📝 docs: Add deployment using ZITADEL authentication services (#4081)

* Create docker-compose.yml for local deploy with zitadel Create docker-compose.yml for local deploy with zitadel * Create .env.zh-CN.example for local deploy with zitadel Create .env.zh-CN.example for local deploy with zitadel * Create .env.example for local deploy with zitadel Create .env.example for local deploy with zitadel * Update .env.zh-CN.example * Create docker-compose.yml for self-hosting with zitadel Create docker-compose.yml for self-hosting with zitadel * Create .env.zh-CN.example for self-hosting deploy with zitadel Create .env.zh-CN.example for self-hosting deploy with zitadel * Create .env.example for self-host deploy with zitadel Create .env.example for self-host deploy with zitadel * Create zitadel-init-steps.yaml * Create zitadel-config.yaml * Update docker-compose.yml * Update docker-compose.yml * Create zitadel-config.yaml * Create zitadel-init-steps.yaml * Update .env.zh-CN.example * Update .env.example * Update .env.example * Update .env.zh-CN.example * Update zitadel-init-steps.yaml
2026-04-21 17:47:27 +00:00 · 2024-09-28 23:35:48 +08:00 · 2024-09-28 23:35:48 +08:00 · 88dc3c9617
commit 88dc3c9617
parent 2c70b90b60
10 changed files with 394 additions and 0 deletions
--- a/docker-compose/local/zitadel/.env.example
+++ b/docker-compose/local/zitadel/.env.example
@ -0,0 +1,33 @@
+# Required: LobeChat domain for tRPC calls
+# Ensure this domain is whitelisted in your NextAuth providers and S3 service CORS settings
+APP_URL=http://localhost:3210
+
+# Postgres related environment variables
+# Required: Secret key for encrypting sensitive information. Generate with: openssl rand -base64 32
+KEY_VAULTS_SECRET=Kix2wcUONd4CX51E/ZPAd36BqM4wzJgKjPtz2sGztqQ=
+# Required: Postgres database connection string
+DATABASE_URL=postgresql://postgres:uWNZugjBqixf8dxC@postgresql:5432/lobechat
+
+# NEXT_AUTH related environment variables
+NEXTAUTH_URL=http://localhost:3210/api/auth
+NEXT_AUTH_SECRET=NX2kaPE923dt6BL2U8e9oSre5RfoT7hg
+NEXT_AUTH_SSO_PROVIDERS=zitadel
+# ZiTADEL provider configuration
+# Please refer to：https://lobehub.com/zh/docs/self-hosting/advanced/auth/next-auth/zitadel
+AUTH_ZITADEL_ID=285945938244075523
+AUTH_ZITADEL_SECRET=hkbtzHLaCEIeHeFThym14UcydpmQiEB5JtAX08HSqSoJxhAlVVkyovTuNUZ5TNrT
+AUTH_ZITADEL_ISSUER=http://localhost:8080
+
+# MinIO S3 configuration
+S3_ACCESS_KEY_ID=        
+S3_SECRET_ACCESS_KEY=
+S3_ENDPOINT=http://localhost:9000
+S3_BUCKET=lobe 
+S3_PUBLIC_DOMAIN=http://localhost:9000
+S3_ENABLE_PATH_STYLE=1
+LLM_VISION_IMAGE_USE_BASE64=1
+
+# Other environment variables, as needed. You can refer to the environment variables configuration for the client version, making sure not to have ACCESS_CODE.
+# OPENAI_API_KEY=sk-xxxx
+# OPENAI_PROXY_URL=https://api.openai.com/v1
+# OPENAI_MODEL_LIST=...
