Files
zitadel/apps/login/project.json
T
Tim MöhlmannandGitHub e94d4c3986 feat(crypto): FIPS 140-3 compliant build and runtime checks (#12233)
# Which Problems Are Solved

Enable FIPS 140-3 compliant build.

# How the Problems Are Solved

- Add runtime config validation, if the FIPS flag is enabled fail the
application when a non-compliant hasher is used, or throw a warning when
a legacy verifier is used
- Add a build matrix for FIPS certified build:
  - Go binary is built with `GOFIPS140=certified`
- Login container uses a separate base:
[ubi9](https://catalog.redhat.com/en/software/containers/ubi9/ubi/615bcf606feffc5384e8452e)
from redhat which provides a FIPS certified OpenSSL (used by NodeJS TLS
stack)
- Non-FIPS images where already pushed to both Github Container Registry
and Google Artifact Repository (GAR). Fips images are only pushed to the
GAR.
- Tag versions are suffixed `-fips`. So on release the following images
will be additionally available:

```
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login:vX.Y.Z-fips
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips-debug
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips
```
  
# Other changes

- Bumb Go toolchain. At least v1.25.10 is required for a
GOFIPS140=certified setting.
 
# Additional Context

- Closes https://github.com/zitadel/zitadel/issues/4335
- Build [test
run](https://github.com/zitadel/zitadel/actions/runs/27253916052)
pushing FIPS and non-FIPS images
2026-06-16 10:16:49 +02:00

148 lines
5.3 KiB
JSON

{
"$schema": "../../node_modules/nx/schemas/project-schema.json",
"targets": {
"prod": {
"description": "Runs the Next.js Login application in production mode from the standalone build",
"continuous": true,
"dependsOn": ["build"],
"defaultConfiguration": "default",
"configurations": {
"default": {}
}
},
"dev": {
"description": "Runs the Next.js Login application in development mode with hot-reloading",
"continuous": true,
"dependsOn": ["^build"]
},
"build": {
"description": "Builds the Next.js Login application in standalone mode for production",
"cache": true,
"dependsOn": ["^build"],
"inputs": [
"default",
"{workspaceRoot}/pnpm-lock.yaml",
"!{projectRoot}/.env.*",
"!{projectRoot}/.local.env",
"!{projectRoot}/acceptance/**/*",
"!{projectRoot}/dockerized/**/*"
],
"outputs": ["{projectRoot}/.next/standalone"]
},
"pack": {
"description": "Builds a local Docker image for the ZITADEL Login UI (zitadel/zitadel-login:local). Requires Docker daemon.",
"dependsOn": ["build"],
"command": "docker build -f apps/login/Dockerfile -t zitadel/zitadel-login:local apps/login",
"cache": false,
"inputs": [
"default",
"{workspaceRoot}/pnpm-lock.yaml",
"{projectRoot}/Dockerfile",
"!{projectRoot}/.env.*",
"!{projectRoot}/acceptance/**/*"
]
},
"pack-fips": {
"description": "Builds a local FIPS-hardened Docker image for the ZITADEL Login UI (zitadel/zitadel-login:local-fips). Requires Docker daemon.",
"dependsOn": ["build"],
"command": "docker build -f apps/login/Dockerfile.fips -t zitadel/zitadel-login:local-fips apps/login",
"cache": false,
"inputs": [
"default",
"{workspaceRoot}/pnpm-lock.yaml",
"{projectRoot}/Dockerfile.fips",
"!{projectRoot}/.env.*",
"!{projectRoot}/acceptance/**/*"
]
},
"build-vercel": {
"description": "Builds the Next.js Login application for Vercel deployment",
"cache": false,
"dependsOn": ["^build"],
"inputs": [
"default",
"{workspaceRoot}/pnpm-lock.yaml",
"!{projectRoot}/.env.*",
"!{projectRoot}/.local.env",
"!{projectRoot}/acceptance/**/*",
"!{projectRoot}/dockerized/**/*"
],
"outputs": ["{projectRoot}/.next/!(cache|standalone)/**"]
},
"lint": {
"description": "Runs all linters",
"dependsOn": ["lint-check-*"]
},
"lint-check-prettier": {
"description": "Checks code formatting with Prettier",
"cache": true,
"inputs": ["default"]
},
"lint-check-next": {
"description": "Runs Next.js specific lint checks",
"cache": true,
"inputs": ["default"],
"dependsOn": ["^build"]
},
"test": {
"description": "Runs all tests (unit, and dockerized)",
"dependsOn": ["test-unit", "test-dockerized"]
},
"test-unit": {
"description": "Runs unit tests using Vitest",
"dependsOn": ["build"]
},
"test-dockerized": {
"description": "Runs dockerized integration tests (OpenTelemetry and custom CA certificate tests)",
"dependsOn": ["build"],
"executor": "nx:run-commands",
"cache": true,
"inputs": ["default", "!{projectRoot}/acceptance/**/*", "!{projectRoot}/dockerized/**/output/**/*"],
"options": {
"cwd": "{projectRoot}",
"commands": ["pnpm vitest --run --config vitest.config.dockerized.ts"]
}
},
"test-ssl": {
"description": "Runs TLS integration tests using testcontainers",
"dependsOn": ["build"],
"executor": "nx:run-commands",
"cache": true,
"inputs": ["default", "!{projectRoot}/acceptance/**/*", "!{projectRoot}/dockerized/**/output/**/*"],
"options": {
"cwd": "{projectRoot}",
"commands": ["pnpm vitest --run --config vitest.config.dockerized.ts dockerized/ssl"]
}
},
"test-acceptance": {
"description": "Runs the Playwright acceptance test suite in apps/login/acceptance/ against a running ZITADEL stack. Requires LOGIN_BASE_URL, ZITADEL_API_URL, and ZITADEL_ADMIN_TOKEN to be set (or apps/login/.env.test.local to exist). Run the setup script at acceptance/setup/setup.sh first to seed config.",
"executor": "nx:run-commands",
"options": {
"cwd": "{projectRoot}",
"command": "pnpm exec playwright test --config acceptance/playwright.config.ts"
},
"inputs": [
"{projectRoot}/acceptance/**",
"!{projectRoot}/acceptance/playwright-report/**",
"!{projectRoot}/acceptance/test-results/**",
"{workspaceRoot}/pnpm-lock.yaml"
]
},
"pack-archive": {
"description": "Packages the standalone Login application build into an archive",
"dependsOn": ["build"],
"executor": "nx:run-commands",
"options": {
"parallel": false,
"env": {
"STANDALONE_DIR": "{projectRoot}/.next/standalone",
"PACK_DIR": "{workspaceRoot}/.artifacts/pack"
},
"commands": ["mkdir -p ${PACK_DIR}", "tar -czf ${PACK_DIR}/zitadel-login.tar.gz -C ${STANDALONE_DIR} ."]
},
"cache": true,
"outputs": ["{workspaceRoot}/.artifacts/pack/zitadel-login.tar.gz"]
}
}
}