Zitadel: run init and setup in the foreground

start-from-init ran in the background with its output thrown away, and the PID to kill was guessed from lsof after 60 seconds; when the process had already ended, kill got no PID and failed with exit 2. init and setup finish on their own, report their errors, and the service only starts once its user exists.
2026-10-20 15:36:52 -04:00 · 2026-10-19 19:33:48 +02:00
13 changed files with 121 additions and 250 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -565,32 +565,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

-## 2026-10-20
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Plane: give Silo its own HOME [@MickLesk](https://github.com/MickLesk) ([#18028](https://github.com/community-scripts/ProxmoxVE/pull/18028))
-    - Immich: Pin version to 3.3.4 [@vhsdream](https://github.com/vhsdream) ([#18036](https://github.com/community-scripts/ProxmoxVE/pull/18036))
-    - InvenTree: run apt under systemd so postinst can finish [@MickLesk](https://github.com/MickLesk) ([#18029](https://github.com/community-scripts/ProxmoxVE/pull/18029))
-    - Profilarr: pass the deno pin as the version [@MickLesk](https://github.com/MickLesk) ([#18025](https://github.com/community-scripts/ProxmoxVE/pull/18025))
-    - Silo: keep the version file out of ~/.silo [@MickLesk](https://github.com/MickLesk) ([#18030](https://github.com/community-scripts/ProxmoxVE/pull/18030))
-    - InvenTree: move to go.packager.io [@MickLesk](https://github.com/MickLesk) ([#18015](https://github.com/community-scripts/ProxmoxVE/pull/18015))
-    - Zitadel: run init and setup in the foreground [@MickLesk](https://github.com/MickLesk) ([#18016](https://github.com/community-scripts/ProxmoxVE/pull/18016))
-
-  - #### ✨ New Features
-
-    - Zitadel: Support v1 and v2 Login [@MickLesk](https://github.com/MickLesk) ([#18031](https://github.com/community-scripts/ProxmoxVE/pull/18031))
-
-  - #### 🔧 Refactor
-
-    - Refactor: OpenWebUI (remove numba pin)  [@MickLesk](https://github.com/MickLesk) ([#18026](https://github.com/community-scripts/ProxmoxVE/pull/18026))
-
-### 💾 Core
-
-  - Only treat an NVIDIA GPU as present when its device nodes are [@MickLesk](https://github.com/MickLesk) ([core#153](https://github.com/community-scripts/core/pull/153))
-
 ## 2026-10-19

 ### 🆕 New Scripts
--- a/ct/immich.sh
+++ b/ct/immich.sh
@@ -77,7 +77,7 @@ EOF
  BASE_DIR=${STAGING_DIR}/base-images
  SOURCE_DIR=${STAGING_DIR}/image-source
  cd /tmp
-  RELEASE="v3.3.4"
+  RELEASE="v3.3.1"
  if [[ -f ~/.intel_version ]]; then
    INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
    curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||
--- a/ct/inventree.sh
+++ b/ct/inventree.sh
@@ -31,36 +31,14 @@ function update_script() {
    exit
  fi

-  if ! grep -qE "^ID=(ubuntu|debian)$" /etc/os-release; then
-    msg_error "Unsupported OS. InvenTree requires Ubuntu or Debian."
+  if ! grep -qE "^ID=(ubuntu)$" /etc/os-release; then
+    msg_error "Unsupported OS. InvenTree requires Ubuntu (20.04/22.04/24.04)."
    exit
  fi

