andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-14 09:55:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(login): add optional TLS termination support (#11663)

Browse Source 
# Which Problems Are Solved

The login container can only serve HTTP. In deployments where a reverse
proxy is not used, operators need the login container to terminate TLS
itself.

Closes #11473

# How the Problems Are Solved

The container now supports optional HTTPS via three environment
variables that match the pattern already used by the backend server:
`ZITADEL_TLS_ENABLED`, `ZITADEL_TLS_CERTPATH`, and
`ZITADEL_TLS_KEYPATH`. When `ZITADEL_TLS_ENABLED` is not set or set to
`false`, behavior is identical to before. When set to `true`, the server
reads the provided certificate and key files and serves HTTPS using the
lower-level `getRequestHandlers` API from Next.js.

The Docker healthcheck was updated to probe the correct scheme
automatically based on the same environment variable.

# Additional Changes

Added a dockerized integration test that verifies both HTTP and HTTPS
modes using testcontainers.

# Additional Context

The TLS path uses `getRequestHandlers` from
`next/dist/server/lib/start-server` instead of `startServer` because the
latter rejects self-signed certificates in production mode. This is the
same internal API that `startServer` itself calls.

---------

Co-authored-by: Copilot <[email protected]>
This commit is contained in:
Mridang Agarwalla
2026-02-25 10:44:51 +00:00
committed by GitHub
co-authored by Copilot
parent 0261536243
commit c8abf6de74
9 changed files with 339 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/login/package.json
+1 -1
View File
@@ -4,7 +4,7 @@
"private": true,
"type": "module",
"scripts": {
"build": "NEXT_OUTPUT_MODE=standalone next build && cp -r public scripts/* .next/standalone/ && cp -r .next/static .next/standalone/apps/login/.next/ && rm .next/standalone/apps/login/.env",
"build": "NEXT_OUTPUT_MODE=standalone next build && cp -r public scripts/* .next/standalone/ && mv .next/standalone/apps/login/server.js .next/standalone/apps/login/next-server.js && cp .next/standalone/server.mjs .next/standalone/apps/login/server.js && cp -r .next/static .next/standalone/apps/login/.next/ && rm .next/standalone/apps/login/.env",
"build-vercel": "next build",
"dev": "HOSTNAME=127.0.0.1 ./scripts/entrypoint.sh next dev",
"prod": "cd ./.next/standalone && HOSTNAME=127.0.0.1 ./entrypoint.sh node apps/login/server.js",