chore: rehaul DevX (#10571)

# Which Problems Are Solved Replaces Turbo by Nx and lays the foundation for the next CI improvements. It enables using Nx Cloud to speed the up the pipelines that affect any node package. It streamlines the dev experience for frontend and backend developers by providing the following commands: | Task | Command | Notes | |------|---------|--------| | **Production** | `nx run PROJECT:prod` | Production server | | **Develop** | `nx run PROJECT:dev` | Hot reloading development server | | **Test** | `nx run PROJECT:test` | Run all tests | | **Lint** | `nx run PROJECT:lint` | Check code style | | **Lint Fix** | `nx run PROJECT:lint-fix` | Auto-fix style issues | The following values can be used for PROJECT: - @zitadel/zitadel (root commands) - @zitadel/api, - @zitadel/login, - @zitadel/console, - @zitadel/docs, - @zitadel/client - @zitadel/proto The project names and folders are streamlined: | Old Folder | New Folder | | --- | --- | | ./e2e | ./tests/functional-ui | | ./load-test | ./benchmark | | ./build/zitadel | ./apps/api | | ./console | ./apps/console (postponed so the PR is reviewable) | Also, all references to the TypeScript repo are removed so we can archive it. # How the Problems Are Solved - Ran `npx nx@latest init` - Replaced all turbo.json by project.json and fixed the target configs - Removed Turbo dependency - All JavaScript related code affected by a PRs changes is quality-checked using the `nx affected` command - We move PR checks that are runnable using Nx into the `check` workflow. For workflows where we don't use Nx, yet, we restore previously built dependency artifacts from Nx. - We only use a single and easy to understand dev container - The CONTRIBUTING.md is streamlined - The setup with a generated client pat is orchestrated with Nx - Everything related to the TypeScript repo is updated or removed. A **Deploy with Vercel** button is added to the docs and the CONTRIBUTING.md. # Additional Changes - NPM package names have a consistent pattern. - Docker bake is removed. The login container is built and released like the core container. - The integration tests build the login container before running, so they don't rely on the login container action anymore. This fixes consistently failing checks on PRs from forks. - The docs build in GitHub actions is removed, as we already build on Vercel. # Additional Context - Internal discussion: https://zitadel.slack.com/archives/C087ADF8LRX/p1756277884928169 - Workflow dispatch test: https://github.com/zitadel/zitadel/actions/runs/17760122959 --------- Co-authored-by: Florian Forster <[email protected]> Co-authored-by: Tim Möhlmann <[email protected]> Co-authored-by: Copilot <[email protected]>
2026-10-31 11:32:15 +00:00 · 2025-10-08 10:27:02 +02:00
parent e47acaeef2
commit f69a6ed4f3
236 changed files with 5708 additions and 6549 deletions
@@ -0,0 +1,5 @@
+ZITADEL_DATABASE_POSTGRES_HOST=${DEVCONTAINER_DB_API_HOST:-localhost}
+ZITADEL_DATABASE_POSTGRES_PORT=5432
+ZITADEL_PORT=8080
+ZITADEL_EXTERNALPORT=8080
+API_AWAIT_DB_SERVICE=db
@@ -0,0 +1,5 @@
+ZITADEL_DATABASE_POSTGRES_HOST=${DEVCONTAINER_DB_FUNCTIONAL_UI_HOST:-localhost}
+ZITADEL_DATABASE_POSTGRES_PORT=5434
+ZITADEL_PORT=8083
+ZITADEL_EXTERNALPORT=8083
+API_AWAIT_DB_SERVICE=db-functional-ui
@@ -0,0 +1,3 @@
+ZITADEL_DATABASE_POSTGRES_HOST=${DEVCONTAINER_DB_API_INTEGRATION_HOST:-localhost}
+ZITADEL_DATABASE_POSTGRES_PORT=5433
+ZITADEL_API_URL=http://localhost:8082
@@ -0,0 +1,5 @@
+ZITADEL_DATABASE_POSTGRES_HOST=${DEVCONTAINER_DB_API_INTEGRATION_HOST:-localhost}
+ZITADEL_DATABASE_POSTGRES_PORT=5433
+ZITADEL_PORT=8082
+ZITADEL_EXTERNALPORT=8082
+API_AWAIT_DB_SERVICE=db-api-integration
@@ -0,0 +1,34 @@
+# Builder stage: Sets up the environment, installs dependencies, copies the Zitadel binary, and configures permissions for the application.
+# This stage produces a runnable image that can be used for debugging.
