mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
Replaces the single-file `docker-compose.yaml` quickstart with a production-aware, Traefik-based compose pack in `deploy/compose/`. The pack covers the full arc from a 2-minute localhost quickstart to a hardened homelab or semi-production deployment. ### What's in the pack **Stack**: Traefik (proxy) → ZITADEL API (Go `:8080`) + ZITADEL Login (Next.js `:3000`) → PostgreSQL All HTTP/gRPC routing is handled by Traefik via Docker labels — no manual proxy config needed. The Login V2 UI is enabled by default. Login URLs are derived automatically from `ZITADEL_DOMAIN`, `ZITADEL_EXTERNALPORT`, and `ZITADEL_PUBLIC_SCHEME` — no separate URL variables needed. **Compose files** | File | Purpose | |------|---------| | `docker-compose.yml` | Base stack — works standalone. Uses explicit `name: zitadel` network for reliable Traefik service discovery. | | `docker-compose.mode-letsencrypt.yml` | TLS overlay: ACME HTTP challenge | | `docker-compose.mode-external-tls.yml` | TLS overlay: upstream LB/CDN terminates TLS. Uses `forwardedHeaders.trustedIPs` (configurable via `TRAEFIK_TRUSTED_IPS`) instead of `insecure=true`. | | `docker-compose.mode-local-tls.yml` | TLS overlay: self-signed certs for LAN | | `docker-compose.prodlike.yml` | Splits init / setup / start for controlled upgrades | | `docker-compose.test.yml` | CI overlay: swaps images to locally-built `:local` tags | **Optional profiles**: `cache` (Redis), `observability` (OpenTelemetry Collector) ### Build infra - New `@zitadel/api:pack` and `@zitadel/login:pack` Nx targets build local Docker images (`zitadel/zitadel:local`, `zitadel/zitadel-login:local`) for use in CI and local testing - `apps/api/Dockerfile` now accepts a `BINARY` build arg so local and release builds share the same image ### Testing - New `@zitadel/compose` Nx project with targets: `test-config` (validates all overlay combinations using `--quiet`), `test-run` (starts full stack with local images), `test-e2e` (Playwright wiring + protocol matrix tests through Traefik), `test-full` (end-to-end: build → start → test → teardown), `stop` - **`@zitadel/compose` is explicitly excluded from `nx affected` in CI for now** — the full stack smoke test requires a Docker daemon and significant resources. The intent is to add a dedicated `compose_smoke_test` CI job in a follow-up. The targets can be run locally with `pnpm nx run @zitadel/compose:test-full`. ### Documentation - **`compose.mdx`**: Complete rewrite with a staged structure (Stage 1 Quickstart → Stage 2 Homelab → Stage 3 Beyond Compose). Documents TLS modes, profiles, secrets hardening, ExternalDomain/Port/Secure invariant, upgrades, and the path to Kubernetes - **New `requirements.mdx`**: Lists supported PostgreSQL versions (14–18), Redis (standalone), Docker Compose v2.x, and reverse proxy h2c requirements - **`reverse_proxy.mdx`**: Added intro covering h2c requirements, TLS modes table, and Login UI routing split - **`troubleshooting.mdx`**: New sections for container restarts on upgrade, FIRSTINSTANCE env vars not taking effect, and diagnosing unhealthy containers - **`caddy/index.mdx`**: Known issue and workaround for the `TE: trailers` header hang - Removed the old `apps/docs/content/self-hosting/deploy/docker-compose.yaml` embedded in the docs ### Breaking change The old `apps/docs/content/self-hosting/deploy/docker-compose.yaml` file is deleted. The getting-started docs page (`/self-hosting/deploy/compose`) now points to the new pack via a `curl | tar` download command. --- ### Checklist - [x] `deploy/compose/` smoke test passes end-to-end locally (`pnpm nx run @zitadel/compose:test-full`) - [x] Docs build passes (`pnpm nx run @zitadel/docs:build`) - [ ] Follow-up issue created to add `compose_smoke_test` CI job --------- Co-authored-by: Mridang Agarwalla <[email protected]>
208 lines
6.4 KiB
JSON
208 lines
6.4 KiB
JSON
{
|
|
"$schema": "../../node_modules/nx/schemas/project-schema.json",
|
|
"targets": {
|
|
"prod": {
|
|
"description": "Runs the Next.js Login application in production mode from the standalone build",
|
|
"continuous": true,
|
|
"dependsOn": [
|
|
"build"
|
|
],
|
|
"defaultConfiguration": "default",
|
|
"configurations": {
|
|
"default": {},
|
|
"test-login-integration": {}
|
|
}
|
|
},
|
|
"dev": {
|
|
"description": "Runs the Next.js Login application in development mode with hot-reloading",
|
|
"continuous": true,
|
|
"dependsOn": [
|
|
"^build"
|
|
]
|
|
},
|
|
"build": {
|
|
"description": "Builds the Next.js Login application in standalone mode for production",
|
|
"cache": true,
|
|
"dependsOn": [
|
|
"^build"
|
|
],
|
|
"inputs": [
|
|
"default",
|
|
"{workspaceRoot}/pnpm-lock.yaml",
|
|
"!{projectRoot}/.env.*",
|
|
"!{projectRoot}/.local.env",
|
|
"!{projectRoot}/integration/**/*",
|
|
"!{projectRoot}/acceptance/**/*",
|
|
"!{projectRoot}/dockerized/**/*",
|
|
"!{projectRoot}/cypress.config.ts"
|
|
],
|
|
"outputs": [
|
|
"{projectRoot}/.next/standalone"
|
|
]
|
|
},
|
|
"pack": {
|
|
"description": "Builds a local Docker image for the ZITADEL Login UI (zitadel/zitadel-login:local). Requires Docker daemon.",
|
|
"dependsOn": [
|
|
"build"
|
|
],
|
|
"command": "docker build -f apps/login/Dockerfile -t zitadel/zitadel-login:local apps/login",
|
|
"cache": false,
|
|
"inputs": [
|
|
"default",
|
|
"{workspaceRoot}/pnpm-lock.yaml",
|
|
"{projectRoot}/Dockerfile",
|
|
"!{projectRoot}/.env.*",
|
|
"!{projectRoot}/integration/**/*",
|
|
"!{projectRoot}/acceptance/**/*"
|
|
]
|
|
},
|
|
"build-vercel": {
|
|
"description": "Builds the Next.js Login application for Vercel deployment",
|
|
"cache": true,
|
|
"dependsOn": [
|
|
"^build"
|
|
],
|
|
"inputs": [
|
|
"default",
|
|
"{workspaceRoot}/pnpm-lock.yaml",
|
|
"!{projectRoot}/.env.*",
|
|
"!{projectRoot}/.local.env",
|
|
"!{projectRoot}/integration/**/*",
|
|
"!{projectRoot}/acceptance/**/*",
|
|
"!{projectRoot}/dockerized/**/*",
|
|
"!{projectRoot}/cypress.config.ts"
|
|
],
|
|
"outputs": [
|
|
"{projectRoot}/.next",
|
|
"!{projectRoot}/.next/cache",
|
|
"!{projectRoot}/.next/standalone"
|
|
]
|
|
},
|
|
"lint": {
|
|
"description": "Runs all linters",
|
|
"dependsOn": [
|
|
"lint-check-*"
|
|
]
|
|
},
|
|
"lint-check-prettier": {
|
|
"description": "Checks code formatting with Prettier",
|
|
"cache": true,
|
|
"inputs": [
|
|
"default"
|
|
]
|
|
},
|
|
"lint-check-next": {
|
|
"description": "Runs Next.js specific lint checks",
|
|
"cache": true,
|
|
"inputs": [
|
|
"default"
|
|
]
|
|
},
|
|
"test": {
|
|
"description": "Runs all tests (unit and integration)",
|
|
"dependsOn": [
|
|
"test-unit",
|
|
"test-integration"
