OpenZiti for OpenWRT

Signed opkg feed for OpenZiti on OpenWRT 23.05+ routers.

Source: github.com/openziti/ziti-openwrt · install guide · compatibility

What's in the feed

ziti-edge-tunnel — the C tunneler
ziti-router — the Go edge router (statically linked)
luci-app-ziti — LuCI web UI
llhttp9 — runtime dep for the tunneler

Per-architecture feed URLs

Pick the URL that matches what your device reports from opkg print-architecture.

Arch	Devices	Feed
`aarch64_cortex-a53_neon-vfpv4`	GL.iNet QSDK (GL-BE3600, GL-MT6000, GL-AXT1800, ...)	aarch64_cortex-a53_neon-vfpv4/
`aarch64_cortex-a53`	mvebu Cortex-A53 (NanoPi R2S, FriendlyELEC NEO3, ESPRESSObin, ...)	aarch64_cortex-a53/
`x86_64`	OpenWRT x86_64 routers and VMs	x86_64/

Install on the device

# 1. Trust the feed's signing key
mkdir -p /etc/opkg/keys
curl -fsSL https://openziti.github.io/ziti-openwrt/pub.key -o /tmp/pub.key
KEYID=$(usign -F -p /tmp/pub.key)
mv /tmp/pub.key /etc/opkg/keys/$KEYID

# 2. Add the feed (substitute <arch> with one of the dirs above)
echo "src/gz openziti https://openziti.github.io/ziti-openwrt/<arch>" >> /etc/opkg/customfeeds.conf

# 3. Install
opkg update
opkg install ziti-edge-tunnel luci-app-ziti ziti-router

For GL.iNet QSDK firmware (GL-BE3600 et al), use aarch64_cortex-a53_neon-vfpv4. The arch label is repacked server-side; no client-side repack needed. Details: install-gl-inet.md.

Public key

The feed is signed with usign. Direct link: pub.key. Compute its fingerprint with usign -F -p pub.key and install on the device at /etc/opkg/keys/<fingerprint>.

Feed metadata

feed-info.json — generation time, base URL, per-target signed/package counts.

Apache-2.0. Built from openziti/ziti-openwrt; same license as upstream OpenZiti.