feat: port reduction (#323)

* move mgmt pkg

* begin package restructure

* rename auth package to authz

* begin start api

* move auth

* move admin

* fix merge

* configs and interceptors

* interceptor

* revert generate-grpc.sh

* some cleanups

* console

* move console

* fix tests and merging

* js linting

* merge

* merging and configs

* change k8s base to current ports

* fixes

* cleanup

* regenerate proto

* remove unnecessary whitespace

* missing param

* go mod tidy

* fix merging

* move login pkg

* cleanup

* move api pkgs again

* fix pkg naming

* fix generate-static.sh for login

* update workflow

* fixes

* logging

* remove duplicate

* comment for optional gateway interfaces

* regenerate protos

* fix proto imports for grpc web

* protos

* grpc web generate

* grpc web generate

* fix changes

* add translation interceptor

* fix merging

* regenerate mgmt proto

cmd/zitadel/caos_local.sh

@@ -40,10 +40,10 @@ export SMTP_TLS=TRUE
 export CHAT_URL=$(gopass zitadel-secrets/zitadel/dev/google-chat-url)
 
 #OIDC
-export ZITADEL_ISSUER=http://localhost:50022
-export ZITADEL_ACCOUNTS=http://localhost:50031
-export ZITADEL_AUTHORIZE=http://localhost:50022
-export ZITADEL_OAUTH=http://localhost:50022
+export ZITADEL_ISSUER=http://localhost:50002/oauth/v2/
+export ZITADEL_ACCOUNTS=http://localhost:50003/login
+export ZITADEL_AUTHORIZE=http://localhost:50002/oauth/v2/
+export ZITADEL_OAUTH=http://localhost:50002/oauth/v2/
 export ZITADEL_CONSOLE=http://localhost:4200
 export CAOS_OIDC_DEV=true
 export ZITADEL_COOKIE_DOMAIN=localhost
@@ -55,7 +55,7 @@ export ZITADEL_CSRF_DEV=true
 export ZITADEL_CACHE_MAXAGE=12h
 export ZITADEL_CACHE_SHARED_MAXAGE=168h
 export ZITADEL_SHORT_CACHE_MAXAGE=5m
-export ZITADEL_SHORT_CACHE_SHARED_MAXAGE=15min
+export ZITADEL_SHORT_CACHE_SHARED_MAXAGE=15m
 
 #Console
 export ZITADEL_CONSOLE_ENV_DIR=../../console/src/assets/

cmd/zitadel/main.go

@@ -3,47 +3,59 @@ package main
 import (
 	"context"
 	"flag"
-	"github.com/caos/zitadel/internal/auth/repository/eventsourcing"
-	"github.com/caos/zitadel/internal/authz"
-	sd "github.com/caos/zitadel/internal/config/systemdefaults"
-	"github.com/caos/zitadel/internal/login"
 
 	"github.com/caos/logging"
 
-	internal_authz "github.com/caos/zitadel/internal/api/auth"
+	admin_es "github.com/caos/zitadel/internal/admin/repository/eventsourcing"
+	"github.com/caos/zitadel/internal/api"
+	internal_authz "github.com/caos/zitadel/internal/api/authz"
+	"github.com/caos/zitadel/internal/api/grpc/admin"
+	"github.com/caos/zitadel/internal/api/grpc/auth"
+	"github.com/caos/zitadel/internal/api/grpc/management"
+	"github.com/caos/zitadel/internal/api/oidc"
+	auth_es "github.com/caos/zitadel/internal/auth/repository/eventsourcing"
+	"github.com/caos/zitadel/internal/authz"
+	authz_repo "github.com/caos/zitadel/internal/authz/repository/eventsourcing"
 	"github.com/caos/zitadel/internal/config"
+	sd "github.com/caos/zitadel/internal/config/systemdefaults"
+	mgmt_es "github.com/caos/zitadel/internal/management/repository/eventsourcing"
 	"github.com/caos/zitadel/internal/notification"
 	tracing "github.com/caos/zitadel/internal/tracing/config"
-	"github.com/caos/zitadel/pkg/admin"
-	"github.com/caos/zitadel/pkg/auth"
-	"github.com/caos/zitadel/pkg/console"
-	"github.com/caos/zitadel/pkg/management"
+	"github.com/caos/zitadel/internal/ui"
+	"github.com/caos/zitadel/internal/ui/console"
+	"github.com/caos/zitadel/internal/ui/login"
 )
 