+FROM debian:latest AS builder
+ARG TARGETPLATFORM
+
+RUN apt-get update && apt-get install ca-certificates -y
+
+COPY apps/api/entrypoint.sh /app/entrypoint.sh
+COPY ./.artifacts/bin/${TARGETPLATFORM}/zitadel /app/zitadel
+
+RUN useradd -s "" --home / zitadel && \
+    chown zitadel /app/zitadel && \
+    chmod +x /app/zitadel && \
+    chown zitadel /app/entrypoint.sh && \
+    chmod +x /app/entrypoint.sh
+
+WORKDIR /app
+ENV PATH="/app:${PATH}"
+
+USER zitadel
+ENTRYPOINT ["/app/entrypoint.sh"]
+
+# Final stage: Creates a minimal container image with just the Zitadel binary and necessary files
+FROM scratch AS final
+
+COPY --from=builder /etc/passwd /etc/passwd
+COPY --from=builder /etc/ssl/certs /etc/ssl/certs
+COPY --from=builder /app/zitadel /app/zitadel
+
+HEALTHCHECK NONE
+EXPOSE 8080
+
+USER zitadel
+ENTRYPOINT ["/app/zitadel"]
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+case $@ in 
+    sh*)
+        ${@:3}
+        ;;
+    bash*)
+        ${@:5}
+        ;;
+    *)
+        if [[ ! -z "$@" ]]
+        then
+            ZITADEL_ARGS="$@"
+        fi
+        /app/zitadel ${ZITADEL_ARGS}
+        ;;
+esac
@@ -0,0 +1,25 @@
+ExternalSecure: false
+TLS.Enabled: false
+Database.Postgres:
+  Database: zitadel
+  MaxOpenConns: 20
+  MaxIdleConns: 20
+  ConnMaxLifetime: 60m
+  ConnMaxIdleTime: 10m
+FirstInstance:
+  LoginClientPatPath: login-client.pat
+  PatPath: admin.pat
+  InstanceName: ZITADEL
+  DefaultLanguage: en
+  Org:
+    LoginClient:
+      Machine:
+        Username: login-client
+        Name: Automatically Initialized IAM Login Client
+      Pat.ExpirationDate: 2099-01-01T00:00:00Z
+    Machine:
+      Machine:
+        Username: admin
+        Name: Automatically Initialized IAM admin Client
+      Pat.ExpirationDate: 2099-01-01T00:00:00Z
+DefaultInstance.Features.LoginV2.BaseURI: http://localhost:3000/ui/v2/login
@@ -0,0 +1,470 @@
+{
+    "$schema": "../../node_modules/nx/schemas/project-schema.json",
+    "name": "@zitadel/api",
+    "projectType": "application",
+    "namedInputs": {
+        "sources": [
+            "{workspaceRoot}/cmd/**/*.go",
+            "{workspaceRoot}/internal/**/*.go",
+            "{workspaceRoot}/proto/**/*.go",
+            "{workspaceRoot}/pkg/**/*.go",
+            "{workspaceRoot}/main.go"
+        ],
+        "runtime": [
+            "sources",
+            "{workspaceRoot}/go*",
+            "!{workspaceRoot}/internal/integration/**/*",
+            "!{workspaceRoot}/**/*_test.go",
+            "!{workspaceRoot}/**/integration_test/**/*"
+        ],
+        "pack": [
+            { "env": "VERSION" },
+            "runtime"
+        ]
+    },
+    "targets": {
+        "prod": {
+            "description": "Runs the Go-based API backend in production mode",
+            "continuous": true,
+            "dependsOn": [
+                "build"
+            ],
+            "executor": "nx:run-commands",
+            "options": {
+                "parallel": false,
+                "commands": [
+                    "timeout 300 bash -c 'until nx run @zitadel/devcontainer:compose exec ${API_AWAIT_DB_SERVICE} pg_isready -U postgres -h localhost; do echo \"Awaiting DB\"; sleep 2; done' || (echo \"Database readiness check timed out after 5 minutes\" && exit 1)",
+                    "./.artifacts/bin/$(go env GOOS)/$(go env GOARCH)/${ZITADEL_BINARY:-zitadel.local} start-from-init --config ${API_CONFIG_FILE} --steps ${API_CONFIG_FILE} --masterkey MasterkeyNeedsToHave32Characters"
+                ]
+            },
+            "defaultConfiguration": "default",
+            "configurations": {
+                "default": {
+                    "env": {
+                        "API_CONFIG_FILE": "{projectRoot}/prod-default.yaml"
+                    }
+                },
+                "test-integration-api": {
+                    "env": {
+                        "API_CONFIG_FILE": "{projectRoot}/test-integration-api.yaml"
+                    }
+                },
+                "test-functional-ui": {
+                    "env": {
+                        "API_CONFIG_FILE": "{projectRoot}/test-functional-ui.yaml"
+                    }
+                }
+            }
+        },
+        "build": {
+            "description": "Compiles the Go-based API backend into an executable binary.",