--- a/docker-compose/local/zitadel/.env.zh-CN.example
+++ b/docker-compose/local/zitadel/.env.zh-CN.example
@ -0,0 +1,32 @@
+# LobeChat 域名
+APP_URL=http://localhost:3210
+
+# Postgres 相关，也即 DB 必须的环境变量
+# 用于加密敏感信息的密钥，可以使用 openssl rand -base64 32 生成
+KEY_VAULTS_SECRET=Kix2wcUONd4CX51E/ZPAd36BqM4wzJgKjPtz2sGztqQ=
+# Postgres 数据库连接字符串
+DATABASE_URL=postgresql://postgres:uWNZugjBqixf8dxC@postgresql:5432/lobechat
+
+# NEXT_AUTH 相关
+NEXTAUTH_URL=http://localhost:3210/api/auth
+NEXT_AUTH_SECRET=NX2kaPE923dt6BL2U8e9oSre5RfoT7hg
+NEXT_AUTH_SSO_PROVIDERS=zitadel
+# ZiTADEL 鉴权服务提供商部分
+# 请参考：https://lobehub.com/zh/docs/self-hosting/advanced/auth/next-auth/zitadel
+AUTH_ZITADEL_ID=285945938244075523
+AUTH_ZITADEL_SECRET=hkbtzHLaCEIeHeFThym14UcydpmQiEB5JtAX08HSqSoJxhAlVVkyovTuNUZ5TNrT
+AUTH_ZITADEL_ISSUER=http://localhost:8080
+
+# MinIO S3 配置
+S3_ACCESS_KEY_ID=        
+S3_SECRET_ACCESS_KEY=
+S3_ENDPOINT=http://localhost:9000
+S3_BUCKET=lobe 
+S3_PUBLIC_DOMAIN=http://localhost:9000
+S3_ENABLE_PATH_STYLE=1
+LLM_VISION_IMAGE_USE_BASE64=1
+
+# 其他环境变量，视需求而定，可以参照客户端版本的环境变量配置，注意不要有 ACCESS_CODE
+# OPENAI_API_KEY=sk-xxxx
+# OPENAI_PROXY_URL=https://api.openai.com/v1
+# OPENAI_MODEL_LIST=...
--- a/docker-compose/local/zitadel/docker-compose.yml
+++ b/docker-compose/local/zitadel/docker-compose.yml
@ -0,0 +1,86 @@
+services:
+  network-service:
+    image: alpine
+    container_name: lobe-network
+    ports:
+      - '9000:9000'  # MinIO API
+      - '9001:9001'  # MinIO Console
+      - '8080:8080' # Zitadel Console
+      - '3210:3210' # LobeChat
+    command: tail -f /dev/null
+    networks:
+      - lobe-network
+
+  postgresql:
+    image: pgvector/pgvector:pg16
+    container_name: lobe-postgres
+    ports:
+      - "5432:5432"
+    volumes:
+      - './data:/var/lib/postgresql/data'
+    environment:
+      - 'POSTGRES_DB=lobechat'
+      - 'POSTGRES_PASSWORD=uWNZugjBqixf8dxC'
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U postgres']
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: always
+    networks:
+      - lobe-network
+
+  minio:
+    image: minio/minio
+    container_name: lobe-minio
+    network_mode: 'service:network-service'
+    volumes:
+      - './s3_data:/etc/minio/data'
+    environment:
+      - 'MINIO_ROOT_USER=YOUR_MINIO_USER'
+      - 'MINIO_ROOT_PASSWORD=YOUR_MINIO_PASSWORD'
+      - 'MINIO_API_CORS_ALLOW_ORIGIN=http://localhost:3210'
+    restart: always
+    command: >
+      server /etc/minio/data --address ":9000" --console-address ":9001"
+
+  zitadel:
+    restart: 'always'
+    image: 'ghcr.io/zitadel/zitadel:latest'
+    container_name: lobe-zitadel
+    network_mode: 'service:network-service'
+    command: start-from-init --config /zitadel-config.yaml --steps
+      /zitadel-init-steps.yaml --masterkey "cft3Tekr/rQBOqwoQSCPoncA9BHbn7QJ"
+      --tlsMode disabled  #MasterkeyNeedsToHave32Characters
+    volumes:
+      - ./zitadel-config.yaml:/zitadel-config.yaml:ro
+      - ./zitadel-init-steps.yaml:/zitadel-init-steps.yaml:ro     
+    depends_on:
+      postgresql:
+        condition: service_healthy
+
+  lobe:
+    image: lobehub/lobe-chat-database
+    container_name: lobe-database
+    network_mode: 'service:network-service'
+    depends_on:
+      postgresql:
+        condition: service_healthy
+      network-service:
+        condition: service_started
+      minio:
+        condition: service_started
+      zitadel:
+        condition: service_started
+    env_file:
+      - .env
+    restart: always
+
+volumes:
+  data:
+    driver: local
+  s3_data:
+    driver: local
+networks:
+  lobe-network:
+    driver: bridge
--- a/docker-compose/local/zitadel/zitadel-config.yaml
+++ b/docker-compose/local/zitadel/zitadel-config.yaml
@ -0,0 +1,26 @@
+Log:
+  Level: 'info'
+
+Port: 8080
+ExternalPort: 8080 
+ExternalDomain: localhost
+ExternalSecure: false
+TLS:
+  Enabled: false 
+
+# If not using the docker compose example, adjust these values for connecting ZITADEL to your PostgreSQL
+Database:
+  postgres:
+    Host: postgresql
+    Port: 5432
+    Database: zitadel
+    User:
+      Username: 'zitadel'
+      Password: 'zitadel'
+      SSL:
+        Mode: 'disable'
+    Admin:
+      Username: 'postgres'
+      Password: 'uWNZugjBqixf8dxC' #postgres password
+      SSL:
+        Mode: 'disable'
--- a/docker-compose/local/zitadel/zitadel-init-steps.yaml
+++ b/docker-compose/local/zitadel/zitadel-init-steps.yaml
@ -0,0 +1,11 @@
+# All possible options and their defaults: https://github.com/zitadel/zitadel/blob/main/cmd/setup/steps.yaml
+FirstInstance:
+  Org:
+    Human:
+      # use the loginname root@zitadel.localhost
+      Username: 'root'
+      # The password must be 8 characters or more and must contain uppercase letters, lowercase letters, symbols, and numbers. The first login will require a password change. 
