mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 13:52:51 +00:00
Livio SpringandGitHub
71fab2e574
# Which Problems Are Solved When running Zitadel behind a reverse proxy and especially when the API and the login UI don't run on the same domain, Zitadel needs to be configured to trust the corresponding domains and use them in public responses, like email links and more. This can be done by adding a trusted domain. However it's currently only possible through the API and not in the instance setup process. # How the Problems Are Solved Added a possibility to configure multiple trusted domains in the first instance setup process. # Additional Changes None # Additional Context - closes #11153
183 lines
10 KiB
YAML
183 lines
10 KiB
YAML
Instrumentation:
|
|
ServiceName: "zitadel-setup" # ZITADEL_INSTRUMENTATION_SERVICENAME
|
|
Trace:
|
|
Fraction: 1.0 # ZITADEL_INSTRUMENTATION_TRACE_FRACTION
|
|
# Trust incoming trace context from remote services for distributed tracing.
|
|
# Enable only in controlled environments; defaults to false for security.
|
|
TrustRemoteSpans: false # ZITADEL_INSTRUMENTATION_TRACE_TRUSTREMOTESPANS
|
|
Exporter:
|
|
# The following exporter types are supported:
|
|
# "none": Disables trace exporting
|
|
# "stdOut": Exports traces to standard output
|
|
# "stdErr": Exports traces to standard error
|
|
# "grpc": Exports traces using the OTEL gRPC exporter (recommended)
|
|
# "http": Exports traces using the OTEL HTTP exporter
|
|
# "google": Exports traces to Google Cloud. Need to configure GoogleProjectID below!
|
|
Type: "none" # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_TYPE
|
|
# Endpoint of the OTEL collector for grpc and http exporters
|
|
Endpoint: "" # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_ENDPOINT
|
|
# Disable TLS for grpc and http exporters
|
|
Insecure: false # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_INSECURE
|
|
# Interval for batching traces before export
|
|
BatchDuration: 1s # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_BATCHDURATION
|
|
# Project ID for Google Cloud Trace exporter
|
|
GoogleProjectID: "" # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_GOOGLEPROJECTID
|
|
Metric:
|
|
Exporter:
|
|
# The following exporter types are supported:
|
|
# "none": Disables metric exporting
|
|
# "stdOut": Exports metrics to standard output
|
|
# "stdErr": Exports metrics to standard error
|
|
# "grpc": Exports metrics using the OTEL gRPC exporter (recommended)
|
|
# "http": Exports metrics using the OTEL HTTP exporter
|
|
# "google": Exports metrics to Google Cloud. Need to configure GoogleProjectID below!
|
|
# "prometheus": Exposes metrics via an HTTP endpoint for Prometheus to scrape
|
|
Type: "none" # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_TYPE
|
|
# Endpoint of the OTEL collector for grpc and http exporters
|
|
Endpoint: "" # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_ENDPOINT
|
|
# Disable TLS for grpc and http exporters
|
|
Insecure: false # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_INSECURE
|
|
# Interval at which metrics are exported
|
|
BatchDuration: 1m # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_BATCHDURATION
|
|
# Project ID for Google Cloud Trace exporter
|
|
GoogleProjectID: "" # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_GOOGLEPROJECTID
|
|
|
|
# Structured logging can print logs on standard error and/or export them using OTEL.
|
|
Log:
|
|
# Log lines lower than this level are not emitted.
|
|
Level: "INFO" # ZITADEL_INSTRUMENTATION_LOG_LEVEL
|
|
# Streams enable logging for specific parts of the application.
|
|
Streams: # ZITADEL_INSTRUMENTATION_LOG_STREAMS (comma separated list)
|
|
- runtime # General runtime logs, such as startup and shutdown messages.
|
|
- ready # Logs related to readiness and health checks. (zitadel ready command)
|
|
- request # Logs for incoming API and HTTP requests.
|
|
- event_handler # Logs for event handling in projections.
|
|
- queue # Logs for the job queue processing.
|
|
# - event_pusher # Logs for event pushing to the database. Warning: contains sensitive information.
|
|
# Mask replaces sensitive information with Value in logs matched by Key
|
|
Mask:
|
|
# Keys are the attribute keys to be masked in logs.
|
|
# Keys are unqualified attribute names and apply to all attributes with the specified name,
|
|
# regardless of their position in the attribute hierarchy.
|
|
# Eg. "some_key" matches "some_key" and "parent.some_key" etc.
|
|
# When the key matches a group of attributes (e.g. slog.Group), all attribute values in the
|
|
# group are masked and the structure of the group is preserved.
|
|
# When the key matches a non-group attribute whose value is a nested object/array
|
|
# (e.g. added via slog.Any), the entire value is replaced with Value and its structure is not preserved.
|
|
Keys: # ZITADEL_INSTRUMENTATION_LOG_MASK_KEYS (comma separated list)
|
|
# - "first_name"
|
|
# - "last_name"
|
|
# Value is the string that replaces the original value of masked attributes.
|
|
Value: "****" # ZITADEL_INSTRUMENTATION_LOG_MASK_VALUE
|
|
# Enable printing structured logs to standard error in the specified format.
|
|
# When disabled, the legacy Log configuration is used.
|
|
# Important: when legacy Log is customized, please add a format and customize before upgrading to v5
|
|
# The following formats are supported:
|
|
# - "disabled": Disables logging (or fallback to legacy Log config)
|
|
# - "text": Logs are printed on StdErr as human-readable text
|
|
# - "json": Logs are printed on StdErr as JSON objects
|
|
# - "gcp": JSON formatted logs compatible with Google Cloud Platform logging.
|
|
# - "gcp_error_reporting": JSON formatted logs compatible with Google Cloud Platform Error Reporting.
|
|
Format: "disabled" # ZITADEL_INSTRUMENTATION_LOG_STDERR
|
|
# Adds the source file and line number where the log line was emitted.
|
|
# Not to be confused with the source of an error.
|
|
AddSource: true # ZITADEL_INSTRUMENTATION_LOG_ADDSOURCE
|
|
# Configure how errors are logged.
|
|
Errors:
|
|
# Adds the source file, line number and function where the error was created.
|
|
ReportLocation: true # ZITADEL_INSTRUMENTATION_LOG_ERRORS_REPORTLOCATION
|
|
# Adds stack traces to logged errors.
|
|
StackTrace: false # ZITADEL_INSTRUMENTATION_LOG_ERRORS_STACKTRACE
|
|
Exporter:
|
|
# The following exporter types are supported:
|
|
# - "none": Disables OTEL log exporter
|
|
# - "stdOut": Exports OTEL logs to standard output
|
|
# - "stdErr": Exports OTEL logs to standard error
|
|
# - "grpc": Exports OTEL logs using the OTEL gRPC exporter (recommended)
|
|
# - "http": Exports OTEL logs using the OTEL HTTP exporter
|
|
Type: "none" # ZITADEL_INSTRUMENTATION_LOG_EXPORTER_TYPE
|
|
# Endpoint of the OTEL collector for grpc and http exporters
|
|
Endpoint: "" # ZITADEL_INSTRUMENTATION_LOG_EXPORTER_ENDPOINT
|
|
# Disable TLS for grpc and http exporters
|
|
Insecure: false # ZITADEL_INSTRUMENTATION_LOG_EXPORTER_INSECURE
|
|
# Interval at which metrics are exported
|
|
BatchDuration: 1s # ZITADEL_INSTRUMENTATION_LOG_EXPORTER_BATCHDURATION
|
|
Profile:
|
|
Exporter:
|
|
# The following profiler types are supported:
|
|
# "none": Disables profiling
|
|
# "google": Exports profiling data to Google Cloud Profiler
|
|
Type: "none" # ZITADEL_INSTRUMENTATION_PROFILE_TYPE
|
|
# Project ID for Google Cloud Profiler
|
|
GoogleProjectID: "" # ZITADEL_INSTRUMENTATION_PROFILE_GOOGLEPROJECTID
|
|
|
|
# By using the FirstInstance section, you can overwrite the DefaultInstance configuration for the first instance created by zitadel setup.
