Skip to content

Commit 6fdf825

Browse files
thieneretthieneret
committed
update authentik
1 parent 26377b7 commit 6fdf825

2 files changed

Lines changed: 187 additions & 24 deletions

File tree

‎ct/authentik.sh‎

Lines changed: 134 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
88
APP="authentik"
99
var_tags="${var_tags:-auth}"
1010
var_cpu="${var_cpu:-4}"
11-
var_ram="${var_ram:-4096}"
11+
var_ram="${var_ram:-8192}"
1212
var_disk="${var_disk:-16}"
1313
var_os="${var_os:-debian}"
1414
var_version="${var_version:-13}"
@@ -22,20 +22,29 @@ catch_errors
2222

2323
function update_script() {
2424
header_info
25-
check_container_storage
26-
check_container_resources
2725

2826
if [[ ! -d /opt/authentik ]]; then
2927
msg_error "No authentik Installation Found!"
3028
exit
3129
fi
3230

31+
CUR_VERSION="$(<"$HOME/.authentik")"
32+
IFS='.' read -ra PARTS <<< "${CUR_VERSION#version/}"
33+
MAJOR=${PARTS[0]}
34+
MINOR=${PARTS[1]}
35+
36+
check_container_storage
37+
check_container_resources
38+
39+
msg_info "Update dependencies"
40+
ensure_dependencies crossbuild-essential-amd64 gcc-x86-64-linux-gnu cmake clang libunwind-18-dev
41+
msg_ok "Update dependencies"
42+
3343
NODE_VERSION="24" setup_nodejs
3444
setup_go
3545
UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
36-
setup_rust
3746

38-
AUTHENTIK_VERSION="version/2026.2.3"
47+
AUTHENTIK_VERSION="version/2026.5.2"
3948
XMLSEC_VERSION="1.3.11"
4049

4150
if check_for_gh_release "geoipupdate" "maxmind/geoipupdate"; then
@@ -71,7 +80,20 @@ function update_script() {
7180

7281
CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
7382

74-
msg_info "Updating web"
83+
msg_info "Clearing rust"
84+
rm -rf /root/.cargo /root/.rustup
85+
msg_ok "Clearing rust"
86+
87+
msg_info "Setup custom rust"
88+
cd /opt/authentik
89+
export PATH="/root/.cargo/bin:$PATH"
90+
echo 'export PATH="/root/.cargo/bin:$PATH"' >>"/root/.profile"
91+
curl https://sh.rustup.rs -sSf | $STD sh -s -- -y --profile minimal --default-toolchain none
92+
$STD rustup install
93+
$STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
94+
msg_ok "Setup custom rust"
95+
96+
msg_info "Updating web"
7597
cd /opt/authentik/web
7698
export NODE_ENV="production"
7799
$STD npm install
@@ -89,6 +111,14 @@ function update_script() {
89111
$STD go build -o /opt/authentik/radius ./cmd/radius
90112
msg_ok "Updated go proxy"
91113