+      Password: 'Password1!'
+      Email:
+        # Optional, if set, can be used to log in with email.
+        Address: 'example@zitadel.com' # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS  
--- a/docker-compose/production/zitadel/.env.example
+++ b/docker-compose/production/zitadel/.env.example
@ -0,0 +1,53 @@
+# Required: LobeChat domain for tRPC calls
+# Ensure this domain is whitelisted in your NextAuth providers and S3 service CORS settings
+APP_URL=https://lobe.example.com/
+
+# Postgres related environment variables
+# Required: Secret key for encrypting sensitive information. Generate with: openssl rand -base64 32
+KEY_VAULTS_SECRET=Kix2wcUONd4CX51E/ZPAd36BqM4wzJgKjPtz2sGztqQ=
+# Required: Postgres database connection string
+# Format: postgresql://username:password@host:port/dbname
+# If using Docker, you can use the container name as the host
+DATABASE_URL=postgresql://postgres:uWNZugjBqixf8dxC@postgresql:5432/lobe
+
+# NEXT_AUTH related environment variables
+# Required: NextAuth URL for callbacks
+NEXTAUTH_URL=https://lobe.example.com/api/auth
+# Required: NextAuth secret key. Generate with: openssl rand -base64 32
+NEXT_AUTH_SECRET=NX2kaPE923dt6BL2U8e9oSre5RfoT7hg
+# Required: Specify the authentication provider
+NEXT_AUTH_SSO_PROVIDERS=zitadel
+
+# ZiTADEL provider configuration
+# Please refer to：https://lobehub.com/zh/docs/self-hosting/advanced/auth/next-auth/zitadel
+AUTH_ZITADEL_ID=285934220675723622
+AUTH_ZITADEL_SECRET=pe7Nh3lopXkZkfqh5YEDYI2xsbIz08eZKqInOUZxssd3refRia518Apbv3DZ
+AUTH_ZITADEL_ISSUER=https://zitadel.example.com
+
+# Proxy settings (if needed, e.g., when using GitHub as an auth provider)
+# HTTP_PROXY=http://localhost:7890
+# HTTPS_PROXY=http://localhost:7890
+
+# S3 related environment variables (example using MinIO)
+# Required: S3 Access Key ID (for MinIO, invalid until manually created in MinIO UI)
+S3_ACCESS_KEY_ID=YOUR_S3_ACCESS_KEY_ID
+# Required: S3 Secret Access Key (for MinIO, invalid until manually created in MinIO UI)
+S3_SECRET_ACCESS_KEY=YOUR_S3_SECRET_ACCESS_KEY
+# Required: S3 Endpoint for server/client connections to S3 API
+S3_ENDPOINT=https://lobe-s3-api.example.com
+# Required: S3 Bucket (invalid until manually created in MinIO UI)
+S3_BUCKET=lobe
+# Required: S3 Public Domain for client access to unstructured data
+S3_PUBLIC_DOMAIN=https://lobe-s3-api.example.com
+# Optional: S3 Enable Path Style
+# Use 0 for mainstream S3 cloud providers; use 1 for self-hosted MinIO
+# See: https://lobehub.com/docs/self-hosting/advanced/s3#s-3-enable-path-style
+S3_ENABLE_PATH_STYLE=1
+
+# Other basic environment variables (as needed)
+# See: https://lobehub.com/docs/self-hosting/environment-variables/basic
+# Note: For server versions, the API must support embedding models (OpenAI text-embedding-3-small) for file processing
+# You don't need to specify this model in OPENAI_MODEL_LIST
+# OPENAI_API_KEY=sk-xxxx
+# OPENAI_PROXY_URL=https://api.openai.com/v1
+# OPENAI_MODEL_LIST=...
