Overview - Zitadel/zitadel

zitadel/zitadel

7 days30 days

Latest CI Pipeline Executions

Fuzzy

In progress
main
ed48fbfb docs: update custom domain guide for customer portal (#11691) This PR fixes some issues on the custom domain guide for the customer portal --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
39 seconds ago by fcoppede
In progress
main
1 minute ago
Succeeded
main
3b74b86d fix(login): check for primary auth methods on user discovery (#11689) # Which Problems Are Solved - Currently, if a user has only secondary authentication methods (like TOTP) configured but no primary authentication method (Password, Passkey, or IDP), the login flow fails to handle them correctly, resulting in an unhelpful "user not found" error when they attempt to log in. - These users are not correctly prompted to set up a primary authentication factor, leaving them in a state where they cannot successfully authenticate. # How the Problems Are Solved - Updated `sendLoginname` to evaluate if a user has an active primary authentication method (`AuthenticationMethodType.PASSWORD`, `PASSKEY`, or `IDP`. If they lack a primary method, the flow now correctly redirects them into the verification/invite process rather than falling through the method checks and returning a generic error. - Updated `sendVerification` to replace the empty `authMethodTypes` array check with a specific check for primary authentication methods. Now, after completing email/invite verification, users who do not have a primary authentication method are explicitly redirected to `/authenticator/set` to set one up.
7 hours ago by pull[bot]
Succeeded
main
8ec1e986 Merge 3b74b86dc411efec24592f7ab12a9e431c78d195 into 0261536243e500dccfd8c7f547d592c822478327
7 hours ago by pull[bot]
Succeeded
main
3b74b86d fix(login): check for primary auth methods on user discovery (#11689) # Which Problems Are Solved - Currently, if a user has only secondary authentication methods (like TOTP) configured but no primary authentication method (Password, Passkey, or IDP), the login flow fails to handle them correctly, resulting in an unhelpful "user not found" error when they attempt to log in. - These users are not correctly prompted to set up a primary authentication factor, leaving them in a state where they cannot successfully authenticate. # How the Problems Are Solved - Updated `sendLoginname` to evaluate if a user has an active primary authentication method (`AuthenticationMethodType.PASSWORD`, `PASSKEY`, or `IDP`. If they lack a primary method, the flow now correctly redirects them into the verification/invite process rather than falling through the method checks and returning a generic error. - Updated `sendVerification` to replace the empty `authMethodTypes` array check with a specific check for primary authentication methods. Now, after completing email/invite verification, users who do not have a primary authentication method are explicitly redirected to `/authenticator/set` to set one up.
8 hours ago by pull[bot]
Succeeded
main
bfa3ca71 Merge 3b74b86dc411efec24592f7ab12a9e431c78d195 into 0261536243e500dccfd8c7f547d592c822478327
8 hours ago by pull[bot]
Succeeded
main
08cd1f80 Merge 54095b64b108a8e5b5031629397ae218bc47ccd4 into ab0f045499d93797d13a7d46a6e4984cb1b46a9f
8 hours ago by pull[bot]
Succeeded
main
3b74b86d fix(login): check for primary auth methods on user discovery (#11689) # Which Problems Are Solved - Currently, if a user has only secondary authentication methods (like TOTP) configured but no primary authentication method (Password, Passkey, or IDP), the login flow fails to handle them correctly, resulting in an unhelpful "user not found" error when they attempt to log in. - These users are not correctly prompted to set up a primary authentication factor, leaving them in a state where they cannot successfully authenticate. # How the Problems Are Solved - Updated `sendLoginname` to evaluate if a user has an active primary authentication method (`AuthenticationMethodType.PASSWORD`, `PASSKEY`, or `IDP`. If they lack a primary method, the flow now correctly redirects them into the verification/invite process rather than falling through the method checks and returning a generic error. - Updated `sendVerification` to replace the empty `authMethodTypes` array check with a specific check for primary authentication methods. Now, after completing email/invite verification, users who do not have a primary authentication method are explicitly redirected to `/authenticator/set` to set one up.