+            "dependsOn": [
+                "generate",
+                "build-console"
+            ],
+            "command": "bash -c 'CGO_ENABLED=0 go build -o .artifacts/bin/$(go env GOOS)/$(go env GOARCH)/zitadel.local -v -ldflags=\"-s -w\"'",
+            "inputs": [
+                { "runtime": "go env GOOS" },
+                { "runtime": "go env GOARCH" },
+                "runtime"
+            ],
+            "outputs": [
+                "{workspaceRoot}/.artifacts/bin/*/*/zitadel.local"
+            ]
+        },
+        "generate": {
+            "description": "Generates the code needed to start a full-featured API: gRPC and OpenAPI stubs, static files for the embedded login v1, asset routes and documentation.",
+            "dependsOn": [
+                "generate-stubs",
+                "generate-assets",
+                "generate-statik"
+            ]
+        },
+        "lint-install":{
+            "description": "Installs golangci-lint binary for linting. Using go install is not recommended in the official docs, because this can produce non-deterministic results.",
+            "cache": true,
+            "command": "curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b .artifacts/bin/$(go env GOOS)/$(go env GOARCH) v2.5.0",
+            "inputs": [
+                { "runtime": "go env GOOS" },
+                { "runtime": "go env GOARCH" }
+            ],
+            "outputs": [
+                "{workspaceRoot}/.artifacts/bin/*/*/golangci-lint"
+            ]
+        },
+        "lint": {
+            "description": "Lints the Go code with golangci-lint using the configuration in .golangci.yaml",
+            "dependsOn": [
+                "lint-install",
+                "generate-stubs",
+                "generate-assets"
+            ],
+            "command": "PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" golangci-lint run --timeout 15m --config ./.golangci.yaml --verbose",
+            "cache": true,
+            "inputs": [
+                "sources",
+                "{workspaceRoot}/.golangci.yaml"
+            ]
+        },
+        "test": {
+            "description": "Runs all tests (unit and integration)",
+            "dependsOn": [
+                "test-unit",
+                "test-integration"
+            ]
+        },
+        "test-unit": {
+            "description": "Runs the unit tests with coverage",
+            "dependsOn": [
+                "generate-stubs",
+                "generate-assets",
+                "generate-statik"
+            ],
+            "command": "go test -race -coverprofile=profile.api.test-unit.cov -coverpkg=./internal/...  ./...",
+            "inputs": [
+                "sources",
+                "{workspaceRoot}/go*"
+            ],
+            "outputs": [
+                "{workspaceRoot}/profile.api.test-unit.cov"
+            ]
+        },
+        "test-integration-build": {
+            "description": "Builds the test binary for integration tests.",
+            "dependsOn": [
+                "generate-stubs",
+                "generate-assets",
+                "generate-statik"
+            ],
+            "command": "go build -cover -race -tags integration -o .artifacts/bin/$(go env GOOS)/$(go env GOARCH)/zitadel.test main.go",
+            "cache": true,
+            "inputs": [
+                { "runtime": "go env GOOS" },
+                { "runtime": "go env GOARCH" },
+                "sources",
+                "{workspaceRoot}/internal/integration/**",
+                "{workspaceRoot}/go*"
+            ],
+            "outputs": [
+                "{workspaceRoot}/.artifacts/bin/*/*/zitadel.test"
+            ]
+        },
+        "test-integration-run-db": {
+            "description": "Runs the database and cache for integration tests.",
+            "continuous": true,
+            "command": "nx run @zitadel/devcontainer:compose up --force-recreate --renew-anon-volumes db-api-integration cache-api-integration"
+        },
+        "test-integration-run-api": {
+            "description": "Runs the API server for the integration tests.",
+            "continuous": true,
+            "dependsOn": [
+                "test-integration-build"
+            ],
+            "executor": "nx:run-commands",
+            "options": {
+                "env": {
+                    "ZITADEL_BINARY": "zitadel.test",
+                    "GOCOVERDIR": "{workspaceRoot}/.artifacts/api-test-integration/coverage",
+                    "GORACE": "log_path=.artifacts/api-test-integration/race.log"
+                },
+                "parallel": false,
+                "commands": [
+                    "rm -rf .artifacts/api-test-integration",
+                    "mkdir -p ${GOCOVERDIR}",
+                    "nx run @zitadel/api:prod:test-integration-api --excludeTaskDependencies"
+                ]
+            }
+        },
+        "test-integration": {
+            "description": "Runs the integration tests sequentially with coverage and race condition detection. Go test caching is disabled, because the tests run against an out-of-process API.",
+            "dependsOn": [
+                "test-integration-run-db",
+                "test-integration-run-api"
+            ],
+            "executor": "nx:run-commands",
+            "options": {
+                "parallel": false,
+                "env": {
+                    "GOCOVERDIR": "{workspaceRoot}/.artifacts/api-test-integration/coverage"
+                },
+                "commands": [
+                    "wait-on --verbose --interval 2000 --simultaneous 1 --timeout 30m \"${ZITADEL_API_URL}/debug/ready\"",
+                    "bash -c 'go test -race -count 1 -tags integration -timeout 60m -parallel 1 $(go list -tags integration ./... | grep -e \"integration_test\" -e \"events_testing\")'",
+                    "go tool covdata textfmt -i=$GOCOVERDIR -pkg=github.com/zitadel/zitadel/internal/...,github.com/zitadel/zitadel/cmd/...,github.com/zitadel/zitadel/backend/... -o profile.api.test-integration.cov",
+                    "nx run @zitadel/api:test-integration-stop"
+                ]
+            },
+            "inputs": [
+                { "runtime": "go env GOOS" },
+                { "runtime": "go env GOARCH" },
+                "sources",
+                "{workspaceRoot}/internal/integration/**",
+                "{workspaceRoot}/go*"
+            ],
+            "outputs": [
+                "{workspaceRoot}/profile.api.test-integration.cov"
+            ]
+        },
+        "test-integration-stop": {
+            "description": "Stops the database and cache containers used for integration tests.",
+            "command": "nx run @zitadel/devcontainer:compose down --volumes db-api-integration cache-api-integration"
+        },
+        "build-console": {
+            "description": "Builds the Console and copies its static files to the API.",
+            "dependsOn": [
+                "@zitadel/console:build"
+            ],
+            "command": "cp -r console/dist/console/* internal/api/ui/console/static",
+            "cache": true,
+            "outputs": [
+                "{workspaceRoot}/internal/api/ui/console/static"
+            ]
+        },
+        "generate-install": {
+            "description": "Installs the binaries needed for generating code. We avoid using go tools so the dev tool dependencies don't interfere with the prod dependencies.",
+            "executor": "nx:run-commands",
+            "options": {
+                "commands": [
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install github.com/dmarkham/[email protected]",
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install go.uber.org/mock/[email protected]",
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install golang.org/x/tools/cmd/[email protected]",
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install github.com/rakyll/[email protected]",
+
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install github.com/bufbuild/buf/cmd/[email protected]",
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install google.golang.org/protobuf/cmd/[email protected]",
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install google.golang.org/grpc/cmd/[email protected]",
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install github.com/grpc-ecosystem/grpc-gateway/v2/[email protected]",
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install github.com/grpc-ecosystem/grpc-gateway/v2/[email protected]",
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install github.com/envoyproxy/[email protected]",
