diff --git a/kubernetes/apps/authentication/kustomization.yaml b/kubernetes/apps/authentication/kustomization.yaml index d3fa890a2..5e7b9db52 100644 --- a/kubernetes/apps/authentication/kustomization.yaml +++ b/kubernetes/apps/authentication/kustomization.yaml @@ -3,4 +3,3 @@ kind: Kustomization resources: - ./namespace.yaml - ./oauth2-proxy/ks.yaml - - ./zitadel/ks.yaml diff --git a/kubernetes/apps/authentication/zitadel/app/helmrelease.yaml b/kubernetes/apps/authentication/zitadel/app/helmrelease.yaml deleted file mode 100644 index 330b0054f..000000000 --- a/kubernetes/apps/authentication/zitadel/app/helmrelease.yaml +++ /dev/null @@ -1,97 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: zitadel - namespace: authentication -spec: - interval: 5m - chart: - spec: - chart: zitadel - version: 10.0.4 - sourceRef: - kind: HelmRepository - name: zitadel - namespace: flux-system - interval: 5m - values: - image: - repository: ghcr.io/zitadel/zitadel - tag: v4.16.1@sha256:fea7ea2e4648d2dfe6a22a446252f084e4a370d8caedf08d3af4632cf517d4ef - setupJob: - machinekeyWriter: - image: - tag: 1.32.3 - zitadel: - configmapConfig: - FirstInstance: - Org: - Machine: - Machine: - Username: zitadel-iac-admin-sa - Name: Admin - MachineKey: - Type: 1 - ExternalDomain: zitadel.internal.immich.cloud - TLS: - Enabled: false # TLS is terminated at the ingress - masterkeySecretName: zitadel-master-key - login: - enabled: false - env: - - name: ZITADEL_DATABASE_POSTGRES_HOST - valueFrom: - secretKeyRef: - name: zitadel-db-app - key: host - - name: ZITADEL_DATABASE_POSTGRES_DATABASE - valueFrom: - secretKeyRef: - name: zitadel-db-app - key: dbname - - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME - valueFrom: - secretKeyRef: - name: zitadel-db-app - key: user - - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD - valueFrom: - secretKeyRef: - name: zitadel-db-app - key: password - - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME - valueFrom: - secretKeyRef: - name: zitadel-db-superuser - key: user - - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD - valueFrom: - secretKeyRef: - name: zitadel-db-superuser - key: password - - ingress: - enabled: true - className: nginx - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production - nginx.ingress.kubernetes.io/backend-protocol: "GRPC" - nginx.ingress.kubernetes.io/configuration-snippet: | - grpc_set_header Host $host; - hosts: - - host: &host zitadel.internal.immich.cloud - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - *host - secretName: zitadel-tls - resources: - limits: - cpu: 1 - memory: 2Gi - requests: - cpu: 500m - memory: 512Mi diff --git a/kubernetes/apps/authentication/zitadel/app/kustomization.yaml b/kubernetes/apps/authentication/zitadel/app/kustomization.yaml deleted file mode 100644 index 5dd7baca7..000000000 --- a/kubernetes/apps/authentication/zitadel/app/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml diff --git a/kubernetes/apps/authentication/zitadel/database/database.yaml b/kubernetes/apps/authentication/zitadel/database/database.yaml deleted file mode 100644 index 160ad2148..000000000 --- a/kubernetes/apps/authentication/zitadel/database/database.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: postgresql.cnpg.io/v1 -kind: Cluster -metadata: - name: zitadel-db - namespace: authentication -spec: - enableSuperuserAccess: true - storage: - size: 10Gi - storageClass: zfs diff --git a/kubernetes/apps/authentication/zitadel/database/kustomization.yaml b/kubernetes/apps/authentication/zitadel/database/kustomization.yaml deleted file mode 100644 index 0012c369c..000000000 --- a/kubernetes/apps/authentication/zitadel/database/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./database.yaml diff --git a/kubernetes/apps/authentication/zitadel/ks.yaml b/kubernetes/apps/authentication/zitadel/ks.yaml deleted file mode 100644 index d6ae50ab6..000000000 --- a/kubernetes/apps/authentication/zitadel/ks.yaml +++ /dev/null @@ -1,89 +0,0 @@ ---- -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app zitadel-secrets - namespace: flux-system -spec: - targetNamespace: authentication - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: external-secrets-stores - path: ./kubernetes/apps/authentication/zitadel/secrets - prune: true - sourceRef: - kind: GitRepository - name: immich-kubernetes - wait: true - interval: 30m - retryInterval: 1m - timeout: 5m ---- -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app zitadel-database - namespace: flux-system -spec: - targetNamespace: authentication - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: database-cloudnative-pg - path: ./kubernetes/apps/authentication/zitadel/database - prune: true - sourceRef: - kind: GitRepository - name: immich-kubernetes - wait: true - interval: 30m - retryInterval: 1m - timeout: 5m ---- -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app zitadel - namespace: flux-system -spec: - targetNamespace: authentication - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: zitadel-secrets - - name: zitadel-database - path: ./kubernetes/apps/authentication/zitadel/app - prune: true - sourceRef: - kind: GitRepository - name: immich-kubernetes - wait: true - interval: 30m - retryInterval: 1m - timeout: 5m ---- -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app zitadel-pushsecret - namespace: flux-system -spec: - targetNamespace: authentication - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: zitadel - path: ./kubernetes/apps/authentication/zitadel/pushsecret - prune: true - sourceRef: - kind: GitRepository - name: immich-kubernetes - wait: true - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/kubernetes/apps/authentication/zitadel/pushsecret/admin-sa.yaml b/kubernetes/apps/authentication/zitadel/pushsecret/admin-sa.yaml deleted file mode 100644 index 23cf5ff5a..000000000 --- a/kubernetes/apps/authentication/zitadel/pushsecret/admin-sa.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: external-secrets.io/v1alpha1 -kind: PushSecret -metadata: - name: zitadel-iac-admin-sa - namespace: authentication -spec: - secretStoreRefs: - - kind: ClusterSecretStore - name: 1p-kubernetes - selector: - secret: - name: zitadel-iac-admin-sa - data: - - match: - secretKey: zitadel-iac-admin-sa.json - remoteRef: - remoteKey: PUSHED_ZITADEL_IAC_ADMIN_SA diff --git a/kubernetes/apps/authentication/zitadel/pushsecret/kustomization.yaml b/kubernetes/apps/authentication/zitadel/pushsecret/kustomization.yaml deleted file mode 100644 index beb3cfe9c..000000000 --- a/kubernetes/apps/authentication/zitadel/pushsecret/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./admin-sa.yaml diff --git a/kubernetes/apps/authentication/zitadel/secrets/kustomization.yaml b/kubernetes/apps/authentication/zitadel/secrets/kustomization.yaml deleted file mode 100644 index ff7ccd626..000000000 --- a/kubernetes/apps/authentication/zitadel/secrets/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./masterkey.yaml diff --git a/kubernetes/apps/authentication/zitadel/secrets/masterkey.yaml b/kubernetes/apps/authentication/zitadel/secrets/masterkey.yaml deleted file mode 100644 index 50099cfed..000000000 --- a/kubernetes/apps/authentication/zitadel/secrets/masterkey.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: zitadel-master-key - namespace: authentication -spec: - secretStoreRef: - kind: ClusterSecretStore - name: 1p-tf - refreshInterval: "20s" - data: - - secretKey: masterkey - remoteRef: - key: AUTH_ZITADEL_MASTER_KEY diff --git a/kubernetes/apps/monitoring-dev/grafana/ks.yaml b/kubernetes/apps/monitoring-dev/grafana/ks.yaml index 8f59eafcb..4b8edbf3e 100644 --- a/kubernetes/apps/monitoring-dev/grafana/ks.yaml +++ b/kubernetes/apps/monitoring-dev/grafana/ks.yaml @@ -18,7 +18,6 @@ spec: timeout: 5m dependsOn: - name: external-secrets-stores - - name: zitadel --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization diff --git a/kubernetes/apps/monitoring/grafana/ks.yaml b/kubernetes/apps/monitoring/grafana/ks.yaml index 582c68a70..cd3e96762 100644 --- a/kubernetes/apps/monitoring/grafana/ks.yaml +++ b/kubernetes/apps/monitoring/grafana/ks.yaml @@ -18,7 +18,6 @@ spec: timeout: 5m dependsOn: - name: external-secrets-stores - - name: zitadel --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization diff --git a/kubernetes/apps/pipelines/data/grafana/ks.yaml b/kubernetes/apps/pipelines/data/grafana/ks.yaml index 85de2e164..b29ec58ec 100644 --- a/kubernetes/apps/pipelines/data/grafana/ks.yaml +++ b/kubernetes/apps/pipelines/data/grafana/ks.yaml @@ -18,7 +18,6 @@ spec: timeout: 5m dependsOn: - name: external-secrets-stores - - name: zitadel --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization diff --git a/kubernetes/apps/tools/containerssh/ks.yaml b/kubernetes/apps/tools/containerssh/ks.yaml index 617ee6601..20bc16642 100644 --- a/kubernetes/apps/tools/containerssh/ks.yaml +++ b/kubernetes/apps/tools/containerssh/ks.yaml @@ -9,7 +9,6 @@ spec: app.kubernetes.io/name: *app dependsOn: - name: external-secrets-stores - - name: zitadel path: ./kubernetes/apps/tools/containerssh/secrets prune: true sourceRef: diff --git a/kubernetes/apps/tools/outline/ks.yaml b/kubernetes/apps/tools/outline/ks.yaml index cd692677d..ac26e0613 100644 --- a/kubernetes/apps/tools/outline/ks.yaml +++ b/kubernetes/apps/tools/outline/ks.yaml @@ -9,7 +9,6 @@ spec: app.kubernetes.io/name: *app dependsOn: - name: external-secrets-stores - - name: zitadel path: ./kubernetes/apps/tools/outline/secrets prune: true sourceRef: diff --git a/kubernetes/flux/repositories/helm/kustomization.yaml b/kubernetes/flux/repositories/helm/kustomization.yaml index 2c5f8fe12..ef9c8b1e9 100644 --- a/kubernetes/flux/repositories/helm/kustomization.yaml +++ b/kubernetes/flux/repositories/helm/kustomization.yaml @@ -17,4 +17,3 @@ resources: - ./immich-charts.yaml - ./controlplaneio.yaml - ./external-secrets.yaml - - ./zitadel.yaml diff --git a/kubernetes/flux/repositories/helm/zitadel.yaml b/kubernetes/flux/repositories/helm/zitadel.yaml deleted file mode 100644 index 125035b61..000000000 --- a/kubernetes/flux/repositories/helm/zitadel.