-  # dl.packager.io is frozen at 1.5.1 and its SHA1-bound key fails on Debian 13;
-  # go.packager.io only carries current builds for these releases
-  if grep -qs "dl.packager.io" /etc/apt/sources.list.d/inventree*; then
-    case "$(get_os_info id)/$(get_os_info version)" in
-    ubuntu/24.04 | ubuntu/26.04 | debian/13)
-      msg_info "Migrating InvenTree Repository"
-      setup_deb822_repo \
-        "inventree" \
-        "https://go.packager.io/srv/deb/inventree/InvenTree/gpg-key.asc" \
-        "https://go.packager.io/srv/deb/inventree/InvenTree/stable/$(get_os_info id)" \
-        "$(get_os_info version)" \
-        "main"
-      msg_ok "Migrated InvenTree Repository"
-      ;;
-    *)
-      msg_warn "InvenTree only publishes updates for Ubuntu 24.04/26.04 and Debian 13; staying on the frozen repository"
-      ;;
-    esac
-  fi
-
  msg_info "Updating InvenTree"
  apt_update_safe
-  # postinst loops forever unless its parent chain reaches PID 1 (not the case under pct exec)
-  $STD systemd-run --wait --pipe --quiet --collect --setenv=DEBIAN_FRONTEND=noninteractive \
-    apt-get install --only-upgrade -y inventree
+  $STD apt install --only-upgrade inventree -y
  msg_ok "Updated InvenTree"
  msg_ok "Updated successfully!"
  exit
--- a/ct/openwebui.sh
+++ b/ct/openwebui.sh
@@ -49,13 +49,10 @@ function update_script() {

    msg_info "Installing uv-based Open-WebUI"
    PYTHON_VERSION="3.12" setup_uv
-    installed=0
-    for attempt in 1 2; do
-      $STD uv tool install --python 3.12 open-webui[all] && { installed=1; break; }
-      msg_warn "Open WebUI install attempt $attempt failed, retrying..."
-      sleep 10
+    for attempt in $(seq 1 3); do
+      $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") open-webui[all] && break
+      [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
    done
-    ((installed)) || $STD uv tool install --python 3.12 open-webui[all]
    msg_ok "Installed uv-based Open-WebUI"

    msg_info "Restoring data"
@@ -128,13 +125,10 @@ EOF
      OTEL_ARGS+=(--with "$pkg")
    done < <(uv pip list --python "$OWUI_PYTHON" --format freeze 2>/dev/null | grep -i '^opentelemetry-' | cut -d= -f1)
  fi
-  updated=0
-  for attempt in 1 2; do
-    $STD uv tool install --force --python 3.12 "${OTEL_ARGS[@]}" open-webui[all] && { updated=1; break; }
-    msg_warn "Open WebUI update attempt $attempt failed, retrying..."
-    sleep 10
+  for attempt in $(seq 1 3); do
+    $STD uv tool install --force --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
+    [[ $attempt -lt 3 ]] && msg_warn "Open WebUI update attempt $attempt failed, retrying..." && sleep 10
  done
-  ((updated)) || $STD uv tool install --force --python 3.12 "${OTEL_ARGS[@]}" open-webui[all]
  systemctl restart open-webui
  msg_ok "Updated Open WebUI"
  msg_ok "Updated successfully!"
--- a/ct/profilarr.sh
+++ b/ct/profilarr.sh
@@ -41,7 +41,7 @@ function update_script() {
  ARCH=$(uname -m)

  if check_for_gh_release "deno" "denoland/deno" "v2.7.5" "Deno is pinned to 2.7.5 because the known WouldBlock: Resource temporarily unavailable (os error 11) Issue"; then
-    fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "v2.7.5" "/usr/local/bin" "deno-${ARCH}-unknown-linux-gnu.zip"
+    fetch_and_deploy_gh_release "deno" "denoland/deno" "v2.7.5" "latest" "/usr/local/bin" "deno-${ARCH}-unknown-linux-gnu.zip"
  fi

  if check_for_gh_release "profilarr" "Dictionarry-Hub/profilarr"; then
--- a/ct/silo.sh
+++ b/ct/silo.sh
@@ -31,13 +31,12 @@ function update_script() {
    exit
  fi

-  [[ -f ~/.silo ]] && mv ~/.silo ~/.silo_s3
-  if check_for_gh_release "silo_s3" "pgsty/silo"; then
+  if check_for_gh_release "silo" "pgsty/silo"; then
    msg_info "Stopping Silo"
    systemctl stop silo
    msg_ok "Stopped Silo"

