Instrumentation: ServiceName: "zitadel-setup" # ZITADEL_INSTRUMENTATION_SERVICENAME Trace: Fraction: 1.0 # ZITADEL_INSTRUMENTATION_TRACE_FRACTION # Trust incoming trace context from remote services for distributed tracing. # Enable only in controlled environments; defaults to false for security. TrustRemoteSpans: false # ZITADEL_INSTRUMENTATION_TRACE_TRUSTREMOTESPANS Exporter: # The following exporter types are supported: # "none": Disables trace exporting # "stdOut": Exports traces to standard output # "stdErr": Exports traces to standard error # "grpc": Exports traces using the OTEL gRPC exporter (recommended) # "http": Exports traces using the OTEL HTTP exporter # "google": Exports traces to Google Cloud. Need to configure GoogleProjectID below! Type: "none" # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_TYPE # Endpoint of the OTEL collector for grpc and http exporters Endpoint: "" # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_ENDPOINT # Disable TLS for grpc and http exporters Insecure: false # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_INSECURE # Interval for batching traces before export BatchDuration: 1s # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_BATCHDURATION # Project ID for Google Cloud Trace exporter GoogleProjectID: "" # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_GOOGLEPROJECTID Metric: Exporter: # The following exporter types are supported: # "none": Disables metric exporting # "stdOut": Exports metrics to standard output # "stdErr": Exports metrics to standard error # "grpc": Exports metrics using the OTEL gRPC exporter (recommended) # "http": Exports metrics using the OTEL HTTP exporter # "google": Exports metrics to Google Cloud. Need to configure GoogleProjectID below! # "prometheus": Exposes metrics via an HTTP endpoint for Prometheus to scrape Type: "none" # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_TYPE # Endpoint of the OTEL collector for grpc and http exporters Endpoint: "" # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_ENDPOINT # Disable TLS for grpc and http exporters Insecure: false # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_INSECURE # Interval at which metrics are exported BatchDuration: 1m # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_BATCHDURATION # Project ID for Google Cloud Trace exporter GoogleProjectID: "" # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_GOOGLEPROJECTID # Structured logging can print logs on standard error and/or export them using OTEL. Log: # Log lines lower than this level are not emitted. Level: "INFO" # ZITADEL_INSTRUMENTATION_LOG_LEVEL # Streams enable logging for specific parts of the application. Streams: # ZITADEL_INSTRUMENTATION_LOG_STREAMS (comma separated list) - runtime # General runtime logs, such as startup and shutdown messages. - ready # Logs related to readiness and health checks. (zitadel ready command) - request # Logs for incoming API and HTTP requests. - event_handler # Logs for event handling in projections. - queue # Logs for the job queue processing. # - event_pusher # Logs for event pushing to the database. Warning: contains sensitive information. # Mask replaces sensitive information with Value in logs matched by Key Mask: # Keys are the attribute keys to be masked in logs. # Keys are unqualified attribute names and apply to all attributes with the specified name, # regardless of their position in the attribute hierarchy. # Eg. "some_key" matches "some_key" and "parent.some_key" etc. # When the key matches a group of attributes (e.g. slog.Group), all attribute values in the # group are masked and the structure of the group is preserved. # When the key matches a non-group attribute whose value is a nested object/array # (e.g. added via slog.Any), the entire value is replaced with Value and its structure is not preserved. Keys: # ZITADEL_INSTRUMENTATION_LOG_MASK_KEYS (comma separated list) # - "first_name" # - "last_name" # Value is the string that replaces the original value of masked attributes. Value: "****" # ZITADEL_INSTRUMENTATION_LOG_MASK_VALUE # Enable printing structured logs to standard error in the specified format. # When disabled, the legacy Log configuration is used. # Important: when legacy Log is customized, please add a format and customize before upgrading to v5 # The following formats are supported: # - "disabled": Disables logging (or fallback to legacy Log config) # - "text": Logs are printed on StdErr as human-readable text # - "json": Logs are printed on StdErr as JSON objects # - "gcp": JSON formatted logs compatible with Google Cloud Platform logging. # - "gcp_error_reporting": JSON formatted logs compatible with Google Cloud Platform Error Reporting. Format: "disabled" # ZITADEL_INSTRUMENTATION_LOG_STDERR # Adds the source file and line number where the log line was emitted. # Not to be confused with the source of an error. AddSource: true # ZITADEL_INSTRUMENTATION_LOG_ADDSOURCE # Configure how errors are logged. Errors: # Adds the source file, line number and function where the error was created. ReportLocation: true # ZITADEL_INSTRUMENTATION_LOG_ERRORS_REPORTLOCATION # Adds stack traces to logged errors. StackTrace: false # ZITADEL_INSTRUMENTATION_LOG_ERRORS_STACKTRACE Exporter: # The following exporter types are supported: # - "none": Disables OTEL log