feat(iam): deliver ZITADEL notifications through Gotify

ZITADEL sends verification codes and password resets by SMTP only, and this
cluster has no mail path. Every human user therefore sits at
verified_email = empty and can never finish a first login, at ZITADEL or at
Forgejo.

Add an smtp-gotify relay in the iam namespace: it accepts plain SMTP on :2525
and forwards each message to the existing Gotify instance, so codes arrive on
the phone through gotify/igotify instead of email.

Point DefaultInstance.SMTPConfiguration at that Service with TLS off, because
the relay speaks plain SMTP inside the cluster. The relay holds the Gotify app
token in a SOPS-encrypted Secret; values never carry the token.

This commit is contained in:

rock

2026-10-26 23:24:33 -07:00

parent fbc1b6a33d

commit 701d79deac

4 changed files with 139 additions and 0 deletions

									
										k8s/infra/iam/kustomization.yaml
									
		+1
		
												View File
												
				@@ -3,6 +3,7 @@ kind: Kustomization

				resources:

				  - rbac-dashboard-rolebinding.yaml

				  - smtp-gotify.yaml

				# IAM provisioning is manual-only (security-sensitive).

				# Script: scripts/iam/zitadel-provision.py