-    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "silo_s3" "pgsty/silo" "binary"
+    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "silo" "pgsty/silo" "binary"

    msg_info "Starting Silo"
    systemctl start silo
--- a/ct/zitadel.sh
+++ b/ct/zitadel.sh
@@ -2,7 +2,7 @@
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: dave-yap (dave-yap) | Co-Author: remz1337, MickLesk (CanbiZ)
+# Author: dave-yap (dave-yap)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://zitadel.com/ | Github: https://github.com/zitadel/zitadel

@@ -16,23 +16,11 @@ var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

-if [[ -z "${var_zitadel_login:-}" ]] && command -v pveversion >/dev/null 2>&1; then
-  var_zitadel_login=$(msg_menu "Choose the Zitadel login UI" \
-    "v2" "Login V2, Zitadel's default (HTTPS, self-signed certificate)" \
-    "v1" "Login V1, the classic login built into the API (HTTP)")
-fi
-export var_zitadel_login="${var_zitadel_login:-v2}"
-
 header_info "$APP"
 variables
 color
 catch_errors

-if [[ ! "${var_zitadel_login}" =~ ^v[12]$ ]]; then
-  msg_error "var_zitadel_login must be v1 or v2"
-  exit 1
-fi
-
 function update_script() {
  header_info
  check_container_storage
@@ -43,29 +31,20 @@ function update_script() {
  fi

  if check_for_gh_release "zitadel" "zitadel/zitadel"; then
-    msg_info "Stopping Zitadel"
-    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
-      systemctl stop zitadel-login
-    fi
+    msg_info "Stopping Service"
    systemctl stop zitadel
-    msg_ok "Stopped Zitadel"
+    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "${CHECK_UPDATE_RELEASE}" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"
-    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
-      NODE_VERSION="24" setup_nodejs
-      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "zitadel-login" "zitadel/zitadel" "prebuild" "${CHECK_UPDATE_RELEASE}" "/opt/zitadel-login" "zitadel-login.tar.gz"
-    fi
+    rm -f /usr/local/bin/zitadel
+    fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "latest" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"

-    msg_info "Migrating Zitadel Database"
+    msg_info "Updating Zitadel"
    $STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml --init-projections=true
-    msg_ok "Migrated Zitadel Database"
+    msg_ok "Updated Zitadel"

-    msg_info "Starting Zitadel"
+    msg_info "Starting Service"
    systemctl start zitadel
-    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
-      systemctl start zitadel-login
-    fi
-    msg_ok "Started Zitadel"
+    msg_ok "Started Service"
    msg_ok "Updated successfully!"
  fi
  exit
@@ -78,9 +57,4 @@ description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-if [[ "${var_zitadel_login}" == "v1" ]]; then
-  echo -e "${GATEWAY}${BGN}http://${IP}:8080/ui/console${CL}"
-else
-  echo -e "${GATEWAY}${BGN}https://${IP}:8080/ui/console${CL}"
-fi
-echo -e "${INFO}${YW}Admin credentials: ~/zitadel.creds (inside the container)${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080/ui/console${CL}"
--- a/install/immich-install.sh
+++ b/install/immich-install.sh
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-RELEASE="v3.3.4"
+RELEASE="v3.3.1"
 if lscpu | grep -q 'GenuineIntel'; then
  echo ""
  echo ""
--- a/install/inventree-install.sh
+++ b/install/inventree-install.sh
@@ -16,17 +16,15 @@ update_os
 msg_info "Setting up InvenTree Repository"
 setup_deb822_repo \
  "inventree" \
-  "https://go.packager.io/srv/deb/inventree/InvenTree/gpg-key.asc" \
-  "https://go.packager.io/srv/deb/inventree/InvenTree/stable/$(get_os_info id)" \
+  "https://dl.packager.io/srv/inventree/InvenTree/key" \
+  "https://dl.packager.io/srv/deb/inventree/InvenTree/stable/$(get_os_info id)" \
  "$(get_os_info version)" \
  "main"
 msg_ok "Set up InvenTree Repository"

 msg_info "Installing InvenTree (Patience)"
-# The package's postinst walks parent PIDs until it reaches PID 1; under pct exec the chain ends at 0
-# and since 1.6.0 that loops forever, so apt runs as a child of systemd
-$STD systemd-run --wait --pipe --quiet --collect --setenv=SETUP_NO_CALLS=true --setenv=DEBIAN_FRONTEND=noninteractive \
-  apt-get install -y inventree
+export SETUP_NO_CALLS=true
+$STD apt install -y inventree
 msg_ok "Installed InvenTree"

 msg_info "Configuring InvenTree"
--- a/install/openwebui-install.sh
+++ b/install/openwebui-install.sh
@@ -47,13 +47,10 @@ if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
 fi

 msg_info "Installing Open WebUI"
-installed=0
-for attempt in 1 2; do
-  $STD uv tool install --python 3.12 "${OTEL_ARGS[@]}" open-webui[all] && { installed=1; break; }
-  msg_warn "Open WebUI install attempt $attempt failed, retrying..."
-  sleep 10
+for attempt in $(seq 1 3); do
+  $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
+  [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
 done
-((installed)) || $STD uv tool install --python 3.12 "${OTEL_ARGS[@]}" open-webui[all]
 msg_ok "Installed Open WebUI"

 prompt="${var_openwebui_ollama:-}"
--- a/install/plane-install.sh
+++ b/install/plane-install.sh
@@ -43,7 +43,7 @@ $STD rabbitmqctl add_user plane "${RABBITMQ_PASS}"
 $STD rabbitmqctl set_permissions -p plane plane ".*" ".*" ".*"
 msg_ok "Configured RabbitMQ"

-fetch_and_deploy_gh_release "silo_s3" "pgsty/silo" "prebuild" "latest" "/opt/silo" "silo_*_linux_$(arch_resolve).tar.gz"
+fetch_and_deploy_gh_release "silo" "pgsty/silo" "prebuild" "latest" "/opt/silo" "silo_*_linux_$(arch_resolve).tar.gz"
 fetch_and_deploy_gh_release "silo_mcli" "pgsty/mc" "prebuild" "latest" "/opt/mcli" "mcli_*_linux_$(arch_resolve).tar.gz"

 msg_info "Configuring Silo"
--- a/install/silo-install.sh
+++ b/install/silo-install.sh
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-fetch_and_deploy_gh_release "silo_s3" "pgsty/silo" "binary"
+fetch_and_deploy_gh_release "silo" "pgsty/silo" "binary"

 msg_info "Configuring Silo"
 mkdir -p /opt/silo_data
--- a/install/zitadel-install.sh
+++ b/install/zitadel-install.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash

 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: dave-yap (dave-yap) | Co-Author: remz1337, MickLesk (CanbiZ)
+# Author: dave-yap
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://zitadel.com/ | Github: https://github.com/zitadel/zitadel

@@ -13,174 +13,131 @@ setting_up_container
 network_check
 update_os

-var_zitadel_login="${var_zitadel_login:-v2}"
+msg_info "Installing Dependencies (Patience)"
+$STD apt install -y ca-certificates
+msg_ok "Installed Dependecies"

 PG_VERSION="17" setup_postgresql
-PG_DB_NAME="zitadel" PG_DB_USER="zitadel" setup_postgresql_db
+
+msg_info "Installing Postgresql"
+DB_NAME="zitadel"
+DB_USER="zitadel"
+DB_PASS=$(random_password 13)
+DB_ADMIN_USER="root"
+DB_ADMIN_PASS=$(random_password 13)
+systemctl start postgresql
+$STD sudo -u postgres psql -c "CREATE USER $DB_USER WITH PASSWORD '$DB_PASS';"
+$STD sudo -u postgres psql -c "CREATE USER $DB_ADMIN_USER WITH PASSWORD '$DB_ADMIN_PASS' SUPERUSER;"
+$STD sudo -u postgres psql -c "CREATE DATABASE $DB_NAME OWNER $DB_ADMIN_USER;"
+cat <<EOF >~/zitadel.creds
+Application Credentials
+DB_NAME: $DB_NAME
+DB_USER: $DB_USER
+DB_PASS: $DB_PASS
+DB_ADMIN_USER: $DB_ADMIN_USER
+DB_ADMIN_PASS: $DB_ADMIN_PASS
+EOF
+msg_ok "Installed PostgreSQL"
+
 fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "latest" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"

