mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
c8abf6de74
# Which Problems Are Solved The login container can only serve HTTP. In deployments where a reverse proxy is not used, operators need the login container to terminate TLS itself. Closes #11473 # How the Problems Are Solved The container now supports optional HTTPS via three environment variables that match the pattern already used by the backend server: `ZITADEL_TLS_ENABLED`, `ZITADEL_TLS_CERTPATH`, and `ZITADEL_TLS_KEYPATH`. When `ZITADEL_TLS_ENABLED` is not set or set to `false`, behavior is identical to before. When set to `true`, the server reads the provided certificate and key files and serves HTTPS using the lower-level `getRequestHandlers` API from Next.js. The Docker healthcheck was updated to probe the correct scheme automatically based on the same environment variable. # Additional Changes Added a dockerized integration test that verifies both HTTP and HTTPS modes using testcontainers. # Additional Context The TLS path uses `getRequestHandlers` from `next/dist/server/lib/start-server` instead of `startServer` because the latter rejects self-signed certificates in production mode. This is the same internal API that `startServer` itself calls. --------- Co-authored-by: Copilot <[email protected]>
23 lines
747 B
JavaScript
23 lines
747 B
JavaScript
import * as https from "node:https";
|
|
import * as http from "node:http";
|
|
|
|
const scheme = process.env.ZITADEL_TLS_ENABLED === "true" ? "https" : "http";
|
|
const port = process.env.PORT || "3000";
|
|
const url = new URL(process.argv[2] || `/ui/v2/login/healthy`, `${scheme}://localhost:${port}`);
|
|
|
|
const get = scheme === "https" ? https.get : http.get;
|
|
|
|
try {
|
|
const res = await new Promise((resolve, reject) => {
|
|
// Safe: localhost-only probe, self-signed certs expected
|
|
get(url, { rejectUnauthorized: false }, (res) => {
|
|
res.resume();
|
|
resolve(res);
|
|
}).on("error", reject);
|
|
});
|
|
process.exit(res.statusCode >= 200 && res.statusCode < 400 ? 0 : 1);
|
|
} catch (e) {
|
|
console.error("Healthcheck failed:", e);
|
|
process.exit(1);
|
|
}
|