feat(iam): deliver ZITADEL notifications through Gotify

ZITADEL sends verification codes and password resets by SMTP only, and this cluster has no mail path. Every human user therefore sits at verified_email = empty and can never finish a first login, at ZITADEL or at Forgejo. Add an smtp-gotify relay in the iam namespace: it accepts plain SMTP on :2525 and forwards each message to the existing Gotify instance, so codes arrive on the phone through gotify/igotify instead of email. Point DefaultInstance.SMTPConfiguration at that Service with TLS off, because the relay speaks plain SMTP inside the cluster. The relay holds the Gotify app token in a SOPS-encrypted Secret; values never carry the token.
2026-10-26 23:24:33 -07:00
parent fbc1b6a33d
commit 701d79deac
4 changed files with 139 additions and 0 deletions
@@ -31,6 +31,22 @@ zitadel:
    ExternalDomain: zitadel.riotpiao.com
    TLS:
      Enabled: false
+    # Notification delivery. ZITADEL speaks SMTP only, and this cluster has no
+    # mail path: without it every verification and password-reset message is
+    # dropped, so nobody can finish a first login. Point SMTP at the in-cluster
+    # smtp-gotify relay (k8s/infra/iam/smtp-gotify.yaml), which forwards each
+    # message to Gotify so codes arrive on the phone.
+    #
+    # TLS is false because the relay speaks plain SMTP inside the cluster and
+    # never leaves it. Host and credentials stay out of this file: no auth is
+    # needed, and the relay holds the Gotify token in the smtp-gotify Secret.
+    DefaultInstance:
+      SMTPConfiguration:
+        SMTP:
+          Host: smtp-gotify.iam.svc.cluster.local:2525
+        TLS: false
+        From: [email protected]
+        FromName: ZITADEL

    # First boot is COMPLETE (2026-10-26): the instance, the system org and the
    # `iam-admin` machine key all exist. Skip stops the setup hook from running