From 701d79deac1f40e107102f4323a311ba207981a2 Mon Sep 17 00:00:00 2001 From: rock Date: Mon, 26 Oct 2026 23:24:33 -0700 Subject: [PATCH] feat(iam): deliver ZITADEL notifications through Gotify ZITADEL sends verification codes and password resets by SMTP only, and this cluster has no mail path. Every human user therefore sits at verified_email = empty and can never finish a first login, at ZITADEL or at Forgejo. Add an smtp-gotify relay in the iam namespace: it accepts plain SMTP on :2525 and forwards each message to the existing Gotify instance, so codes arrive on the phone through gotify/igotify instead of email. Point DefaultInstance.SMTPConfiguration at that Service with TLS off, because the relay speaks plain SMTP inside the cluster. The relay holds the Gotify app token in a SOPS-encrypted Secret; values never carry the token. --- .../secrets/smtp-gotify-secrets.enc.yaml | 23 +++++ k8s/infra/iam/kustomization.yaml | 1 + k8s/infra/iam/smtp-gotify.yaml | 99 +++++++++++++++++++ k8s/infra/iam/zitadel-values.yaml | 16 +++ 4 files changed, 139 insertions(+) create mode 100644 k8s/argocd/secrets/smtp-gotify-secrets.enc.yaml create mode 100644 k8s/infra/iam/smtp-gotify.yaml diff --git a/k8s/argocd/secrets/smtp-gotify-secrets.enc.yaml b/k8s/argocd/secrets/smtp-gotify-secrets.enc.yaml new file mode 100644 index 0000000..19b9f5c --- /dev/null +++ b/k8s/argocd/secrets/smtp-gotify-secrets.enc.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +data: + token: ENC[AES256_GCM,data:CUJ0rUtgye71fpFz50RSDXJeG+t8Wjrm6T6jboVPbt2FVuIRSscqKg/Pc3k/L8nvLvrkYlzz1rbYu9v5NAdNF2c35AQ=,iv:tsfQ+v4qwj6H7G/O79b6m4XMWRw3mwE67f+4LjDCOoY=,tag:SLGGBYtYoF45AQstETPYZA==,type:str] +kind: Secret +metadata: + creationTimestamp: null + name: smtp-gotify + namespace: iam +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFWmU5TUxLeGU4YzUxRU9G + ZFR5a2hqS3huYlJtempaQ25zUkljUDJLSENrCkx0bjQ4UVF3UWpWa0t3WHQ2bkNl + eEp2d0dQRHJSOExIYjN4TmRTZWdQY00KLS0tIGF5enUxTmxRTHlQRUt1aTFIYTFB + MEJaOWd6SnhWQU1PQXdUZDJqWmp2MGsKIOOrp52+d3M8AQlMw0VSnLQ2efDtC6Ye + oC/TPqYi9SqYNxaHkODS2QZN9msyfRFcgUh/6ZXr8sivnpwRY8ZZtw== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + encrypted_regex: ^(data|stringData)$ + lastmodified: "2026-10-27T06:24:20Z" + mac: ENC[AES256_GCM,data:9Jsnij+I1MhLhIPLt2hr1a6Jryf8XcAb4QAknGkX1hNEN+Z9HT5PSnPARqyhl0WTxe8813a/G0h93SJ0A419jIzZugv6zEj4STsOG4hMI8O2NniqOwiDWl+Az9SRXIQ0ahH9En7ssvEdiosIDGJSz31ufNc8FbwKnHvgWCwfK9Q=,iv:VNTOpQkDakoaCu2dG4lRbd+6AzimNZVNzggq/7C2eM8=,tag:cJI9WdnKiG3K3J4LRDqQxQ==,type:str] + version: 3.13.2 diff --git a/k8s/infra/iam/kustomization.yaml b/k8s/infra/iam/kustomization.yaml index 03a361d..d134eb6 100644 --- a/k8s/infra/iam/kustomization.yaml +++ b/k8s/infra/iam/kustomization.yaml @@ -3,6 +3,7 @@ kind: Kustomization resources: - rbac-dashboard-rolebinding.yaml + - smtp-gotify.yaml # IAM provisioning is manual-only (security-sensitive). # Script: scripts/iam/zitadel-provision.py diff --git a/k8s/infra/iam/smtp-gotify.yaml b/k8s/infra/iam/smtp-gotify.yaml new file mode 100644 index 0000000..38a2949 --- /dev/null +++ b/k8s/infra/iam/smtp-gotify.yaml @@ -0,0 +1,99 @@ +# SMTP -> Gotify relay for ZITADEL notifications. +# +# ZITADEL sends verification codes, password resets and one-time passwords by +# SMTP only, and this cluster has no working mail path: no SMTP credentials are +# configured for ZITADEL, and the notification table shows +# verified_email empty for every user. Without a delivery path nobody can finish +# a first login, at ZITADEL or at any relying party such as Forgejo. +# +# This relay accepts plain SMTP on :2525 and forwards every message to Gotify, +# so codes arrive on the phone through the existing gotify/igotify setup instead +# of email. ZITADEL then points DefaultInstance.SMTPConfiguration at this +# Service (see k8s/infra/iam/zitadel-values.yaml). +# +# The Gotify token is a Secret, never a literal here. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: smtp-gotify + namespace: iam + labels: + app: smtp-gotify +spec: + replicas: 1 + revisionHistoryLimit: 2 + selector: + matchLabels: + app: smtp-gotify + template: + metadata: + labels: + app: smtp-gotify + spec: + securityContext: + runAsNonRoot: true + runAsUser: 65534 + runAsGroup: 65534 + seccompProfile: + type: RuntimeDefault + containers: + - name: smtp-gotify + image: quay.io/reiml/smtp-gotify:latest + imagePullPolicy: IfNotPresent + env: + - name: GOTIFY_URL + value: "http://gotify.notifications.svc.cluster.local" + - name: GOTIFY_TOKEN + valueFrom: + secretKeyRef: + name: smtp-gotify + key: token + - name: GOTIFY_PRIORITY + value: "5" + # ZITADEL sends "ZITADEL - Verify email" style subjects; keep them + # so the phone notification says what it is. + - name: GOTIFY_TITLE_TEMPLATE + value: "{{.Subject}}" + ports: + - name: smtp + containerPort: 2525 + protocol: TCP + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 200m + memory: 128Mi + readinessProbe: + tcpSocket: + port: smtp + initialDelaySeconds: 3 + periodSeconds: 10 + livenessProbe: + tcpSocket: + port: smtp + initialDelaySeconds: 10 + periodSeconds: 20 +--- +apiVersion: v1 +kind: Service +metadata: + name: smtp-gotify + namespace: iam + labels: + app: smtp-gotify +spec: + type: ClusterIP + selector: + app: smtp-gotify + ports: + - name: smtp + port: 2525 + targetPort: smtp + protocol: TCP diff --git a/k8s/infra/iam/zitadel-values.yaml b/k8s/infra/iam/zitadel-values.yaml index 586a2e7..8453e8c 100644 --- a/k8s/infra/iam/zitadel-values.yaml +++ b/k8s/infra/iam/zitadel-values.yaml @@ -31,6 +31,22 @@ zitadel: ExternalDomain: zitadel.riotpiao.com TLS: Enabled: false + # Notification delivery. ZITADEL speaks SMTP only, and this cluster has no + # mail path: without it every verification and password-reset message is + # dropped, so nobody can finish a first login. Point SMTP at the in-cluster + # smtp-gotify relay (k8s/infra/iam/smtp-gotify.yaml), which forwards each + # message to Gotify so codes arrive on the phone. + # + # TLS is false because the relay speaks plain SMTP inside the cluster and + # never leaves it. Host and credentials stay out of this file: no auth is + # needed, and the relay holds the Gotify token in the smtp-gotify Secret. + DefaultInstance: + SMTPConfiguration: + SMTP: + Host: smtp-gotify.iam.svc.cluster.local:2525 + TLS: false + From: zitadel@riotpiao.com + FromName: ZITADEL # First boot is COMPLETE (2026-10-26): the instance, the system org and the # `iam-admin` machine key all exist. Skip stops the setup hook from running