104 lines
4.1 KiB
Bash
104 lines
4.1 KiB
Bash
# ⚠️ INSECURE DEFAULTS — for local development only.
|
|
# Before exposing this stack to a network, change ZITADEL_MASTERKEY,
|
|
# POSTGRES_ADMIN_PASSWORD, and POSTGRES_ZITADEL_PASSWORD.
|
|
# See: https://zitadel.com/docs/self-hosting/deploy/compose#homelab
|
|
|
|
# -----------------------------
|
|
# Domain and external URL
|
|
# -----------------------------
|
|
ZITADEL_DOMAIN=localhost
|
|
# Used by the base (non-TLS) compose; TLS overlays also publish 80/443 and may still expose
|
|
# this port unless their ports are adjusted.
|
|
PROXY_HTTP_PUBLISHED_PORT=8080
|
|
ZITADEL_EXTERNALPORT=8080
|
|
ZITADEL_EXTERNALSECURE=false
|
|
# Overridden by TLS overlays (they hardcode X-Forwarded-Proto: https).
|
|
ZITADEL_PUBLIC_SCHEME=http
|
|
|
|
# -----------------------------
|
|
# Security/bootstrap
|
|
# -----------------------------
|
|
# Must be exactly 32 chars for new deployments.
|
|
ZITADEL_MASTERKEY=MasterkeyNeedsToHave32Characters
|
|
LOGIN_CLIENT_PAT_EXPIRATION=2099-01-01T00:00:00Z
|
|
|
|
# -----------------------------
|
|
# Pinned image tags
|
|
# To upgrade ZITADEL, bump ZITADEL_VERSION and run:
|
|
# docker compose --env-file .env -f docker-compose.yml pull
|
|
# docker compose --env-file .env -f docker-compose.yml up -d --wait
|
|
# -----------------------------
|
|
ZITADEL_VERSION=v4.13.0
|
|
TRAEFIK_IMAGE=traefik:v3.6.8
|
|
POSTGRES_IMAGE=postgres:17.2-alpine
|
|
REDIS_IMAGE=redis:7.4.2-alpine
|
|
OTEL_COLLECTOR_IMAGE=otel/opentelemetry-collector-contrib:0.114.0
|
|
|
|
# -----------------------------
|
|
# Proxy settings
|
|
# -----------------------------
|
|
TRAEFIK_DASHBOARD_ENABLED=false
|
|
TRAEFIK_LOG_LEVEL=INFO
|
|
TRAEFIK_ACCESSLOG_ENABLED=true
|
|
# Trusted proxy IPs for X-Forwarded-* headers (external-tls mode).
|
|
# Comma-separated CIDR ranges of your upstream load balancer / reverse proxy.
|
|
TRAEFIK_TRUSTED_IPS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
|
|
|
|
# Let's Encrypt mode
|
|
LETSENCRYPT_EMAIL=ops@example.com
|
|
|
|
# -----------------------------
|
|
# Postgres settings
|
|
# -----------------------------
|
|
POSTGRES_DB=zitadel
|
|
POSTGRES_ADMIN_USER=postgres
|
|
POSTGRES_ADMIN_PASSWORD=postgres
|
|
# DSN used by ZITADEL to connect to PostgreSQL.
|
|
# The start-from-init command uses this DSN to create the database schema and for
|
|
# normal operation. When a DSN is configured, ZITADEL does not create or switch
|
|
# to a separate unprivileged database user; the user in this DSN is used directly
|
|
# and must already exist. For production, configure this DSN to use a non-superuser
|
|
# role with only the permissions ZITADEL needs.
|
|
# See https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
|
|
ZITADEL_DATABASE_POSTGRES_DSN=postgresql://postgres:postgres@postgres:5432/zitadel?sslmode=disable
|
|
|
|
# -----------------------------
|
|
# Access logs
|
|
# -----------------------------
|
|
ZITADEL_ACCESS_LOG_STDOUT_ENABLED=true
|
|
|
|
# -----------------------------
|
|
# Optional Redis cache settings
|
|
# Default is disabled.
|
|
# Enable with --profile cache and switch connectors to redis.
|
|
# -----------------------------
|
|
ZITADEL_CACHES_CONNECTORS_REDIS_ENABLED=false
|
|
# DSN used by ZITADEL to connect to Redis.
|
|
# See https://redis.io/docs/latest/develop/tools/cli/#host-port-password-and-database
|
|
ZITADEL_CACHES_CONNECTORS_REDIS_URL=redis://redis:6379/0
|
|
ZITADEL_CACHES_INSTANCE_CONNECTOR=
|
|
ZITADEL_CACHES_MILESTONES_CONNECTOR=
|
|
ZITADEL_CACHES_ORGANIZATION_CONNECTOR=
|
|
|
|
# -----------------------------
|
|
# Optional API tracing (OTEL)
|
|
# Default is disabled. Enable with --profile observability.
|
|
# The collector receives traces from ZITADEL on port 4317 (gRPC) and 4318 (HTTP)
|
|
# and logs them to stdout by default.
|
|
# To forward traces to your own backend (Grafana Tempo, Jaeger, OpenObserve, etc.),
|
|
# uncomment the otlp exporter in otel-collector-config.yaml and set:
|
|
# OTEL_BACKEND_ENDPOINT=http://your-backend:4317
|
|
# -----------------------------
|
|
ZITADEL_INSTRUMENTATION_SERVICENAME=zitadel-api
|
|
ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_TYPE=none
|
|
ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_ENDPOINT=otel-collector:4317
|
|
ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_INSECURE=true
|
|
|
|
# -----------------------------
|
|
# Future Login OTEL placeholders
|
|
# Current login image may ignore these.
|
|
# -----------------------------
|
|
LOGIN_OTEL_SERVICE_NAME=zitadel-login
|
|
LOGIN_OTEL_EXPORTER_OTLP_ENDPOINT=
|
|
LOGIN_OTEL_EXPORTER_OTLP_PROTOCOL=grpc
|