mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
Tim MöhlmannandGitHub
e94d4c3986
# Which Problems Are Solved Enable FIPS 140-3 compliant build. # How the Problems Are Solved - Add runtime config validation, if the FIPS flag is enabled fail the application when a non-compliant hasher is used, or throw a warning when a legacy verifier is used - Add a build matrix for FIPS certified build: - Go binary is built with `GOFIPS140=certified` - Login container uses a separate base: [ubi9](https://catalog.redhat.com/en/software/containers/ubi9/ubi/615bcf606feffc5384e8452e) from redhat which provides a FIPS certified OpenSSL (used by NodeJS TLS stack) - Non-FIPS images where already pushed to both Github Container Registry and Google Artifact Repository (GAR). Fips images are only pushed to the GAR. - Tag versions are suffixed `-fips`. So on release the following images will be additionally available: ``` europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login:vX.Y.Z-fips europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips-debug europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips ``` # Other changes - Bumb Go toolchain. At least v1.25.10 is required for a GOFIPS140=certified setting. # Additional Context - Closes https://github.com/zitadel/zitadel/issues/4335 - Build [test run](https://github.com/zitadel/zitadel/actions/runs/27253916052) pushing FIPS and non-FIPS images
24 lines
953 B
Docker
24 lines
953 B
Docker
FROM registry.access.redhat.com/ubi9/nodejs-24
|
|
USER root
|
|
RUN update-crypto-policies --set FIPS
|
|
WORKDIR /app
|
|
# If /.env-file/.env is mounted into the container, its variables are made available to the server before it starts up.
|
|
RUN mkdir -p /.env-file && touch /.env-file/.env && chown -R 1001:0 /.env-file
|
|
|
|
COPY --chown=1001:0 .next/standalone ./
|
|
|
|
USER 1001
|
|
ENV HOSTNAME="::" \
|
|
PORT="3000" \
|
|
NODE_ENV="production" \
|
|
NODE_OPTIONS="--use-openssl-ca --openssl-shared-config --enable-fips --require /app/load-ssl-cert-dir.cjs" \
|
|
SSL_CERT_FILE="/etc/pki/tls/certs/ca-bundle.crt" \
|
|
ZITADEL_TLS_ENABLED="false" \
|
|
ZITADEL_FIPS_REQUIRED="true" \
|
|
OTEL_SERVICE_NAME="zitadel-login" \
|
|
OTEL_EXPORTER_OTLP_PROTOCOL="http/protobuf"
|
|
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
|
|
CMD ["node", "/app/healthcheck.mjs", "/ui/v2/login/ready"]
|
|
ENTRYPOINT ["/app/entrypoint.sh", "node", "apps/login/server.js"]
|