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install connectrpc.com/connect/cmd/[email protected]",
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install google.golang.org/protobuf/cmd/[email protected]",
+
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install ./internal/protoc/protoc-gen-authoption",
+                    "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install ./internal/protoc/protoc-gen-zitadel"
+                ]
+            },
+            "cache": true,
+            "inputs": [
+                { "runtime": "go env GOOS" },
+                { "runtime": "go env GOARCH" },
+                "{workspaceRoot}/internal/protoc/protoc-gen-authoption/**/*",
+                "{workspaceRoot}/internal/protoc/protoc-gen-zitadel/**/*"
+            ],
+            "outputs": [
+                "{workspaceRoot}/.artifacts/bin/*/*/enumer",
+                "{workspaceRoot}/.artifacts/bin/*/*/mockgen",
+                "{workspaceRoot}/.artifacts/bin/*/*/stringer",
+                "{workspaceRoot}/.artifacts/bin/*/*/statik",
+
+                "{workspaceRoot}/.artifacts/bin/*/*/buf",
+                "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-go",
+                "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-go-grpc",
+                "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-grpc-gateway",
+                "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-openapiv2",
+                "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-validate",
+                "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-connect-go",
+
+                "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-authoption",
+                "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-zitadel"
+            ]
+        },
+        "generate-stubs": {
+            "description": "Generates the gRPC and OpenAPI stubs from the proto files.",
+            "dependsOn": [
+                "generate-install"
+            ],
+            "executor": "nx:run-commands",
+            "options": {
+                "parallel": false,
+                "commands": [
+                    "bash -c 'PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" buf generate'",
+                    "mkdir -p pkg/grpc openapi/v2/zitadel",
+                    "cp -r .artifacts/grpc/github.com/zitadel/zitadel/pkg/grpc/** pkg/grpc/",
+                    "cp -r .artifacts/grpc/zitadel/ openapi/v2/zitadel"
+                ]
+            },
+            "cache": true,
+            "inputs": [
+                "{workspaceRoot}/proto/**/*",
+                "{workspaceRoot}/buf.gen.yaml",
+                "{workspaceRoot}/buf.yaml"
+            ],
+            "outputs": [
+                "{workspaceRoot}/pkg/grpc/**/*",
+                "{workspaceRoot}/openapi/v2/zitadel/**/*"
+            ]
+        },
+        "generate-statik": {
+            "description": "Generates statik files for embedding static resources",
+            "dependsOn": [
+                "generate-install"
+            ],
+            "executor": "nx:run-commands",
+            "options": {
+                "commands": [
+                    "PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" go generate internal/api/ui/login/static/resources/generate.go",
+                    "PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" go generate internal/api/ui/login/statik/generate.go",
+                    "PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" go generate internal/notification/statik/generate.go",
+                    "PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" go generate internal/statik/generate.go"
+                ]
+            },
+            "cache": true,
+            "inputs": [
+                { "runtime": "go env GOOS" },
+                { "runtime": "go env GOARCH" },
+                "{workspaceRoot}/internal/statik/generate.go",
+                "{workspaceRoot}/internal/notification/statik/generate.go",
+                "{workspaceRoot}/internal/api/ui/login/static/resources/generate.go",
+                "{workspaceRoot}/internal/api/ui/login/statik/generate.go"
+            ],
+            "outputs": [
+                "{workspaceRoot}/internal/statik/statik.go",
