feat(iam): deliver ZITADEL notifications through Gotify
ZITADEL sends verification codes and password resets by SMTP only, and this cluster has no mail path. Every human user therefore sits at verified_email = empty and can never finish a first login, at ZITADEL or at Forgejo. Add an smtp-gotify relay in the iam namespace: it accepts plain SMTP on :2525 and forwards each message to the existing Gotify instance, so codes arrive on the phone through gotify/igotify instead of email. Point DefaultInstance.SMTPConfiguration at that Service with TLS off, because the relay speaks plain SMTP inside the cluster. The relay holds the Gotify app token in a SOPS-encrypted Secret; values never carry the token.
This commit is contained in:
@@ -0,0 +1,23 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
token: ENC[AES256_GCM,data:CUJ0rUtgye71fpFz50RSDXJeG+t8Wjrm6T6jboVPbt2FVuIRSscqKg/Pc3k/L8nvLvrkYlzz1rbYu9v5NAdNF2c35AQ=,iv:tsfQ+v4qwj6H7G/O79b6m4XMWRw3mwE67f+4LjDCOoY=,tag:SLGGBYtYoF45AQstETPYZA==,type:str]
|
||||
kind: Secret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: smtp-gotify
|
||||
namespace: iam
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFWmU5TUxLeGU4YzUxRU9G
|
||||
ZFR5a2hqS3huYlJtempaQ25zUkljUDJLSENrCkx0bjQ4UVF3UWpWa0t3WHQ2bkNl
|
||||
eEp2d0dQRHJSOExIYjN4TmRTZWdQY00KLS0tIGF5enUxTmxRTHlQRUt1aTFIYTFB
|
||||
MEJaOWd6SnhWQU1PQXdUZDJqWmp2MGsKIOOrp52+d3M8AQlMw0VSnLQ2efDtC6Ye
|
||||
oC/TPqYi9SqYNxaHkODS2QZN9msyfRFcgUh/6ZXr8sivnpwRY8ZZtw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
lastmodified: "2026-10-27T06:24:20Z"
|
||||
mac: ENC[AES256_GCM,data:9Jsnij+I1MhLhIPLt2hr1a6Jryf8XcAb4QAknGkX1hNEN+Z9HT5PSnPARqyhl0WTxe8813a/G0h93SJ0A419jIzZugv6zEj4STsOG4hMI8O2NniqOwiDWl+Az9SRXIQ0ahH9En7ssvEdiosIDGJSz31ufNc8FbwKnHvgWCwfK9Q=,iv:VNTOpQkDakoaCu2dG4lRbd+6AzimNZVNzggq/7C2eM8=,tag:cJI9WdnKiG3K3J4LRDqQxQ==,type:str]
|
||||
version: 3.13.2
|
||||
@@ -3,6 +3,7 @@ kind: Kustomization
|
||||
|
||||
resources:
|
||||
- rbac-dashboard-rolebinding.yaml
|
||||
- smtp-gotify.yaml
|
||||
|
||||
# IAM provisioning is manual-only (security-sensitive).
|
||||
# Script: scripts/iam/zitadel-provision.py
|
||||
|
||||
@@ -0,0 +1,99 @@
|
||||
# SMTP -> Gotify relay for ZITADEL notifications.
|
||||
#
|
||||
# ZITADEL sends verification codes, password resets and one-time passwords by
|
||||
# SMTP only, and this cluster has no working mail path: no SMTP credentials are
|
||||
# configured for ZITADEL, and the notification table shows
|
||||
# verified_email empty for every user. Without a delivery path nobody can finish
|
||||
# a first login, at ZITADEL or at any relying party such as Forgejo.
|
||||
#
|
||||
# This relay accepts plain SMTP on :2525 and forwards every message to Gotify,
|
||||
# so codes arrive on the phone through the existing gotify/igotify setup instead
|
||||
# of email. ZITADEL then points DefaultInstance.SMTPConfiguration at this
|
||||
# Service (see k8s/infra/iam/zitadel-values.yaml).
|
||||
#
|
||||
# The Gotify token is a Secret, never a literal here.
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: smtp-gotify
|
||||
namespace: iam
|
||||
labels:
|
||||
app: smtp-gotify
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: smtp-gotify
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: smtp-gotify
|
||||
spec:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65534
|
||||
runAsGroup: 65534
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: smtp-gotify
|
||||
image: quay.io/reiml/smtp-gotify:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: GOTIFY_URL
|
||||
value: "http://gotify.notifications.svc.cluster.local"
|
||||
- name: GOTIFY_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: smtp-gotify
|
||||
key: token
|
||||
- name: GOTIFY_PRIORITY
|
||||
value: "5"
|
||||
# ZITADEL sends "ZITADEL - Verify email" style subjects; keep them
|
||||
# so the phone notification says what it is.
|
||||
- name: GOTIFY_TITLE_TEMPLATE
|
||||
value: "{{.Subject}}"
|
||||
ports:
|
||||
- name: smtp
|
||||
containerPort: 2525
|
||||
protocol: TCP
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: smtp
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: smtp
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 20
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: smtp-gotify
|
||||
namespace: iam
|
||||
labels:
|
||||
app: smtp-gotify
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: smtp-gotify
|
||||
ports:
|
||||
- name: smtp
|
||||
port: 2525
|
||||
targetPort: smtp
|
||||
protocol: TCP
|
||||
@@ -31,6 +31,22 @@ zitadel:
|
||||
ExternalDomain: zitadel.riotpiao.com
|
||||
TLS:
|
||||
Enabled: false
|
||||
# Notification delivery. ZITADEL speaks SMTP only, and this cluster has no
|
||||
# mail path: without it every verification and password-reset message is
|
||||
# dropped, so nobody can finish a first login. Point SMTP at the in-cluster
|
||||
# smtp-gotify relay (k8s/infra/iam/smtp-gotify.yaml), which forwards each
|
||||
# message to Gotify so codes arrive on the phone.
|
||||
#
|
||||
# TLS is false because the relay speaks plain SMTP inside the cluster and
|
||||
# never leaves it. Host and credentials stay out of this file: no auth is
|
||||
# needed, and the relay holds the Gotify token in the smtp-gotify Secret.
|
||||
DefaultInstance:
|
||||
SMTPConfiguration:
|
||||
SMTP:
|
||||
Host: smtp-gotify.iam.svc.cluster.local:2525
|
||||
TLS: false
|
||||
From: [email protected]
|
||||
FromName: ZITADEL
|
||||
|
||||
# First boot is COMPLETE (2026-10-26): the instance, the system org and the
|
||||
# `iam-admin` machine key all exist. Skip stops the setup hook from running
|
||||
|
||||
Reference in New Issue
Block a user