-msg_info "Configuring Zitadel"
+msg_info "Setting up Zitadel Environments"
 mkdir -p /opt/zitadel
-random_password 32 >/opt/zitadel/.masterkey
-ADMIN_PASS="$(random_password 20)Aa1!"
+echo "/opt/zitadel/config.yaml" >"/opt/zitadel/.config"
+random_password 32 >"/opt/zitadel/.masterkey"
+cat <<EOF >~/zitadel.creds
+Config location: $(cat "/opt/zitadel/.config")
+Masterkey: $(cat "/opt/zitadel/.masterkey")
+EOF
 cat <<EOF >/opt/zitadel/config.yaml
-ExternalDomain: ${LOCAL_IP}
+Port: 8080
 ExternalPort: 8080
+ExternalDomain: localhost
+ExternalSecure: false
 TLS:
  Enabled: false
+  KeyPath: ""
+  Key: ""
+  CertPath: ""
+  Cert: ""
+
 Database:
  postgres:
    Host: localhost
    Port: 5432
-    Database: zitadel
+    Database: ${DB_NAME}
    User:
-      Username: zitadel
-      Password: ${PG_DB_PASS}
+      Username: ${DB_USER}
+      Password: ${DB_PASS}
      SSL:
        Mode: disable
-EOF
-if [[ "$var_zitadel_login" == "v1" ]]; then
-  cat <<EOF >>/opt/zitadel/config.yaml
-Port: 8080
-ExternalSecure: false
+        RootCert: ""
+        Cert: ""
+        Key: ""
+    Admin:
+      Username: ${DB_ADMIN_USER}
+      Password: ${DB_ADMIN_PASS}
+      SSL:
+        Mode: disable
+        RootCert: ""
+        Cert: ""
+        Key: ""
 DefaultInstance:
  Features:
    LoginV2:
      Required: false
-FirstInstance:
-  Org:
-    Human:
-      UserName: zitadel-admin@zitadel.localhost
-      Password: ${ADMIN_PASS}
-      PasswordChangeRequired: true
 EOF
-else
-  cat <<EOF >>/opt/zitadel/config.yaml
-Port: 8081
-ExternalSecure: true
-DefaultInstance:
-  Features:
-    LoginV2:
-      Required: true
-FirstInstance:
-  LoginClientPatPath: /opt/zitadel/login-client.pat
-  Org:
-    Human:
-      UserName: zitadel-admin@zitadel.localhost
-      Password: ${ADMIN_PASS}
-      PasswordChangeRequired: true
-    LoginClient:
-      Machine:
-        Username: login-client
-        Name: Automatically Initialized IAM_LOGIN_CLIENT
-      Pat:
-        ExpirationDate: 2099-01-01T00:00:00Z
-EOF
-fi
-chmod 600 /opt/zitadel/.masterkey /opt/zitadel/config.yaml
-msg_ok "Configured Zitadel"
+msg_ok "Installed Zitadel Enviroments"

-msg_info "Initializing Zitadel"
-$STD zitadel init zitadel --config /opt/zitadel/config.yaml
-$STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml --steps /opt/zitadel/config.yaml
-cat <<EOF >>~/zitadel.creds
-
-Zitadel Admin
-Username: zitadel-admin@zitadel.localhost
-Initial Password: ${ADMIN_PASS}
-EOF
-chmod 600 ~/zitadel.creds
-msg_ok "Initialized Zitadel"
-
-msg_info "Creating Service"
+msg_info "Creating Services"
 cat <<EOF >/etc/systemd/system/zitadel.service
 [Unit]
-Description=Zitadel
+Description=ZITADEL Identiy Server
 After=network.target postgresql.service
 Wants=postgresql.service

