Zitadel v4 redirects every sign-in to /ui/v2/login, which is served by a
separate container (zitadel-login) that this stack didn't run, so logging
in on a fresh instance ended in a 404.
- Add zitadel-login, with its own service account (login-client) whose
PAT Zitadel writes to a volume only that container mounts.
- Configure the Login V2 base URL (ZITADEL_LOGIN_BASE_URL): its own port
in dev, same hostname as Zitadel behind the edge in prod.
- Pin zitadel and zitadel-login to v4.19.1 and add healthchecks.
- Run Zitadel as root, as Zitadel's own compose does, so it can write the
PATs into root-owned mounts (the Linux bind mount and the new volume).
- Route /ui/v2/login on the auth vhost to the login container and drop
the no-op grpc_set_header.
- Document the extra steps for an instance created before this.
One nginx owns host ports 80/443 for every project (Gitea, Musify) and
proxies by container name over infra-net and gitea_gitea; a certbot
service renews the Let's Encrypt certificates.
The README previously described this stack as shared by "every project
under Documentos/", which is just this machine's local checkout location,
not something the repo itself should assume. Every project lives in its
own git repository; the path to this repo's checkout is a per-project
setting (ZITADEL_ADMIN_PAT_DIR), not a fixed convention.
Also drops leftover em dashes across the docs and compose comments for
plainer prose.
Admin