feat(iam): deliver ZITADEL notifications through Gotify

ZITADEL sends verification codes and password resets by SMTP only, and this cluster has no mail path. Every human user therefore sits at verified_email = empty and can never finish a first login, at ZITADEL or at Forgejo. Add an smtp-gotify relay in the iam namespace: it accepts plain SMTP on :2525 and forwards each message to the existing Gotify instance, so codes arrive on the phone through gotify/igotify instead of email. Point DefaultInstance.SMTPConfiguration at that Service with TLS off, because the relay speaks plain SMTP inside the cluster. The relay holds the Gotify app token in a SOPS-encrypted Secret; values never carry the token.
2026-10-26 23:24:33 -07:00
parent fbc1b6a33d
commit 701d79deac
4 changed files with 139 additions and 0 deletions
@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    token: ENC[AES256_GCM,data:CUJ0rUtgye71fpFz50RSDXJeG+t8Wjrm6T6jboVPbt2FVuIRSscqKg/Pc3k/L8nvLvrkYlzz1rbYu9v5NAdNF2c35AQ=,iv:tsfQ+v4qwj6H7G/O79b6m4XMWRw3mwE67f+4LjDCOoY=,tag:SLGGBYtYoF45AQstETPYZA==,type:str]
+kind: Secret
+metadata:
+    creationTimestamp: null
+    name: smtp-gotify
+    namespace: iam
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFWmU5TUxLeGU4YzUxRU9G
+            ZFR5a2hqS3huYlJtempaQ25zUkljUDJLSENrCkx0bjQ4UVF3UWpWa0t3WHQ2bkNl
+            eEp2d0dQRHJSOExIYjN4TmRTZWdQY00KLS0tIGF5enUxTmxRTHlQRUt1aTFIYTFB
+            MEJaOWd6SnhWQU1PQXdUZDJqWmp2MGsKIOOrp52+d3M8AQlMw0VSnLQ2efDtC6Ye
+            oC/TPqYi9SqYNxaHkODS2QZN9msyfRFcgUh/6ZXr8sivnpwRY8ZZtw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-10-27T06:24:20Z"
+    mac: ENC[AES256_GCM,data:9Jsnij+I1MhLhIPLt2hr1a6Jryf8XcAb4QAknGkX1hNEN+Z9HT5PSnPARqyhl0WTxe8813a/G0h93SJ0A419jIzZugv6zEj4STsOG4hMI8O2NniqOwiDWl+Az9SRXIQ0ahH9En7ssvEdiosIDGJSz31ufNc8FbwKnHvgWCwfK9Q=,iv:VNTOpQkDakoaCu2dG4lRbd+6AzimNZVNzggq/7C2eM8=,tag:cJI9WdnKiG3K3J4LRDqQxQ==,type:str]
+    version: 3.13.2