114+
msg_info "Building worker"
115+
export AWS_LC_FIPS_SYS_CC="clang"
116+
cd /opt/authentik
117+
$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
118+
cp ./target/release/authentik /opt/authentik/authentik-worker
119+
rm -r ./target
120+
msg_ok "Buildt worker"
121+
92122
msg_info "Updating python server"
93123
export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
94124
export UV_COMPILE_BYTECODE="1"
@@ -100,6 +130,103 @@ function update_script() {
100130
$STD uv sync --frozen --no-install-project --no-dev
101131
chown -R authentik:authentik /opt/authentik
102132
msg_ok "Updated python server"
133+
134+
if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
135+
msg_info "Updating Worker and Server config"
136+
cp /etc/authentik/config.yml /etc/authentik/config.bak
137+
yq -i ".postgresql.conn_max_age = 0" /etc/authentik/config.yml
138+
yq -i ".postgresql.conn_health_checks = false" /etc/authentik/config.yml
139+
yq -i ".listen.debug_tokio = \"[::]:6669\"" /etc/authentik/config.yml
140+
yq -i ".log.rust_log.console_subscriber = \"info\"" /etc/authentik/config.yml
141+
yq -i ".log.rust_log.h2 = \"info\"" /etc/authentik/config.yml
142+
yq -i ".log.rust_log.hyper_util = \"warn\"" /etc/authentik/config.yml
143+
yq -i ".log.rust_log.mio = \"info\"" /etc/authentik/config.yml
144+
yq -i ".log.rust_log.notify = \"info\"" /etc/authentik/config.yml
145+
yq -i ".log.rust_log.reqwest = \"info\"" /etc/authentik/config.yml
146+
yq -i ".log.rust_log.runtime = \"info\"" /etc/authentik/config.yml
147+
yq -i ".log.rust_log.rustls = \"info\"" /etc/authentik/config.yml
148+
yq -i ".log.rust_log.sqlx = \"info\"" /etc/authentik/config.yml
149+
yq -i ".log.rust_log.sqlx_postgres = \"info\"" /etc/authentik/config.yml
150+
yq -i ".log.rust_log.tokio = \"info\"" /etc/authentik/config.yml
151+
yq -i ".log.rust_log.tungstenite = \"info\"" /etc/authentik/config.yml
152+
yq -i ".web.workers = 2" /etc/authentik/config.yml
153+
mv /etc/default/authentik /etc/default/authentik.bak
154+
cat <<EOF >/etc/default/authentik-server
155+
TMPDIR=/dev/shm/
156+
UV_LINK_MODE=copy
157+
UV_PYTHON_DOWNLOADS=0
158+
UV_NATIVE_TLS=1
159+
VENV_PATH=/opt/authentik/.venv
160+
PYTHONDONTWRITEBYTECODE=1
161+
PYTHONUNBUFFERED=1
162+
PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
163+
DJANGO_SETTINGS_MODULE=authentik.root.settings
164+
PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
165+
AUTHENTIK_LISTEN__HTTP="[::]:9000"
166+
AUTHENTIK_LISTEN__HTTPS="[::]:9443"
167+
AUTHENTIK_LISTEN__METRICS="[::]:9300"
168+
EOF
169+
cat <<EOF >/etc/default/authentik-worker
170+
TMPDIR=/dev/shm/
171+
UV_LINK_MODE=copy
172+
UV_PYTHON_DOWNLOADS=0
173+
UV_NATIVE_TLS=1
174+
VENV_PATH=/opt/authentik/.venv
175+
PYTHONDONTWRITEBYTECODE=1
176+
PYTHONUNBUFFERED=1
177+
PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
178+
DJANGO_SETTINGS_MODULE=authentik.root.settings
179+
PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
180+
AUTHENTIK_LISTEN__HTTP="[::]:8000"
181+
AUTHENTIK_LISTEN__HTTPS="[::]:8443"
182+
AUTHENTIK_LISTEN__METRICS="[::]:8300"
183+
EOF
184+
msg_ok "Updated Worker and Server config!"
185+
msg_warn "Please check /etc/default/authentik-worker and /etc/default/authentik-server config files for port configurations!"
186+
187+
msg_info "Updating services"
188+
cat <<EOF >/etc/systemd/system/authentik-server.service
189+
[Unit]
190+
Description=authentik Go Server (API Gateway)
191+
After=network.target authentik-worker.service
192+
Wants=postgresql.service authentik-worker.service
193+
194+
[Service]
195+
User=authentik
196+
Group=authentik
197+
ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
198+
ExecStart=/opt/authentik/authentik-server
199+
WorkingDirectory=/opt/authentik/
200+
Restart=always
201+
RestartSec=5
202+
EnvironmentFile=/etc/default/authentik-server
203+
204+
[Install]
205+
WantedBy=multi-user.target
206+
EOF
207+
208+
cat <<EOF >/etc/systemd/system/authentik-worker.service
209+
[Unit]
210+
Description=authentik Worker
211+
After=network.target postgresql.service
212+
213+
[Service]
214+
User=authentik
215+
Group=authentik
216+
Type=simple
217+
EnvironmentFile=/etc/default/authentik-worker
218+
ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
219+
ExecStart=/opt/authentik/authentik-worker worker
220+
WorkingDirectory=/opt/authentik
221+
Restart=always
222+
RestartSec=5
223+
224+
[Install]
225+
WantedBy=multi-user.target
226+
EOF
227+
systemctl daemon-reload
228+
msg_ok "Updated services"
229+
fi
103230
fi
104231

