Post-X-Society/Post-Tyranny-Tech-Infrastructure

Pieter 48ef4da920 Fix Zitadel deployment by removing FirstInstance variables

- Remove all ZITADEL_FIRSTINSTANCE_* environment variables
- Fixes migration error: duplicate key constraint violation
- Root cause: Bug in Zitadel v2.63.7 FirstInstance migration
- Workaround: Complete initial setup via web UI
- Upstream issue: https://github.com/zitadel/zitadel/issues/8791

Changes:
- Clean up obsolete documentation (OIDC_AUTOMATION.md, SETUP_GUIDE.md, COLLABORA_SETUP.md)
- Add PROJECT_REFERENCE.md for essential configuration info
- Add force recreate functionality with clean database volumes
- Update bootstrap instructions for web UI setup
- Document one-time manual setup requirement for OIDC automation

Zitadel now deploys successfully and is accessible at:
https://zitadel.test.vrije.cloud

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>

2026-01-06 16:43:57 +01:00

3.3 KiB

Raw Blame History

Post-X Society Multi-Tenant Infrastructure

Infrastructure as Code for a scalable multi-tenant VPS platform running Zitadel (identity provider) and Nextcloud (file sync/share) on Hetzner Cloud.

🏗️ Architecture

Provisioning: OpenTofu (open source Terraform fork)
Configuration: Ansible with dynamic inventory
Secrets: SOPS + Age encryption
Hosting: Hetzner Cloud (EU-based, GDPR-compliant)
Identity: Zitadel (Swiss company, AGPL 3.0)
Storage: Nextcloud (German company, AGPL 3.0)

📁 Repository Structure

infrastructure/
├── .claude/agents/          # AI agent definitions for specialized tasks
├── docs/                    # Architecture decisions and runbooks
├── tofu/                    # OpenTofu configurations for Hetzner
├── ansible/                 # Ansible playbooks and roles
├── secrets/                 # SOPS-encrypted secrets (git-safe)
├── docker/                  # Docker Compose configurations
└── scripts/                 # Deployment and management scripts

🚀 Quick Start

Prerequisites

Initial Setup

Clone repository:
```
git clone <repo-url>
cd infrastructure
```

Generate Age encryption key:

age-keygen -o keys/age-key.txt
# Store securely in password manager!

Configure OpenTofu variables:

cp tofu/terraform.tfvars.example tofu/terraform.tfvars
# Edit with your Hetzner API token and configuration

Provision infrastructure:
```
cd tofu
tofu init
tofu plan
tofu apply
```

Deploy applications:

cd ../ansible
ansible-playbook playbooks/setup.yml

🎯 Project Principles

EU/GDPR-first: European vendors and data residency
Truly open source: Avoid source-available or restrictive licenses
Client isolation: Full separation between tenants
Infrastructure as Code: All changes via version control
Security by default: Encryption, hardening, least privilege

📖 Documentation

PROJECT_REFERENCE.md - Essential information and common operations
Architecture Decision Record - Complete design rationale
Agent Definitions - Specialized AI agent instructions

🤝 Contributing

This project uses specialized AI agents for development:

Architect: High-level design decisions
Infrastructure: OpenTofu + Ansible implementation
Zitadel: Identity provider configuration
Nextcloud: File sync/share configuration

See individual agent files in .claude/agents/ for responsibilities.

🔒 Security

Secrets are encrypted with SOPS + Age before committing
Age private keys are NEVER stored in this repository
See .gitignore for protected files

📝 License

TBD

🙋 Support

For issues or questions, please create a GitHub issue with the appropriate label:

agent:architect - Architecture/design questions
agent:infrastructure - IaC implementation
agent:zitadel - Identity provider
agent:nextcloud - File sync/share

3.3 KiB Raw Blame History