WIP: Initial commit

Includes a basic docker-compose and a hopefully working k8s manifest set.

docker-compose.yml

@@ -0,0 +1,46 @@
+version: '3.8'
+
+services:
+  zitadel:
+    restart: 'always'
+    networks:
+      - 'zitadel'
+    image: 'ghcr.io/zitadel/zitadel:latest'
+    command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode disabled'
+    environment:
+      - 'ZITADEL_DATABASE_POSTGRES_HOST=db'
+      - 'ZITADEL_DATABASE_POSTGRES_PORT=5432'
+      - 'ZITADEL_DATABASE_POSTGRES_DATABASE=zitadel'
+      - 'ZITADEL_DATABASE_POSTGRES_USER_USERNAME=zitadel'
+      - 'ZITADEL_DATABASE_POSTGRES_USER_PASSWORD=zitadel'
+      - 'ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE=disable'
+      - 'ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME=postgres'
+      - 'ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD=postgres'
+      - 'ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE=disable'
+      - 'ZITADEL_EXTERNALSECURE=false'
+      - 'ZITADEL_EXTERNALDOMAIN=diogenes.halia'
+    depends_on:
+      db:
+        condition: 'service_healthy'
+    ports:
+      - '8080:8080'
+
+  db:
+    restart: 'always'
+    image: postgres:16-alpine
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_PASSWORD=postgres
+    networks:
+      - 'zitadel'
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready", "-d", "db_prod"]
+      interval: '10s'
+      timeout: '30s'
+      retries: 5
+      start_period: '20s'
+    ports:
+      - '5432:5432'
+
+networks:
+  zitadel:

manifests/database.yaml

@@ -0,0 +1,35 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: zitadel-db
+  namespace: zitadel
+
+spec:
+  instances: 2
+
+  storage:
+    size: 1Gi
+    storageClass: redundant-storage-class
+
+  bootstrap:
+    initdb:
+      database: zitadel
+      owner: zitadel
+      secret:
+        name: zitadel-db-user
+
+  enableSuperuserAccess: true
+  superuserSecret:
+    name: zitadel-db-superuser
+
+  postgresql:
+    pg_hba:
+      - host all all all md5
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 100Mi
+    limits:
+      cpu: 500m
+      memory: 500Mi

manifests/deployment.yaml

@@ -0,0 +1,65 @@
+# TODO
+#
+# Update var envs
+# Create necessary secrets
+# Explore volume organisation
+# Test multiple replicas configuration
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+    name: zitadel
+    namespace: zitadel
+spec:
+    replicas: 1
+    selector:
+        matchLabels:
+            app: zitadel
+    template:
+        metadata:
+            labels:
+                app: zitadel
+        spec:
+            hostname: zitadel
+            subdomain: zitadel
+            containers:
+              - name: zitadel
+                image: ghcr.io/zitadel/zitadel:v2.50.0-rc.2
+                command: ["/app/zitadel", "start-from-init", "--masterkey", "'MasterkeyNeedsToHave32Characte'", "--tlsMode", "external"]
+                ports:
+                  - containerPort: 8080
+                env:
+                  - name: ZITADEL_DATABASE_POSTGRES_HOST
+                    value: "zitadel-db-rw.zitadel.svc.cluster.local"
+                  - name: ZITADEL_DATABASE_POSTGRES_PORT
+                    value: "5432"
+                  - name: ZITADEL_DATABASE_POSTGRES_DATABASE
+                    value: "zitadel"
+                  - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
+                    valueFrom:
+                      secretKeyRef:
+                        name: zitadel-db-user
+                        key: username
+                  - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
+                    valueFrom:
+                      secretKeyRef:
+                        name: zitadel-db-user
+                        key: password
+                  - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
+                    value: "disable"
+                  - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
+                    valueFrom:
+                      secretKeyRef:
+                        name: zitadel-db-superuser
+                        key: username
+                  - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
+                    valueFrom:
+                      secretKeyRef:
+                        name: zitadel-db-superuser
+                        key: password
+                  - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE # Note : Does not need to be secure, as everything is internal to the cluster
+                    value: "disable"
+                  - name: ZITADEL_EXTERNALSECURE
+                    value: "false"
+                  - name: ZITADEL_EXTERNALDOMAIN
+                    value: "https://zitadel.beta.halia.dev"

manifests/ingress.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+    name: zitadel-ingress
+    namespace: zitadel
+    annotations:
+        kubernetes.io/ingress.class: "traefik"
+spec:
+    tls:
+      - secretName: zitadel-beta-tls
+        hosts:
+            - zitadel.beta.halia.dev
+    rules:
+      - host: zitadel.beta.halia.dev
+        http:
+            paths:
+              - path: /
+                pathType: Prefix
+                backend:
+                    service:
+                        name: zitadel-svc
+                        port:
+                            number: 80

manifests/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: zitadel
+
+resources:
+  - namespace.yaml
+  - service.yaml
+  - ingress.yaml
+  - database.yaml
+  - deployment.yaml

manifests/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: zitadel

manifests/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+    name: zitadel-svc
+    namespace: zitadel
+spec:
+    ports:
+        - name: http
+          port: 80
+          protocol: TCP
+          targetPort: 8080
+    selector:
+        app: zitadel