ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/zitadel/bootstrap.md

@@ -0,0 +1,118 @@
+# Zitadel Bootstrap
+
+## 1. Terraform — Vault KV + database engine
+
+```bash
+vault kv put secret/cloudflare/api-token api-token="<cloudflare-api-token>"
+vault kv put secret/postgres/admin username="********" password="<postgres-admin-password>"
+```
+
+```bash
+cd terraform/internal/vault
+../../scripts/tofu-versitygw-state apply \
+  -var="internal_domain=quorate.internal" \
+  -var='users=["<admin-user>"]' \
+  -var="admin_user=<admin-user>"
+```
+
+## 2. PostgreSQL — roles and database
+
+```bash
+cd terraform/internal/postgres
+../../scripts/tofu-versitygw-state apply
+```
+
+## 3. Network policies
+
+```bash
+kubectl --context default apply -f vendor/platform/postgres/network-policies.yaml
+kubectl --context default apply -f vendor/platform/vault/network-policies.yaml
+```
+
+```bash
+vault read database/config/postgres
+```
+
+## 4. cert-manager — Cloudflare token + Let's Encrypt issuer
+
+```bash
+kubectl --context default apply -f vendor/platform/cert-manager/config/vso.yaml
+kubectl --context default apply -f vendor/platform/cert-manager/config/issuers.yaml
+```
+
+```bash
+kubectl --context default get secret cloudflare-api-token -n cert-manager
+```
+
+## 5. Gateway R
+
+```bash
+flux reconcile kustomization platform-cilium-config --context default -n flux-system --with-source
+```
+
+The `gateway-relay-tls` Certificate triggers a DNS-01 ACME challenge. Monitor:
+
+```bash
+kubectl --context default describe certificate gateway-relay-tls -n kube-system
+```
+
+Cloudflare declares `auth.quorate.dev` from the OCI relay state in `terraform/external/cloudflare`.
+
+## 6. Zitadel namespace + network policies + VSO
+
+```bash
+kubectl --context default create namespace zitadel
+# Pre-create the service account so VSO can authenticate before Helm runs
+kubectl --context default create serviceaccount zitadel -n zitadel
+kubectl --context default apply -f vendor/platform/zitadel/network-policies.yaml
+kubectl --context default apply -f vendor/platform/zitadel/vso.yaml
+```
+
+Wait for both secrets:
+
+```bash
+kubectl --context default get secret zitadel-masterkey -n zitadel
+kubectl --context default get secret zitadel-db -n zitadel
+```
+
+## 7. Helm install
+
+```bash
+helm repo add zitadel https://charts.zitadel.com
+helm upgrade --install zitadel zitadel/zitadel \
+  --namespace zitadel \
+  -f vendor/platform/zitadel/values.yaml
+```
+
+## 8. HTTPRoute
+
+```bash
+kubectl --context default apply -f vendor/platform/zitadel/route.yaml
+```
+
+## 9. Post-deploy — organization and OIDC clients
+
+Once Zitadel is up and the IAM admin machine key secret exists, mirror it to Vault for Terraform:
+
+```bash
+kubectl --context default get secret iam-admin -n zitadel -o jsonpath='{.data.iam-admin\.json}' | base64 -d > iam-admin.json
+vault kv put secret/zitadel/iam-admin iam-admin.json=@iam-admin.json
+```
+
+```bash
+cd terraform/internal/zitadel
+../../scripts/tofu-versitygw-state apply -var="zitadel_domain=auth.quorate.dev"
+```
+
+This creates the primary service organization, the shared service project, and the Forgejo OIDC application.
+
+The Forgejo OIDC client material is mirrored into Vault for later VSO sync. Use the non-secret outputs when configuring or verifying Forgejo's OAuth2 authentication source:
+
+```bash
+tofu output forgejo_oidc_authentication_name
+tofu output forgejo_oidc_discovery_url
+tofu output forgejo_oidc_redirect_uri
+tofu output forgejo_oidc_vault_secret_path
+```
+
+The Forgejo authentication source name must stay aligned with the redirect URI: `https://forge.quorate.internal/user/oauth2/Zitadel/callback`.