Admin
6dcbd9589a
Zitadel v4 redirects every sign-in to /ui/v2/login, which is served by a separate container (zitadel-login) that this stack didn't run, so logging in on a fresh instance ended in a 404. - Add zitadel-login, with its own service account (login-client) whose PAT Zitadel writes to a volume only that container mounts. - Configure the Login V2 base URL (ZITADEL_LOGIN_BASE_URL): its own port in dev, same hostname as Zitadel behind the edge in prod. - Pin zitadel and zitadel-login to v4.19.1 and add healthchecks. - Run Zitadel as root, as Zitadel's own compose does, so it can write the PATs into root-owned mounts (the Linux bind mount and the new volume). - Route /ui/v2/login on the auth vhost to the login container and drop the no-op grpc_set_header. - Document the extra steps for an instance created before this.
41 lines
1.6 KiB
Bash
41 lines
1.6 KiB
Bash
# Production configuration for compose.yml (no overlay needed: the base
|
|
# file is already the production shape, with no published ports and
|
|
# everything reachable only on infra-net).
|
|
#
|
|
# cp .env.prod.example .env.prod
|
|
# chmod 600 .env.prod
|
|
# docker compose --env-file .env.prod -f compose.yml up -d
|
|
#
|
|
# Replace every CHANGE_ME with a strong random value (`openssl rand -hex 24`;
|
|
# the Zitadel masterkey needs exactly 32 characters) and auth.example.com
|
|
# with the real hostname the shared edge (edge/) terminates TLS for.
|
|
|
|
# --- PostgreSQL ---------------------------------------------------------------
|
|
POSTGRES_USER=postgres
|
|
POSTGRES_PASSWORD=CHANGE_ME
|
|
|
|
# --- Zitadel (OIDC) ----------------------------------------------------------
|
|
ZITADEL_MASTERKEY=CHANGE_ME_32_CHARACTERS_EXACTLY_
|
|
ZITADEL_EXTERNAL_DOMAIN=auth.example.com
|
|
ZITADEL_EXTERNAL_PORT=443
|
|
ZITADEL_EXTERNAL_SECURE=true
|
|
ZITADEL_TLS_MODE=external
|
|
ZITADEL_PUBLIC_SCHEME=https
|
|
# Login V2 UI, routed by the edge under the same hostname. No trailing slash.
|
|
ZITADEL_LOGIN_BASE_URL=https://auth.example.com/ui/v2/login
|
|
ZITADEL_DATABASE_PASSWORD=CHANGE_ME
|
|
ZITADEL_ORG_NAME=Iker Demo
|
|
ZITADEL_ADMIN_USERNAME=admin@ikerdemo.cat
|
|
ZITADEL_ADMIN_FIRST_NAME=Iker Demo
|
|
ZITADEL_ADMIN_LAST_NAME=Admin
|
|
ZITADEL_ADMIN_DISPLAY_NAME=Iker Demo Admin
|
|
ZITADEL_ADMIN_PASSWORD=CHANGE_ME
|
|
|
|
# --- SeaweedFS (S3) ----------------------------------------------------------
|
|
S3_ACCESS_KEY=CHANGE_ME
|
|
S3_SECRET_KEY=CHANGE_ME
|
|
|
|
# --- RabbitMQ -----------------------------------------------------------------
|
|
RABBITMQ_DEFAULT_USER=CHANGE_ME
|
|
RABBITMQ_DEFAULT_PASS=CHANGE_ME
|