+                "{workspaceRoot}/internal/notification/statik/statik.go",
+                "{workspaceRoot}/internal/api/ui/login/static/resources/themes/zitadel/css/zitadel.css*",
+                "{workspaceRoot}/internal/api/ui/login/statik/statik.go"
+            ]
+        },
+        "generate-assets": {
+            "description": "Generates asset routes and documentation",
+            "dependsOn": [
+                "generate-install"
+            ],
+            "command": "mkdir -p docs/apis/assets && go run internal/api/assets/generator/asset_generator.go -directory=internal/api/assets/generator/ -assets=docs/apis/assets/assets.md",
+            "cache": true,
+            "inputs": [
+                "{workspaceRoot}/internal/api/assets/generator/asset_generator.go"
+            ],
+            "outputs": [
+                "{workspaceRoot}/internal/api/assets/authz.go",
+                "{workspaceRoot}/internal/api/assets/router.go",
+                "{workspaceRoot}/docs/apis/assets/assets.md"
+            ]
+        },
+        "generate-go": {
+            "description": "Generates Go using Go native generation tools. This only needs to be run if sources for //go:generate  files change, like for Stringer, Enumer, Mockgen etc.",
+            "dependsOn": [
+                "generate-install"
+            ],
+            "command": "PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" go generate ./..."
+        },
+        "pack-platform": {
+            "description": "Cross-compiles the binary and packages it for the platform defined by GOOS and GOARCH environment variables. The version is taken from the ZITADEL_VERSION environment variable.",
+            "executor": "nx:run-commands",
+            "options": {
+                "commands": [
+                    "mkdir -p .artifacts/pack .artifacts/bin/$GOOS/$GOARCH",
+                    "bash -c 'EXT=\"\"; if [ \"$GOOS\" = \"windows\" ]; then EXT=\".exe\"; fi; echo \"Building for $GOOS-$GOARCH...\"; CGO_ENABLED=0 go build -o .artifacts/bin/$GOOS/$GOARCH/zitadel$EXT -v -ldflags=\"-s -w -X github.com/zitadel/zitadel/cmd/build.commit=$(git rev-parse --short HEAD) -X github.com/zitadel/zitadel/cmd/build.date=$(date \"+%Y-%m-%dT%T%z\" | sed -E \"s/.([0-9]{2})([0-9]{2})$/-\\1:\\2/\") -X github.com/zitadel/zitadel/cmd/build.version=${ZITADEL_VERSION}\"'",
+                    "bash -c 'EXT=\"\"; if [ \"$GOOS\" = \"windows\" ]; then EXT=\".exe\"; fi; FOLDER=\".artifacts/pack/zitadel-$GOOS-$GOARCH\"; mkdir -p \"$FOLDER\"; cp \".artifacts/bin/$GOOS/$GOARCH/zitadel$EXT\" \"$FOLDER/\"; cp LICENSE \"$FOLDER/\"; cp README.md \"$FOLDER/\"; tar -czvf \"$FOLDER.tar.gz\" \"$FOLDER\"; rm -rf \"$FOLDER\"'"
+                ]
+            }
+        },
+        "pack-darwin-amd64": {
+            "description": "Packages the API for Darwin AMD64 (Intel) architecture",
+            "dependsOn": [
+                "generate-stubs",
+                "generate-assets",
+                "generate-statik"
+            ],
+            "command": "GOOS=darwin GOARCH=amd64 nx run @zitadel/api:pack-platform",
+            "cache": true,
+            "inputs": [
+                "pack",
+                { "env": "ZITADEL_VERSION" }
+            ],
+            "outputs": [
+                "{workspaceRoot}/.artifacts/pack/zitadel-darwin-amd64.tar.gz",
+                "{workspaceRoot}/.artifacts/bin/darwin/amd64/zitadel"
+            ]
+        },
+        "pack-darwin-arm64": {
+            "description": "Packages the API for Darwin ARM64 (Apple Silicon) architecture",
+            "dependsOn": [
+                "generate-stubs",
+                "generate-assets",
+                "generate-statik"
+            ],
+            "command": "GOOS=darwin GOARCH=arm64 nx run @zitadel/api:pack-platform",
+            "cache": true,
+            "inputs": [
+                "pack",
+                { "env": "ZITADEL_VERSION" }
+            ],
+            "outputs": [
+                "{workspaceRoot}/.artifacts/pack/zitadel-darwin-arm64.tar.gz",
+                "{workspaceRoot}/.artifacts/bin/darwin/arm64/zitadel"
+            ]
+        },
+        "pack-linux-amd64": {
+            "description": "Packages the API for Linux AMD64 architecture",
+            "dependsOn": [
+                "generate-stubs",
+                "generate-assets",
