Update: Zitadel

Author: MickLesk

ct/zitadel.sh

@@ -19,8 +19,8 @@ var_unprivileged="${var_unprivileged:-1}"
 
 if [[ -z "${var_zitadel_login:-}" ]] && command -v pveversion >/dev/null 2>&1; then
   var_zitadel_login=$(msg_menu "Choose the Zitadel login UI" \
-    "v2" "Login V2 (Zitadel's default for new instances)" \
-    "v1" "Login V1 (classic login built into the API)")
+    "v2" "Login V2, Zitadel's default (HTTPS, self-signed certificate)" \
+    "v1" "Login V1, the classic login built into the API (HTTP)")
 fi
 export var_zitadel_login="${var_zitadel_login:-v2}"
 

install/zitadel-install.sh

@@ -112,7 +112,7 @@ EOF
 systemctl enable -q --now zitadel
 msg_ok "Created Service"
 
-if [[ "$var_zitadel_login" == "v2" ]]; then
+if [[ "$var_zitadel_login" != "v1" ]]; then
   NODE_VERSION="24" setup_nodejs
   fetch_and_deploy_gh_release "zitadel-login" "zitadel/zitadel" "prebuild" "latest" "/opt/zitadel-login" "zitadel-login.tar.gz"
 
@@ -123,7 +123,7 @@ if [[ "$var_zitadel_login" == "v2" ]]; then
 ZITADEL_API_URL=http://127.0.0.1:8081
 ZITADEL_API_AWAITINITIALCONN=5m
 ZITADEL_SERVICE_USER_TOKEN_FILE=/opt/zitadel/login-client.pat
-ZITADEL_SESSION_COOKIE_SECRET=$(openssl rand -base64 32)
+ZITADEL_SESSION_COOKIE_SECRET=$(random_password 48)
 NEXT_PUBLIC_BASE_PATH=/ui/v2/login
 HOSTNAME=127.0.0.1
 PORT=3000

json/zitadel.json

@@ -0,0 +1,66 @@
+{
+  "name": "Zitadel",
+  "slug": "zitadel",
+  "categories": [
+    6
+  ],
+  "date_created": "2025-02-10",
+  "type": "ct",
+  "updateable": true,
+  "privileged": false,
+  "architectures": [
+    "amd64",
+    "arm64"
+  ],
+  "interface_port": 8080,
+  "documentation": "https://zitadel.com/docs/guides/overview",
+  "website": "https://zitadel.com",
+  "repository": "https://github.com/zitadel/zitadel",
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/zitadel.webp",
+  "description": "Zitadel is an open-source identity and access management platform. It provides single sign-on over OpenID Connect, OAuth 2.0 and SAML, passkeys and multi-factor authentication, and multi-tenancy through organizations, with every change kept in an audit trail.",
+  "install_methods": [
+    {
+      "type": "default",
+      "script": "ct/zitadel.sh",
+      "config_path": "/opt/zitadel/config.yaml",
+      "resources": {
+        "cpu": 1,
+        "ram": 1024,
+        "hdd": 8,
+        "os": "Debian",
+        "version": "13"
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": "zitadel-admin@zitadel.localhost",
+    "password": null
+  },
+  "app_vars": [
+    {
+      "name": "var_zitadel_login",
+      "label": "Login UI",
+      "type": "select",
+      "options": [
+        "v2",
+        "v1"
+      ],
+      "default": "v2",
+      "help": "v2 is Zitadel's default since v4: a separate login app, served together with the API over HTTPS on port 8080 with a self-signed certificate. v1 is the classic login built into the API, over plain HTTP. Updates keep the choice"
+    }
+  ],
+  "notes": [
+    {
+      "text": "Sign in at /ui/console as zitadel-admin@zitadel.localhost with the initial password from ~/zitadel.creds in the container. Zitadel asks for a new password at the first sign-in.",
+      "type": "info"
+    },
+    {
+      "text": "With Login V2 (default) Zitadel runs at https://<IP>:8080 with a self-signed certificate; accept it in the browser. Login V1 stays on plain http://<IP>:8080.",
+      "type": "info"
+    },
+    {
+      "text": "Zitadel only answers on the ExternalDomain in /opt/zitadel/config.yaml (the container IP). To use a hostname, change it, run zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml and restart zitadel.",
+      "type": "info"
+    }
+  ]
+}