mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-20 14:34:25 +00:00
c8abf6de74
# Which Problems Are Solved The login container can only serve HTTP. In deployments where a reverse proxy is not used, operators need the login container to terminate TLS itself. Closes #11473 # How the Problems Are Solved The container now supports optional HTTPS via three environment variables that match the pattern already used by the backend server: `ZITADEL_TLS_ENABLED`, `ZITADEL_TLS_CERTPATH`, and `ZITADEL_TLS_KEYPATH`. When `ZITADEL_TLS_ENABLED` is not set or set to `false`, behavior is identical to before. When set to `true`, the server reads the provided certificate and key files and serves HTTPS using the lower-level `getRequestHandlers` API from Next.js. The Docker healthcheck was updated to probe the correct scheme automatically based on the same environment variable. # Additional Changes Added a dockerized integration test that verifies both HTTP and HTTPS modes using testcontainers. # Additional Context The TLS path uses `getRequestHandlers` from `next/dist/server/lib/start-server` instead of `startServer` because the latter rejects self-signed certificates in production mode. This is the same internal API that `startServer` itself calls. --------- Co-authored-by: Copilot <[email protected]>
23 lines
843 B
Docker
23 lines
843 B
Docker
FROM node:22-alpine
|
|
WORKDIR /app
|
|
RUN addgroup --system --gid 1001 nodejs && \
|
|
adduser --system --uid 1001 nextjs
|
|
# If /.env-file/.env is mounted into the container, its variables are made available to the server before it starts up.
|
|
RUN mkdir -p /.env-file && touch /.env-file/.env && chown -R nextjs:nodejs /.env-file
|
|
|
|
COPY --chown=nextjs:nodejs .next/standalone ./
|
|
|
|
USER nextjs
|
|
ENV HOSTNAME="::" \
|
|
PORT="3000" \
|
|
NODE_ENV="production" \
|
|
NODE_OPTIONS="--use-openssl-ca" \
|
|
SSL_CERT_FILE="/etc/ssl/certs/ca-certificates.crt" \
|
|
SSL_CERT_DIR="/etc/ssl/certs" \
|
|
ZITADEL_TLS_ENABLED="false"
|
|
|
|
# TODO: Check healthy, not ready
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
|
|
CMD ["/usr/local/bin/node", "/app/healthcheck.mjs"]
|
|
ENTRYPOINT ["/app/entrypoint.sh", "node", "apps/login/server.js" ]
|