8 hours ago by pull[bot]
Succeeded
main
880f74fc Merge 3b74b86dc411efec24592f7ab12a9e431c78d195 into 0261536243e500dccfd8c7f547d592c822478327
8 hours ago by pull[bot]
Succeeded
main
3b74b86d fix(login): check for primary auth methods on user discovery (#11689) # Which Problems Are Solved - Currently, if a user has only secondary authentication methods (like TOTP) configured but no primary authentication method (Password, Passkey, or IDP), the login flow fails to handle them correctly, resulting in an unhelpful "user not found" error when they attempt to log in. - These users are not correctly prompted to set up a primary authentication factor, leaving them in a state where they cannot successfully authenticate. # How the Problems Are Solved - Updated `sendLoginname` to evaluate if a user has an active primary authentication method (`AuthenticationMethodType.PASSWORD`, `PASSKEY`, or `IDP`. If they lack a primary method, the flow now correctly redirects them into the verification/invite process rather than falling through the method checks and returning a generic error. - Updated `sendVerification` to replace the empty `authMethodTypes` array check with a specific check for primary authentication methods. Now, after completing email/invite verification, users who do not have a primary authentication method are explicitly redirected to `/authenticator/set` to set one up.
9 hours ago by peintnermax
Succeeded
main
9 hours ago
Succeeded
main
c8abf6de feat(login): add optional TLS termination support (#11663) # Which Problems Are Solved The login container can only serve HTTP. In deployments where a reverse proxy is not used, operators need the login container to terminate TLS itself. Closes #11473 # How the Problems Are Solved The container now supports optional HTTPS via three environment variables that match the pattern already used by the backend server: `ZITADEL_TLS_ENABLED`, `ZITADEL_TLS_CERTPATH`, and `ZITADEL_TLS_KEYPATH`. When `ZITADEL_TLS_ENABLED` is not set or set to `false`, behavior is identical to before. When set to `true`, the server reads the provided certificate and key files and serves HTTPS using the lower-level `getRequestHandlers` API from Next.js. The Docker healthcheck was updated to probe the correct scheme automatically based on the same environment variable. # Additional Changes Added a dockerized integration test that verifies both HTTP and HTTPS modes using testcontainers. # Additional Context The TLS path uses `getRequestHandlers` from `next/dist/server/lib/start-server` instead of `startServer` because the latter rejects self-signed certificates in production mode. This is the same internal API that `startServer` itself calls. --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
11 hours ago by mridang
Succeeded
main
11 hours ago
Succeeded
main
46b5c116 Merge 54095b64b108a8e5b5031629397ae218bc47ccd4 into 87aae1b5fc3978630b4a064c10b3c088356fb5a7
12 hours ago by pull[bot]
Succeeded
main
02615362 Merge commit from fork
12 hours ago by fengjicheng
Succeeded
main
