Hedi Kalboussi
1e90a85359
- 6 docs racine (README, HANDOVER, ARCHITECTURE, DECISIONS, INSTALL, OPERATIONS) - 9 docs thématiques dans docs/ - 10 templates docker-compose dans configs/ - 7 scripts Python/Shell d'import Furious vers Zitadel - 2 matrices RBAC Etat infra au 5 juin 2026 : - 88 users Furious importes dans Zitadel - 8 roles RBAC crees et attribues - Intranet filtre les cartes selon role (Approche A) - 7 outils SSO operationnels
137 lines
5.0 KiB
Plaintext
137 lines
5.0 KiB
Plaintext
# ============================================================================
|
|
# Zitadel docker-compose.yml.template
|
|
# ============================================================================
|
|
# Basé sur la quickstart officielle Zitadel avec proxy Traefik intégré.
|
|
# Source : https://github.com/zitadel/zitadel-charts/tree/main/charts/zitadel
|
|
#
|
|
# Ce docker-compose contient :
|
|
# - proxy : Traefik dédié à Zitadel
|
|
# - zitadel : Serveur API
|
|
# - zitadel-login : UI de login v2
|
|
# - postgres : DB dédiée
|
|
#
|
|
# ⚠️ Ce fichier est SIMPLIFIÉ. Pour la version complète production-ready,
|
|
# voir le repo officiel : https://github.com/zitadel/zitadel-charts
|
|
# ============================================================================
|
|
|
|
name: zitadel
|
|
|
|
services:
|
|
# Traefik dédié à Zitadel (isolé du Traefik principal)
|
|
proxy:
|
|
image: ${TRAEFIK_IMAGE}
|
|
restart: unless-stopped
|
|
command:
|
|
- --providers.docker=true
|
|
- --providers.docker.exposedbydefault=false
|
|
- --providers.docker.network=zitadel
|
|
- --entrypoints.web.address=:80
|
|
- --entrypoints.websecure.address=:443
|
|
- --api.dashboard=${TRAEFIK_DASHBOARD_ENABLED}
|
|
- --api.insecure=false
|
|
- --ping=true
|
|
- --ping.entrypoint=web
|
|
- --log.level=${TRAEFIK_LOG_LEVEL}
|
|
- --accesslog=${TRAEFIK_ACCESSLOG_ENABLED}
|
|
ports:
|
|
- ${PROXY_HTTP_PUBLISHED_PORT}:80
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
networks:
|
|
- zitadel
|
|
- web # Pour que le Traefik principal puisse router vers ici
|
|
labels:
|
|
# Permet au Traefik principal externe de router vers ce Traefik interne
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.zitadel-external.rule=Host(`${ZITADEL_EXTERNALDOMAIN}`)"
|
|
- "traefik.http.routers.zitadel-external.entrypoints=websecure"
|
|
- "traefik.http.routers.zitadel-external.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.zitadel-external.loadbalancer.server.port=80"
|
|
|
|
zitadel:
|
|
image: ghcr.io/zitadel/zitadel:v4.13.0
|
|
restart: unless-stopped
|
|
command: 'start-from-init --masterkey "${ZITADEL_MASTERKEY}" --tlsMode disabled'
|
|
environment:
|
|
ZITADEL_DATABASE_POSTGRES_HOST: postgres
|
|
ZITADEL_DATABASE_POSTGRES_PORT: 5432
|
|
ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
|
|
ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
|
|
ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: ${ZITADEL_DATABASE_POSTGRES_USER_PASSWORD}
|
|
ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
|
|
ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
|
|
ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: ${ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD}
|
|
ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
|
|
ZITADEL_EXTERNALDOMAIN: ${ZITADEL_EXTERNALDOMAIN}
|
|
ZITADEL_EXTERNALPORT: 443
|
|
ZITADEL_EXTERNALSECURE: "true"
|
|
ZITADEL_TLS_ENABLED: "false"
|
|
ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME: ${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME}
|
|
ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD: ${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD}
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
networks:
|
|
- zitadel
|
|
healthcheck:
|
|
test: ["CMD", "/app/zitadel", "ready", "--config", "/example-zitadel-config.yaml"]
|
|
interval: 10s
|
|
timeout: 30s
|
|
retries: 5
|
|
start_period: 20s
|
|
volumes:
|
|
- ./machinekey:/machinekey
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.zitadel.rule=Host(`${ZITADEL_EXTERNALDOMAIN}`) && (PathPrefix(`/zitadel.`) || PathPrefix(`/oauth/v2`) || PathPrefix(`/openid`) || PathPrefix(`/saml`) || PathPrefix(`/.well-known`))"
|
|
- "traefik.http.routers.zitadel.entrypoints=web"
|
|
- "traefik.http.services.zitadel.loadbalancer.server.port=8080"
|
|
|
|
zitadel-login:
|
|
image: ghcr.io/zitadel/zitadel-login:v4.13.0
|
|
restart: unless-stopped
|
|
environment:
|
|
ZITADEL_API_URL: http://zitadel:8080
|
|
ZITADEL_LOGIN_BASE_URL: https://${ZITADEL_EXTERNALDOMAIN}/ui/v2/login
|
|
NEXTAUTH_URL: https://${ZITADEL_EXTERNALDOMAIN}/ui/v2/login
|
|
depends_on:
|
|
zitadel:
|
|
condition: service_healthy
|
|
networks:
|
|
- zitadel
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--spider", "http://localhost:3000"]
|
|
interval: 10s
|
|
timeout: 30s
|
|
retries: 5
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.zitadel-login.rule=Host(`${ZITADEL_EXTERNALDOMAIN}`)"
|
|
- "traefik.http.routers.zitadel-login.entrypoints=web"
|
|
- "traefik.http.routers.zitadel-login.priority=10"
|
|
- "traefik.http.services.zitadel-login.loadbalancer.server.port=3000"
|
|
|
|
postgres:
|
|
image: postgres:17.2-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: ${ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD}
|
|
POSTGRES_DB: zitadel
|
|
networks:
|
|
- zitadel
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U postgres -d zitadel"]
|
|
interval: 10s
|
|
timeout: 30s
|
|
retries: 5
|
|
start_period: 20s
|
|
volumes:
|
|
- ./postgres-data:/var/lib/postgresql/data:rw
|
|
|
|
networks:
|
|
zitadel:
|
|
driver: bridge
|
|
web:
|
|
external: true
|