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1 -kind: HelmRepository -metadata: - name: zitadel - namespace: flux-system -spec: - interval: 1h - url: https://charts.zitadel.com/ diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/.terraform.lock.hcl b/tf/deployment/modules/shared/zitadel/self-hosted/.terraform.lock.hcl deleted file mode 100644 index 2304636f7..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/.terraform.lock.hcl +++ /dev/null @@ -1,132 +0,0 @@ -# This file is maintained automatically by "tofu init". -# Manual edits may be lost in future updates. - -provider "registry.opentofu.org/1password/onepassword" { - version = "2.2.1" - constraints = "~> 2.1" - hashes = [ - "h1:CosIqZ6jkgylvF23rLyNixIecZAAhFyb61sLl6GrEsc=", - "zh:025709a6b5f1b3685d277f2c48f7cb8b53d14b3699c1123d7e9a2135c099c533", - "zh:037fc89d150063a8aacdcab08ba26038b489fe2468d509b842d298ea59096ca6", - "zh:233777182b25faf1658e8ce171b684460983bb41cff79fb243662f3f9dc5ca6c", - "zh:2fb5ca2fc8c37b1d1c54da646ed13bf40897941fe92eece784fba496f677b533", - "zh:4b25b5ce1f694ec265e65234fc85d6bdf3810297ffeaced54ad46a1ba28142de", - "zh:5509d1e4fb7b45c63124ec66fd1f9d6757daa8bf1f7bdd724d5adb2965b61436", - "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f", - "zh:a23ba946c629ec912b2fcbf606a2eb8853626ec0e0bee749f2d39146a872c082", - "zh:a3d3024485426237d7b4a4350b12dda4d29d88f3942246a9370be35ec2a51e9e", - "zh:a6ef65544ab8fc26d468b38636407a3d2d902e35c51b648729bf97c31d1937f9", - "zh:afbe9480a0da0ad8dc514b277f1e4be36b8931f045021d05c21665ef1ac0b7c8", - "zh:b2e96e69fa9ff7e179dccdef5b785cd020eb46bb2b3d1d507d009d71be6b0c26", - "zh:ceefaede9e8a3104463523ba267e3e985b27a706f7628a9ddd37330c2ca59d4d", - "zh:ea77786bd6809ff4f8043b84a0212fec4de18b7d51bc420417ba10999ca99887", - "zh:f7d8160c3669c8ab76a2da14ea740d91a08ca23d1fb657669e52a840b2b113d9", - ] -} - -provider "registry.opentofu.org/hashicorp/http" { - version = "3.6.0" - constraints = "~> 3.5" - hashes = [ - "h1:0n4RBz9zNw6TTddh5+x7E8L2+qzPXNwKhK4uoZ/DUwE=", - "h1:22Ob7lpzMBSqdrCvoFN5EgmhGPHPBovV/9qo0c/Cd+A=", - "h1:2IRBvmWOYrq/ooaYYn2i86jZb7iIUvlg0KlmOMfDHoQ=", - "h1:5mucXikk4OcW3un3u94QnMx4AB4Wfih+sXeMd5QxSNk=", - "h1:5oU7Zm+2gAVGmxqtJ9E8uTudUkYy/DEn/y3IWphdv4k=", - "h1:5w0R4b1/VSzpqQF1tXXPr/qmaQLPVRXamOmPKWFcTk4=", - "h1:AEVeJr8xGmwad+JUUQ833C3x5d4W+W2szF5DfwxYppw=", - "h1:CPHJ+0zQbS/cX1m55Y90jIOgf1jV3ocUUnqsXAh+9Eg=", - "h1:JPewnGDOJudNer5+ghqwXoaJkfot3QRq9uiEYvo+JHU=", - "h1:QzbluV2vQLxsJYxjpziQCmPndIoJ/UGS4/UHH/GpwUM=", - "h1:TjUNbUdqweRBq/ycQ4ixpNkx5qaYwpXEOn9QCpqNZP8=", - "h1:XNbcODP60ajj21N/OO7af8bBg1ltIsYkq9egn7BYbiY=", - "h1:tgrbgmX7WYQz9G9ncgu7TkpVB+RlLjJA/Rvp9KPlZH8=", - "h1:vLxthX/ZWsOZ+aHKbAMqmNKqD0K5f4nJ8ppy0Ioyup0=", - "h1:wZOdGBAZkY8OKEPjKz82j1HloAKOmmvtjWyTxM+I110=", - "zh:0f719fa5426bc883e9fa6abf7f6498e48025edafbc29015e2f5c028f1cca3b9d", - "zh:1b4d7dafefd6c61764b2f9ed6943ceb9a200dee3590d18747e3a5f6b20ce85e0", - "zh:1d23a712984866d29f7b07028a4e99c783c71f1a5dddf08bc3d4e7da9d91a1fa", - "zh:257d23d58c3bb024b6bc8eb88736eaf912e934ad47c639d0c3c742bddda849a1", - "zh:479860e1a5468f5e04013b9364c9496d7ed0804bf9a1acd8e07558d57609993d", - "zh:4cb5e681bf599b411b27c4a2c4066a5fb2ed79aaa3a1a3cb5a30002fec062ce9", - "zh:4fb35c3f643dae9f3670d719397a415f815a0b95f8ed7bd8a72f27a94ba78092", - "zh:59ba40825ab38db5b4a0989a2db0df35cc15d8984f898176011ba352f27d77b7", - "zh:61fc1252eb88088638f4c69ea4e2171cde2e5089fa632ac1e943b13787348f73", - "zh:7c5d6dd5f7cbc460e95d368be35c29b4e0402069b8912dbd5d1cd7fa9acef216", - "zh:7f76d756240d4284642f359ad470226e5378670239aadc366ef54d9d914d4d2e", - "zh:8133ad0814098177e0d067c816ccf1bf48bbadacd18f6f2c808c90447505723b", - "zh:c93be06269bb728f1968f8c50506de56c887017ac1d6e4be1f925651d8437eb6", - "zh:ef47b78a10a82e6cf53344a6a85a94041c28286c10a70541c564d762f1cfede0", - "zh:f5796a53a74999135bd9087aff50fddda59129d09b2f9b1902ff8c0c1e047e48", - ] -} - -provider "registry.opentofu.org/hashicorp/random" { - version = "3.9.0" - hashes = [ - "h1:8EQU5KSxezcjo/phRSe69rDOI0lk4pSaggj7FsskYp8=", - "h1:Lw9im2VBBJQ3RyAbHPQ0rcvcmmcZWm3x+kIOpN+Tv9s=", - "h1:U8KXqGCoNI9/guYbTvzgdtVk3fRthoG0UXwm1JoEpIs=", - "h1:YXaVd4p6qXPPVaxIBaIDNXmBwT02ZqDn0qD+tYpw8sA=", - "h1:cOpc03fphEt/G9Rfc4jLL/fW0D7tgvlXqiDKPF4vuww=", - "h1:g09RR7T1xWkeGrZwWvWMT9ncJrFGr1k3CBD585UmO7w=", - "h1:gGDdPPibmw2EWROx+sh1RGLjR5+nPwZyrf6/N9jXfeM=", - "h1:haE7/nXCOhXKP4oXeEnER3t5CaVQWqujz4nBnpeTUv4=", - "h1:ieSVpfZS2lKuMr05ph0QsOVpCzg7uk3cgKBaXR+Ikug=", - "h1:ig2s1IS9IzehorRjvVAnKIsUUj8fkgyxct1L/kswcc4=", - "h1:j3lS+ZEERFnoab8t1ppDrScGVP/cgWbzlCrEYKTCXYw=", - "h1:lxezrKmOiQIySHAM+os8qLVq7hqufDr8h3Hpzvsk+78=", - "h1:lzRqBJAG+NETxHbEZUJ/YP3RMEjZBinTX7VmgH3lw60=", - "h1:tdSNWK5ApqUsgbdYieyeYLTu6nIZUV3hR1oFqUfAuGo=", - "h1:xedet8yH/zI2CfdxsGlK0nlFWc/Bp61yrWsEa3fHB8g=", - "zh:03f1114cc20b8913523735ab76e0f0a2b16ce13c92923a53304bf85f07fc0dbc", - "zh:105b678ee72322a3067f105d7e05e940f6143238f377f6e87ff4ec909246ac2a", - "zh:55f3bbf13ea18cbace61a706566a80f25f33fe2b1780b6f3d7b582af2a05b6d2", - "zh:63adf996db48f082f7a6351eb485e219cd88795fc71e6ec60a837263ab0d2cb1", - "zh:7e99550738a4e3cc68b8a467714b0d69371025fe95e3326d5323d026d55653e9", - "zh:8342b54af3a18a37e075eeae61be57f4de2ba71b35d95c5075d402dd2c1f289d", - "zh:83ee18e32ac9dd5fc91298554b7c4cfa4c3a1db50f4c797945637cc93c0844ae", - "zh:993ecc0adbf6bd535a59fbc9b735d8c33950e6f6eb5e621d750da9b71d65d80a", - "zh:ad722bc59d4edbf1415e827fc007c0efe6e0e9462d5568bae20b34be1058a261", - "zh:ae9448e1f87b2f9a6c5197a0e9862162ec6b137cb3a3835e11522995d8939e7c", - "zh:bc9cdd3aac784f759125c6627f6f6416e8726a1c184eb9cf3e55b9edbc94c627", - "zh:c8e35b89572ba1c40a9b20022e033a3395fb8d42e7604d50c900f193ba10382e", - "zh:e2deaa8a9975ef81d9f62baed12c41286918b0a10908e0e031f13f69a3b730a1", - "zh:ee39707557210a0ab1098aa357d2cdfe502e5a312d0dbdffb09d08facc4d3fc5", - "zh:f81afe4eb63e8aa9e0ea71be6c990f0dc69cb360e7191c0742a991f4a5081b64", - ] -} - -provider "registry.opentofu.org/zitadel/zitadel" { - version = "2.12.8" - constraints = "2.12.8" - hashes = [ - "h1:/KtT6/u4Tl8FlfNu3fDAAUEpwpcsDwZPHAH44OdQ4zM=", - "h1:3kMM+shoaxGTue0q2sljwYuDMFYAYtPcx2lVaRFJQXQ=", - "h1:6w/7uc20DG3a4C/6F1+jFZk0W9hL0OZJSvp60jSWfVg=", - "h1:AMFM5wojfBz/4QlUnpC5kF/pchgYv6xPmvJEAj/CTNI=", - "h1:BeeCkpgx6K1Y3e1Cs1rUt/8+YcaHEys3hJGb+TvZm1Y=", - "h1:Hzl6ZyCdQguLwcfLBWudvEQi2aV8NiwRG5GL7Cvv+0E=", - "h1:K+DeCgdNTRGkaSdjpf+R/MOF8G5TmvOZpABaW8dQBAU=", - "h1:dSCQd9UD38Cnl+zR72qmXLaniU26rH+fXlP6bqqXuEM=", - "h1:jG/QsZbrBD7VVP9XqHvAk7tMrFBSuDVT2KndQ1SgeKU=", - "h1:osYErmDg7vLTjAMry+zN7SH+l7HmNvAk8mxeFEnDUmA=", - "h1:p1jvk7j9OdYUPrTYWkXC8S+rdDet5P7n6kX5TE7qOK8=", - "h1:r5Z0EfR9wIhMUcKtd0grisnD7qrrr7LIyF//LxQDf10=", - "h1:vCT9CQ4FgFh0EDm5mBlVdeFV5SZemiiJ5x+itrdf5/g=", - "zh:45b56f3c187686b95e92c90c65a1fc9064fc0ee8651bea31721cc8821d115680", - "zh:4795d8aa86bfa8f3b44223fd7754b3c9eb7af4ed1087dccba2e23ecdd3fd59e8", - "zh:4c2dfae7162e4bc3c60249d31a73419ea18e400e6bc5871dda5d54a4759404b6", - "zh:6b1fc7badb46ca692d6f836288d5d0c3f4776982c1c9c16928a7dd0f6bf3849b", - "zh:8355f5df417582056f30d323089a35e6558eb3db5cd4e33bafd643b27fd02973", - "zh:99a0b87970478a22477c4f0d683c68c32bf5b75f57abe3bfab03ff1c30b3b7e8", - "zh:a33d53acc640dc93b81352ba633cf392bc8c7614a72d320d59d3dcdb22d73fc4", - "zh:a9a620278003fdc293ffd30f0e152cca9090fcabbd801b22cf2e8f9daaa17bef", - "zh:b321f81355ed4feda1139b7692fd8858d70b4438de68d7912b51de91eea5313c", - "zh:b8691127f6e213ed0a9457817e6112ce8966665d96778f5f24272541832988be", - "zh:da88e461c9398abdbe630984b10f9e3fc65d90ea8c032de17d98d31ae34fa736", - "zh:e152e480515dcb34570b0a4e5722dd87f72bb5a897c4e45bfaae6efc437cf726", - "zh:e6a53c084025423336a0cd41c9b4947856fc6e4d7c0afa002e0917056395c9bc", - "zh:e970ce1499fc4e4a99b76cf1f0839c88dd5ccd15a71fa670c8e98607de40096b", - ] -} diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/actions.tf b/tf/deployment/modules/shared/zitadel/self-hosted/actions.tf deleted file mode 100644 index e4de2547d..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/actions.tf +++ /dev/null @@ -1,140 +0,0 @@ -resource "zitadel_action" "map_github_oauth" { - org_id = zitadel_org.immich.id - name = "mapGitHubOAuth" - script = <<-EOT - let logger = require("zitadel/log"); - let { fetch } = require("zitadel/http"); - - async function mapGitHubOAuth(ctx, api) { - if (ctx.v1.externalUser.externalIdpId !== "${zitadel_idp_github.github.id}") { - return; - } - - try { - const response = fetch('https://api.github.com/user/emails', { - method: 'GET', - headers: { - 'Authorization': 'Bearer ' + ctx.accessToken, - 'Accept': 'application/vnd.github.v3+json' - } - }); - - if (!response.status == 200) { - logger.error("Failed to fetch GitHub emails, status: " + response.status + ", body: " + response.text()); - return; - } - - const emails = response.json(); - - let primaryEmail = null; - const primaryEmailObject = emails.find(email => email.primary); - if (primaryEmailObject) { - primaryEmail = primaryEmailObject.email; - } - - if (primaryEmail) { - api.setEmail(primaryEmail); - api.setEmailVerified(true); - } else { - logger.warn("No primary email found in GitHub response for user: " + ctx.v1.externalUser.human.displayName); - } - - } catch (error) { - logger.error("Error fetching or processing GitHub emails: " + error.toString()); - } - - let firstName = ctx.v1.providerInfo.login; - let lastName = " "; - - const nameParts = ctx.v1.providerInfo.name.trim().split(" "); - if (nameParts.length > 0 && nameParts[0].length > 0) { - firstName = nameParts[0]; - } - if (nameParts.length > 1) { - lastName = nameParts.slice(1).join(" "); - } - - api.setFirstName(firstName); - api.setLastName(lastName); - } - EOT - allowed_to_fail = true - timeout = "10s" -} - -resource "zitadel_trigger_actions" "map_github_oauth" { - org_id = zitadel_org.immich.id - action_ids = [zitadel_action.map_github_oauth.id] - trigger_type = "TRIGGER_TYPE_POST_AUTHENTICATION" - flow_type = "FLOW_TYPE_EXTERNAL_AUTHENTICATION" -} - -resource "zitadel_action" "map_roles" { - org_id = zitadel_org.immich.id - name = "mapRoles" - script = <<-EOT - const logger = require('zitadel/log'); - - function mapRoles(ctx, api) { - logger.info('help'); - if (ctx.v1.user.grants == undefined || ctx.v1.user.grants.count == 0) { - return; - } - - // I want to use named capture groups but apparently they aren't supported - const projectId = Object.keys(ctx.v1.claims).map((claim) => claim.match(/urn:zitadel:iam:org:project:(?\d+):roles/)?.[1]).filter(Boolean).at(0); - - if (!projectId) { - return; - } - - - const grants = ctx.v1.user.grants.grants.filter((grant) => grant.projectId === projectId); - const roles = grants.map(({ roles }) => roles); - - if (roles.length === 1) { - api.v1.claims.setClaim('role', String(roles[0])); - return; - } - - if (roles.length > 1) { - api.v1.claims.setClaim('roles', roles) - } - } - EOT - allowed_to_fail = false - timeout = "10s" -} - -resource "zitadel_trigger_actions" "map_roles" { - org_id = zitadel_org.immich.id - action_ids = [zitadel_action.map_roles.id] - trigger_type = "TRIGGER_TYPE_PRE_USERINFO_CREATION" - flow_type = "FLOW_TYPE_CUSTOMISE_TOKEN" -} - -resource "zitadel_action" "saml_map_roles" { - org_id = zitadel_org.immich.id - name = "samlMapRoles" - script = <<-EOT - function samlMapRoles(ctx, api) { - if (ctx.v1.user.grants == undefined || ctx.v1.user.grants.count == 0) { - return; - } - let roles = []; - ctx.v1.user.grants.grants.forEach(grant => { - roles.push(grant.roles) - }) - api.v1.attributes.setCustomAttribute('Roles', '', ...roles) - } - EOT - allowed_to_fail = false - timeout = "10s" -} - -resource "zitadel_trigger_actions" "saml_map_roles" { - org_id = zitadel_org.immich.id - action_ids = [zitadel_action.saml_map_roles.id] - trigger_type = "TRIGGER_TYPE_PRE_SAML_RESPONSE_CREATION" - flow_type = "FLOW_TYPE_SAML_RESPONSE" -} diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/assets/ovhcloud-sp-metadata.xml b/tf/deployment/modules/shared/zitadel/self-hosted/assets/ovhcloud-sp-metadata.xml deleted file mode 100644 index 411af60fc..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/assets/ovhcloud-sp-metadata.xml +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - MIIFVzCCAz+gAwIBAgIUQSUwSIh9zUNgNtP/FhkGdy7bEPYwDQYJKoZIhvcNAQELBQAwOzEdMBsGA1UEAwwUYXV0aC5ldS5vdmhjbG91ZC5jb20xCzAJBgNVBAsMAlNQMQ0wCwYDVQQKDARTQU1MMB4XDTI0MDExMjE0MTYzM1oXDTM0MDEwOTE0MTYzM1owOzEdMBsGA1UEAwwUYXV0aC5ldS5vdmhjbG91ZC5jb20xCzAJBgNVBAsMAlNQMQ0wCwYDVQQKDARTQU1MMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0RWhT7fEM8NLiLeEe9Burk15IJUVHvHXJFySOr4lGhbpUWXgnRQZKP8klr3Jd9jZwv9ss+NhsbT/64lqB6WINozk11fGefdyrO6TbIioQnTOcwtF7NCTy9ypuBZiseqMxA67g6VDRqtRuZCtHVFOBJxMzux0h6sGS5t/a3aaHR+0xw9dhhHE0+sNiZUehl0BuNafoelar1nK6Q1ZfXWmoC5zJjxxJAE2DH+kNZaWOdkbPCWpD5G1maZlNL+tEFHzAAmCjj5re4C9enMs4/XPnxqS4wLzsuAEU2/7917+wdgPTpF7RHsqYgFD+gff00IkpY1+H8oqsEtf/iebIvoy0EYD0KozPnSolKNHhOEqSFcxehtCDOPdVq92Ie5FzMPLEeZoO1UvPIlKm2043BjGbNtYNBcFOTP6jdMInGau7KLXz/Bh5g/8mBI+UyCTbZaSoB1GkfzJJpP5j+VPYXcum/s/Y0AJUwNBXujQnu7EkNwQeE8QkjfrHXSC0wI6QYzpcc4DyMk1TNWg+4dn2EdU0TJS+zO/ohaAO1L1O9Pw6+JfHrXcNy5E7iPeRyMhkRMEhWyHxh6PlO7c2Hydo1WVAuV1BqQJmjMYP3D4dzcdmaZiy6JElV4fvkGBh/J3+jRGqeQtb0vplz0d3Dj5Zeto07xi79XtaItk4e9a6KPVds8CAwEAAaNTMFEwHQYDVR0OBBYEFJ/VldqCVgz9XObIdmTtzX+7qo9JMB8GA1UdIwQYMBaAFJ/VldqCVgz9XObIdmTtzX+7qo9JMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBACVM09u+blp3PDDjJsSJM0WyAq40bamTxncfyqZG1P+pN+K/Y38XU+F874FpiglFn1U1ZNekPA8HHj9SpRK1iZKqohB2r6ivwMqcwOJJM3LPNuPxs/RnNXAuup7KfnkEocnIYfad4KUr5QZoWfAyzMGiiRUF9mY4mLvRii1627XsTeQiDN2NJKvl/8FzXSWy2X61nA6kjw7erx5n6QoOprrXbG4Lmq2dRGdO3fqKtSByXrr5pLvHQgduoCtwbJn2mJHEnNSM8h7EDcszMRsgagQuUxT/XdGA8jqzs/qL38XHPxSmdaVzLO1pIxGXH5mZ+emDPGFN/Yd3WA/63qQ+Ig+ctu5gKJGDHaVLXmHE/cQXWs9tYoEen2iSL4nTf9hdH9hz7osQ1q9tNyJkHPwxYYvV9po6ui6jivd/OrasO54SzkoIEIlz0GpaZ4+sVfxWxoaHguQjmbesrppMXwdj8rc8fzKq70nMUm/T3hlehFXsBeH1lZygfKpb1EtpSbmStrQ/pY6xPB0oa4syj9kAnLfVWWsogg4RnIJ3QBZmk5qqwkf1Nq07fnXxIHRxmt5c1PS4hqvSxvIcH/Ghq0VVDZb3yMELZYJWIN20Q52A9I78yEwbjWmtGJ9oG1hRceGlWsxVhqX6Br1fHaHvkgz8HIoTM6kwPAHT+IVxnBIkKOuC - - - - urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified - - - \ No newline at end of file diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/config.tf b/tf/deployment/modules/shared/zitadel/self-hosted/config.tf deleted file mode 100644 index dd0efebf5..