bac224c5 chore: improve docker compose template, tests and docs (#11593) Replaces the single-file `docker-compose.yaml` quickstart with a production-aware, Traefik-based compose pack in `deploy/compose/`. The pack covers the full arc from a 2-minute localhost quickstart to a hardened homelab or semi-production deployment. ### What's in the pack **Stack**: Traefik (proxy) → ZITADEL API (Go `:8080`) + ZITADEL Login (Next.js `:3000`) → PostgreSQL All HTTP/gRPC routing is handled by Traefik via Docker labels — no manual proxy config needed. The Login V2 UI is enabled by default. Login URLs are derived automatically from `ZITADEL_DOMAIN`, `ZITADEL_EXTERNALPORT`, and `ZITADEL_PUBLIC_SCHEME` — no separate URL variables needed. **Compose files** | File | Purpose | |------|---------| | `docker-compose.yml` | Base stack — works standalone. Uses explicit `name: zitadel` network for reliable Traefik service discovery. | | `docker-compose.mode-letsencrypt.yml` | TLS overlay: ACME HTTP challenge | | `docker-compose.mode-external-tls.yml` | TLS overlay: upstream LB/CDN terminates TLS. Uses `forwardedHeaders.trustedIPs` (configurable via `TRAEFIK_TRUSTED_IPS`) instead of `insecure=true`. | | `docker-compose.mode-local-tls.yml` | TLS overlay: self-signed certs for LAN | | `docker-compose.prodlike.yml` | Splits init / setup / start for controlled upgrades | | `docker-compose.test.yml` | CI overlay: swaps images to locally-built `:local` tags | **Optional profiles**: `cache` (Redis), `observability` (OpenTelemetry Collector) ### Build infra - New `@zitadel/api:pack` and `@zitadel/login:pack` Nx targets build local Docker images (`zitadel/zitadel:local`, `zitadel/zitadel-login:local`) for use in CI and local testing - `apps/api/Dockerfile` now accepts a `BINARY` build arg so local and release builds share the same image ### Testing - New `@zitadel/compose` Nx project with targets: `test-config` (validates all overlay combinations using `--quiet`), `test-run` (starts full stack with local images), `test-e2e` (Playwright wiring + protocol matrix tests through Traefik), `test-full` (end-to-end: build → start → test → teardown), `stop` - **`@zitadel/compose` is explicitly excluded from `nx affected` in CI for now** — the full stack smoke test requires a Docker daemon and significant resources. The intent is to add a dedicated `compose_smoke_test` CI job in a follow-up. The targets can be run locally with `pnpm nx run @zitadel/compose:test-full`. ### Documentation - **`compose.mdx`**: Complete rewrite with a staged structure (Stage 1 Quickstart → Stage 2 Homelab → Stage 3 Beyond Compose). Documents TLS modes, profiles, secrets hardening, ExternalDomain/Port/Secure invariant, upgrades, and the path to Kubernetes - **New `requirements.mdx`**: Lists supported PostgreSQL versions (14–18), Redis (standalone), Docker Compose v2.x, and reverse proxy h2c requirements - **`reverse_proxy.mdx`**: Added intro covering h2c requirements, TLS modes table, and Login UI routing split - **`troubleshooting.mdx`**: New sections for container restarts on upgrade, FIRSTINSTANCE env vars not taking effect, and diagnosing unhealthy containers - **`caddy/index.mdx`**: Known issue and workaround for the `TE: trailers` header hang - Removed the old `apps/docs/content/self-hosting/deploy/docker-compose.yaml` embedded in the docs ### Breaking change The old `apps/docs/content/self-hosting/deploy/docker-compose.yaml` file is deleted. The getting-started docs page (`/self-hosting/deploy/compose`) now points to the new pack via a `curl | tar` download command. --- ### Checklist - [x] `deploy/compose/` smoke test passes end-to-end locally (`pnpm nx run @zitadel/compose:test-full`) - [x] Docs build passes (`pnpm nx run @zitadel/docs:build`) - [ ] Follow-up issue created to add `compose_smoke_test` CI job --------- Co-authored-by: Mridang Agarwalla <mridang@zitadel.com>
13 hours ago by yonas
Succeeded
main
02615362 Merge commit from fork
13 hours ago by pull[bot]
Succeeded
main
69f48b73 Merge 0261536243e500dccfd8c7f547d592c822478327 into bac224c56dd1a9a0f49e255c92edd9c545fb5de9
13 hours ago by pull[bot]
Succeeded
main
02615362 Merge commit from fork
14 hours ago by pull[bot]
Succeeded
main
a3f853cc Merge 0261536243e500dccfd8c7f547d592c822478327 into bac224c56dd1a9a0f49e255c92edd9c545fb5de9
14 hours ago by pull[bot]