From 9f4801af6800848df2de46670fb6076c772f6c17 Mon Sep 17 00:00:00 2001
From: ivan <ivan@MacBook-Air-som-tillhor-ivan.local>
Date: Thu, 29 Oct 2026 15:32:27 +0500
Subject: [PATCH] ++ contour zitadel: sarex-installer machine user for
 zitadel-setup

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 infrastructure/zitadel/contour-template/zitadel.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/infrastructure/zitadel/contour-template/zitadel.yaml b/infrastructure/zitadel/contour-template/zitadel.yaml
index ba42a20..fe8dbd1 100644
--- a/infrastructure/zitadel/contour-template/zitadel.yaml
+++ b/infrastructure/zitadel/contour-template/zitadel.yaml
@@ -110,6 +110,17 @@ spec:
       configmapConfig:
         ExternalDomain: ${HOST_LOGIN}
         ExternalSecure: true
+        # IAM_OWNER service user for sarexctl phase zitadel-setup; the chart stores its key
+        # in secret zitadel/sarex-installer. Created only on the first instance setup.
+        FirstInstance:
+          Org:
+            Machine:
+              Machine:
+                Username: sarex-installer
+                Name: sarexctl
+              MachineKey:
+                ExpirationDate: "2099-01-01T00:00:00Z"
+                Type: 1
       debug:
         enabled: false
     postgresqlSecret: