fix(zitadel): wire EXTERNALDOMAIN/PORT/SECURE to the generated domain

Zitadel resolves its instance from the external domain/port/scheme, so the
template's ZITADEL_EXTERNALPORT=8080 made every generated URL (OIDC issuer,
login redirects) point at http://<domain>:8080 instead of the domain served
by Traefik, ending in {"code":5,"message":"Not Found"} (#516).

- Expose ZITADEL_EXTERNALDOMAIN / ZITADEL_EXTERNALPORT / ZITADEL_EXTERNALSECURE
  as template env vars, defaulting to the generated domain over HTTP
  (port 80, secure=false) so the routed domain and Zitadel's external config
  always match; HTTPS users flip them to 443/true in the Env tab.
- Pin image to v4.16.0 (was latest) and keep the built-in login v1 via
  ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED=false so no separate
  login-v2 container is needed.
- Add the official readiness healthcheck, drop the unused /app/data volume,
  bogus SMTP env keys, published port and obsolete compose version key.

Closes #516

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

blueprints/gitlab-ce/docker-compose.yml

@@ -1,24 +1,65 @@
 services:
   gitlab:
-    image: gitlab/gitlab-ce:19.1.2-ce.0
+    image: gitlab/gitlab-ce:latest
     restart: unless-stopped
-    shm_size: "256m"
+    hostname: gitlab.example.com
     environment:
       GITLAB_OMNIBUS_CONFIG: |
         external_url 'http://${GITLAB_HOST}'
+        gitlab_rails['gitlab_ssh_host'] = '${GITLAB_HOST}'
+        gitlab_rails['gitlab_shell_ssh_port'] = 2224
+        gitlab_rails['db_adapter'] = 'postgresql'
+        gitlab_rails['db_host'] = 'postgresql'
+        gitlab_rails['db_port'] = '5432'
+        gitlab_rails['db_database'] = '${POSTGRES_DB}'
+        gitlab_rails['db_username'] = '${POSTGRES_USER}'
+        gitlab_rails['db_password'] = '${POSTGRES_PASSWORD}'
+        # Redis config for external TCP connection
+        gitlab_rails['redis_url'] = 'redis://redis:6379/0'
+        gitlab_rails['redis_host'] = 'redis'
+        gitlab_rails['redis_port'] = 6379
+        gitlab_rails['redis_socket'] = nil
+        gitlab_rails['gitlab_email_enabled'] = false
+        gitlab_rails['gitlab_default_can_create_group'] = true
+        gitlab_rails['gitlab_username_changing_enabled'] = false
+        unicorn['worker_processes'] = 2
+        unicorn['worker_timeout'] = 60
+        postgresql['enable'] = false
+        redis['enable'] = false
+        nginx['enable'] = true
         nginx['listen_port'] = 80
         nginx['listen_https'] = false
-        gitlab_rails['initial_root_password'] = '${GITLAB_ROOT_PASSWORD}'
-        gitlab_rails['gitlab_email_enabled'] = false
-        puma['worker_processes'] = 0
-        sidekiq['concurrency'] = 10
         prometheus_monitoring['enable'] = false
+    ports:
+      - "80"
+      - "2224"
     volumes:
       - gitlab_config:/etc/gitlab
       - gitlab_logs:/var/log/gitlab
       - gitlab_data:/var/opt/gitlab
+    depends_on:
+      - postgresql
+      - redis
+
+  postgresql:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    volumes:
+      - postgresql_data:/var/lib/postgresql/data
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    volumes:
+      - redis_data:/data
 
 volumes:
   gitlab_config:
   gitlab_logs:
   gitlab_data:
+  postgresql_data:
+  redis_data:

blueprints/gitlab-ce/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "gitlab-ce",
   "name": "GitLab CE",
-  "version": "19.1.2",
+  "version": "latest",
   "description": "GitLab Community Edition is a free and open source platform for managing Git repositories, CI/CD pipelines, and project management.",
   "logo": "gitlab-ce.svg",
   "links": {

blueprints/gitlab-ce/template.toml

@@ -1,11 +1,15 @@
 [variables]
 main_domain = "${domain}"
-gitlab_root_password = "${password:32}"
+postgres_db = "gitlab"
+postgres_user = "gitlab"
+postgres_password = "${password:32}"
 
 [config]
 env = [
   "GITLAB_HOST=${main_domain}",
-  "GITLAB_ROOT_PASSWORD=${gitlab_root_password}",
+  "POSTGRES_DB=${postgres_db}",
+  "POSTGRES_USER=${postgres_user}",
+  "POSTGRES_PASSWORD=${postgres_password}",
 ]
 