+                "generate-statik"
+            ],
+            "command": "GOOS=linux GOARCH=amd64 nx run @zitadel/api:pack-platform",
+            "cache": true,
+            "inputs": [
+                "pack",
+                { "env": "ZITADEL_VERSION" }
+            ],
+            "outputs": [
+                "{workspaceRoot}/.artifacts/pack/zitadel-linux-amd64.tar.gz",
+                "{workspaceRoot}/.artifacts/bin/linux/amd64/zitadel"
+            ]
+        },
+        "pack-linux-arm64": {
+            "description": "Packages the API for Linux ARM64 architecture",
+            "dependsOn": [
+                "generate-stubs",
+                "generate-assets",
+                "generate-statik"
+            ],
+            "command": "GOOS=linux GOARCH=arm64 nx run @zitadel/api:pack-platform",
+            "cache": true,
+            "inputs": [
+                "pack",
+                { "env": "ZITADEL_VERSION" }
+            ],
+            "outputs": [
+                "{workspaceRoot}/.artifacts/pack/zitadel-linux-arm64.tar.gz",
+                "{workspaceRoot}/.artifacts/bin/linux/arm64/zitadel"
+            ]
+        },
+        "pack-windows-amd64": {
+            "description": "Packages the API for Windows AMD64 architecture",
+            "dependsOn": [
+                "generate-stubs",
+                "generate-assets",
+                "generate-statik"
+            ],
+            "command": "GOOS=windows GOARCH=amd64 nx run @zitadel/api:pack-platform",
+            "cache": true,
+            "inputs": [
+                "pack",
+                { "env": "ZITADEL_VERSION" }
+            ],
+            "outputs": [
+                "{workspaceRoot}/.artifacts/pack/zitadel-windows-amd64.tar.gz",
+                "{workspaceRoot}/.artifacts/bin/windows/amd64/zitadel.exe"
+            ]
+        },
+        "pack-windows-arm64": {
+            "description": "Packages the API for Windows ARM64 architecture",
+            "dependsOn": [
+                "generate-stubs",
+                "generate-assets",
+                "generate-statik"
+            ],
+            "command": "GOOS=windows GOARCH=arm64 nx run @zitadel/api:pack-platform",
+            "cache": true,
+            "inputs": [
+                "pack",
+                { "env": "ZITADEL_VERSION" }
+            ],
+            "outputs": [
+                "{workspaceRoot}/.artifacts/pack/zitadel-windows-arm64.tar.gz",
+                "{workspaceRoot}/.artifacts/bin/windows/arm64/zitadel.exe"
+            ]
+        }
+    }
+}
@@ -0,0 +1,59 @@
+Log:
+  Level: info
+
+ExternalSecure: false
+
+Database:
+  postgres:
+    # This makes the e2e config reusable with an out-of-docker zitadel process and an /etc/hosts entry
+    database: zitadel
+    MaxOpenConns: 15
+    MaxIdleConns: 10
+    Database: zitadel
+    User:
+      Username: zitadel
+      Password: zitadel
+      SSL:
+        Mode: disable
+    Admin:
+      Username: postgres
+      Password: postgres
+      SSL:
+        Mode: disable
+
+TLS:
+  Enabled: false
+
+FirstInstance:
+  Org:
+    Human:
+      PasswordChangeRequired: false
+
+Console:
+  InstanceManagementURL: "https://example.com/instances/{{.InstanceID}}"
+
+Projections:
+  Customizations:
+    NotificationsQuotas:
+      RequeueEvery: 1s
+
+Quotas:
+  Access:
+    Enabled: true
+    Debounce:
+      MinFrequency: 0s
+      MaxBulkSize: 0
+    ExhaustedCookieKey: "zitadel.quota.limiting"
+    ExhaustedCookieMaxAge: "600s"
+
+DefaultInstance:
+  LoginPolicy:
+    MfaInitSkipLifetime: "0"
+  Features:
+    LoginV2:
+      Required: false
+
+SystemAPIUsers:
+- cypress:
+    KeyData: "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF6aStGRlNKTDdmNXl3NEtUd3pnTQpQMzRlUEd5Y20vTStrVDBNN1Y0Q2d4NVYzRWFESXZUUUtUTGZCYUVCNDV6YjlMdGpJWHpEdzByWFJvUzJoTzZ0CmgrQ1lRQ3ozS0N2aDA5QzBJenhaaUIySVMzSC9hVCs1Qng5RUZZK3ZuQWtaamNjYnlHNVlOUnZtdE9sbnZJZUkKSDdxWjB0RXdrUGZGNUdFWk5QSlB0bXkzVUdWN2lvZmRWUVMxeFJqNzMrYU13NXJ2SDREOElkeWlBQzNWZWtJYgpwdDBWajBTVVgzRHdLdG9nMzM3QnpUaVBrM2FYUkYwc2JGaFFvcWRKUkk4TnFnWmpDd2pxOXlmSTV0eXhZc3duCitKR3pIR2RIdlczaWRPRGxtd0V0NUsycGFzaVJJV0syT0dmcSt3MEVjbHRRSGFidXFFUGdabG1oQ2tSZE5maXgKQndJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg=="
+
@@ -0,0 +1,128 @@
+Database:
+  Postgres:
+    MaxOpenConns: 20
+    MaxIdleConns: 20