 type Config struct {
-	Mgmt         management.Config
-	Auth         auth.Config
-	Login        login.Config
-	AuthZ        authz.Config
-	Admin        admin.Config
-	Console      console.Config
-	Notification notification.Config
-
 	Log            logging.Config
 	Tracing        tracing.TracingConfig
 	InternalAuthZ  internal_authz.Config
 	SystemDefaults sd.SystemDefaults
+
+	AuthZ authz.Config
+	Auth  auth_es.Config
+	Admin admin_es.Config
+	Mgmt  mgmt_es.Config
+
+	API api.Config
+	UI  ui.Config
+
+	Notification notification.Config
 }
 
+var (
+	configPaths         = config.NewArrayFlags("authz.yaml", "startup.yaml", "system-defaults.yaml")
+	adminEnabled        = flag.Bool("admin", true, "enable admin api")
+	managementEnabled   = flag.Bool("management", true, "enable management api")
+	authEnabled         = flag.Bool("auth", true, "enable auth api")
+	oidcEnabled         = flag.Bool("oidc", true, "enable oidc api")
+	loginEnabled        = flag.Bool("login", true, "enable login ui")
+	consoleEnabled      = flag.Bool("console", true, "enable console ui")
+	notificationEnabled = flag.Bool("notification", true, "enable notification handler")
+)
+
 func main() {
-	configPaths := config.NewArrayFlags("authz.yaml", "startup.yaml", "system-defaults.yaml")
 	flag.Var(configPaths, "config-files", "paths to the config files")
-	managementEnabled := flag.Bool("management", true, "enable management api")
-	authEnabled := flag.Bool("auth", true, "enable auth api")
-	loginEnabled := flag.Bool("login", true, "enable login ui")
-	adminEnabled := flag.Bool("admin", true, "enable admin api")
-	consoleEnabled := flag.Bool("console", true, "enable console ui")
-	notificationEnabled := flag.Bool("notification", true, "enable notification handler")
 	flag.Parse()
 
 	conf := new(Config)
@@ -53,31 +65,58 @@ func main() {
 	ctx := context.Background()
 	authZRepo, err := authz.Start(ctx, conf.AuthZ, conf.InternalAuthZ, conf.SystemDefaults)
 	logging.Log("MAIN-s9KOw").OnError(err).Fatal("error starting authz repo")
-
-	if *adminEnabled {
-		admin.Start(ctx, conf.Admin, authZRepo, conf.InternalAuthZ, conf.SystemDefaults)
-	}
-	if *managementEnabled {
-		management.Start(ctx, conf.Mgmt, authZRepo, conf.InternalAuthZ, conf.SystemDefaults)
-	}
-	var authRepo *eventsourcing.EsRepository
-	if *authEnabled || *loginEnabled {
-		authRepo, err = eventsourcing.Start(conf.Auth.Repository, conf.InternalAuthZ, conf.SystemDefaults, authZRepo)
+	var authRepo *auth_es.EsRepository
+	if *authEnabled || *oidcEnabled || *loginEnabled {
+		authRepo, err = auth_es.Start(conf.Auth, conf.InternalAuthZ, conf.SystemDefaults, authZRepo)
 		logging.Log("MAIN-9oRw6").OnError(err).Fatal("error starting auth repo")
 	}
-	if *authEnabled {
-		auth.Start(ctx, conf.Auth, authZRepo, conf.InternalAuthZ, conf.SystemDefaults, authRepo)
-	}
-	if *loginEnabled {
-		login.Start(ctx, conf.Login, conf.SystemDefaults, authRepo)
-	}
+
+	startAPI(ctx, conf, authZRepo, authRepo)
+	startUI(ctx, conf, authRepo)
+
 	if *notificationEnabled {
 		notification.Start(ctx, conf.Notification, conf.SystemDefaults)
 	}
-	if *consoleEnabled {
-		err = console.Start(ctx, conf.Console)
-		logging.Log("MAIN-3Dfuc").OnError(err).Fatal("error starting console ui")
-	}
+
 	<-ctx.Done()
 	logging.Log("MAIN-s8d2h").Info("stopping zitadel")
 }
+
+func startUI(ctx context.Context, conf *Config, authRepo *auth_es.EsRepository) {
+	uis := ui.Create(conf.UI)
+	if *loginEnabled {
+		uis.RegisterHandler(ui.LoginHandler, login.Start(conf.UI.Login, authRepo, ui.LoginHandler).Handler())
+	}
+	if *consoleEnabled {
+		consoleHandler, err := console.Start(conf.UI.Console)
+		logging.Log("API-AGD1f").OnError(err).Fatal("error starting console")
+		uis.RegisterHandler(ui.ConsoleHandler, consoleHandler)
+	}
+	uis.Start(ctx)
+}
+
+func startAPI(ctx context.Context, conf *Config, authZRepo *authz_repo.EsRepository, authRepo *auth_es.EsRepository) {
+	apis := api.Create(conf.API, conf.InternalAuthZ, authZRepo, conf.SystemDefaults)
+	roles := make([]string, len(conf.InternalAuthZ.RolePermissionMappings))
+	for i, role := range conf.InternalAuthZ.RolePermissionMappings {
+		roles[i] = role.Role
+	}
+	if *adminEnabled {
+		adminRepo, err := admin_es.Start(ctx, conf.Admin, conf.SystemDefaults, roles)
+		logging.Log("API-D42tq").OnError(err).Fatal("error starting auth repo")
+		apis.RegisterServer(ctx, admin.CreateServer(adminRepo))
+	}
+	if *managementEnabled {
+		managementRepo, err := mgmt_es.Start(conf.Mgmt, conf.SystemDefaults, roles)
+		logging.Log("API-Gd2qq").OnError(err).Fatal("error starting management repo")
+		apis.RegisterServer(ctx, management.CreateServer(managementRepo, conf.SystemDefaults))
+	}
+	if *authEnabled {
+		apis.RegisterServer(ctx, auth.CreateServer(authRepo))
+	}
+	if *oidcEnabled {
+		op := oidc.NewProvider(ctx, conf.API.OIDC, authRepo)
+		apis.RegisterHandler("/oauth/v2", op.HttpHandler().Handler)
+	}
+	apis.Start(ctx)
+}

cmd/zitadel/startup.yaml

@@ -1,3 +1,8 @@
+Log:
+  Level: $ZITADEL_LOG_LEVEL
+  Formatter:
+    Format: text
+
 Tracing:
   Type: google
   Config:
@@ -5,168 +10,6 @@ Tracing:
     MetricPrefix: ZITADEL-V1
     Fraction: $ZITADEL_TRACING_FRACTION
 
