From 8b942ab6c2e9fcb3bfe26e01edfb6cb51ee8250e Mon Sep 17 00:00:00 2001 From: XShine555 Date: Thu, 24 Sep 2026 17:11:50 +0200 Subject: [PATCH] Give docker-manager its project on the shared Zitadel Its OIDC login isn't implemented yet, but it's meant to use the same Zitadel as Musify and Ping. Provision its Zitadel project and service account now, so its future zitadel-init only has to create its apps. Document that every project shares one Zitadel organization: one account per person across all projects, with single sign-on between them. --- README.md | 11 +++++++++++ compose.yml | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 3070ad2..02d4b0f 100644 --- a/README.md +++ b/README.md @@ -138,6 +138,17 @@ only thing that doesn't carry over is RabbitMQ: a project now uses its own vhost, so drain its queues on `/` first; its consumers recreate their exchanges and queues in the new vhost. +### One Zitadel for every project + +Every project signs its users in against the same instance and the same +organization (the first one, `ZITADEL_ORG_NAME`), each with its own Zitadel +project for its apps. So there is one account per person, not one per +project: someone who registers in Musify can sign in to Ping with the same +account, and a session in one app is reused by the others (single sign-on), +because none of the projects requires a per-project grant or role to sign +in. Keep it that way when adding a project: point its issuer at this +Zitadel (`PUBLIC_AUTH_URL`), and don't create a separate organization for it. + ### The Zitadel PAT Each project's `zitadel-init` mounts **its own** folder, diff --git a/compose.yml b/compose.yml index a030582..96fb313 100644 --- a/compose.yml +++ b/compose.yml @@ -278,7 +278,7 @@ services: PING_ZITADEL_PROJECT: Ping DOCKERMANAGER_DB_PASSWORD: ${DOCKERMANAGER_DB_PASSWORD:-} DOCKERMANAGER_RABBITMQ_PASSWORD: ${DOCKERMANAGER_RABBITMQ_PASSWORD:-} - DOCKERMANAGER_ZITADEL_PROJECT: "" + DOCKERMANAGER_ZITADEL_PROJECT: Docker Manager volumes: - ./provision:/provision:ro - ./zitadel/.output:/output