TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2024-12-04 15:35:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: fix and harmonize docker compose files (#8839)
Some checks are pending
ZITADEL CI/CD / core (push) Waiting to run
Details
ZITADEL CI/CD / console (push) Waiting to run
Details
ZITADEL CI/CD / version (push) Waiting to run
Details
ZITADEL CI/CD / compile (push) Blocked by required conditions
Details
ZITADEL CI/CD / core-unit-test (push) Blocked by required conditions
Details
ZITADEL CI/CD / core-integration-test (push) Blocked by required conditions
Details
ZITADEL CI/CD / lint (push) Blocked by required conditions
Details
ZITADEL CI/CD / container (push) Blocked by required conditions
Details
ZITADEL CI/CD / e2e (push) Blocked by required conditions
Details
ZITADEL CI/CD / release (push) Blocked by required conditions
Details
Code Scanning / CodeQL-Build (go) (push) Waiting to run
Details
Code Scanning / CodeQL-Build (javascript) (push) Waiting to run
Details

Browse Source 
# Which Problems Are Solved

1. Postgres spams FATAL: role "root" does not exist as mentioned in
https://github.com/zitadel/zitadel/discussions/7832 (even with -U)

2. The compose commands for a ZITADEL deployment with initial service
account key don't work out-of-the box with a non-root user, because
docker creates non-existing directories to bind-mount with root
ownership.


![image](https://github.com/user-attachments/assets/f2fc92d5-2ff4-47a4-bf4d-e9657aa2bb94)

```
time="2024-10-29T09:37:13Z" level=error msg="migration failed" caller="/home/runner/work/zitadel/zitadel/internal/migration/migration.go:68" error="open /machinekey/zitadel-admin-sa.json: permission denied" name=03_default_instance
time="2024-10-29T09:37:13Z" level=fatal msg="migration failed" caller="/home/runner/work/zitadel/zitadel/cmd/setup/setup.go:248" error="open /machinekey/zitadel-admin-sa.json: permission denied" name=03_default_instance
```

# How the Problems Are Solved

1. The branch bases on https://github.com/zitadel/zitadel/pull/8826. The
env vars are cleaned up and prettified across compose files.

2. A command is added to the docs that creates the directory with the
current users permission. The ZITADEL container runs with the current
users ID.

# Additional Context

- Replaces https://github.com/zitadel/zitadel/pull/8826
- Discussion https://github.com/zitadel/zitadel/discussions/7832
- Closes https://github.com/zitadel/zitadel/issues/7725

---------

Co-authored-by: m4tu4g <71326926+m4tu4g@users.noreply.github.com>
This commit is contained in:
Elio Bischof 2024-10-29 20:02:04 +01:00 committed by GitHub
parent 1426823d40
commit cff4fe5dfd
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 98 additions and 99 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
.devcontainer/docker-compose.yml
View File

@ -8,25 +8,24 @@ services:
network_mode: service:db network_mode: service:db
command: sleep infinity command: sleep infinity
environment: environment:
- 'ZITADEL_DATABASE_POSTGRES_HOST=db' ZITADEL_DATABASE_POSTGRES_HOST: db
- 'ZITADEL_DATABASE_POSTGRES_PORT=5432' ZITADEL_DATABASE_POSTGRES_PORT: 5432
- 'ZITADEL_DATABASE_POSTGRES_DATABASE=zitadel' ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
- 'ZITADEL_DATABASE_POSTGRES_USER_USERNAME=zitadel' ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
- 'ZITADEL_DATABASE_POSTGRES_USER_PASSWORD=zitadel' ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel
- 'ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE=disable' ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
- 'ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME=postgres' ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
- 'ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD=postgres' ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
- 'ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE=disable' ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
- 'ZITADEL_EXTERNALSECURE=false' ZITADEL_EXTERNALSECURE: false
db: db:
image: postgres:latest image: postgres:latest
restart: unless-stopped restart: unless-stopped
volumes: volumes:
- postgres-data:/var/lib/postgresql/data - postgres-data:/var/lib/postgresql/data
environment: environment:
PGUSER: postgres
POSTGRES_PASSWORD: postgres POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
POSTGRES_DB: postgres
volumes: volumes:
postgres-data: postgres-data:

3
docs/docs/self-hosting/deploy/compose.mdx
View File

@ -51,6 +51,9 @@ By executing the commands below, you will download the following file:
# Download the docker compose example configuration. # Download the docker compose example configuration.
wget https://raw.githubusercontent.com/zitadel/zitadel/main/docs/docs/self-hosting/deploy/docker-compose-sa.yaml -O docker-compose.yaml wget https://raw.githubusercontent.com/zitadel/zitadel/main/docs/docs/self-hosting/deploy/docker-compose-sa.yaml -O docker-compose.yaml
# create the machine key directory
mkdir machinekey
# Run the database and application containers. # Run the database and application containers.
docker compose up --detach docker compose up --detach

38
docs/docs/self-hosting/deploy/docker-compose-sa.yaml
View File

@ -1,27 +1,27 @@
version: '3.8'
services: services:
zitadel: zitadel:
# The user should have the permission to write to ./machinekey
user: "${UID:-1000}"
restart: 'always' restart: 'always'
networks: networks:
- 'zitadel' - 'zitadel'
image: 'ghcr.io/zitadel/zitadel:latest' image: 'ghcr.io/zitadel/zitadel:latest'
command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode disabled' command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode disabled'
environment: environment:
- 'ZITADEL_DATABASE_POSTGRES_HOST=db' ZITADEL_DATABASE_POSTGRES_HOST: db
- 'ZITADEL_DATABASE_POSTGRES_PORT=5432' ZITADEL_DATABASE_POSTGRES_PORT: 5432
- 'ZITADEL_DATABASE_POSTGRES_DATABASE=zitadel' ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
- 'ZITADEL_DATABASE_POSTGRES_USER_USERNAME=zitadel' ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
- 'ZITADEL_DATABASE_POSTGRES_USER_PASSWORD=zitadel' ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel
- 'ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE=disable' ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
- 'ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME=postgres' ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
- 'ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD=postgres' ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
- 'ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE=disable' ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
- 'ZITADEL_EXTERNALSECURE=false' ZITADEL_EXTERNALSECURE: false
- 'ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH=/machinekey/zitadel-admin-sa.json' ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH: /machinekey/zitadel-admin-sa.json
- 'ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_USERNAME=zitadel-admin-sa' ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_USERNAME: zitadel-admin-sa
- 'ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME=Admin' ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME: Admin
- 'ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINEKEY_TYPE=1' ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINEKEY_TYPE: 1
depends_on: depends_on:
db: db:
condition: 'service_healthy' condition: 'service_healthy'
@ -34,12 +34,12 @@ services:
restart: 'always' restart: 'always'
image: postgres:16-alpine image: postgres:16-alpine
environment: environment:
- POSTGRES_USER=postgres PGUSER: postgres
- POSTGRES_PASSWORD=postgres POSTGRES_PASSWORD: postgres
networks: networks:
- 'zitadel' - 'zitadel'
healthcheck: healthcheck:
test: ["CMD-SHELL", "pg_isready", "-d", "db_prod"] test: ["CMD-SHELL", "pg_isready", "-d", "zitadel", "-U", "postgres"]
interval: '10s' interval: '10s'
timeout: '30s' timeout: '30s'
retries: 5 retries: 5

27
docs/docs/self-hosting/deploy/docker-compose.yaml
View File

@ -1,5 +1,3 @@
version: '3.8'
services: services:
zitadel: zitadel:
restart: 'always' restart: 'always'
@ -8,16 +6,16 @@ services:
image: 'ghcr.io/zitadel/zitadel:latest' image: 'ghcr.io/zitadel/zitadel:latest'
command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode disabled' command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode disabled'
environment: environment:
- 'ZITADEL_DATABASE_POSTGRES_HOST=db' ZITADEL_DATABASE_POSTGRES_HOST: db
- 'ZITADEL_DATABASE_POSTGRES_PORT=5432' ZITADEL_DATABASE_POSTGRES_PORT: 5432
- 'ZITADEL_DATABASE_POSTGRES_DATABASE=zitadel' ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
- 'ZITADEL_DATABASE_POSTGRES_USER_USERNAME=zitadel' ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
- 'ZITADEL_DATABASE_POSTGRES_USER_PASSWORD=zitadel' ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel
- 'ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE=disable' ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
- 'ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME=postgres' ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
- 'ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD=postgres' ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
- 'ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE=disable' ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
- 'ZITADEL_EXTERNALSECURE=false' ZITADEL_EXTERNALSECURE: false
depends_on: depends_on:
db: db:
condition: 'service_healthy' condition: 'service_healthy'
@ -28,9 +26,8 @@ services:
restart: 'always' restart: 'always'
image: postgres:16-alpine image: postgres:16-alpine
environment: environment:
- POSTGRES_USER=postgres PGUSER: postgres
- POSTGRES_PASSWORD=postgres POSTGRES_PASSWORD: postgres
- POSTGRES_DB=zitadel
networks: networks:
- 'zitadel' - 'zitadel'
healthcheck: healthcheck:

106
docs/docs/self-hosting/manage/reverseproxy/docker-compose.yaml
View File

@ -7,19 +7,19 @@ services:
service: zitadel-init service: zitadel-init
command: 'start-from-setup --init-projections --masterkey "MasterkeyNeedsToHave32Characters" --config /zitadel.yaml --steps /zitadel.yaml' command: 'start-from-setup --init-projections --masterkey "MasterkeyNeedsToHave32Characters" --config /zitadel.yaml --steps /zitadel.yaml'
environment: environment:
- ZITADEL_EXTERNALPORT=80 ZITADEL_EXTERNALPORT: 80
- ZITADEL_EXTERNALSECURE=false ZITADEL_EXTERNALSECURE: false
- ZITADEL_TLS_ENABLED=false ZITADEL_TLS_ENABLED: false
# database configuration # database configuration
- ZITADEL_DATABASE_POSTGRES_HOST=db ZITADEL_DATABASE_POSTGRES_HOST: db
- ZITADEL_DATABASE_POSTGRES_PORT=5432 ZITADEL_DATABASE_POSTGRES_PORT: 5432
- ZITADEL_DATABASE_POSTGRES_DATABASE=zitadel ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
- ZITADEL_DATABASE_POSTGRES_USER_USERNAME=zitadel_user ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel_user
- ZITADEL_DATABASE_POSTGRES_USER_PASSWORD=zitadel_pw ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel_pw
- ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE=disable ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
- ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME=root ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: root
- ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD=postgres ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
- ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE=disable ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
networks: networks:
- 'zitadel' - 'zitadel'
depends_on: depends_on:
@ -33,19 +33,19 @@ services:
service: zitadel-init service: zitadel-init
command: 'start-from-setup --init-projections --masterkey "MasterkeyNeedsToHave32Characters" --config /zitadel.yaml --steps /zitadel.yaml' command: 'start-from-setup --init-projections --masterkey "MasterkeyNeedsToHave32Characters" --config /zitadel.yaml --steps /zitadel.yaml'
environment: environment:
- ZITADEL_EXTERNALPORT=443 ZITADEL_EXTERNALPORT: 443
- ZITADEL_EXTERNALSECURE=true ZITADEL_EXTERNALSECURE: true
- ZITADEL_TLS_ENABLED=false ZITADEL_TLS_ENABLED: false
# database configuration # database configuration
- ZITADEL_DATABASE_POSTGRES_HOST=db ZITADEL_DATABASE_POSTGRES_HOST: db
- ZITADEL_DATABASE_POSTGRES_PORT=5432 ZITADEL_DATABASE_POSTGRES_PORT: 5432
- ZITADEL_DATABASE_POSTGRES_DATABASE=zitadel ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
- ZITADEL_DATABASE_POSTGRES_USER_USERNAME=zitadel_user ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel_user
- ZITADEL_DATABASE_POSTGRES_USER_PASSWORD=zitadel_pw ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel_pw
- ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE=disable ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
- ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME=root ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: root
- ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD=postgres ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
- ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE=disable ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
networks: networks:
- 'zitadel' - 'zitadel'
depends_on: depends_on:
@ -59,21 +59,21 @@ services:
service: zitadel-init service: zitadel-init
command: 'start-from-setup --init-projections --masterkey "MasterkeyNeedsToHave32Characters" --config /zitadel.yaml --steps /zitadel.yaml' command: 'start-from-setup --init-projections --masterkey "MasterkeyNeedsToHave32Characters" --config /zitadel.yaml --steps /zitadel.yaml'
environment: environment:
- ZITADEL_EXTERNALPORT=443 ZITADEL_EXTERNALPORT: 443
- ZITADEL_EXTERNALSECURE=true ZITADEL_EXTERNALSECURE: true
- ZITADEL_TLS_ENABLED=true ZITADEL_TLS_ENABLED: true
- ZITADEL_TLS_CERTPATH=/etc/certs/selfsigned.crt ZITADEL_TLS_CERTPATH: /etc/certs/selfsigned.crt
- ZITADEL_TLS_KEYPATH=/etc/certs/selfsigned.key ZITADEL_TLS_KEYPATH: /etc/certs/selfsigned.key
# database configuration # database configuration
- ZITADEL_DATABASE_POSTGRES_HOST=db ZITADEL_DATABASE_POSTGRES_HOST: db
- ZITADEL_DATABASE_POSTGRES_PORT=5432 ZITADEL_DATABASE_POSTGRES_PORT: 5432
- ZITADEL_DATABASE_POSTGRES_DATABASE=zitadel ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
- ZITADEL_DATABASE_POSTGRES_USER_USERNAME=zitadel_user ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel_user
- ZITADEL_DATABASE_POSTGRES_USER_PASSWORD=zitadel_pw ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel_pw
- ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE=disable ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
- ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME=root ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: root
- ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD=postgres ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
- ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE=disable ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
volumes: volumes:
- ./selfsigned.crt:/etc/certs/selfsigned.crt - ./selfsigned.crt:/etc/certs/selfsigned.crt
- ./selfsigned.key:/etc/certs/selfsigned.key - ./selfsigned.key:/etc/certs/selfsigned.key
@ -96,22 +96,22 @@ services:
# Using an external domain other than localhost proofs, that the proxy configuration works. # Using an external domain other than localhost proofs, that the proxy configuration works.
# If ZITADEL can't resolve a requests original host to this domain, # If ZITADEL can't resolve a requests original host to this domain,
# it will return a 404 Instance not found error. # it will return a 404 Instance not found error.
- ZITADEL_EXTERNALDOMAIN=127.0.0.1.sslip.io ZITADEL_EXTERNALDOMAIN: 127.0.0.1.sslip.io
# In case something doesn't work as expected, # In case something doesn't work as expected,
# it can be handy to be able to read the access logs. # it can be handy to be able to read the access logs.
- ZITADEL_LOGSTORE_ACCESS_STDOUT_ENABLED=true ZITADEL_LOGSTORE_ACCESS_STDOUT_ENABLED: true
# For convenience, ZITADEL should not ask to change the initial admin users password. # For convenience, ZITADEL should not ask to change the initial admin users password.
- ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED=false ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED: false
# database configuration # database configuration
- ZITADEL_DATABASE_POSTGRES_HOST=db ZITADEL_DATABASE_POSTGRES_HOST: db
- ZITADEL_DATABASE_POSTGRES_PORT=5432 ZITADEL_DATABASE_POSTGRES_PORT: 5432
- ZITADEL_DATABASE_POSTGRES_DATABASE=zitadel ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
- ZITADEL_DATABASE_POSTGRES_USER_USERNAME=zitadel_user ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel_user
- ZITADEL_DATABASE_POSTGRES_USER_PASSWORD=zitadel_pw ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel_pw
- ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE=disable ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
- ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME=root ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: root
- ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD=postgres ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
- ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE=disable ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
networks: networks:
- 'zitadel' - 'zitadel'
healthcheck: healthcheck:
@ -125,10 +125,10 @@ services:
restart: 'always' restart: 'always'
image: postgres:16-alpine image: postgres:16-alpine
environment: environment:
- POSTGRES_USER=root PGUSER: root
- POSTGRES_PASSWORD=postgres POSTGRES_PASSWORD: postgres
healthcheck: healthcheck:
test: ["CMD-SHELL", "pg_isready", "-d", "db_prod"] test: ["CMD-SHELL", "pg_isready", "-d", "zitadel", "-U", "postgres"]
interval: 5s interval: 5s
timeout: 60s timeout: 60s
retries: 10 retries: 10