Every project used the Postgres superuser, the RabbitMQ administrator, an
admin S3 identity and the Zitadel instance-admin PAT, so any one of them
could read or change the others' data.
A new one-shot, `provision` (runs on every `up`, idempotent), gives each
project in x-projects its own:
- Postgres role, owner of its database. No database is open to PUBLIC
anymore, so a role can only connect to its own. An existing database
and everything in it is handed over to the project's role.
- RabbitMQ user, with permissions on its own vhost only.
- Zitadel service account, PROJECT_OWNER of its own project only; its
PAT is written to zitadel/.output/<project>/ for that project's
zitadel-init to mount instead of the admin PAT.
SeaweedFS renders one S3 identity per project, limited to its bucket, and
refuses to start with a clear message on a malformed or repeated key.
The admin accounts stay with this stack. postgres-init is gone: provision
creates the databases. *.sh files are checked out with LF so they run in
the Linux containers from a Windows checkout.
- Pin seaweedfs (4.47), jaeger (1.76.0), certbot (v5.8.0) and pgadmin
(9.18) instead of :latest.
- Rotate container logs (json-file, 3 x 10 MB) in every stack.
- Cap Jaeger's in-memory storage at 100k traces and add a healthcheck.
- Publish dev ports on 127.0.0.1 (DEV_BIND_ADDRESS) so the dev
credentials aren't reachable from the LAN.
- Fix the prod command in compose.yml's header, the README's note on who
writes the admin PAT, and the certbot command's line breaks.
- Unknown hostnames and direct IP access no longer land on the first
vhost (Gitea): port 80 closes the connection, except for ACME
challenges, and port 443 refuses the handshake.
- Mozilla intermediate ciphers (forward secrecy only, no CBC), session
cache, no session tickets, and HSTS with a short max-age for now.
- Set X-Forwarded-For to the client address instead of appending to
whatever the client sent.
RabbitMQ stores its data under rabbit@<hostname>, and the hostname
changed with every recreated container, so an image update or an .env
change came up with an empty broker. Pin it to `rabbitmq` and document
how to carry the definitions over on an existing deployment.
Every project shares infra-net, where a generic service name like `api`
resolves to every container that has it, round-robin, across projects.
The edge now proxies to container names (musify-api, infra-zitadel, ...).
Zitadel v4 redirects every sign-in to /ui/v2/login, which is served by a
separate container (zitadel-login) that this stack didn't run, so logging
in on a fresh instance ended in a 404.
- Add zitadel-login, with its own service account (login-client) whose
PAT Zitadel writes to a volume only that container mounts.
- Configure the Login V2 base URL (ZITADEL_LOGIN_BASE_URL): its own port
in dev, same hostname as Zitadel behind the edge in prod.
- Pin zitadel and zitadel-login to v4.19.1 and add healthchecks.
- Run Zitadel as root, as Zitadel's own compose does, so it can write the
PATs into root-owned mounts (the Linux bind mount and the new volume).
- Route /ui/v2/login on the auth vhost to the login container and drop
the no-op grpc_set_header.
- Document the extra steps for an instance created before this.
One nginx owns host ports 80/443 for every project (Gitea, Musify) and
proxies by container name over infra-net and gitea_gitea; a certbot
service renews the Let's Encrypt certificates.
The README previously described this stack as shared by "every project
under Documentos/", which is just this machine's local checkout location,
not something the repo itself should assume. Every project lives in its
own git repository; the path to this repo's checkout is a per-project
setting (ZITADEL_ADMIN_PAT_DIR), not a fixed convention.
Also drops leftover em dashes across the docs and compose comments for
plainer prose.
Admin