Fix Zitadel TLS and email validation

Author: terion-labs

README.md

@@ -41,7 +41,7 @@ Non-interactive:
 ```bash
 curl -fsSL https://raw.githubusercontent.com/terion-name/terrarium/refs/heads/main/install.sh | bash -s -- \
   --non-interactive \
-  --email admin@example.com \
+  --email admin@your-domain.tld \
   --idp-mode zitadel-self-hosted \
   --storage-mode loop \
   --yes

ansible/roles/idp_zitadel/templates/terraform-main.tf.j2

@@ -9,8 +9,6 @@ terraform {
 
 provider "zitadel" {
   domain           = "{{ terrarium_auth_domain }}"
-  insecure         = true
-  port             = "{{ terrarium_zitadel_api_port }}"
   jwt_profile_file = "/secrets/admin-sa.json"
 }
 

scripts/terrarium-install.ts

@@ -51,6 +51,8 @@ function fail(message: string): never {
   process.exit(1);
 }
 
+const RESERVED_EMAIL_DOMAINS = new Set(["example.com", "example.org", "example.net"]);
+
 function info(message: string): void {
   console.log(chalk.cyan(`${PREFIX}: ${message}`));
 }
@@ -59,6 +61,19 @@ function success(message: string): void {
   console.log(chalk.green(`${PREFIX}: ${message}`));
 }
 
+function validateEmail(email: string, fieldName: string): string {
+  const normalized = email.trim();
+  const match = normalized.match(/^[^@\s]+@([^@\s]+)$/);
+  if (!match) {
+    fail(`${fieldName} must be a valid email address`);
+  }
+  const domain = match[1].toLowerCase();
+  if (RESERVED_EMAIL_DOMAINS.has(domain)) {
+    fail(`${fieldName} must not use reserved example.* domains because ACME rejects them`);
+  }
+  return normalized;
+}
+
 function requireRoot(): void {
   if (typeof process.getuid === "function" && process.getuid() !== 0) {
     fail("run as root");
@@ -193,6 +208,24 @@ async function promptText(message: string, defaultValue = ""): Promise<string> {
   });
 }
 
+async function promptEmail(message: string, defaultValue = "", fieldName = "email"): Promise<string> {
+  return await input({
+    message,
+    default: defaultValue,
+    validate: (value) => {
+      const normalized = value.trim();
+      const match = normalized.match(/^[^@\s]+@([^@\s]+)$/);
+      if (!match) {
+        return "Enter a valid email address";
+      }
+      if (RESERVED_EMAIL_DOMAINS.has(match[1].toLowerCase())) {
+        return "Reserved example.* domains are not accepted";
+      }
+      return true;
+    }
+  }).then((value) => validateEmail(value, fieldName));
+}
+
 async function promptConfirm(message: string, defaultValue: boolean, assumeYes: boolean): Promise<boolean> {
   if (assumeYes) {
     return true;
@@ -204,7 +237,7 @@ async function interactiveConfig(options: InstallOptions): Promise<void> {
   options.publicIp = await detectPublicIp(options.publicIp);
   const dashed = dashedIp(options.publicIp);
 
-  options.email = options.email || (await promptText("Email for ACME/notifications", `admin@${options.publicIp}.nip.io`));
+  options.email = options.email || (await promptEmail("Email for ACME/notifications", `admin@${options.publicIp}.nip.io`, "--email"));
   options.zitadelAdminEmail = options.zitadelAdminEmail || options.email;
 
   if (!options.domain && !options.manageDomain) {
@@ -237,7 +270,11 @@ async function interactiveConfig(options: InstallOptions): Promise<void> {
       options.authDomain ||
       (options.domain ? `auth.${options.domain}` : `auth.${dashed}.traefik.me`);
     options.authDomain = await promptText("ZITADEL auth domain", options.authDomain);
-    options.zitadelAdminEmail = await promptText("ZITADEL bootstrap admin email", options.zitadelAdminEmail || options.email);
+    options.zitadelAdminEmail = await promptEmail(
+      "ZITADEL bootstrap admin email",
+      options.zitadelAdminEmail || options.email,
+      "--zitadel-admin-email"
+    );
   } else {
     options.idpMode = "none";
     options.authDomain = "";
@@ -314,10 +351,12 @@ function validateNonInteractive(options: InstallOptions): void {
   if (!options.email) {
     fail("--email is required in non-interactive mode");
   }
+  options.email = validateEmail(options.email, "--email");
 
   if (options.idpMode === "zitadel_self_hosted") {
     options.authDomain = options.authDomain || (options.domain ? `auth.${options.domain}` : `auth.${dashed}.traefik.me`);
     options.zitadelAdminEmail = options.zitadelAdminEmail || options.email;
+    options.zitadelAdminEmail = validateEmail(options.zitadelAdminEmail, "--zitadel-admin-email");
   } else {
     options.authDomain = "";
   }

scripts/terrarium-zitadel-sync.ts

@@ -53,6 +53,23 @@ async function waitForApiReady(stackDir: string): Promise<void> {
   throw new Error(`timed out waiting for ZITADEL API readiness: ${lastError}`);
 }
 
+async function waitForHttpsDiscovery(authDomain: string): Promise<void> {
+  let lastError = "";
+  for (let attempt = 0; attempt < WAIT_ATTEMPTS; attempt += 1) {
+    const result = await runAllowFailure([
+      "curl",
+      "-fsS",
+      `https://${authDomain}/.well-known/openid-configuration`
+    ]);
+    if (result.exitCode === 0) {
+      return;
+    }
+    lastError = result.stderr.trim() || result.stdout.trim() || "OIDC discovery is not reachable yet";
+    await Bun.sleep(WAIT_INTERVAL_MS);
+  }
+  throw new Error(`timed out waiting for HTTPS OIDC discovery on ${authDomain}: ${lastError}`);
+}
+
 export async function idpSyncCmd(configPath = DEFAULT_CONFIG_PATH): Promise<void> {
   const config = loadConfig(configPath, PREFIX);
   if (configString(config, "terrarium_idp_mode") !== "zitadel_self_hosted") {
@@ -76,6 +93,7 @@ export async function idpSyncCmd(configPath = DEFAULT_CONFIG_PATH): Promise<void
   await waitForFile(`${bootstrapDir}/admin-sa.json`, "bootstrap machine key");
   await waitForFile(`${bootstrapDir}/login-client.pat`, "login client PAT");
   await waitForApiReady(zitadelDir);
+  await waitForHttpsDiscovery(authDomain);
 
   const commonArgs = [
     "run",