rock
701d79deac
ZITADEL sends verification codes and password resets by SMTP only, and this cluster has no mail path. Every human user therefore sits at verified_email = empty and can never finish a first login, at ZITADEL or at Forgejo. Add an smtp-gotify relay in the iam namespace: it accepts plain SMTP on :2525 and forwards each message to the existing Gotify instance, so codes arrive on the phone through gotify/igotify instead of email. Point DefaultInstance.SMTPConfiguration at that Service with TLS off, because the relay speaks plain SMTP inside the cluster. The relay holds the Gotify app token in a SOPS-encrypted Secret; values never carry the token.
12 lines
281 B
YAML
12 lines
281 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- rbac-dashboard-rolebinding.yaml
|
|
- smtp-gotify.yaml
|
|
|
|
# IAM provisioning is manual-only (security-sensitive).
|
|
# Script: scripts/iam/zitadel-provision.py
|
|
# Run:
|
|
# scripts/iam/zitadel-provision.py all
|