-Log:
-  Level: $ZITADEL_LOG_LEVEL
-  Formatter:
-    Format: text
-
-Mgmt:
-  API:
-    GRPC:
-      ServerPort: 50010
-      GatewayPort: 50011
-      CustomHeaders:
-        - x-zitadel-
-  Repository:
-    SearchLimit: 100
-    Domain: $ZITADEL_DEFAULT_DOMAIN
-    Eventstore:
-      ServiceName: 'ManagementAPI'
-      Repository:
-        SQL:
-          Host: $ZITADEL_EVENTSTORE_HOST
-          Port: $ZITADEL_EVENTSTORE_PORT
-          User: 'management'
-          Password: $CR_MANAGEMENT_PASSWORD
-          Database: 'eventstore'
-          SSL:
-            Mode: $CR_SSL_MODE
-            RootCert: $CR_ROOT_CERT
-            Cert: $CR_MANAGEMENT_CERT
-            Key: $CR_MANAGEMENT_KEY
-      Cache:
-        Type: 'fastcache'
-        Config:
-          MaxCacheSizeInByte: 10485760 #10mb
-    View:
-      Host: $ZITADEL_EVENTSTORE_HOST
-      Port: $ZITADEL_EVENTSTORE_PORT
-      User: 'management'
-      Password: $CR_MANAGEMENT_PASSWORD
-      Database: 'management'
-      SSL:
-        Mode: $CR_SSL_MODE
-        RootCert: $CR_ROOT_CERT
-        Cert: $CR_MANAGEMENT_CERT
-        Key: $CR_MANAGEMENT_KEY
-    Spooler:
-      ConcurrentTasks: 4
-      BulkLimit: 100
-      FailureCountUntilSkip: 5
-
-Auth:
-  API:
-    GRPC:
-      ServerPort: 50020
-      GatewayPort: 50021
-      CustomHeaders:
-        - x-zitadel-
-    OIDC:
-      OPConfig:
-        Issuer: $ZITADEL_ISSUER
-        DefaultLogoutRedirectURI: $ZITADEL_ACCOUNTS/logout/done
-        Port: 50022
-      StorageConfig:
-        DefaultLoginURL: $ZITADEL_ACCOUNTS/login?authRequestID=
-        DefaultAccessTokenLifetime: 12h
-        DefaultIdTokenLifetime: 12h
-        SigningKeyAlgorithm: RS256
-      UserAgentCookieConfig:
-        Name: caos.zitadel.useragent
-        Domain: $ZITADEL_COOKIE_DOMAIN
-        Key:
-          EncryptionKeyID: $ZITADEL_COOKIE_KEY
-      Cache:
-        MaxAge: $ZITADEL_CACHE_MAXAGE
-        SharedMaxAge: $ZITADEL_CACHE_SHARED_MAXAGE
-      Endpoints:
-        Auth:
-          Path: 'authorize'
-          URL: '$ZITADEL_AUTHORIZE/authorize'
-        Token:
-          Path: 'token'
-          URL: '$ZITADEL_OAUTH/token'
-        EndSession:
-          Path: 'endsession'
-          URL: '$ZITADEL_AUTHORIZE/endsession'
-        Userinfo:
-          Path: 'userinfo'
-          URL: '$ZITADEL_OAUTH/userinfo'
-        Keys:
-          Path: 'keys'
-          URL: '$ZITADEL_OAUTH/keys'
-  Repository:
-    SearchLimit: 100
-    Eventstore:
-      ServiceName: 'authAPI'
-      Repository:
-        SQL:
-          Host: $ZITADEL_EVENTSTORE_HOST
-          Port: $ZITADEL_EVENTSTORE_PORT
-          User: 'auth'
-          Password: $CR_AUTH_PASSWORD
-          Database: 'eventstore'
-          SSL:
-            Mode: $CR_SSL_MODE
-            RootCert: $CR_ROOT_CERT
-            Cert: $CR_AUTH_CERT
-            Key: $CR_AUTH_KEY
-      Cache:
-        Type: 'fastcache'
-        Config:
-          MaxCacheSizeInByte: 10485760 #10mb
-    AuthRequest:
-      Connection:
-        Host: $ZITADEL_EVENTSTORE_HOST
-        Port: $ZITADEL_EVENTSTORE_PORT
-        User: 'auth'
-        Password: $CR_AUTH_PASSWORD
-        Database: 'auth'
-        SSL:
-          Mode: $CR_SSL_MODE
-          RootCert: $CR_ROOT_CERT
-          Cert: $CR_AUTH_CERT
-          Key: $CR_AUTH_KEY
-    View:
-      Host: $ZITADEL_EVENTSTORE_HOST
-      Port: $ZITADEL_EVENTSTORE_PORT
-      User: 'auth'
-      Password: $CR_AUTH_PASSWORD
-      Database: 'auth'
-      SSL:
-        Mode: $CR_SSL_MODE
-        RootCert: $CR_ROOT_CERT
-        Cert: $CR_AUTH_CERT
-        Key: $CR_AUTH_KEY
-    Spooler:
-      ConcurrentTasks: 4
-      BulkLimit: 100
-      FailureCountUntilSkip: 5
-    KeyConfig:
-      Size: 2048
-      PrivateKeyLifetime: 6h
-      PublicKeyLifetime: 30h
-      EncryptionConfig:
-        EncryptionKeyID: $ZITADEL_OIDC_KEYS_ID
-      SigningKeyRotation: 10s
-
-Login:
-  Handler:
-    Port: 50031
-    OidcAuthCallbackURL: '$ZITADEL_AUTHORIZE/authorize/'
-    ZitadelURL: '$ZITADEL_CONSOLE'
-    LanguageCookieName: 'caos.zitadel.login.lang'
-    DefaultLanguage: 'de'
-    CSRF:
-      CookieName: 'caos.zitadel.login.csrf'
-      Key:
-        EncryptionKeyID: $ZITADEL_CSRF_KEY
-      Development: $ZITADEL_CSRF_DEV
-    Cache:
-      MaxAge: $ZITADEL_CACHE_MAXAGE
-      SharedMaxAge: $ZITADEL_CACHE_SHARED_MAXAGE
-
-
 AuthZ:
   Repository:
     Eventstore:
@@ -176,8 +19,8 @@ AuthZ:
           Host: $ZITADEL_EVENTSTORE_HOST
           Port: $ZITADEL_EVENTSTORE_PORT
           User: 'authz'
-          Password: $CR_AUTHZ_PASSWORD
           Database: 'eventstore'
+          Password: $CR_AUTHZ_PASSWORD
           SSL:
             Mode: $CR_SSL_MODE
             RootCert: $CR_ROOT_CERT
@@ -191,7 +34,6 @@ AuthZ:
       Host: $ZITADEL_EVENTSTORE_HOST
       Port: $ZITADEL_EVENTSTORE_PORT
       User: 'authz'
-      Password: $CR_AUTHZ_PASSWORD
       Database: 'authz'
       SSL:
         Mode: $CR_SSL_MODE
@@ -203,61 +45,200 @@ AuthZ:
       BulkLimit: 100
       FailureCountUntilSkip: 5
 