+    MaxConnLifetime: 1h
+    MaxConnIdleTime: 5m
+    Database: zitadel
+FirstInstance:
+  Skip: false
+  PatPath: .artifacts/api-test-integration/admin-pat.txt
+  InstanceName: ZITADEL
+  DefaultLanguage: en
+  Org:
+    Name: ZITADEL
+    Machine:
+      Machine:
+        Username: boss
+        Name: boss
+      Pat:
+        ExpirationDate: 2099-01-01T00:00:00Z
+    Human:
+      PasswordChangeRequired: false
+
+Log:
+  Level: info
+
+ExternalSecure: false
+
+TLS:
+  Enabled: false
+
+Caches:
+  Connectors:
+    Memory:
+      Enabled: true
+    Postgres:
+      Enabled: true
+    Redis:
+      Enabled: true
+  Instance:
+    Connector: "memory"
+    MaxAge: 5m
+    LastUsage: 1m
+    Log:
+      Level: info
+  Milestones:
+    Connector: "postgres"
+    MaxAge: 5m
+    LastUsage: 1m
+    Log:
+      Level: info
+  Organization:
+    Connector: "redis"
+    MaxAge: 5m
+    LastUsage: 1m
+    Log:
+      Level: info
+
+Quotas:
+  Access:
+    Enabled: true
+
+Telemetry:
+  Enabled: true
+  Endpoints:
+  - http://localhost:8081/milestone
+  Headers:
+    single-value: "single-value"
+    multi-value:
+    - "multi-value-1"
+    - "multi-value-2"
+
+LogStore:
+  Execution:
+    Stdout:
+      Enabled: true
+
+Projections:
+  HandleActiveInstances: 30m
+  RequeueEvery: 20s
+  Customizations:
+    NotificationsQuotas:
+      RequeueEvery: 5s
+    telemetry:
+      HandleActiveInstances: 60s
+      RequeueEvery: 5s
+
+DefaultInstance:
+  LoginPolicy:
+    MfaInitSkipLifetime: "0"
+
+SystemAPIUsers:
+  - tester:
+      KeyData: "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF6aStGRlNKTDdmNXl3NEtUd3pnTQpQMzRlUEd5Y20vTStrVDBNN1Y0Q2d4NVYzRWFESXZUUUtUTGZCYUVCNDV6YjlMdGpJWHpEdzByWFJvUzJoTzZ0CmgrQ1lRQ3ozS0N2aDA5QzBJenhaaUIySVMzSC9hVCs1Qng5RUZZK3ZuQWtaamNjYnlHNVlOUnZtdE9sbnZJZUkKSDdxWjB0RXdrUGZGNUdFWk5QSlB0bXkzVUdWN2lvZmRWUVMxeFJqNzMrYU13NXJ2SDREOElkeWlBQzNWZWtJYgpwdDBWajBTVVgzRHdLdG9nMzM3QnpUaVBrM2FYUkYwc2JGaFFvcWRKUkk4TnFnWmpDd2pxOXlmSTV0eXhZc3duCitKR3pIR2RIdlczaWRPRGxtd0V0NUsycGFzaVJJV0syT0dmcSt3MEVjbHRRSGFidXFFUGdabG1oQ2tSZE5maXgKQndJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg=="
+      Memberships:
+        - MemberType: System
+          Roles:
+            - "SYSTEM_OWNER"
+            - "IAM_OWNER"
+            - "ORG_OWNER"
+  - cypress:
+      KeyData: "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF6aStGRlNKTDdmNXl3NEtUd3pnTQpQMzRlUEd5Y20vTStrVDBNN1Y0Q2d4NVYzRWFESXZUUUtUTGZCYUVCNDV6YjlMdGpJWHpEdzByWFJvUzJoTzZ0CmgrQ1lRQ3ozS0N2aDA5QzBJenhaaUIySVMzSC9hVCs1Qng5RUZZK3ZuQWtaamNjYnlHNVlOUnZtdE9sbnZJZUkKSDdxWjB0RXdrUGZGNUdFWk5QSlB0bXkzVUdWN2lvZmRWUVMxeFJqNzMrYU13NXJ2SDREOElkeWlBQzNWZWtJYgpwdDBWajBTVVgzRHdLdG9nMzM3QnpUaVBrM2FYUkYwc2JGaFFvcWRKUkk4TnFnWmpDd2pxOXlmSTV0eXhZc3duCitKR3pIR2RIdlczaWRPRGxtd0V0NUsycGFzaVJJV0syT0dmcSt3MEVjbHRRSGFidXFFUGdabG1oQ2tSZE5maXgKQndJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg=="
+  - system-user-with-no-permissions:
+      KeyData: "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFqTVdFWDZtK0gzWndaV1ptTUhxbApHbVoxa0wvRVlWZzJCb24yQm5wOU5LTXdoVTlpK29CcUwrR0FzVVZYdnBkMmhVTy9ZK1VpVzlRdnJ4K3ZBeVpNCmdrNjRRNlFFNm5ZMWJncnV3aEJDUC85ZWlMMzVvOTRHelhiS2RDSEF5bFNBQmRHemZaTDN1YUgwVndvRk9neU0KZkJveTdGMHFLRXA0bVp5ZUhmMFo3ZXZacVVyRDVNcEZMTjBhUnRqVWpwOTFpd0tGU29kYXY1S25sYW4vSGtQaQpzN3NnLzBmVURRRDRzZ2ZvcndManJWYnI1aUtxSTBHQ3VhUEwzazRQOEdnY1haczVJcHUzb1BDZXdWUTBvd1hoCjJvRXVTdlNDYS8wTmxYanRLMlRqbmlYeTVSL2NaVXF3NzNOd0NFdjl4N1pLaU51dkpEWkw2UnM5Q0xJT3RhVkUKTFFJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg=="
+      Memberships:
+      # MemberType System allows the user to access all APIs for all instances or organizations
+      - MemberType: IAM
+        Roles:
+          - "NO_ROLES"
+
+InitProjections:
+  Enabled: true
+
+# Extend key lifetimes so we do not see more legacy keys when
+# integration tests are rerun on the same DB with more than 6 hours apart.
+# The test counts the amount of keys returned from the JWKS endpoint and fails
+# with 2 or more legacy public keys,
+SystemDefaults:
+  KeyConfig:
+    PrivateKeyLifetime: 7200h
+    PublicKeyLifetime: 14400h
+
+OIDC:
+  DefaultLoginURLV2: "/login?authRequest=" # ZITADEL_OIDC_DEFAULTLOGINURLV2
+  DefaultLogoutURLV2: "/logout?post_logout_redirect=" # ZITADEL_OIDC_DEFAULTLOGOUTURLV2
+
+SAML:
+  DefaultLoginURLV2: "/login?authRequest=" # ZITADEL_SAML_DEFAULTLOGINURLV2