105232
msg_info "Starting Services"
@@ -150,7 +277,5 @@ description
150277

151278
msg_ok "Completed successfully!\n"
152279
echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
153-
echo -e "${INFO}${YW} Initial setup URL:${CL}"
154-
echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:9000/if/flow/initial-setup/${CL}"
155280
echo -e "${INFO}${YW} Access it using the following URL:${CL}"
156-
echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:9000${CL}"
281+
echo -e "${TAB}${GATEWAY}${BGN}https://${IP}:9443${CL}"

‎install/authentik-install.sh‎

Lines changed: 53 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ $STD apt install -y \
2929
libltdl-dev \
3030
libpq5 \
3131
libmaxminddb0 \
32-
libkrb5-3 \
33-
libkdb5-10 \
3432
libkadm5clnt-mit12 \
3533
libkadm5clnt7t64-heimdal \
3634
libltdl7 \
@@ -44,19 +42,23 @@ $STD apt install -y \
4442
libtool \
4543
libtool-bin \
4644
gcc \
45+
crossbuild-essential-amd64 \
46+
gcc-x86-64-linux-gnu \
47+
cmake \
48+
clang \
49+
libunwind-18-dev \
4750
git
4851
msg_ok "Installed Dependencies"
4952

5053
NODE_VERSION="24" setup_nodejs
5154
setup_yq
5255
setup_go
5356
UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
54-
setup_rust
5557
PG_VERSION="17" setup_postgresql
5658
PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
5759

5860
XMLSEC_VERSION="1.3.11"
59-
AUTHENTIK_VERSION="version/2026.2.3"
61+
AUTHENTIK_VERSION="version/2026.5.2"
6062
fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
6163
fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
6264
fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
@@ -68,25 +70,35 @@ $STD make -j $(nproc)
6870
$STD make check
6971
$STD make install
7072
$STD ldconfig
71-
msg_ok "xmlsec installed"
73+
msg_ok "Setup xmlsec"
74+
75+
msg_info "Setup custom rust"
76+
cd /opt/authentik
77+
export PATH="/root/.cargo/bin:$PATH"
78+
echo 'export PATH="/root/.cargo/bin:$PATH"' >>"/root/.profile"
79+
curl https://sh.rustup.rs -sSf | $STD sh -s -- -y --profile minimal --default-toolchain none
80+
$STD rustup install
81+
$STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
82+
msg_ok "Setup custom rust"
7283

7384
msg_info "Setup web"
7485
cd /opt/authentik/web
7586
export NODE_ENV="production"
7687
$STD npm install
7788
$STD npm run build
7889
$STD npm run build:sfe
79-
msg_ok "Web installed"
90+
msg_ok "Setup web"
8091

8192
msg_info "Setup go proxy"
8293
cd /opt/authentik
8394
export CGO_ENABLED="1"
95+
export CC="x86_64-linux-gnu-gcc"
8496
$STD go mod download
8597
$STD go build -o /opt/authentik/authentik-server ./cmd/server
8698
$STD go build -o /opt/authentik/ldap ./cmd/ldap
8799
$STD go build -o /opt/authentik/rac ./cmd/rac
88100
$STD go build -o /opt/authentik/radius ./cmd/radius
89-
msg_ok "Go proxy installed"
101+
msg_ok "Setup go proxy"
90102

91103
cat <<EOF >/usr/local/etc/GeoIP.conf
92104
AccountID ChangeME
@@ -99,17 +111,23 @@ EOF
99111

100112
echo "#39 19 * * 6,4 /usr/bin/geoipupdate -f /usr/local/etc/GeoIP.conf" | crontab -
101113

114+
msg_info "Building worker"
115+
export AWS_LC_FIPS_SYS_CC="clang"
116+
cd /opt/authentik
117+
$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
118+
cp ./target/release/authentik /opt/authentik/authentik-worker
119+
msg_ok "Building worker"
120+
102121
msg_info "Setup python server"
103122
export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
104123
export UV_COMPILE_BYTECODE="1"
105124
export UV_LINK_MODE="copy"
106125
export UV_NATIVE_TLS="1"
107-
export RUSTUP_PERMIT_COPY_RENAME="true"
108126
export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
109127
cd /opt/authentik
110128
$STD uv sync --frozen --no-install-project --no-dev
111129
cp /opt/authentik/authentik/sources/kerberos/krb5.conf /etc/krb5.conf
112-
msg_ok "Installed python server"
130+
msg_ok "Setup python server"
113131

