Admin
6dcbd9589a
Zitadel v4 redirects every sign-in to /ui/v2/login, which is served by a separate container (zitadel-login) that this stack didn't run, so logging in on a fresh instance ended in a 404. - Add zitadel-login, with its own service account (login-client) whose PAT Zitadel writes to a volume only that container mounts. - Configure the Login V2 base URL (ZITADEL_LOGIN_BASE_URL): its own port in dev, same hostname as Zitadel behind the edge in prod. - Pin zitadel and zitadel-login to v4.19.1 and add healthchecks. - Run Zitadel as root, as Zitadel's own compose does, so it can write the PATs into root-owned mounts (the Linux bind mount and the new volume). - Route /ui/v2/login on the auth vhost to the login container and drop the no-op grpc_set_header. - Document the extra steps for an instance created before this.
42 lines
1.6 KiB
Bash
42 lines
1.6 KiB
Bash
# Development configuration for compose.yml + compose.dev.yml.
|
|
# Copy to .env and adjust.
|
|
#
|
|
# cp .env.example .env
|
|
|
|
# --- PostgreSQL (shared instance, one database per project) -----------------
|
|
POSTGRES_USER=postgres
|
|
POSTGRES_PASSWORD=postgres
|
|
POSTGRES_HOST_PORT=5432
|
|
|
|
# --- Zitadel (OIDC) ----------------------------------------------------------
|
|
# The masterkey MUST be exactly 32 characters. host.docker.internal resolves
|
|
# to the same address from the browser, from apps on the host and from
|
|
# inside every project's containers, which is what makes the OIDC issuer
|
|
# valid everywhere without a shared Docker network in dev.
|
|
ZITADEL_MASTERKEY=MasterkeyNeedsToHave32Characters
|
|
ZITADEL_EXTERNAL_DOMAIN=host.docker.internal
|
|
ZITADEL_EXTERNAL_PORT=8080
|
|
ZITADEL_EXTERNAL_SECURE=false
|
|
ZITADEL_PUBLIC_SCHEME=http
|
|
# Login V2 UI (zitadel-login). In dev it has its own port; the URL has no
|
|
# trailing slash. Only read when the Zitadel instance is created.
|
|
ZITADEL_LOGIN_HOST_PORT=3100
|
|
ZITADEL_LOGIN_BASE_URL=http://host.docker.internal:3100/ui/v2/login
|
|
ZITADEL_DATABASE_PASSWORD=zitadel
|
|
# Console login: <username>@zitadel.<external domain>
|
|
ZITADEL_ADMIN_USERNAME=admin
|
|
ZITADEL_ADMIN_PASSWORD=Password1!
|
|
|
|
# --- SeaweedFS (S3) ----------------------------------------------------------
|
|
S3_ACCESS_KEY=admin_access_key
|
|
S3_SECRET_KEY=admin_secret_key
|
|
|
|
# --- RabbitMQ -----------------------------------------------------------------
|
|
RABBITMQ_DEFAULT_USER=guest
|
|
RABBITMQ_DEFAULT_PASS=guest
|
|
|
|
# --- pgAdmin (optional, `--profile tools`) -----------------------------------
|
|
PGADMIN_DEFAULT_EMAIL=admin@infra.dev
|
|
PGADMIN_DEFAULT_PASSWORD=admin
|
|
PGADMIN_HOST_PORT=5050
|