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/config.tf +++ /dev/null @@ -1,17 +0,0 @@ -terraform { - backend "pg" { - schema_name = "prod_zitadel" - } - required_version = "~> 1.7" - - required_providers { - zitadel = { - source = "zitadel/zitadel" - version = "2.12.8" - } - onepassword = { - source = "1Password/onepassword" - version = "~> 2.1" - } - } -} diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/data.tf b/tf/deployment/modules/shared/zitadel/self-hosted/data.tf deleted file mode 100644 index 11b84bffb..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/data.tf +++ /dev/null @@ -1,12 +0,0 @@ -data "zitadel_orgs" "zitadel" { - name = "Zitadel" -} - -data "zitadel_projects" "zitadel" { - name = "Zitadel" - org_id = data.zitadel_orgs.zitadel.ids[0] -} - -data "onepassword_vault" "tf" { - name = "tf" -} diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/defaults.tf b/tf/deployment/modules/shared/zitadel/self-hosted/defaults.tf deleted file mode 100644 index 50b23ce22..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/defaults.tf +++ /dev/null @@ -1,71 +0,0 @@ -resource "zitadel_default_login_policy" "default" { - user_login = false - allow_register = false - allow_external_idp = true - force_mfa = false - force_mfa_local_only = false - passwordless_type = "PASSWORDLESS_TYPE_NOT_ALLOWED" - hide_password_reset = "true" - password_check_lifetime = "240h0m0s" - external_login_check_lifetime = "720h0m0s" - multi_factor_check_lifetime = "24h0m0s" - mfa_init_skip_lifetime = "720h0m0s" - second_factor_check_lifetime = "24h0m0s" - ignore_unknown_usernames = true - default_redirect_uri = "" - second_factors = [] - multi_factors = [] - idps = [zitadel_idp_github.github.id] - allow_domain_discovery = false - disable_login_with_email = true - disable_login_with_phone = true -} - -resource "zitadel_default_oidc_settings" "default" { - access_token_lifetime = "12h0m0s" - id_token_lifetime = "12h0m0s" - refresh_token_expiration = "720h0m0s" - refresh_token_idle_expiration = "2160h0m0s" -} - -// Find the default zitadel project and disallow users from logging in -resource "zitadel_project" "zitadel" { - name = "Zitadel" - org_id = data.zitadel_orgs.zitadel.ids[0] - project_role_assertion = false - project_role_check = true - has_project_check = false - private_labeling_setting = "PRIVATE_LABELING_SETTING_UNSPECIFIED" -} - -resource "zitadel_instance_member" "superusers" { - for_each = { - for user in local.users_data : user.github.id => user - if try(user.github.username, "") != "" && contains(user.roles, "immich_admin") - } - user_id = zitadel_human_user.users[each.key].id - roles = ["IAM_OWNER"] -} - -resource "zitadel_project_role" "zitadel_admin" { - org_id = zitadel_project.zitadel.org_id - project_id = zitadel_project.zitadel.id - role_key = "admin" - display_name = "Admin" -} - -resource "zitadel_user_grant" "superusers" { - for_each = { - for user in local.users_data : user.github.id => user - if try(user.github.username, "") != "" && contains(user.roles, "immich_admin") - } - org_id = zitadel_project.zitadel.org_id - project_id = zitadel_project.zitadel.id - user_id = zitadel_human_user.users[each.key].id - role_keys = [zitadel_project_role.zitadel_admin.role_key] -} - -import { - id = data.zitadel_projects.zitadel.project_ids[0] - to = zitadel_project.zitadel -} diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/idp.tf b/tf/deployment/modules/shared/zitadel/self-hosted/idp.tf deleted file mode 100644 index 616f7cce3..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/idp.tf +++ /dev/null @@ -1,11 +0,0 @@ -resource "zitadel_idp_github" "github" { - name = "GitHub" - client_id = var.zitadel_github_client_id - client_secret = var.zitadel_github_client_secret - scopes = ["read:user", "user:email"] - is_auto_creation = false - is_auto_update = true - is_creation_allowed = false - is_linking_allowed = true - auto_linking = "AUTO_LINKING_OPTION_USERNAME" -} diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/org.tf b/tf/deployment/modules/shared/zitadel/self-hosted/org.tf deleted file mode 100644 index eb0375a77..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/org.tf +++ /dev/null @@ -1,4 +0,0 @@ -resource "zitadel_org" "immich" { - name = "Immich" - is_default = true -} diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/permissions.tf b/tf/deployment/modules/shared/zitadel/self-hosted/permissions.tf deleted file mode 100644 index d63b4302a..