- Pin seaweedfs (4.47), jaeger (1.76.0), certbot (v5.8.0) and pgadmin
(9.18) instead of :latest.
- Rotate container logs (json-file, 3 x 10 MB) in every stack.
- Cap Jaeger's in-memory storage at 100k traces and add a healthcheck.
- Publish dev ports on 127.0.0.1 (DEV_BIND_ADDRESS) so the dev
credentials aren't reachable from the LAN.
- Fix the prod command in compose.yml's header, the README's note on who
writes the admin PAT, and the certbot command's line breaks.
Zitadel v4 redirects every sign-in to /ui/v2/login, which is served by a
separate container (zitadel-login) that this stack didn't run, so logging
in on a fresh instance ended in a 404.
- Add zitadel-login, with its own service account (login-client) whose
PAT Zitadel writes to a volume only that container mounts.
- Configure the Login V2 base URL (ZITADEL_LOGIN_BASE_URL): its own port
in dev, same hostname as Zitadel behind the edge in prod.
- Pin zitadel and zitadel-login to v4.19.1 and add healthchecks.
- Run Zitadel as root, as Zitadel's own compose does, so it can write the
PATs into root-owned mounts (the Linux bind mount and the new volume).
- Route /ui/v2/login on the auth vhost to the login container and drop
the no-op grpc_set_header.
- Document the extra steps for an instance created before this.
Postgres, Zitadel and SeaweedFS were previously duplicated or fragilely
cross-referenced across the Musify, Ping and docker-manager repos. This
consolidates them into one place: compose.yml is the production shape
(no published ports, joins infra-net), compose.dev.yml is a thin overlay
that publishes ports for local development.
Admin