|
|
]
|
|
},
|
|
"test-unit": {
|
|
"description": "Runs unit tests using Vitest",
|
|
"dependsOn": [
|
|
"^build"
|
|
]
|
|
},
|
|
"test-ca": {
|
|
"description": "Runs custom CA certificate integration tests using testcontainers",
|
|
"dependsOn": [
|
|
"build"
|
|
],
|
|
"executor": "nx:run-commands",
|
|
"cache": true,
|
|
"inputs": [
|
|
"default",
|
|
"!{projectRoot}/integration/**/*",
|
|
"!{projectRoot}/acceptance/**/*",
|
|
"!{projectRoot}/dockerized/**/output/**/*"
|
|
],
|
|
"options": {
|
|
"cwd": "{projectRoot}",
|
|
"commands": [
|
|
"pnpm vitest --run --config vitest.config.ca.mts"
|
|
]
|
|
}
|
|
},
|
|
"test-integration-run-login": {
|
|
"description": "Runs the Login application under test. It has its own target, separate from test-integration, because it's a continuous task.",
|
|
"dependsOn": [
|
|
"build"
|
|
],
|
|
"continuous": true,
|
|
"command": "nx run @zitadel/login:prod:test-login-integration --excludeTaskDependencies"
|
|
},
|
|
"test-integration": {
|
|
"description": "Runs integration tests using Cypress against a running Login and a mocked API",
|
|
"dependsOn": [
|
|
"test-integration-run-login",
|
|
"@zitadel/login-api-mock:build",
|
|
"@zitadel/login-api-mock:serve"
|
|
],
|
|
"executor": "nx:run-commands",
|
|
"options": {
|
|
"cwd": "{projectRoot}",
|
|
"parallel": false,
|
|
"commands": [
|
|
"pnpm cypress install",
|
|
"pnpm wait-on --verbose --interval 2000 --simultaneous 1 --timeout 30m \"tcp:${API_MOCK_STUBS_HOST}:22220\" \"http-get://localhost:3001/ui/v2/login/verify?userId=221394658884845598&code=abc\"",
|
|
"DISPLAY='' pnpm cypress run --headless",
|
|
"nx run @zitadel/login:test-integration-stop"
|
|
]
|
|
},
|
|
"inputs": [
|
|
"default",
|
|
"{workspaceRoot}/pnpm-lock.yaml",
|
|
"!{projectRoot}/acceptance/**/*",
|
|
{ "env": "LOGIN_BASE_URL" }
|
|
]
|
|
},
|
|
"test-integration-stop": {
|
|
"description": "Stops the gRPC mock container used for integration tests.",
|
|
"command": "nx run @zitadel/login-api-mock:down"
|
|
},
|
|
"test-acceptance": {
|
|
"description": "Runs the Playwright acceptance test suite in apps/login/acceptance/ against a running ZITADEL stack. Requires LOGIN_BASE_URL, ZITADEL_API_URL, and ZITADEL_ADMIN_TOKEN to be set (or apps/login/.env.test.local to exist). Run the setup script at acceptance/setup/setup.sh first to seed config.",
|
|
"executor": "nx:run-commands",
|
|
"options": {
|
|
"cwd": "{projectRoot}",
|
|
"command": "pnpm exec playwright test --config acceptance/playwright.config.ts"
|
|
},
|
|
"inputs": [
|
|
"{projectRoot}/acceptance/**",
|
|
"!{projectRoot}/acceptance/playwright-report/**",
|
|
"!{projectRoot}/acceptance/test-results/**",
|
|
"{workspaceRoot}/pnpm-lock.yaml"
|
|
]
|
|
},
|
|
"pack-archive": {
|
|
"description": "Packages the standalone Login application build into an archive",
|
|
"dependsOn": [
|
|
"build"
|
|
],
|
|
"executor": "nx:run-commands",
|
|
"options": {
|
|
"parallel": false,
|
|
"env": {
|
|
"STANDALONE_DIR": "{projectRoot}/.next/standalone",
|
|
"PACK_DIR": "{workspaceRoot}/.artifacts/pack"
|
|
},
|
|
"commands": [
|
|
"mkdir -p ${PACK_DIR}",
|
|
"tar -czf ${PACK_DIR}/zitadel-login.tar.gz -C ${STANDALONE_DIR} ."
|
|
]
|
|
},
|
|
"cache": true,
|
|
"outputs": [
|
|
"{workspaceRoot}/.artifacts/pack/zitadel-login.tar.gz"
|
|
]
|
|
}
|
|
}
|
|
} |