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/permissions.tf +++ /dev/null @@ -1,47 +0,0 @@ -locals { - project_to_displaynames = flatten([ - for project in local.projects : [ - for role in project.roles : { - project_name = project.name - role_key = role.key - } - ] - ]) - - # For each user+project, grant only the highest-priority role (first match in the ordered list) - project_user_grants = flatten([ - for project in local.projects : [ - for user in local.users_data : { - project_name = project.name - role_key = [for role in project.roles : role.key if length(setintersection(toset(role.grants_to), toset(user.roles))) > 0][0] - github_user_id = user.github.id - } - if length([for role in project.roles : role.key if length(setintersection(toset(role.grants_to), toset(user.roles))) > 0]) > 0 - && try(user.github.username, "") != "" - ] - ]) -} - - -resource "zitadel_project_role" "project_roles" { - for_each = { - for project in local.project_to_displaynames : "${project.project_name}_${project.role_key}" => project - } - - org_id = zitadel_org.immich.id - project_id = zitadel_project.projects[each.value.project_name].id - role_key = each.value.role_key - display_name = each.value.role_key -} - -resource "zitadel_user_grant" "project_grants" { - for_each = { - for grant in local.project_user_grants : "${grant.project_name}_${grant.github_user_id}" => grant - } - depends_on = [zitadel_project_role.project_roles] - - org_id = zitadel_org.immich.id - project_id = zitadel_project.projects[each.value.project_name].id - user_id = zitadel_human_user.users[each.value.github_user_id].id - role_keys = [each.value.role_key] -} diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/project.tf b/tf/deployment/modules/shared/zitadel/self-hosted/project.tf deleted file mode 100644 index 8899fe3ef..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/project.tf +++ /dev/null @@ -1,133 +0,0 @@ -locals { - project_defaults = { - authMethod = "NONE" - appType = "WEB" - redirectUris = [] - grantTypes = ["AUTHORIZATION_CODE"] - protocol = "oidc" - metadataFile = "" - } - projects_data = [ - { - name = "Grafana Monitoring Prod" - roles = [{ key = "GrafanaAdmin", grants_to = ["immich_admin"] }, { key = "Editor", grants_to = ["team"] }] - redirectUris = ["https://monitoring.immich.cloud/login/generic_oauth"] - }, - { - name = "Grafana Monitoring Dev" - roles = [{ key = "GrafanaAdmin", grants_to = ["immich_admin"] }, { key = "Editor", grants_to = ["team"] }] - redirectUris = ["https://monitoring.dev.immich.cloud/login/generic_oauth"] - }, - { - name = "Grafana Data Prod" - roles = [{ key = "GrafanaAdmin", grants_to = ["immich_admin"] }, { key = "Editor", grants_to = ["team"] }] - redirectUris = ["https://grafana.data.immich.cloud/login/generic_oauth"] - }, - { - name = "Outline" - roles = [ - { key = "Leadership", grants_to = ["immich_admin"] }, - { key = "Team", grants_to = ["team"] }, - { key = "Contributor", grants_to = ["contributor"] }, - { key = "Support Crew", grants_to = ["support"] } - ] - authMethod = "BASIC" - redirectUris = ["https://outline.immich.cloud/auth/oidc.callback"] - }, - { - name = "ContainerSSH" - roles = [ - { key = "Granted", grants_to = ["immich_admin", "team", "contributor"] } - ] - appType = "NATIVE" - grantTypes = ["DEVICE_CODE"] - }, - { - name = "OAuth2 Proxy" - roles = [{ key = "Granted", grants_to = ["immich_admin", "team"] }] - redirectUris = ["https://oauth2-proxy.internal.immich.cloud/oauth2/callback"] - }, - { - name = "LoopDedupe" - roles = [{ key = "Granted", grants_to = ["immich_admin", "team", "contributor", "support"] }] - authMethod = "BASIC" - redirectUris = ["https://loopdedupe.internal.immich.cloud/oauth2/callback"] - }, - { - name = "OVHCloud" - protocol = "saml" - roles = [{ key = "ADMIN", grants_to = ["immich_admin", "yucca"] }, { key = "DEFAULT", grants_to = ["team"] }] - # SP metadata is vendored rather than fetched at plan time: OVH gates - # https://auth.eu.ovhcloud.com/sso/saml/sp/metadata.xml behind a CDN - # Set-Cookie 307-redirect-to-self that the http provider (no cookie jar) - # can't satisfy, so `data.http` loops to 10 redirects and fails the apply. - # Re-fetch with `curl -sL -c jar -b jar ` if OVH rotates their SP cert. - metadataFile = "ovhcloud-sp-metadata.xml" - } - ] - - projects = [ - for project in local.projects_data : merge(local.project_defaults, project) - ] - - oidc_projects = [ - for project in local.projects : project if project.protocol == "oidc" - ] - - saml_projects = [ - for project in local.projects : project if project.protocol == "saml" - ] -} - -resource "zitadel_project" "projects" { - for_each = { for project in local.projects : project.name => project } - name = each.value.name - org_id = zitadel_org.immich.id - project_role_check = true - project_role_assertion = true - has_project_check = false -} - -resource "zitadel_application_oidc" "applications" { - for_each = { for project in local.oidc_projects : project.name => project } - name = upper(replace(each.value.name, "/[^a-zA-Z0-9]/", "_")) - org_id = zitadel_org.immich.id - project_id = zitadel_project.projects[each.key].id - - redirect_uris = each.value.redirectUris - response_types = ["OIDC_RESPONSE_TYPE_CODE"] - grant_types = [for grant_type in each.value.grantTypes : "OIDC_GRANT_TYPE_${grant_type}"] - app_type = "OIDC_APP_TYPE_${each.value.appType}" - auth_method_type = "OIDC_AUTH_METHOD_TYPE_${each.value.authMethod}" -} - -resource "onepassword_item" "application_client_id" { - for_each = { for application in zitadel_application_oidc.applications : application.name => application } - - vault = data.onepassword_vault.tf.uuid - title = "ZITADEL_OAUTH_CLIENT_ID_${each.value.name}" - category = "password" - - password = each.value.client_id -} - -resource "onepassword_item" "application_client_secret" { - for_each = { - for application in zitadel_application_oidc.applications : application.name => application - if application.auth_method_type != "OIDC_AUTH_METHOD_TYPE_NONE" - } - - vault = data.onepassword_vault.tf.uuid - title = "ZITADEL_OAUTH_CLIENT_SECRET_${each.value.name}" - category = "password" - - password = each.value.client_secret -} - -resource "zitadel_application_saml" "applications" { - for_each = { for project in local.saml_projects : project.name => project } - name = upper(replace(each.value.name, "/[^a-zA-Z0-9]/", "_")) - org_id = zitadel_org.immich.id - project_id = zitadel_project.projects[each.key].id - metadata_xml = file("${path.module}/assets/${each.value.metadataFile}") -} diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/providers.tf b/tf/deployment/modules/shared/zitadel/self-hosted/providers.tf deleted file mode 100644 index 0a80da173..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/providers.tf +++ /dev/null @@ -1,10 +0,0 @@ -provider "zitadel" { - domain = "zitadel.internal.immich.cloud" - insecure = false - jwt_profile_json = var.zitadel_profile_json -} - -provider "onepassword" { - url = var.op_connect_url - token = var.op_connect_token -} diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/terragrunt.hcl b/tf/deployment/modules/shared/zitadel/self-hosted/terragrunt.hcl deleted file mode 100644 index 8ce8626cb..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/terragrunt.hcl +++ /dev/null @@ -1,21 +0,0 @@ -terraform { - source = "." - - extra_arguments custom_vars { - commands = get_terraform_commands_that_need_vars() - } - - include_in_copy = ["repo-files/*", "assets/*"] -} - -include "root" { - path = find_in_parent_folders("root.hcl") -} - -inputs = { - users_data_file_path = "${get_repo_root()}/tf/deployment/data/users.json" -} - -dependencies { - paths = [] -} diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/users.tf b/tf/deployment/modules/shared/zitadel/self-hosted/users.tf deleted file mode 100644 index 044cdb75a..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/users.tf +++ /dev/null @@ -1,48 +0,0 @@ -locals { - users_data = jsondecode(file(var.users_data_file_path)) -} - -resource "random_password" "zitadel_user_initial_password" { - for_each = { - for user in local.users_data : user.github.id => user - if try(user.github.username, "") != "" - } - length = 64 - special = true -} - -resource "zitadel_human_user" "users" { - for_each = { - for user in local.users_data : user.github.id => user - if try(user.github.username, "") != "" - } - email = "${each.value.github.id}+${each.value.github.username}@users.noreply.github.com" - first_name = each.value.github.username - last_name = "last_name" - user_name = each.value.github.username - org_id = zitadel_org.immich.id - initial_password = random_password.zitadel_user_initial_password[each.key].result - initial_skip_password_change = true - is_email_verified = true - is_phone_verified = false - - lifecycle { - ignore_changes = [ - first_name, - last_name, - email, - nick_name - ] - } -} - -resource "zitadel_user_metadata" "role" { - for_each = { - for user in local.users_data : user.github.id => user - if try(user.github.username, "") != "" - } - org_id = zitadel_org.immich.id - user_id = zitadel_human_user.users[each.key].id - key = "role" - value = jsonencode(each.value.roles) -} diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/variables.tf b/tf/deployment/modules/shared/zitadel/self-hosted/variables.tf deleted file mode 100644 index 406725394..000000000 --- a/tf/deployment/modules/shared/zitadel/self-hosted/variables.tf +++ /dev/null @@ -1,18 +0,0 @@ -variable "tf_state_postgres_conn_str" {} - -variable "op_connect_url" {} -variable "op_connect_token" { - sensitive = true -} - -variable "zitadel_profile_json" {} - -variable "users_data_file_path" { - description = "The path to the JSON file containing user data. This path should be resolvable from the Terragrunt execution directory or be an absolute path." - type = string -} - -variable "zitadel_github_client_id" {} -variable "zitadel_github_client_secret" { - sensitive = true -}