Zitadel: fall back to Login V1 UI (Login V2 needs a separate deployed app)

README.md

@@ -58,6 +58,21 @@ this workspace to reach the Zitadel login page on port 8080 — browsing and rea
 quotes on the main app is public regardless. A demo user (`demo`) was created for
 testing; see `.zitadel-demo-user` (not committed) for its password.
 
+Zitadel defaults to "Login V2", a separate UI app we don't deploy here, so the
+instance's `loginV2.required` feature flag was switched off in favor of the classic
+login UI bundled in the main server image (`ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED`
+in `docker-compose.yml`, plus a one-time `PUT /v2/features/instance` call against the
+already-running instance — re-apply that call if the Zitadel volume is ever recreated
+and the env var doesn't take retroactively).
+
+The full authorize → login → callback → session chain was verified as far as it can be
+from inside the VM: OIDC discovery, the PKCE authorize redirect, and the login page
+itself (200, not 404) all check out. The very last mile — an actual browser completing
+login — couldn't be driven from here, since this VM's own DNS resolves its public
+hostname to a private, TLS-less address (bypassing exe.dev's real edge proxy), and
+Zitadel's login cookie is `__Host-`-prefixed, which browsers only accept over genuine
+HTTPS. Worth a real sign-in test from an actual browser to confirm the last step.
+
 ## Backups
 
 ```sh

docker-compose.yml

@@ -46,6 +46,9 @@ services:
       ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE: "2030-01-01T00:00:00Z"
       ZITADEL_FIRSTINSTANCE_PATPATH: /bootstrap/admin.pat
       ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED: "true"
+      # Use the classic server-rendered login UI (bundled in this image) instead of
+      # Login V2, which ships as a separate Next.js app we don't deploy here.
+      ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED: "false"
     ports:
       - "8080:8080"
     volumes: