fix(iam): make ZITADEL OIDC secrets and identity links IaC-owned (#85)

Co-authored-by: rock <[email protected]>
2026-10-31 20:53:53 +00:00
parent 41dcda819e
commit 4e84571f0c
9 changed files with 282 additions and 2 deletions
@@ -6,6 +6,11 @@ resources:
  # RoleBinding). Authentik is retired, so the file is gone; keep this list in
  # step with the directory or kustomize fails the whole app.
  - smtp-gotify.yaml
+  # Repairs the ZITADEL subject stored inside the Forgejo, Paperless and Immich
+  # databases. Those links are not Kubernetes objects, so without this Job a
+  # fresh cluster (or a provider change) leaves every one of them pointing at
+  # the old subject and SSO cannot complete.
+  - identity-link-repair-job.yaml

 # IAM provisioning is manual-only (security-sensitive).
 # Script: scripts/iam/zitadel-provision.py