mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-20 14:34:25 +00:00
33 lines
1.9 KiB
Plaintext
33 lines
1.9 KiB
Plaintext
---
|
|
title: Database
|
|
description: Configure and manage the ZITADEL database using PostgreSQL for persistent storage and audit logs
|
|
---
|
|
|
|
import Postgres from './_postgres.mdx'
|
|
|
|
## Database Configuration
|
|
|
|
<Postgres components={props.components} />
|
|
|
|
## Zitadel Credentials
|
|
|
|
The [init phase](/self-hosting/manage/updating_scaling#separating-init-and-setup-from-the-runtime) of ZITADEL creates the ZITADEL database user (`Database.*.User.Username` & `Database.*.User.Password`) if it does not exist and admin credentials are provided. **Init does not update or deprecate existing users or passwords.** If you need to change the ZITADEL database user or rotate its password, you must do this manually.
|
|
|
|
<Callout type="warn">
|
|
The `init` command is designed to be run **only once**, during the initial setup of ZITADEL. Running `init` again after changing the database user or credentials does **not** migrate database object ownerships, nor does it reassign permissions on schemas, tables, or other objects to a new user. You must update these permissions manually if you switch users.
|
|
</Callout>
|
|
|
|
### Rotating Database Credentials
|
|
|
|
If you must rotate the credentials:
|
|
|
|
- You can change the password for the existing ZITADEL user, but you must manually update the password wherever ZITADEL needs it.
|
|
- Creating a new database user requires manual reassignment of ownership and privileges for all required database objects (schemas, tables, etc.) to the new user.
|
|
- After migration, remove or deprecate the old user using admin access and commands appropriate for your database provider.
|
|
|
|
Attempting to run `init` a second time with new credentials will fail if the user already exists, and will not change existing permissions or migrate data.
|
|
|
|
<Callout type="warn">
|
|
Dropping and recreating the database does **not** automatically remove existing users. Always verify and clean up old users if necessary.
|
|
</Callout>
|