|
|
FirstInstance:
|
|
# If set to true zitadel is setup without initial data
|
|
Skip: false
|
|
# The machine key from the section FirstInstance.Org.Machine.MachineKey is written to the MachineKeyPath.
|
|
MachineKeyPath: # ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH
|
|
# The personal access token from the section FirstInstance.Org.Machine.Pat is written to the PatPath.
|
|
PatPath: # ZITADEL_FIRSTINSTANCE_PATPATH
|
|
LoginClientPatPath: # ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH
|
|
InstanceName: ZITADEL # ZITADEL_FIRSTINSTANCE_INSTANCENAME
|
|
# A list of trusted domains, which are allowed to be used for public responses like email links or when running
|
|
# ZITADEL or the login UI behind a reverse proxy. If no trusted domain is set, the instance domain is used.
|
|
TrustedDomains: # ZITADEL_FIRSTINSTANCE_TRUSTEDDOMAINS
|
|
# - login.example.com
|
|
# - api.example.com
|
|
DefaultLanguage: en # ZITADEL_FIRSTINSTANCE_DEFAULTLANGUAGE
|
|
Org:
|
|
Name: ZITADEL # ZITADEL_FIRSTINSTANCE_ORG_NAME
|
|
# In the FirstInstance.Org.Human section, the initial organization's admin user with the role IAM_OWNER is defined.
|
|
# If FirstInstance.Org.Machine.Machine is defined, a service account is created with the IAM_OWNER role.
|
|
Human:
|
|
# In case UserLoginMustBeDomain is false (default) and you don't overwrite the username with an email,
|
|
# it will be suffixed by the Organization Domain (org-name + domain from config).
|
|
# for example zitadel-admin in org ZITADEL on domain.tld -> [email protected]
|
|
UserName: zitadel-admin # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME
|
|
FirstName: ZITADEL # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME
|
|
LastName: Admin # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME
|
|
NickName: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_NICKNAME
|
|
DisplayName: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_DISPLAYNAME
|
|
Email:
|
|
# uses the username if empty
|
|
Address: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS
|
|
Verified: true # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_VERIFIED
|
|
PreferredLanguage: en # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PREFERREDLANGUAGE
|
|
Gender: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_GENDER
|
|
Phone:
|
|
Number: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PHONE_NUMBER
|
|
Verified: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PHONE_VERIFIED
|
|
Password: Password1! # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD
|
|
PasswordChangeRequired: true # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED
|
|
# In the FirstInstance.Org.Machine section, the initial organization's admin user with the role IAM_OWNER is defined.
|
|
# If FirstInstance.Org.Machine.Machine is defined, a service account is created with the IAM_OWNER role.
|
|
Machine:
|
|
Machine:
|
|
Username: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_USERNAME
|
|
Name: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME
|
|
MachineKey:
|
|
# date format: 2023-01-01T00:00:00Z
|
|
ExpirationDate: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINEKEY_EXPIRATIONDATE
|
|
# Currently, the only supported value is 1 for JSON
|
|
Type: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINEKEY_TYPE
|
|
Pat:
|
|
# date format: 2023-01-01T00:00:00Z
|
|
ExpirationDate: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE
|
|
LoginClient:
|
|
Machine:
|
|
Username: # ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_USERNAME
|
|
Name: # ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME
|
|
Pat:
|
|
# date format: 2023-01-01T00:00:00Z
|
|
ExpirationDate: # ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_PAT_EXPIRATIONDATE
|
|
|
|
CorrectCreationDate:
|
|
FailAfter: 5m # ZITADEL_CORRECTCREATIONDATE_FAILAFTER
|
|
|
|
AddEventCreatedAt:
|
|
BulkAmount: 100 # ZITADEL_ADDEVENTCREATEDAT_BULKAMOUNT
|
|
|
|
FillFields:
|
|
BatchSize: 1000 # ZITADEL_EVENTSTORE_FILLFIELDS_BULKLIMIT |