exporter # - "stdOut": Exports OTEL logs to standard output # - "stdErr": Exports OTEL logs to standard error # - "grpc": Exports OTEL logs using the OTEL gRPC exporter (recommended) # - "http": Exports OTEL logs using the OTEL HTTP exporter Type: "none" # ZITADEL_INSTRUMENTATION_LOG_EXPORTER_TYPE # Endpoint of the OTEL collector for grpc and http exporters Endpoint: "" # ZITADEL_INSTRUMENTATION_LOG_EXPORTER_ENDPOINT # Disable TLS for grpc and http exporters Insecure: false # ZITADEL_INSTRUMENTATION_LOG_EXPORTER_INSECURE # Interval at which metrics are exported BatchDuration: 1s # ZITADEL_INSTRUMENTATION_LOG_EXPORTER_BATCHDURATION Profile: Exporter: # The following profiler types are supported: # "none": Disables profiling # "google": Exports profiling data to Google Cloud Profiler Type: "none" # ZITADEL_INSTRUMENTATION_PROFILE_TYPE # Project ID for Google Cloud Profiler GoogleProjectID: "" # ZITADEL_INSTRUMENTATION_PROFILE_GOOGLEPROJECTID # By using the FirstInstance section, you can overwrite the DefaultInstance configuration for the first instance created by zitadel setup. FirstInstance: # If set to true zitadel is setup without initial data Skip: false # The machine key from the section FirstInstance.Org.Machine.MachineKey is written to the MachineKeyPath. MachineKeyPath: # ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH # The personal access token from the section FirstInstance.Org.Machine.Pat is written to the PatPath. PatPath: # ZITADEL_FIRSTINSTANCE_PATPATH LoginClientPatPath: # ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH InstanceName: ZITADEL # ZITADEL_FIRSTINSTANCE_INSTANCENAME # A list of trusted domains, which are allowed to be used for public responses like email links or when running # ZITADEL or the login UI behind a reverse proxy. If no trusted domain is set, the instance domain is used. TrustedDomains: # ZITADEL_FIRSTINSTANCE_TRUSTEDDOMAINS # - login.example.com # - api.example.com DefaultLanguage: en # ZITADEL_FIRSTINSTANCE_DEFAULTLANGUAGE Org: Name: ZITADEL # ZITADEL_FIRSTINSTANCE_ORG_NAME # In the FirstInstance.Org.Human section, the initial organization's admin user with the role IAM_OWNER is defined. # If FirstInstance.Org.Machine.Machine is defined, a service account is created with the IAM_OWNER role. Human: # In case UserLoginMustBeDomain is false (default) and you don't overwrite the username with an email, # it will be suffixed by the Organization Domain (org-name + domain from config). # for example zitadel-admin in org ZITADEL on domain.tld -> zitadel-admin@zitadel.domain.tld UserName: zitadel-admin # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME FirstName: ZITADEL # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME LastName: Admin # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME NickName: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_NICKNAME DisplayName: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_DISPLAYNAME Email: # uses the username if empty Address: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS Verified: true # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_VERIFIED PreferredLanguage: en # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PREFERREDLANGUAGE Gender: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_GENDER Phone: Number: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PHONE_NUMBER Verified: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PHONE_VERIFIED Password: Password1! # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD PasswordChangeRequired: true # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED # In the FirstInstance.Org.Machine section, the initial organization's admin user with the role IAM_OWNER is defined. # If FirstInstance.Org.Machine.Machine is defined, a service account is created with the IAM_OWNER role. Machine: Machine: Username: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_USERNAME Name: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME MachineKey: # date format: 2023-01-01T00:00:00Z ExpirationDate: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINEKEY_EXPIRATIONDATE # Currently, the only supported value is 1 for JSON Type: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINEKEY_TYPE Pat: # date format: 2023-01-01T00:00:00Z ExpirationDate: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE LoginClient: Machine: Username: # ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_USERNAME Name: # ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME Pat: # date format: 2023-01-01T00:00:00Z ExpirationDate: # ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_PAT_EXPIRATIONDATE CorrectCreationDate: FailAfter: 5m # ZITADEL_CORRECTCREATIONDATE_FAILAFTER AddEventCreatedAt: BulkAmount: 100 # ZITADEL_ADDEVENTCREATEDAT_BULKAMOUNT FillFields: BatchSize: 1000 # ZITADEL_EVENTSTORE_FILLFIELDS_BULKLIMIT RelationalTables: # This is used for development DO NOT USE IN PRODUCTION ShouldRecreateSchema: false # ZITADEL_RELATIONALTABLES_SHOULDRECREATESCHEMA BackfillUniqueConstraintOwners: # After a rolling update on this same version, set true and re-run setup to # backfill leftover empty owners and enable owner-only unique-constraint delete. # Default false: owner-delete waits until the next release runs 79 again. ForceFinalize: false # ZITADEL_BACKFILLUNIQUECONSTRAINTOWNERS_FORCEFINALIZE