Zitadel Login Error after Upgrade

🏬Self-hosted🪲Bugs✅Solved

Use-case: Personal services for SSO
Environment: Self-Hosting Docker
Version: 3.3.2
Stack: I use Cloudflare tunnel as a reverse proxy for my external domain. Here's the actual compose file:

services:
  zitadel:
    restart: 'always'
    networks:
      - 'zitadel'
    #image: 'ghcr.io/zitadel/zitadel:latest'
    image: 'ghcr.io/zitadel/zitadel:oldlocal'
    command: 'start --masterkey "keychangedhere" --tlsMode external'
    environment:
      ZITADEL_DATABASE_POSTGRES_HOST: db
      ZITADEL_DATABASE_POSTGRES_PORT: 5432
      ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
      ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
      ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
      ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
      ZITADEL_ACTIONS_HTTP_DENYLIST: "0.0.0.0/0"
      ZITADEL_EXTERNALSECURE: true
      ZITADEL_EXTERNALDOMAIN: auth.domain.com
      ZITADEL_EXTERNALPORT: 443
    depends_on:
      db:
        condition: 'service_healthy'
    ports:
      - '80:8080'

  db:
    restart: 'always'
    image: postgres:17-alpine
    environment:
      PGUSER: postgres
      POSTGRES_PASSWORD: postgres
    volumes:
      - /data/zitadel/db:/var/lib/postgresql/data
    networks:
      - 'zitadel'
    healthcheck:
      test: ["CMD-SHELL", "pg_isready", "-d", "zitadel", "-U", "postgres"]
      interval: '10s'
      timeout: '30s'
      retries: 5
      start_period: '20s'

networks:
  zitadel:

services:
  zitadel:
    restart: 'always'
    networks:
      - 'zitadel'
    #image: 'ghcr.io/zitadel/zitadel:latest'
    image: 'ghcr.io/zitadel/zitadel:oldlocal'
    command: 'start --masterkey "keychangedhere" --tlsMode external'
    environment:
      ZITADEL_DATABASE_POSTGRES_HOST: db
      ZITADEL_DATABASE_POSTGRES_PORT: 5432
      ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
      ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
      ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
      ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
      ZITADEL_ACTIONS_HTTP_DENYLIST: "0.0.0.0/0"
      ZITADEL_EXTERNALSECURE: true
      ZITADEL_EXTERNALDOMAIN: auth.domain.com
      ZITADEL_EXTERNALPORT: 443
    depends_on:
      db:
        condition: 'service_healthy'
    ports:
      - '80:8080'

  db:
    restart: 'always'
    image: postgres:17-alpine
    environment:
      PGUSER: postgres
      POSTGRES_PASSWORD: postgres
    volumes:
      - /data/zitadel/db:/var/lib/postgresql/data
    networks:
      - 'zitadel'
    healthcheck:
      test: ["CMD-SHELL", "pg_isready", "-d", "zitadel", "-U", "postgres"]
      interval: '10s'
      timeout: '30s'
      retries: 5
      start_period: '20s'

networks:
  zitadel:

Attachments:

2025-12-07T20:23:35.284149936Z time=2025-12-07T20:23:35.283Z level=ERROR msg="request error" oidc_error.parent="ID=QUERY-Iuk0s Message=Errors.Internal Parent=(ID=CRYPT-Jaik2R Message=error decrypting value Parent=(invalid character '/' in literal true (expecting 'r')))" oidc_error.description=Errors.Internal oidc_error.type=server_error status_code=500

I'm trying to upgrade from the last version I had, 3.32, to the latest docker image. When I try to authenticate to the initial admin user, I get the above error in attachments. I tried running "zitadel init" and "zitadel setup" in the container and restarting the container, but it still has the same error. Falling back to the old image (which I tagged as oldlocal) resumes functionality.

I tried reviewing the documentation, but the upgrade process doesn't provide much in the way of docker. I also added --init-projections=true to the setup command. I also have google OIDC configured for external users and it also doesn't work after the upgrade.

Let me know if there is anything I might be missing.

Zitadel Login Error after Upgrade

🏬Self-hosted🪲Bugs✅Solved

services:
  zitadel:
    restart: 'always'
    networks:
      - 'zitadel'
    #image: 'ghcr.io/zitadel/zitadel:latest'
    image: 'ghcr.io/zitadel/zitadel:oldlocal'
    command: 'start --masterkey "keychangedhere" --tlsMode external'
    environment:
      ZITADEL_DATABASE_POSTGRES_HOST: db
      ZITADEL_DATABASE_POSTGRES_PORT: 5432
      ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
      ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
      ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
      ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
      ZITADEL_ACTIONS_HTTP_DENYLIST: "0.0.0.0/0"
      ZITADEL_EXTERNALSECURE: true
      ZITADEL_EXTERNALDOMAIN: auth.domain.com
      ZITADEL_EXTERNALPORT: 443
    depends_on:
      db:
        condition: 'service_healthy'
    ports:
      - '80:8080'

  db:
    restart: 'always'
    image: postgres:17-alpine
    environment:
      PGUSER: postgres
      POSTGRES_PASSWORD: postgres
    volumes:
      - /data/zitadel/db:/var/lib/postgresql/data
    networks:
      - 'zitadel'
    healthcheck:
      test: ["CMD-SHELL", "pg_isready", "-d", "zitadel", "-U", "postgres"]
      interval: '10s'
      timeout: '30s'
      retries: 5
      start_period: '20s'

networks:
  zitadel:

services:
  zitadel:
    restart: 'always'
    networks:
      - 'zitadel'
    #image: 'ghcr.io/zitadel/zitadel:latest'
    image: 'ghcr.io/zitadel/zitadel:oldlocal'
    command: 'start --masterkey "keychangedhere" --tlsMode external'
    environment:
      ZITADEL_DATABASE_POSTGRES_HOST: db
      ZITADEL_DATABASE_POSTGRES_PORT: 5432
      ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
      ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
      ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
      ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
      ZITADEL_ACTIONS_HTTP_DENYLIST: "0.0.0.0/0"
      ZITADEL_EXTERNALSECURE: true
      ZITADEL_EXTERNALDOMAIN: auth.domain.com
      ZITADEL_EXTERNALPORT: 443
    depends_on:
      db:
        condition: 'service_healthy'
    ports:
      - '80:8080'

  db:
    restart: 'always'
    image: postgres:17-alpine
    environment:
      PGUSER: postgres
      POSTGRES_PASSWORD: postgres
    volumes:
      - /data/zitadel/db:/var/lib/postgresql/data
    networks:
      - 'zitadel'
    healthcheck:
      test: ["CMD-SHELL", "pg_isready", "-d", "zitadel", "-U", "postgres"]
      interval: '10s'
      timeout: '30s'
      retries: 5
      start_period: '20s'

networks:
  zitadel:

Zitadel Login Error after Upgrade

Zitadel Login Error after Upgrade

Continue the conversation

ZITADEL

Continue the conversation

ZITADEL

Similar Threads