd /opt/key-networks/ztncui
```

```bash
certbot --webroot -w public -d [network_controller_fqdn]
```

--------------------------------

### Configure HTTPS Port in .env

Source: https://key-networks.com/ztncui

Setting the HTTPS_PORT variable to enable HTTPS listening on a specific port.

```text
HTTPS_PORT=3443
```

--------------------------------

### Locate Let's Encrypt Certificate

Source: https://key-networks.com/ztncui

The expected file path for the generated Let's Encrypt certificate.

```text
/etc/letsencrypt/live/[network_controller_fqdn]/fullchain.pem
```

--------------------------------

### Link a Purchased Certificate

Source: https://key-networks.com/ztncui

Commands to link an existing private key and certificate chain to the ztncui TLS directory. The ztncui user must have read access to the linked files.

```bash
sudo -i
```

```bash
cd /opt/key-networks/ztncui/etc/tls
```

```bash
rm -f privkey.pem fullchain.pem
```

```bash
ln -s /path/to/private/key privkey.pem
```

```bash
ln -s /path/to/full/chain/cert fullchain.pem
```

--------------------------------

### Generate a Self-Signed Certificate

Source: https://key-networks.com/ztncui

Commands to generate a new self-signed certificate for ztncui. Ensure the ztncui user has appropriate permissions after generation.

```bash
sudo -i
```

```bash
cd /opt/key-networks/ztncui/etc/tls
```

```bash
rm -f privkey.pem fullchain.pem
```

```bash
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privkey.pem -out fullchain.pem
```

```bash
chown ztncui.ztncui *.pem
```

```bash
chmod 600 privkey.pem
```

--------------------------------

### Restrict HTTPS Listening Interface

Source: https://key-networks.com/ztncui

Setting the HTTPS_HOST variable to bind the HTTPS server to a specific IP address.

```text
HTTPS_HOST=12.34.56.78
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.