Thanks for that pointer, I was able to enroll my Linux machine with: "ziti-edge-tunnel enroll -j my.jwt -i my.json" and then get connected using "ziti-edge-tunnel run -i my.json" (note that "ziti-edge-tunnel run my.json" doesn't fail, but also doesn't seem to register with the NetFoundry servers).

So that "enroll" step seems to be missing from the various "getting started" guides.

I went through the rest of the hello world example, but ran into various problems. My Mac never showed the service I created. I was never able to do DNS resolution, probably because systemd-resolved is running (and relied upon) on port 53 on the Linux side. Not sure why the Mac side couldn't do DNS resolution, probably similar (but I'm using the Mac DNS services, also relied upon to get DNS resolution to my work VPNs), possibly related to the lack of the service showing up in the Mac Ziti client.

I tried both a service by name and a service by IP, but wasn't able to connect to the IP from either machine, and iptables on the Linux side never showed the IP I gave the service.

I like the promise of OpenZiti, but man is it hard to set up. I'd say I've easily got more time in setting up OpenZiti and still haven't been able to successfully pass traffice, than I have in setting up ZeroTier, Nebula, and Wireguard combined. Just for a point of reference.