--- a/docker-compose/production/zitadel/.env.zh-CN.example
+++ b/docker-compose/production/zitadel/.env.zh-CN.example
@ -0,0 +1,48 @@
+# 必填，LobeChat 域名，用于 tRPC 调用
+# 请保证此域名在你的 NextAuth 鉴权服务提供商、S3 服务商的 CORS 白名单中
+APP_URL=https://lobe.example.com/
+
+# Postgres 相关，也即 DB 必需的环境变量
+# 必填，用于加密敏感信息的密钥，可以使用 openssl rand -base64 32 生成
+KEY_VAULTS_SECRET=Kix2wcUONd4CX51E/ZPAd36BqM4wzJgKjPtz2sGztqQ=
+# 必填，Postgres 数据库连接字符串，用于连接到数据库
+# 格式：postgresql://username:password@host:port/dbname，如果你的 pg 实例为 Docker 容器且位于同一 docker-compose 文件中，亦可使用容器名作为 host
+DATABASE_URL=postgresql://postgres:uWNZugjBqixf8dxC@postgresql:5432/lobe
+
+# NEXT_AUTH 相关，也即鉴权服务必需的环境变量
+# 必填，NextAuth 的 URL，用于 NextAuth 的回调
+NEXTAUTH_URL=https://lobe.example.com/api/auth
+# 必填，用于 NextAuth 的密钥，可以使用 openssl rand -base64 32 生成
+NEXT_AUTH_SECRET=NX2kaPE923dt6BL2U8e9oSre5RfoT7hg
+# 必填，指定鉴权服务提供商
+NEXT_AUTH_SSO_PROVIDERS=zitadel
+
+# ZiTADEL 鉴权服务提供商部分
+# 请参考：https://lobehub.com/zh/docs/self-hosting/advanced/auth/next-auth/zitadel
+AUTH_ZITADEL_ID=285934220675723622
+AUTH_ZITADEL_SECRET=pe7Nh3lopXkZkfqh5YEDYI2xsbIz08eZKqInOUZxssd3refRia518Apbv3DZ
+AUTH_ZITADEL_ISSUER=https://zitadel.example.com
+
+# S3 相关，也即非结构化数据（文件、图片等）存储必需的环境变量
+# 这里以 MinIO 为例
+# 必填，S3 的 Access Key ID，对于 MinIO 来说，直到在 MinIO UI 中手动创建之前都是无效的
+S3_ACCESS_KEY_ID=YOUR_S3_ACCESS_KEY_ID
+# 必填，S3 的 Secret Access Key，对于 MinIO 来说，直到在 MinIO UI 中手动创建之前都是无效的
+S3_SECRET_ACCESS_KEY=YOUR_S3_SECRET_ACCESS_KEY
+# 必填，S3 的 Endpoint，用于服务端/客户端连接到 S3 API
+S3_ENDPOINT=https://lobe-s3-api.example.com
+# 必填，S3 的 Bucket，直到在 MinIO UI 中手动创建之前都是无效的
+S3_BUCKET=lobe
+# 必填，S3 的 Public Domain，用于客户端通过公开连接访问非结构化数据
+S3_PUBLIC_DOMAIN=https://lobe-s3-api.example.com
+# 选填，S3 的 Enable Path Style
+# 对于主流 S3 Cloud 服务商，一般填 0 即可；对于自部署的 MinIO，请填 1
+# 请参考：https://lobehub.com/zh/docs/self-hosting/advanced/s3#s-3-enable-path-style
+S3_ENABLE_PATH_STYLE=1
+
+# 其他基础环境变量，视需求而定。注意不要有 ACCESS_CODE
+# 请参考：https://lobehub.com/zh/docs/self-hosting/environment-variables/basic
+# 请注意，对于服务端版本，其 API 必须支持嵌入（即 OpenAI text-embedding-3-small）模型，否则无法对上传文件进行处理，但你无需在 OPENAI_MODEL_LIST 中指定此模型
+# OPENAI_API_KEY=sk-xxxx
+# OPENAI_PROXY_URL=https://api.openai.com/v1
+# OPENAI_MODEL_LIST=...
