Prohomelab

1
services:
2
    zitadel:
3
        restart: "always"
4
        container_name: zitadel
5
        networks:
6
            - zitadel
7
            - proxy
8
        image: "ghcr.io/zitadel/zitadel:latest"
9
        command: 'start-from-init --masterkey "${MASTERKEY_32}" --tlsMode external'
10
        env_file: .env
11
        environment:
12
            ZITADEL_DATABASE_POSTGRES_HOST: zitadel-db
13
            ZITADEL_DATABASE_POSTGRES_PORT: 5432
14
            ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
15
            ZITADEL_DATABASE_POSTGRES_USER_USERNAME: ${DB_USER}
16
            ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: ${DB_PASSWORD}
17
            ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
18
            ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: ${DB_ADMIN_USER}
19
            ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: ${DB_ADMIN_PASSWORD}
20
            ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
21
            ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME: ${ZITADEL_LOGIN_USER}
22
            ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD: ${ZITADEL_LOGIN_PASSWORD}
23
            ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED: false
24
            ZITADEL_FIRSTINSTANCE_ORG_NAME: HomeLab
25
            ZITADEL_PORT: 8080 #For External TLS (Also use h2c)
26
            ZITADEL_EXTERNALPORT: 443
27
            ZITADEL_EXTERNALDOMAIN: ${ZITADEL_SUBDOMAIN}.${DOMAIN_NAME} #eg. auth.DOMAIN_NAME
28
            ZITADEL_EXTERNALSECURE: true
29
        labels:
30
            - "traefik.enable=true"
31
            - "traefik.http.routers.zitadel.entrypoints=http"
32
            - "traefik.http.routers.zitadel.rule=Host(`${ZITADEL_SUBDOMAIN}.${DOMAIN_NAME}`)"
33
            - "traefik.http.middlewares.https-redirect.redirectscheme.scheme=https"
34
            - "traefik.http.routers.zitadel.middlewares=https-redirect"
35
            - "traefik.http.routers.zitadel-secure.entrypoints=https"
36
            - "traefik.http.routers.zitadel-secure.rule=Host(`${ZITADEL_SUBDOMAIN}.${DOMAIN_NAME}`)"
37
            - "traefik.http.routers.zitadel-secure.tls=true"
38
            - "traefik.http.routers.zitadel-secure.service=zitadel"
39
            - "traefik.http.services.zitadel.loadbalancer.server.scheme=h2c"
40
            - "traefik.http.services.zitadel.loadbalancer.passHostHeader=true"
41
            - "traefik.http.services.zitadel.loadbalancer.server.port=8080"
42
            - "traefik.docker.network=proxy"
43
        depends_on:
44
            zitadel-db:
45
                condition: "service_healthy"
46

47
    zitadel-db:
48
        restart: "always"
49
        container_name: zitadel-db
50
        image: postgres:17-alpine
51
        env_file: .env
52
        environment:
53
            POSTGRES_USER: ${DB_ADMIN_USER}
54
            POSTGRES_PASSWORD: ${DB_ADMIN_PASSWORD}
55
        networks:
56
            - zitadel
57
        healthcheck:
58
            test:
59
                [
60
                    "CMD-SHELL",
61
                    "pg_isready",
62
                    "-d",
63
                    "zitadel",
64
                    "-U",
65
                    "${DB_ADMIN_USER}",
66
                ]
67
            interval: "10s"
68
            timeout: "30s"
69
            retries: 5
70
            start_period: "20s"
71
        volumes:
72
            - ${DB_LOCATION}:/var/lib/postgresql/data
73

74
networks:
75
    zitadel:
76
        name: zitadel
77
    proxy:
78
        external: true
79
        name: proxy

1
MASTERKEY_32=GENERATE_RANDOM_KEY_LENGTH_32_ChangeMe  #Replace Master Key (tr -dc A-Za-z0-9 </dev/urandom | head -c 32)
2
DB_USER=Enter_DB_User_ChangeMe
3
DB_PASSWORD=Enter_DB_Password_ChangeMe
4
DB_ADMIN_USER=Enter_DB_Root_User_ChangeMe
5
DB_ADMIN_PASSWORD=Enter_DB_Root_Password_ChangeMe
6
ZITADEL_LOGIN_USER=Loginusername@Your_Domain_ChangeMe.com
7
ZITADEL_LOGIN_PASSWORD=Zitadel_Password_ChangeMe
8
ZITADEL_SUBDOMAIN=zitadel
9
DOMAIN_NAME=Your_Domain_ChangeMe.com
10
DB_LOCATION=/path/to/directory/zitadel/zitadel-db