-Admin:
-  API:
-    GRPC:
-      ServerPort: 50040
-      GatewayPort: 50041
-      CustomHeaders:
-        - x-zitadel-
-  Repository:
-    SearchLimit: 100
-    Domain: $ZITADEL_DEFAULT_DOMAIN
-    Eventstore:
-      ServiceName: 'Admin'
-      Repository:
-        SQL:
-          Host: $ZITADEL_EVENTSTORE_HOST
-          Port: $ZITADEL_EVENTSTORE_PORT
-          User: 'adminapi'
-          Password: $CR_ADMINAPI_PASSWORD
-          Database: 'eventstore'
-          SSL:
-            Mode: $CR_SSL_MODE
-            RootCert: $CR_ROOT_CERT
-            Cert: $CR_ADMINAPI_CERT
-            Key: $CR_ADMINAPI_KEY
-      Cache:
-        Type: 'fastcache'
-        Config:
-          MaxCacheSizeInByte: 10485760 #10mb
-    View:
+Auth:
+  SearchLimit: 100
+  Eventstore:
+    ServiceName: 'authAPI'
+    Repository:
+      SQL:
+        Host: $ZITADEL_EVENTSTORE_HOST
+        Port: $ZITADEL_EVENTSTORE_PORT
+        User: 'auth'
+        Database: 'eventstore'
+        Password: $CR_AUTH_PASSWORD
+        SSL:
+          Mode: $CR_SSL_MODE
+          RootCert: $CR_ROOT_CERT
+          Cert: $CR_AUTH_CERT
+          Key: $CR_AUTH_KEY
+    Cache:
+      Type: 'fastcache'
+      Config:
+        MaxCacheSizeInByte: 10485760 #10mb
+  AuthRequest:
+    Connection:
       Host: $ZITADEL_EVENTSTORE_HOST
       Port: $ZITADEL_EVENTSTORE_PORT
-      User: 'adminapi'
-      Password: $CR_ADMINAPI_PASSWORD
-      Database: 'adminapi'
+      User: 'auth'
+      Database: 'auth'
+      Password: $CR_AUTH_PASSWORD
       SSL:
         Mode: $CR_SSL_MODE
         RootCert: $CR_ROOT_CERT
-        Cert: $CR_ADMINAPI_CERT
-        Key: $CR_ADMINAPI_KEY
-    Spooler:
-      ConcurrentTasks: 1
-      BulkLimit: 100
-      FailureCountUntilSkip: 5
+        Cert: $CR_AUTH_CERT
+        Key: $CR_AUTH_KEY
+  View:
+    Host: $ZITADEL_EVENTSTORE_HOST
+    Port: $ZITADEL_EVENTSTORE_PORT
+    User: 'auth'
+    Database: 'auth'
+    Password: $CR_AUTH_PASSWORD
+    SSL:
+      Mode: $CR_SSL_MODE
+      RootCert: $CR_ROOT_CERT
+      Cert: $CR_AUTH_CERT
+      Key: $CR_AUTH_KEY
+  Spooler:
+    ConcurrentTasks: 4
+    BulkLimit: 100
+    FailureCountUntilSkip: 5
+  KeyConfig:
+    Size: 2048
+    PrivateKeyLifetime: 6h
+    PublicKeyLifetime: 30h
+    EncryptionConfig:
+      EncryptionKeyID: $ZITADEL_OIDC_KEYS_ID
+    SigningKeyRotation: 10s
 
