Zitadel — auth.hrmnn.dev

Identity and Access Management for the hrmnn k3s cluster.

Architecture

• Zitadel — OIDC/OAuth2 identity provider at auth.hrmnn.dev
• PostgreSQL — dedicated database for Zitadel (separate from Authentik's)
• Ingress — NGINX ingress with cert-manager TLS

Prerequisites

• k3s cluster at 46.225.234.15
• NGINX ingress controller
• cert-manager with ClusterIssuer letsencrypt-prod
• Helm 3.x

Deployment

# 1. Create namespace and secrets
kubectl apply -f manifests/namespace.yaml
kubectl apply -f manifests/secrets.yaml   # Edit passwords first!

# 2. Deploy PostgreSQL
kubectl apply -f manifests/postgres.yaml

# 3. Install Zitadel via Helm
helm repo add zitadel https://charts.zitadel.com
helm repo update
helm install zitadel zitadel/zitadel \
  --namespace zitadel \
  --values helm/values.yaml

# 4. Wait for init/setup jobs to complete, then verify
kubectl -n zitadel get pods --watch

# 5. Access console
# https://auth.hrmnn.dev/ui/console
# Login: admin / (see secrets)

Forgejo Integration

After Zitadel is running, configure Forgejo OIDC authentication. See docs/forgejo-oidc.md for step-by-step instructions.

Cleanup Authentik

Once Zitadel is confirmed working:

helm uninstall authentik -n authentik   # or kubectl delete ns authentik