mirror of
https://github.com/zitadel/zitadel.git
synced 2025-10-20 17:59:12 +00:00
f60d200d5a
* key rotation * fix: rotate signing key * cleanup * introspect * testingapplication key * date * client keys * fix client keys * fix client keys * access tokens only for users * AuthMethodPrivateKeyJWT * client keys * set introspection info correctly * managae apis * update oidc pkg * cleanup * merge msater * set current sequence in migration * set current sequence in migration * set current sequence in migration * ensure authn keys uptodate * improve key rotation * fix: return api config in ApplicationView * fix mocks for tests * fix(mock): corrected unit tests for updated mock package Co-authored-by: Stefan Benz <stefan@caos.ch>
303 lines
7.7 KiB
YAML
303 lines
7.7 KiB
YAML
Log:
|
|
Level: $ZITADEL_LOG_LEVEL
|
|
Formatter:
|
|
Format: text
|
|
|
|
Tracing:
|
|
Type: $ZITADEL_TRACING_TYPE
|
|
Config:
|
|
ProjectID: $ZITADEL_TRACING_PROJECT_ID
|
|
MetricPrefix: ZITADEL-V1
|
|
Fraction: $ZITADEL_TRACING_FRACTION
|
|
Endpoint: $ZITADEL_TRACING_ENDPOINT
|
|
|
|
Metrics:
|
|
Type: 'otel'
|
|
Config:
|
|
MeterName: 'github.com/caos/zitadel'
|
|
|
|
AuthZ:
|
|
Domain: $ZITADEL_DEFAULT_DOMAIN
|
|
Repository:
|
|
Eventstore:
|
|
ServiceName: 'AuthZ'
|
|
Repository:
|
|
SQL:
|
|
Host: $ZITADEL_EVENTSTORE_HOST
|
|
Port: $ZITADEL_EVENTSTORE_PORT
|
|
User: 'authz'
|
|
Database: 'eventstore'
|
|
Password: $CR_AUTHZ_PASSWORD
|
|
SSL:
|
|
Mode: $CR_SSL_MODE
|
|
RootCert: $CR_ROOT_CERT
|
|
Cert: $CR_AUTHZ_CERT
|
|
Key: $CR_AUTHZ_KEY
|
|
Cache:
|
|
Type: 'fastcache'
|
|
Config:
|
|
MaxCacheSizeInByte: 10485760 #10mb
|
|
View:
|
|
Host: $ZITADEL_EVENTSTORE_HOST
|
|
Port: $ZITADEL_EVENTSTORE_PORT
|
|
User: 'authz'
|
|
Database: 'authz'
|
|
Password: $CR_AUTHZ_PASSWORD
|
|
SSL:
|
|
Mode: $CR_SSL_MODE
|
|
RootCert: $CR_ROOT_CERT
|
|
Cert: $CR_AUTHZ_CERT
|
|
Key: $CR_AUTHZ_KEY
|
|
Spooler:
|
|
ConcurrentWorkers: 1
|
|
BulkLimit: 10000
|
|
FailureCountUntilSkip: 5
|
|
|
|
Auth:
|
|
SearchLimit: 1000
|
|
Domain: $ZITADEL_DEFAULT_DOMAIN
|
|
Eventstore:
|
|
ServiceName: 'authAPI'
|
|
Repository:
|
|
SQL:
|
|
Host: $ZITADEL_EVENTSTORE_HOST
|
|
Port: $ZITADEL_EVENTSTORE_PORT
|
|
User: 'auth'
|
|
Database: 'eventstore'
|
|
Password: $CR_AUTH_PASSWORD
|
|
SSL:
|
|
Mode: $CR_SSL_MODE
|
|
RootCert: $CR_ROOT_CERT
|
|
Cert: $CR_AUTH_CERT
|
|
Key: $CR_AUTH_KEY
|
|
Cache:
|
|
Type: 'fastcache'
|
|
Config:
|
|
MaxCacheSizeInByte: 10485760 #10mb
|
|
AuthRequest:
|
|
Connection:
|
|
Host: $ZITADEL_EVENTSTORE_HOST
|
|
Port: $ZITADEL_EVENTSTORE_PORT
|
|
User: 'auth'
|
|
Database: 'auth'
|
|
Password: $CR_AUTH_PASSWORD
|
|
SSL:
|
|
Mode: $CR_SSL_MODE
|
|
RootCert: $CR_ROOT_CERT
|
|
Cert: $CR_AUTH_CERT
|
|
Key: $CR_AUTH_KEY
|
|
View:
|
|
Host: $ZITADEL_EVENTSTORE_HOST
|
|
Port: $ZITADEL_EVENTSTORE_PORT
|
|
User: 'auth'
|
|
Database: 'auth'
|
|
Password: $CR_AUTH_PASSWORD
|
|
SSL:
|
|
Mode: $CR_SSL_MODE
|
|
RootCert: $CR_ROOT_CERT
|
|
Cert: $CR_AUTH_CERT
|
|
Key: $CR_AUTH_KEY
|
|
Spooler:
|
|
ConcurrentWorkers: 1
|
|
BulkLimit: 10000
|
|
FailureCountUntilSkip: 5
|
|
KeyConfig:
|
|
Size: 2048
|
|
PrivateKeyLifetime: 6h
|
|
PublicKeyLifetime: 30h
|
|
EncryptionConfig:
|
|
EncryptionKeyID: $ZITADEL_OIDC_KEYS_ID
|
|
SigningKeyRotationCheck: 10s
|
|
SigningKeyGracefulPeriod: 10m
|
|
|
|
Admin:
|
|
SearchLimit: 1000
|
|
Domain: $ZITADEL_DEFAULT_DOMAIN
|
|
Eventstore:
|
|
ServiceName: 'Admin'
|
|
Repository:
|
|
SQL:
|
|
Host: $ZITADEL_EVENTSTORE_HOST
|
|
Port: $ZITADEL_EVENTSTORE_PORT
|
|
User: 'adminapi'
|
|
Database: 'eventstore'
|
|
Password: $CR_ADMINAPI_PASSWORD
|
|
SSL:
|
|
Mode: $CR_SSL_MODE
|
|
RootCert: $CR_ROOT_CERT
|
|
Cert: $CR_ADMINAPI_CERT
|
|
Key: $CR_ADMINAPI_KEY
|
|
Cache:
|
|
Type: 'fastcache'
|
|
Config:
|
|
MaxCacheSizeInByte: 10485760 #10mb
|
|
View:
|
|
Host: $ZITADEL_EVENTSTORE_HOST
|
|
Port: $ZITADEL_EVENTSTORE_PORT
|
|
User: 'adminapi'
|
|
Database: 'adminapi'
|
|
Password: $CR_ADMINAPI_PASSWORD
|
|
SSL:
|
|
Mode: $CR_SSL_MODE
|
|
RootCert: $CR_ROOT_CERT
|
|
Cert: $CR_ADMINAPI_CERT
|
|
Key: $CR_ADMINAPI_KEY
|
|
Spooler:
|
|
ConcurrentWorkers: 1
|
|
BulkLimit: 10000
|
|
FailureCountUntilSkip: 5
|
|
|
|
Mgmt:
|
|
SearchLimit: 1000
|
|
Domain: $ZITADEL_DEFAULT_DOMAIN
|
|
Eventstore:
|
|
ServiceName: 'ManagementAPI'
|
|
Repository:
|
|
SQL:
|
|
Host: $ZITADEL_EVENTSTORE_HOST
|
|
Port: $ZITADEL_EVENTSTORE_PORT
|
|
User: 'management'
|
|
Database: 'eventstore'
|
|
Password: $CR_MANAGEMENT_PASSWORD
|
|
SSL:
|
|
Mode: $CR_SSL_MODE
|
|
RootCert: $CR_ROOT_CERT
|
|
Cert: $CR_MANAGEMENT_CERT
|
|
Key: $CR_MANAGEMENT_KEY
|
|
Cache:
|
|
Type: 'fastcache'
|
|
Config:
|
|
MaxCacheSizeInByte: 10485760 #10mb
|
|
View:
|
|
Host: $ZITADEL_EVENTSTORE_HOST
|
|
Port: $ZITADEL_EVENTSTORE_PORT
|
|
User: 'management'
|
|
Database: 'management'
|
|
Password: $CR_MANAGEMENT_PASSWORD
|
|
SSL:
|
|
Mode: $CR_SSL_MODE
|
|
RootCert: $CR_ROOT_CERT
|
|
Cert: $CR_MANAGEMENT_CERT
|
|
Key: $CR_MANAGEMENT_KEY
|
|
Spooler:
|
|
ConcurrentWorkers: 1
|
|
BulkLimit: 10000
|
|
FailureCountUntilSkip: 5
|
|
|
|
API:
|
|
GRPC:
|
|
ServerPort: 50001
|
|
GatewayPort: 50002
|
|
CustomHeaders:
|
|
- x-zitadel-
|
|
OIDC:
|
|
OPConfig:
|
|
Issuer: $ZITADEL_ISSUER
|
|
DefaultLogoutRedirectURI: $ZITADEL_ACCOUNTS/logout/done
|
|
CodeMethodS256: true
|
|
AuthMethodPrivateKeyJWT: true
|
|
StorageConfig:
|
|
DefaultLoginURL: $ZITADEL_ACCOUNTS/login?authRequestID=
|
|
DefaultAccessTokenLifetime: 12h