-Console:
-  Port: 50050
-  EnvOverwriteDir: $ZITADEL_CONSOLE_ENV_DIR
-  ShortCache:
-    MaxAge: $ZITADEL_SHORT_CACHE_MAXAGE
-    SharedMaxAge: $ZITADEL_SHORT_CACHE_SHARED_MAXAGE
-  LongCache:
+Admin:
+  SearchLimit: 100
+  Domain: $ZITADEL_DEFAULT_DOMAIN
+  Eventstore:
+    ServiceName: 'Admin'
+    Repository:
+      SQL:
+        Host: $ZITADEL_EVENTSTORE_HOST
+        Port: $ZITADEL_EVENTSTORE_PORT
+        User: 'admin_api'
+        Database: 'eventstore'
+        Password: $CR_ADMINAPI_PASSWORD
+        SSL:
+          Mode: $CR_SSL_MODE
+          RootCert: $CR_ROOT_CERT
+          Cert: $CR_ADMINAPI_CERT
+          Key: $CR_ADMINAPI_KEY
+    Cache:
+      Type: 'fastcache'
+      Config:
+        MaxCacheSizeInByte: 10485760 #10mb
+  View:
+    Host: $ZITADEL_EVENTSTORE_HOST
+    Port: $ZITADEL_EVENTSTORE_PORT
+    User: 'admin_api'
+    Database: 'admin_api'
+    Password: $CR_ADMINAPI_PASSWORD
+    SSL:
+      Mode: $CR_SSL_MODE
+      RootCert: $CR_ROOT_CERT
+      Cert: $CR_ADMINAPI_CERT
+      Key: $CR_ADMINAPI_KEY
+  Spooler:
+    ConcurrentTasks: 1
+    BulkLimit: 100
+    FailureCountUntilSkip: 5
+
+Mgmt:
+  SearchLimit: 100
+  Domain: $ZITADEL_DEFAULT_DOMAIN
+  Eventstore:
+    ServiceName: 'ManagementAPI'
+    Repository:
+      SQL:
+        Host: $ZITADEL_EVENTSTORE_HOST
+        Port: $ZITADEL_EVENTSTORE_PORT
+        User: 'management'
+        Database: 'eventstore'
+        Password: $CR_MANAGEMENT_PASSWORD
+        SSL:
+          Mode: $CR_SSL_MODE
+          RootCert: $CR_ROOT_CERT
+          Cert: $CR_MANAGEMENT_CERT
+          Key: $CR_MANAGEMENT_KEY
+    Cache:
+      Type: 'fastcache'
+      Config:
+        MaxCacheSizeInByte: 10485760 #10mb
+  View:
+    Host: $ZITADEL_EVENTSTORE_HOST
+    Port: $ZITADEL_EVENTSTORE_PORT
+    User: 'management'
+    Database: 'management'
+    Password: $CR_MANAGEMENT_PASSWORD
+    SSL:
+      Mode: $CR_SSL_MODE
+      RootCert: $CR_ROOT_CERT
+      Cert: $CR_MANAGEMENT_CERT
+      Key: $CR_MANAGEMENT_KEY
+  Spooler:
+    ConcurrentTasks: 4
+    BulkLimit: 100
+    FailureCountUntilSkip: 5
+
+API:
+  GRPC:
+    ServerPort: 50001
+    GatewayPort: 50002
+    CustomHeaders:
+      - x-zitadel-
+  OIDC:
+    OPConfig:
+      Issuer: $ZITADEL_ISSUER
+      DefaultLogoutRedirectURI: $ZITADEL_ACCOUNTS/logout/done
+    StorageConfig:
+      DefaultLoginURL: $ZITADEL_ACCOUNTS/login?authRequestID=
+      DefaultAccessTokenLifetime: 12h
+      DefaultIdTokenLifetime: 12h
+      SigningKeyAlgorithm: RS256
+    UserAgentCookieConfig:
+      Name: caos.zitadel.useragent
+      Domain: $ZITADEL_COOKIE_DOMAIN
+      Key:
+        EncryptionKeyID: $ZITADEL_COOKIE_KEY
+    Cache:
       MaxAge: $ZITADEL_CACHE_MAXAGE
       SharedMaxAge: $ZITADEL_CACHE_SHARED_MAXAGE
-  CSPDomain: $ZITADEL_DEFAULT_DOMAIN
+    Endpoints:
+      Auth:
+        Path: 'authorize'
+        URL: '$ZITADEL_AUTHORIZE/authorize'
+      Token:
+        Path: 'token'
+        URL: '$ZITADEL_OAUTH/token'
+      EndSession:
+        Path: 'endsession'
+        URL: '$ZITADEL_AUTHORIZE/endsession'
+      Userinfo:
+        Path: 'userinfo'
+        URL: '$ZITADEL_OAUTH/userinfo'
+      Keys:
+        Path: 'keys'
+        URL: '$ZITADEL_OAUTH/keys'
 
+UI:
+  Port: 50003
+  Login:
+    Handler:
+      OidcAuthCallbackURL: '$ZITADEL_AUTHORIZE/authorize/'
+      ZitadelURL: '$ZITADEL_CONSOLE'
+      LanguageCookieName: 'caos.zitadel.login.lang'
+      DefaultLanguage: 'de'
+      CSRF:
+        CookieName: 'caos.zitadel.login.csrf'
+        Key:
+          EncryptionKeyID: $ZITADEL_CSRF_KEY
+        Development: $ZITADEL_CSRF_DEV
+      Cache:
+        MaxAge: $ZITADEL_CACHE_MAXAGE
+        SharedMaxAge: $ZITADEL_CACHE_SHARED_MAXAGE
+  Console:
+    EnvOverwriteDir: $ZITADEL_CONSOLE_ENV_DIR
+    ShortCache:
+      MaxAge: $ZITADEL_SHORT_CACHE_MAXAGE
+      SharedMaxAge: $ZITADEL_SHORT_CACHE_SHARED_MAXAGE
+    LongCache:
+      MaxAge: $ZITADEL_CACHE_MAXAGE
+      SharedMaxAge: $ZITADEL_CACHE_SHARED_MAXAGE
+    CSPDomain: $ZITADEL_DEFAULT_DOMAIN
 
 Notification:
   Repository:
@@ -270,8 +251,8 @@ Notification:
           Host: $ZITADEL_EVENTSTORE_HOST
           Port: $ZITADEL_EVENTSTORE_PORT
           User: 'notification'
-          Password: $CR_NOTIFICATION_PASSWORD
           Database: 'eventstore'
+          Password: $CR_NOTIFICATION_PASSWORD
           SSL:
             Mode: $CR_SSL_MODE
             RootCert: $CR_ROOT_CERT
@@ -285,8 +266,8 @@ Notification:
       Host: $ZITADEL_EVENTSTORE_HOST
       Port: $ZITADEL_EVENTSTORE_PORT
       User: 'notification'
-      Password: $CR_NOTIFICATION_PASSWORD
       Database: 'notification'
+      Password: $CR_NOTIFICATION_PASSWORD
       SSL:
         Mode: $CR_SSL_MODE
         RootCert: $CR_ROOT_CERT
@@ -298,4 +279,4 @@ Notification:
       FailureCountUntilSkip: 5
       Handlers:
         Notification:
-          MinimumCycleDuration: 10s
+          MinimumCycleDuration: 10s