Zitadel - Hardened Self-Hosted Identity and Access Management

This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.

WHAT IS ZITADEL

Zitadel is an open-source identity and access management platform: it authenticates your users and issues tokens for your own applications over the standards they already speak. It is a single statically linked Go binary that serves the API and the admin Console, paired with a hosted login UI, and this AMI bundles the PostgreSQL 17 event store it needs. Feature blocks include OpenID Connect 1.0, OAuth 2.0 with the device and token-exchange flows, SAML 2.0, SCIM 2.0 provisioning, passwords, passkeys/WebAuthn and time-based one-time codes, plus multiple organizations inside one instance for multi-tenant products. Zitadel is event-sourced - every change is appended to an immutable event log in PostgreSQL, so the audit trail is the storage model rather than an add-on, and ordinary PostgreSQL backup and replication tooling applies directly. AGPL-3.0 license, no vendor lock-in: the issuer is a hostname you control, so you can rebuild or move the deployment without every relying party re-integrating.

WHAT THIS AMI ADDS

Security hardening:

• No credentials are baked into the AMI - the administrator password, the PostgreSQL application and superuser passwords, and the encryption master key that protects every stored secret are all generated on the instance at first launch and written to /root/zitadel-credentials.txt
• Self-registration is disabled, so anonymous visitors cannot create their own accounts in your directory; it can be enabled from the Console when you want public sign-up
• A unique TLS certificate is generated on each instance at first launch, carrying that instance's address - no private key is shared between deployments
• TLS is terminated at the perimeter on 443 in front of the Console, the OIDC/OAuth2/SAML/SCIM endpoints and gRPC; the application ports are not reachable from the network
• Bundled PostgreSQL 17 bound to 127.0.0.1 only, SCRAM-SHA-256 authentication, no trust authentication anywhere, and blocked externally in the firewall
• Login and consent screens cannot be framed (X-Frame-Options DENY), which blocks the classic consent-clickjacking attack against an identity provider
• Usage reporting is switched off - nothing leaves the instance
• The encryption master key is stored root-only and the login service cannot read it, so a compromise of the login process does not expose stored secrets
• UFW firewall pre-configured - TCP 22, 80 and 443 open; the API port, the login service port and PostgreSQL blocked
• fail2ban, AppArmor
• CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown, with a documented tailored profile
• auditd, SSH hardening (key-only, no password authentication), Kernel hardening, IMDSv2 enforced

Compliance artifacts:

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report at /etc/lynxroute/cis-report.html
• CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• AGPL-3.0 license text and the exact upstream revision this image was built from at /usr/share/doc/lynxroute/LICENSES.txt