NotS1mp/SharedServices
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Run Zitadel with tlsMode external behind the edge

Browse Source 
With tlsMode disabled Zitadel advertises http URLs, so the console calls
http://<domain> and the CSP blocks it. Make it configurable through
ZITADEL_TLS_MODE (default disabled for dev, external in prod).
This commit is contained in:
Admin
2026-09-23 18:03:49 +02:00
parent 24f801cf2f
commit b97dacba94
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.prod.example
+1
View File
@@ -19,6 +19,7 @@ ZITADEL_MASTERKEY=CHANGE_ME_32_CHARACTERS_EXACTLY_
ZITADEL_EXTERNAL_DOMAIN=auth.example.com ZITADEL_EXTERNAL_DOMAIN=auth.example.com
ZITADEL_EXTERNAL_PORT=443 ZITADEL_EXTERNAL_PORT=443
ZITADEL_EXTERNAL_SECURE=true ZITADEL_EXTERNAL_SECURE=true
ZITADEL_TLS_MODE=external
ZITADEL_DATABASE_PASSWORD=CHANGE_ME ZITADEL_DATABASE_PASSWORD=CHANGE_ME
ZITADEL_ADMIN_USERNAME=admin ZITADEL_ADMIN_USERNAME=admin
ZITADEL_ADMIN_PASSWORD=CHANGE_ME ZITADEL_ADMIN_PASSWORD=CHANGE_ME
compose.yml
+4 -1
View File
@@ -47,7 +47,10 @@ services:
zitadel: zitadel:
image: ghcr.io/zitadel/zitadel:latest image: ghcr.io/zitadel/zitadel:latest
container_name: infra-zitadel container_name: infra-zitadel
command: start-from-init --masterkeyFromEnv --tlsMode disabled # `disabled` (dev, plain http) makes Zitadel advertise http URLs; behind a
# TLS-terminating proxy it must be `external` or the console calls
# http://<domain> and the CSP blocks it.
command: start-from-init --masterkeyFromEnv --tlsMode ${ZITADEL_TLS_MODE:-disabled}
environment: environment:
ZITADEL_MASTERKEY: ${ZITADEL_MASTERKEY} ZITADEL_MASTERKEY: ${ZITADEL_MASTERKEY}
# The external domain/port form the token issuer and must be identical # The external domain/port form the token issuer and must be identical