 [[config.domains]]

blueprints/zitadel/docker-compose.yml

@@ -1,9 +1,7 @@
-version: '3.8'
-
 services:
   zitadel:
     restart: 'always'
-    image: 'ghcr.io/zitadel/zitadel:latest'
+    image: 'ghcr.io/zitadel/zitadel:v4.16.0'
     command: 'start-from-init --masterkey "${ZITADEL_MASTERKEY}" --tlsMode disabled'
     environment:
       # Database Configuration
@@ -17,33 +15,37 @@ services:
       ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: "${POSTGRES_PASSWORD}"
       ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
 
-      # External Configuration for HTTP only - TLS mode disabled
-      ZITADEL_EXTERNALSECURE: false
-      ZITADEL_EXTERNALPORT: 8080
-      ZITADEL_EXTERNALDOMAIN: "${EXTERNAL_DOMAIN}"
+      # External access configuration. These MUST match the domain configured
+      # in the Domains tab and the scheme/port it is served on, otherwise
+      # Zitadel answers {"code":5,"message":"Not Found"}.
+      # HTTP  -> ZITADEL_EXTERNALPORT=80,  ZITADEL_EXTERNALSECURE=false
+      # HTTPS -> ZITADEL_EXTERNALPORT=443, ZITADEL_EXTERNALSECURE=true
+      ZITADEL_EXTERNALDOMAIN: "${ZITADEL_EXTERNALDOMAIN}"
+      ZITADEL_EXTERNALPORT: "${ZITADEL_EXTERNALPORT}"
+      ZITADEL_EXTERNALSECURE: "${ZITADEL_EXTERNALSECURE}"
       ZITADEL_TLS_ENABLED: false
 
-      # Disable Email Notifications
-      ZITADEL_NOTIFICATIONS_SMTP_HOST: ""
-      ZITADEL_NOTIFICATIONS_SMTP_PORT: ""
-
       # Custom Admin User Configuration
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME}"
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD}"
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS}"
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME}"
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME}"
-      
-      # Default Instance Features
+
+      # Use the login UI built into the API container (no extra login-v2 service needed)
       ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED: false
 
+    healthcheck:
+      test: ["CMD", "/app/zitadel", "ready"]
+      interval: '10s'
+      timeout: '30s'
+      retries: 12
+      start_period: '30s'
     depends_on:
       db:
         condition: 'service_healthy'
-    ports:
-      - '8080'
-    volumes:
-      - zitadel_data:/app/data
+    expose:
+      - 8080
 
   db:
     restart: 'always'
@@ -63,4 +65,3 @@ services:
 
 volumes:
   postgres_data:
-  zitadel_data:

blueprints/zitadel/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "zitadel",
   "name": "Zitadel",
-  "version": "latest",
+  "version": "4.16.0",
   "description": "Open-source identity and access management platform with multi-tenancy, OpenID Connect, SAML, and OAuth 2.0 support.",
   "logo": "zitadel.png",
   "links": {

blueprints/zitadel/template.toml

@@ -7,6 +7,8 @@ admin_email = "${email}"
 admin_password = "AdminPassword123!"
 
 [config]
+mounts = []
+
 [[config.domains]]
 serviceName = "zitadel"
 port = 8080
@@ -16,7 +18,15 @@ path = "/"
 [config.env]
 POSTGRES_PASSWORD = "${postgres_password}"
 ZITADEL_MASTERKEY = "${zitadel_masterkey}"
-EXTERNAL_DOMAIN = "${main_domain}"
+
+# ZITADEL_EXTERNALDOMAIN must always match the domain configured in the
+# Domains tab. If you change the domain, update this variable too (and do it
+# BEFORE the first deploy — Zitadel binds its instance to this domain on
+# first start). For a domain served over HTTPS set ZITADEL_EXTERNALPORT=443
+# and ZITADEL_EXTERNALSECURE=true.
+ZITADEL_EXTERNALDOMAIN = "${main_domain}"
+ZITADEL_EXTERNALPORT = "80"
+ZITADEL_EXTERNALSECURE = "false"
 
 # Custom Admin User Configuration
 ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME = "${admin_username}"
@@ -24,5 +34,3 @@ ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD = "${admin_password}"
 ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS = "${admin_email}"
 ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME = "Admin"
 ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME = "User"
-
-[[config.mounts]]