--- a/docker-compose/production/zitadel/docker-compose.yml
+++ b/docker-compose/production/zitadel/docker-compose.yml
@ -0,0 +1,69 @@
+services:
+  postgresql:
+    image: pgvector/pgvector:pg16
+    container_name: lobe-postgres
+    ports:
+      - '5432:5432'
+    volumes:
+      - './data:/var/lib/postgresql/data'
+    environment:
+      - 'POSTGRES_DB=lobe'
+      - 'POSTGRES_PASSWORD=uWNZugjBqixf8dxC'
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U postgres']
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: always
+
+  minio:
+    image: minio/minio
+    container_name: lobe-minio
+    ports:
+      - '9000:9000'
+      - '9001:9001'
+    volumes:
+      - './s3_data:/etc/minio/data'
+    environment:
+      - 'MINIO_ROOT_USER=YOUR_MINIO_USER'
+      - 'MINIO_ROOT_PASSWORD=YOUR_MINIO_PASSWORD'
+      - 'MINIO_DOMAIN=lobe-s3-api.example.com'
+      - 'MINIO_API_CORS_ALLOW_ORIGIN=https://lobe.example.com' # Your LobeChat's domain name.
+    restart: always
+    command: >
+      server /etc/minio/data --address ":9000" --console-address ":9001"
+      
+  zitadel:
+    restart: always
+    image: ghcr.io/zitadel/zitadel:latest
+    container_name: lobe-zitadel
+    command: start-from-init --config /zitadel-config.yaml --steps
+      /zitadel-init-steps.yaml --masterkey "cft3Tekr/rQBOqwoQSCPoncA9BHbn7QJ"
+      --tlsMode external  #MasterkeyNeedsToHave32Characters
+    ports:
+      - 8080:8080
+    volumes:
+      - ./zitadel-config.yaml:/zitadel-config.yaml:ro
+      - ./zitadel-init-steps.yaml:/zitadel-init-steps.yaml:ro
+    depends_on:
+      postgresql:
+        condition: service_healthy
+
+  lobe:
+    image: lobehub/lobe-chat-database
+    container_name: lobe-database
+    ports:
+      - '3210:3210'
+    depends_on:
+      - postgresql
+      - minio
+      - zitadel
+    env_file:
+      - .env
+    restart: always
+
+volumes:
+  data:
+    driver: local
+  s3_data:
+    driver: local
--- a/docker-compose/production/zitadel/zitadel-config.yaml
+++ b/docker-compose/production/zitadel/zitadel-config.yaml
@ -0,0 +1,25 @@
+Log:
+  Level: 'info'
+
+ExternalPort: 443 
+ExternalDomain: example.com #Your zitadel's domain name
+ExternalSecure: true 
+TLS:
+  Enabled: false # ZITADEL_TLS_ENABLED
+
+# If not using the docker compose example, adjust these values for connecting ZITADEL to your PostgreSQL
+Database:
+  postgres:
+    Host: postgresql
+    Port: 5432
+    Database: zitadel
+    User:
+      Username: 'zitadel'
+      Password: 'zitadel'
+      SSL:
+        Mode: 'disable'
+    Admin:
+      Username: 'postgres'
+      Password: 'uWNZugjBqixf8dxC' #postgres password
+      SSL:
+        Mode: 'disable'
--- a/docker-compose/production/zitadel/zitadel-init-steps.yaml
+++ b/docker-compose/production/zitadel/zitadel-init-steps.yaml
@ -0,0 +1,11 @@
+# All possible options and their defaults: https://github.com/zitadel/zitadel/blob/main/cmd/setup/steps.yaml
+FirstInstance:
+  Org:
+    Human:
+      # use the loginname root@zitadel.localhost, replace localhost with your configured external domain
+      Username: 'root'
+      # The password must be 8 characters or more and must contain uppercase letters, lowercase letters, symbols, and numbers. The first login will require a password change. 
+      Password: 'Password1!'
+      Email:
+        # Optional, if set, can be used to log in with email.
+        Address: 'example@zitadel.com' # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS