riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

refactor(iam): retire terraform/zitadel, provision through the API

Browse Source 
The Terraform root module duplicated a writer that the provisioning script could
be, and its state carried generated client secrets. Declare the objects in the
script instead: project, 19 roles, 12 OIDC apps, applied through the management
API with the iam-admin PAT. State is a 0600 JSON file under ~/.config/zitadel.

Also add zitadel to the Cloudflare tunnel hostname list, with the import command
and the note that the tunnel's Public Hostname entry is a separate dashboard
step: DNS alone yields a 404 from the tunnel.
This commit is contained in:
pi
2026-10-25 19:35:01 -07:00
parent be44a576d4
commit d4e9dbf350
13 changed files with 213 additions and 653 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/edge/providers.tf
+1 -1
View File
@@ -18,7 +18,7 @@
# terraform -chdir=terraform/edge init
# terraform -chdir=terraform/edge plan -var china_domain=example.cn ...
#
# State is local and git-ignored, same as terraform/zitadel. It carries no
# State is local and git-ignored. It carries no
# credential today, but it will once InstanceData or certificates are added, so
# treat it as a secret and move it to MinIO before a second operator applies.
terraform {