 [Service]
 Type=simple
-ExecStart=/usr/local/bin/zitadel start --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml
+User=zitadel
+Group=zitadel
+ExecStart=/usr/local/bin/zitadel start --masterkeyFile "/opt/zitadel/.masterkey" --config "/opt/zitadel/config.yaml"
 Restart=always
 RestartSec=5
+TimeoutStartSec=0
+
+# Security Hardening options
+ProtectSystem=full
+ProtectHome=true
+PrivateTmp=true
+NoNewPrivileges=true

 [Install]
 WantedBy=multi-user.target
 EOF
-systemctl enable -q --now zitadel
-msg_ok "Created Service"
+systemctl enable -q zitadel
+msg_ok "Created Services"

-if [[ "$var_zitadel_login" != "v1" ]]; then
-  NODE_VERSION="24" setup_nodejs
-  fetch_and_deploy_gh_release "zitadel-login" "zitadel/zitadel" "prebuild" "latest" "/opt/zitadel-login" "zitadel-login.tar.gz"
+msg_info "Zitadel initial setup"
+$STD zitadel init --config /opt/zitadel/config.yaml
+$STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml
+useradd zitadel
+msg_ok "Zitadel initialized"

-  msg_info "Setting up Zitadel Login"
-  $STD apt install -y nginx
-  create_self_signed_cert "zitadel"
-  cat <<EOF >/opt/zitadel/login.env
-ZITADEL_API_URL=http://127.0.0.1:8081
-ZITADEL_API_AWAITINITIALCONN=5m
-ZITADEL_SERVICE_USER_TOKEN_FILE=/opt/zitadel/login-client.pat
-ZITADEL_SESSION_COOKIE_SECRET=$(random_password 48)
-NEXT_PUBLIC_BASE_PATH=/ui/v2/login
-HOSTNAME=127.0.0.1
-PORT=3000
+msg_info "Set ExternalDomain to current IP and restart Zitadel"
+IP=$(ip a s dev eth0 | awk '/inet / {print $2}' | cut -d/ -f1)
+sed -i "0,/localhost/s/localhost/${IP}/" /opt/zitadel/config.yaml
+systemctl stop -q zitadel
+$STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml
+systemctl restart -q zitadel
+msg_ok "Zitadel restarted with ExternalDomain set to current IP"
+
+msg_info "Create zitadel-rerun.sh"
+cat <<EOF >~/zitadel-rerun.sh
+systemctl stop zitadel
+timeout --kill-after=5s 15s zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml
+systemctl restart zitadel
 EOF
-  chmod 600 /opt/zitadel/login.env /opt/zitadel/login-client.pat
-  cat <<EOF >/etc/systemd/system/zitadel-login.service
-[Unit]
-Description=Zitadel Login
-After=network.target zitadel.service
-Wants=zitadel.service
-
-[Service]
-Type=simple
-WorkingDirectory=/opt/zitadel-login
-EnvironmentFile=/opt/zitadel/login.env
-ExecStart=/opt/zitadel-login/entrypoint.sh node apps/login/server.js
-Restart=always
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-  systemctl enable -q --now zitadel-login
-  cat <<'EOF' >/etc/nginx/sites-available/zitadel
-server {
-    listen 8080 ssl;
-    http2 on;
-    server_name _;
-    ssl_certificate /etc/ssl/zitadel/zitadel.crt;
-    ssl_certificate_key /etc/ssl/zitadel/zitadel.key;
-    error_page 497 =301 https://$http_host$request_uri;
-
-    location = / {
-        return 302 /ui/v2/login/;
-    }
-
-    location /ui/v2/login {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $http_host;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    location /api/ {
-        rewrite ^/api(/.*)$ $1 break;
-        grpc_pass grpc://127.0.0.1:8081;
-        grpc_set_header Host $http_host;
-    }
-
-    location / {
-        grpc_pass grpc://127.0.0.1:8081;
-        grpc_set_header Host $http_host;
-    }
-}
-EOF
-  nginx_enable_site "zitadel"
-  msg_ok "Set up Zitadel Login"
-fi
+msg_ok "Bash script for rerunning Zitadel after changing Zitadel config.yaml"

 motd_ssh
 customize