114132
msg_info "Creating authentik config"
115133
mkdir -p /etc/authentik
@@ -125,7 +143,7 @@ yq -i ".storage.file.path = \"/opt/authentik-data\"" /etc/authentik/config.yml
125143
yq -i ".disable_startup_analytics = \"true\"" /etc/authentik/config.yml
126144
$STD useradd -U -s /usr/sbin/nologin -r -M -d /opt/authentik authentik
127145
chown -R authentik:authentik /opt/authentik
128-
cat <<EOF >/etc/default/authentik
146+
cat <<EOF >/etc/default/authentik-server
129147
TMPDIR=/dev/shm/
130148
UV_LINK_MODE=copy
131149
UV_PYTHON_DOWNLOADS=0
@@ -136,6 +154,24 @@ PYTHONUNBUFFERED=1
136154
PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
137155
DJANGO_SETTINGS_MODULE=authentik.root.settings
138156
PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
157+
AUTHENTIK_LISTEN__HTTP="[::]:9000"
158+
AUTHENTIK_LISTEN__HTTPS="[::]:9443"
159+
AUTHENTIK_LISTEN__METRICS="[::]:9300"
160+
EOF
161+
cat <<EOF >/etc/default/authentik-worker
162+
TMPDIR=/dev/shm/
163+
UV_LINK_MODE=copy
164+
UV_PYTHON_DOWNLOADS=0
165+
UV_NATIVE_TLS=1
166+
VENV_PATH=/opt/authentik/.venv
167+
PYTHONDONTWRITEBYTECODE=1
168+
PYTHONUNBUFFERED=1
169+
PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
170+
DJANGO_SETTINGS_MODULE=authentik.root.settings
171+
PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
172+
AUTHENTIK_LISTEN__HTTP="[::]:8000"
173+
AUTHENTIK_LISTEN__HTTPS="[::]:8443"
174+
AUTHENTIK_LISTEN__METRICS="[::]:8300"
139175
EOF
140176
cat <<EOF >/etc/default/authentik_ldap
141177
AUTHENTIK_HOST="https://127.0.0.1:9443"
@@ -152,7 +188,7 @@ AUTHENTIK_HOST="https://127.0.0.1:9443"
152188
AUTHENTIK_INSECURE="true"
153189
AUTHENTIK_TOKEN="token-generated-by-authentik"
154190
EOF
155-
msg_ok "authentik config created"
191+
msg_ok "Created authentik config"
156192

157193
msg_info "Creating services"
158194
cat <<EOF >/etc/systemd/system/authentik-server.service
@@ -164,12 +200,12 @@ Wants=postgresql.service
164200
[Service]
165201
User=authentik
166202
Group=authentik
203+
EnvironmentFile=/etc/default/authentik-server
167204
ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
168205
ExecStart=/opt/authentik/authentik-server
169206
WorkingDirectory=/opt/authentik/
170207
Restart=always
171208
RestartSec=5
172-
EnvironmentFile=/etc/default/authentik
173209
174210
[Install]
175211
WantedBy=multi-user.target
@@ -184,8 +220,9 @@ After=network.target postgresql.service
184220
User=authentik
185221
Group=authentik
186222
Type=simple
187-
EnvironmentFile=/etc/default/authentik
188-
ExecStart=/usr/local/bin/uv run python -m manage worker --pid-file /dev/shm/authentik-worker.pid
223+
EnvironmentFile=/etc/default/authentik-worker
224+
ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
225+
ExecStart=/opt/authentik/authentik-worker worker
189226
WorkingDirectory=/opt/authentik
190227
Restart=always
191228
RestartSec=5
@@ -250,7 +287,8 @@ EnvironmentFile=/etc/default/authentik_radius
250287
[Install]
251288
WantedBy=multi-user.target
252289
EOF
253-
msg_ok "Services created"
290+
291+
msg_ok "Created services"
254292

255293
motd_ssh
256294
customize

0 commit comments

Comments
 (0)