|
|
DefaultIdTokenLifetime: 12h
|
|
SigningKeyAlgorithm: RS256
|
|
UserAgentCookieConfig:
|
|
Name: caos.zitadel.useragent
|
|
Domain: $ZITADEL_COOKIE_DOMAIN
|
|
MaxAge: 8760h #365*24h (1 year)
|
|
Key:
|
|
EncryptionKeyID: $ZITADEL_COOKIE_KEY
|
|
Cache:
|
|
MaxAge: $ZITADEL_CACHE_MAXAGE
|
|
SharedMaxAge: $ZITADEL_CACHE_SHARED_MAXAGE
|
|
Endpoints:
|
|
Auth:
|
|
Path: 'authorize'
|
|
URL: '$ZITADEL_AUTHORIZE/authorize'
|
|
Token:
|
|
Path: 'token'
|
|
URL: '$ZITADEL_OAUTH/token'
|
|
Introspection:
|
|
Path: 'introspect'
|
|
URL: '$ZITADEL_OAUTH/introspect'
|
|
EndSession:
|
|
Path: 'endsession'
|
|
URL: '$ZITADEL_AUTHORIZE/endsession'
|
|
Userinfo:
|
|
Path: 'userinfo'
|
|
URL: '$ZITADEL_OAUTH/userinfo'
|
|
Keys:
|
|
Path: 'keys'
|
|
URL: '$ZITADEL_OAUTH/keys'
|
|
|
|
UI:
|
|
Port: 50003
|
|
Login:
|
|
Handler:
|
|
BaseURL: '$ZITADEL_ACCOUNTS'
|
|
OidcAuthCallbackURL: '$ZITADEL_AUTHORIZE/authorize/callback?id='
|
|
ZitadelURL: '$ZITADEL_CONSOLE'
|
|
LanguageCookieName: 'caos.zitadel.login.lang'
|
|
DefaultLanguage: 'de'
|
|
CSRF:
|
|
CookieName: 'caos.zitadel.login.csrf'
|
|
Key:
|
|
EncryptionKeyID: $ZITADEL_CSRF_KEY
|
|
Development: $ZITADEL_CSRF_DEV
|
|
UserAgentCookieConfig:
|
|
Name: caos.zitadel.useragent
|
|
Domain: $ZITADEL_COOKIE_DOMAIN
|
|
MaxAge: 8760h #365*24h (1 year)
|
|
Key:
|
|
EncryptionKeyID: $ZITADEL_COOKIE_KEY
|
|
Cache:
|
|
MaxAge: $ZITADEL_CACHE_MAXAGE
|
|
SharedMaxAge: $ZITADEL_CACHE_SHARED_MAXAGE
|
|
Console:
|
|
EnvOverwriteDir: $ZITADEL_CONSOLE_ENV_DIR
|
|
ShortCache:
|
|
MaxAge: $ZITADEL_SHORT_CACHE_MAXAGE
|
|
SharedMaxAge: $ZITADEL_SHORT_CACHE_SHARED_MAXAGE
|
|
LongCache:
|
|
MaxAge: $ZITADEL_CACHE_MAXAGE
|
|
SharedMaxAge: $ZITADEL_CACHE_SHARED_MAXAGE
|
|
CSPDomain: $ZITADEL_DEFAULT_DOMAIN
|
|
|
|
Notification:
|
|
Repository:
|
|
DefaultLanguage: 'de'
|
|
Domain: $ZITADEL_DEFAULT_DOMAIN
|
|
Eventstore:
|
|
ServiceName: 'Notification'
|
|
Repository:
|
|
SQL:
|
|
Host: $ZITADEL_EVENTSTORE_HOST
|
|
Port: $ZITADEL_EVENTSTORE_PORT
|
|
User: 'notification'
|
|
Database: 'eventstore'
|
|
Password: $CR_NOTIFICATION_PASSWORD
|
|
SSL:
|
|
Mode: $CR_SSL_MODE
|
|
RootCert: $CR_ROOT_CERT
|
|
Cert: $CR_NOTIFICATION_CERT
|
|
Key: $CR_NOTIFICATION_KEY
|
|
Cache:
|
|
Type: 'fastcache'
|
|
Config:
|
|
MaxCacheSizeInByte: 10485760 #10mb
|
|
View:
|
|
Host: $ZITADEL_EVENTSTORE_HOST
|
|
Port: $ZITADEL_EVENTSTORE_PORT
|
|
User: 'notification'
|
|
Database: 'notification'
|
|
Password: $CR_NOTIFICATION_PASSWORD
|
|
SSL:
|
|
Mode: $CR_SSL_MODE
|
|
RootCert: $CR_ROOT_CERT
|
|
Cert: $CR_NOTIFICATION_CERT
|
|
Key: $CR_NOTIFICATION_KEY
|
|
Spooler:
|
|
ConcurrentWorkers: 1
|
|
BulkLimit: 10000
|
|
FailureCountUntilSkip: 5
|
|
Handlers: |