Repository navigation
Conversation
|
Your Vercel team Vercel Solutions is not permitted to deploy from this git repository. Contact an administrator to add github organization vercel as a Protected Git Scope in Vercel Solutions on Vercel. Once added, commit again to see your changes. Learn more: https://vercel.com/docs/security/protected-git-scopes |
|
Deployment failed for project mintlify-docs-rewrite with the following error: Learn More: https://vercel.com/docs/concepts/projects/project-configuration |
|
Your Vercel team vtest314-hive is not permitted to deploy from this git repository. Contact an administrator to add github organization vercel as a Protected Git Scope in vtest314-hive on Vercel. Once added, commit again to see your changes. Learn more: https://vercel.com/docs/security/protected-git-scopes |
Adds
container-images/zeroauthy, a standalone example that runs zeroauthy on Vercel Functions as a container image, with Postgres for storage.Why
zeroauthy is an open-source (Apache-2.0), OpenID-certified identity server written in Go. It speaks the Auth0 Authentication and Management APIs, so existing Auth0 SDKs work against it without code changes. It fits Vercel well: one static binary, plain HTTP, all state in a SQL database, and an issuer that is always
https://<host>/, so it works unchanged behind Vercel's TLS termination.Approach
The example contains no zeroauthy code, following the respan-gateway container example.
Dockerfile.vercelfetches zeroauthy at pinned commit5d1c30c(there is no tagged release yet). It builds a staticCGO_ENABLED=0binary, which embeds the committed admin console, and ships it ondistroless/static:nonroot. The image is about 66 MB.ZEROAUTHY_SERVER__LISTEN=:80(Vercel's default port), JSON logs,AUTO_MIGRATE=trueandSEED_MODE=create_only.ZEROAUTHY_STORAGE__DSN(Marketplace Postgres),ZEROAUTHY_SECURITY__MASTER_KEYandZEROAUTHY_SERVER__SYSTEM_HOST(the admin console host).zeroauthy admin create, run locally against the same database. The built-in bootstrap writes its link to the instance's disk, which you can't read on Vercel.local-test/smoke-test.shruns the built image the way Vercel does: port 80, no TLS, and theHostheader selects the tenant. It uses a throwaway Postgres container and test-only seed credentials.verify_jwt.pychecks RS256 signatures against the JWKS using only the Python standard library.Validation
Built from this
Dockerfile.vercelin Docker (adding the build machine's TLS-proxy CA to a throwaway local copy only), then ran./local-test/smoke-test.sh:The last three checks replace the container with a fresh one on the same database. Keys, clients and users survive, which is what lets the app scale across function instances.
Not verified
postgres:17-alpine).