Skip to content

feat: add Zitadel secrets - #2

Merged
glitchedmob merged 1 commit into
mainfrom
feat/add-zitadel-secrets
Aug 24, 2026
Merged

feat: add Zitadel secrets#2
glitchedmob merged 1 commit into
mainfrom
feat/add-zitadel-secrets

Conversation

@glitchedmob

Copy link
Copy Markdown
Member

Adds the write-only bootstrap and backup credentials required by the Zitadel deployment.

  • Generates the initial administrator password and persistent master key under the SGF workload SSM prefix.
  • Adds Zitadel to the existing Restic password set.
  • Protects the master key and Restic password from ordinary destruction.

Merge and apply this before sgfdevs/infra-k8s-apps#71.

@github-actions

Copy link
Copy Markdown

Terraform plan

Artifacts: https://github.com/sgfdevs/infra-vm-workloads/actions/runs/32732547888

Show summary
CHANGE RESOURCE
add (3) aws_ssm_parameter.restic_password["zitadel"]
aws_ssm_parameter.zitadel_initial_admin_password
aws_ssm_parameter.zitadel_master_key

Decrypt artifacts:
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.enc -out tfplan -pass pass:$OUTPUT_ENCRYPTION_KEY
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.txt.enc -out tfplan.txt -pass pass:$OUTPUT_ENCRYPTION_KEY

@glitchedmob
glitchedmob merged commit 0ea6594 into main Aug 24, 2026
6 checks passed
@glitchedmob
glitchedmob deleted the feat/add-zitadel-secrets branch August 24, 2026 13:27
glitchedmob added a commit to sgfdevs/infra-k8s-apps that referenced this pull request Aug 24, 2026
Deploys Zitadel at `id.sgf.dev` using the same Helm, CloudNativePG,
ingress, certificate, and K8up backup model as the LZ deployment.

- Adds on-demand backup, guarded transactional restore, and emergency
resume Argo WorkflowTemplates.
- Pauses Argo CD and scales application workloads down before restoring
PostgreSQL, then restores reconciliation and replica counts.
- Uses the SGF Backblaze S3 repository and AWS SSM credentials created
by sgfdevs/infra-vm-workloads#2.

Merge and apply sgfdevs/infra-vm-workloads#2 before this PR.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant