Skip to content

update authentik to 2026.5.2 #14846

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MickLesk merged 19 commits into from
Jun 5, 2026
Merged

update authentik to 2026.5.2 #14846

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
6fdf825
update authentik
thieneret Jun 1, 2026
0accd6e
Apply e
thieneret Jun 1, 2026
2ac56e4
Apply requested change
thieneret Jun 1, 2026
7b776e9
refactored
thieneret Jun 1, 2026
8b925c1
Update install/authentik-install.sh
MickLesk Jun 2, 2026
2713e68
Update install/authentik-install.sh
MickLesk Jun 2, 2026
96a3b98
Update install/authentik-install.sh
MickLesk Jun 2, 2026
7337c95
Update install/authentik-install.sh
MickLesk Jun 2, 2026
6e6eeb0
Update install/authentik-install.sh
MickLesk Jun 2, 2026
f33dacf
Update ct/authentik.sh
MickLesk Jun 2, 2026
3ab1a0f
Update ct/authentik.sh
MickLesk Jun 2, 2026
7b63f05
Update ct/authentik.sh
MickLesk Jun 2, 2026
bc8848f
Update install/authentik-install.sh
MickLesk Jun 2, 2026
2bd183f
update rust
thieneret Jun 2, 2026
928c54f
Update install/authentik-install.sh
MickLesk Jun 2, 2026
ed29ce1
add setup_yq
thieneret Jun 4, 2026
b1cb083
update current version check
thieneret Jun 4, 2026
be922f8
Update ct/authentik.sh
MickLesk Jun 4, 2026
561ec22
Merge branch 'main' into update-authentik-2026.5.2
thieneret Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
132 changes: 125 additions & 7 deletions ct/authentik.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
APP="authentik"
var_tags="${var_tags:-auth}"
var_cpu="${var_cpu:-4}"
var_ram="${var_ram:-4096}"
var_ram="${var_ram:-8192}"
var_disk="${var_disk:-16}"
var_os="${var_os:-debian}"
var_version="${var_version:-13}"
Expand All @@ -30,12 +30,21 @@ function update_script() {
exit
fi

CUR_VERSION="$(<"$HOME/.authentik")"
IFS='.' read -ra PARTS <<< "${CUR_VERSION#version/}"
MAJOR=${PARTS[0]}
MINOR=${PARTS[1]}
Comment thread
thieneret marked this conversation as resolved.
Outdated

msg_info "Update dependencies"
ensure_dependencies crossbuild-essential-amd64 gcc-x86-64-linux-gnu cmake clang libunwind-18-dev
msg_ok "Update dependencies"

NODE_VERSION="24" setup_nodejs
setup_go
UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
setup_rust
RUST_PROFILE="minimal" RUST_TOOLCHAIN="1.95.0" setup_rust
Comment thread
MickLesk marked this conversation as resolved.
Outdated

Comment thread
thieneret marked this conversation as resolved.
AUTHENTIK_VERSION="version/2026.2.3"
AUTHENTIK_VERSION="version/2026.5.2"
XMLSEC_VERSION="1.3.11"
Comment thread
MickLesk marked this conversation as resolved.

if check_for_gh_release "geoipupdate" "maxmind/geoipupdate"; then
Expand Down Expand Up @@ -71,7 +80,13 @@ function update_script() {

CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"

msg_info "Updating web"
msg_info "Configure rust"
Comment thread
MickLesk marked this conversation as resolved.
Outdated
cd /opt/authentik
$STD rustup install
$STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
msg_ok "Configure rust"
Comment thread
MickLesk marked this conversation as resolved.
Outdated

msg_info "Updating web"
cd /opt/authentik/web
export NODE_ENV="production"
$STD npm install
Expand All @@ -89,6 +104,14 @@ function update_script() {
$STD go build -o /opt/authentik/radius ./cmd/radius
msg_ok "Updated go proxy"

msg_info "Building worker"
export AWS_LC_FIPS_SYS_CC="clang"
cd /opt/authentik
$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
Comment thread
MickLesk marked this conversation as resolved.
cp ./target/release/authentik /opt/authentik/authentik-worker
rm -r ./target
msg_ok "Buildt worker"
Comment thread
MickLesk marked this conversation as resolved.
Outdated

msg_info "Updating python server"
export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
export UV_COMPILE_BYTECODE="1"
Expand All @@ -100,6 +123,103 @@ function update_script() {
$STD uv sync --frozen --no-install-project --no-dev
chown -R authentik:authentik /opt/authentik
msg_ok "Updated python server"

if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
msg_info "Updating Worker and Server config"
cp /etc/authentik/config.yml /etc/authentik/config.bak
yq -i ".postgresql.conn_max_age = 0" /etc/authentik/config.yml
yq -i ".postgresql.conn_health_checks = false" /etc/authentik/config.yml
yq -i ".listen.debug_tokio = \"[::]:6669\"" /etc/authentik/config.yml
yq -i ".log.rust_log.console_subscriber = \"info\"" /etc/authentik/config.yml
yq -i ".log.rust_log.h2 = \"info\"" /etc/authentik/config.yml
yq -i ".log.rust_log.hyper_util = \"warn\"" /etc/authentik/config.yml
yq -i ".log.rust_log.mio = \"info\"" /etc/authentik/config.yml
yq -i ".log.rust_log.notify = \"info\"" /etc/authentik/config.yml
yq -i ".log.rust_log.reqwest = \"info\"" /etc/authentik/config.yml
yq -i ".log.rust_log.runtime = \"info\"" /etc/authentik/config.yml
yq -i ".log.rust_log.rustls = \"info\"" /etc/authentik/config.yml
yq -i ".log.rust_log.sqlx = \"info\"" /etc/authentik/config.yml
yq -i ".log.rust_log.sqlx_postgres = \"info\"" /etc/authentik/config.yml
yq -i ".log.rust_log.tokio = \"info\"" /etc/authentik/config.yml
yq -i ".log.rust_log.tungstenite = \"info\"" /etc/authentik/config.yml
yq -i ".web.workers = 2" /etc/authentik/config.yml
mv /etc/default/authentik /etc/default/authentik.bak
cat <<EOF >/etc/default/authentik-server
TMPDIR=/dev/shm/
UV_LINK_MODE=copy
UV_PYTHON_DOWNLOADS=0
UV_NATIVE_TLS=1
VENV_PATH=/opt/authentik/.venv
PYTHONDONTWRITEBYTECODE=1
PYTHONUNBUFFERED=1
PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
DJANGO_SETTINGS_MODULE=authentik.root.settings
PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
AUTHENTIK_LISTEN__HTTP="[::]:9000"
AUTHENTIK_LISTEN__HTTPS="[::]:9443"
AUTHENTIK_LISTEN__METRICS="[::]:9300"
EOF
cat <<EOF >/etc/default/authentik-worker
TMPDIR=/dev/shm/
UV_LINK_MODE=copy
UV_PYTHON_DOWNLOADS=0
UV_NATIVE_TLS=1
VENV_PATH=/opt/authentik/.venv
PYTHONDONTWRITEBYTECODE=1
PYTHONUNBUFFERED=1
PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
DJANGO_SETTINGS_MODULE=authentik.root.settings
PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
AUTHENTIK_LISTEN__HTTP="[::]:8000"
AUTHENTIK_LISTEN__HTTPS="[::]:8443"
AUTHENTIK_LISTEN__METRICS="[::]:8300"
EOF
msg_ok "Updated Worker and Server config!"
msg_warn "Please check /etc/default/authentik-worker and /etc/default/authentik-server config files for port configurations!"
Comment thread
thieneret marked this conversation as resolved.

msg_info "Updating services"
cat <<EOF >/etc/systemd/system/authentik-server.service
[Unit]
Description=authentik Go Server (API Gateway)
After=network.target
Wants=postgresql.service

[Service]
User=authentik
Group=authentik
ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
Comment thread
MickLesk marked this conversation as resolved.
ExecStart=/opt/authentik/authentik-server
WorkingDirectory=/opt/authentik/
Restart=always
RestartSec=5
EnvironmentFile=/etc/default/authentik-server

[Install]
WantedBy=multi-user.target
EOF

cat <<EOF >/etc/systemd/system/authentik-worker.service
[Unit]
Description=authentik Worker
After=network.target postgresql.service

[Service]
User=authentik
Group=authentik
Type=simple
EnvironmentFile=/etc/default/authentik-worker
ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
Comment thread
MickLesk marked this conversation as resolved.
ExecStart=/opt/authentik/authentik-worker worker
WorkingDirectory=/opt/authentik
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
msg_ok "Updated services"
Comment thread
MickLesk marked this conversation as resolved.
fi
fi

msg_info "Starting Services"
Expand Down Expand Up @@ -150,7 +270,5 @@ description

msg_ok "Completed successfully!\n"
echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
echo -e "${INFO}${YW} Initial setup URL:${CL}"
echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:9000/if/flow/initial-setup/${CL}"
echo -e "${INFO}${YW} Access it using the following URL:${CL}"
echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:9000${CL}"
echo -e "${TAB}${GATEWAY}${BGN}https://${IP}:9443${CL}"
66 changes: 51 additions & 15 deletions install/authentik-install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,6 @@ $STD apt install -y \
libltdl-dev \
libpq5 \
libmaxminddb0 \
libkrb5-3 \
libkdb5-10 \
libkadm5clnt-mit12 \
libkadm5clnt7t64-heimdal \
libltdl7 \
Expand All @@ -44,19 +42,24 @@ $STD apt install -y \
libtool \
libtool-bin \
gcc \
crossbuild-essential-amd64 \
gcc-x86-64-linux-gnu \
cmake \
clang \
libunwind-18-dev \
git
msg_ok "Installed Dependencies"

NODE_VERSION="24" setup_nodejs
setup_yq
setup_go
RUST_PROFILE="minimal" RUST_TOOLCHAIN="1.95.0" setup_rust
UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
setup_rust
Comment thread
CrazyWolf13 marked this conversation as resolved.
PG_VERSION="17" setup_postgresql
PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

XMLSEC_VERSION="1.3.11"
AUTHENTIK_VERSION="version/2026.2.3"
AUTHENTIK_VERSION="version/2026.5.2"
fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
Expand All @@ -68,25 +71,32 @@ $STD make -j $(nproc)
$STD make check
$STD make install
$STD ldconfig
msg_ok "xmlsec installed"
msg_ok "Setup xmlsec"

msg_info "Configure rust"
Comment thread
MickLesk marked this conversation as resolved.
Outdated
cd /opt/authentik
$STD rustup install
$STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
msg_ok "Configure rust"
Comment thread
MickLesk marked this conversation as resolved.
Outdated

msg_info "Setup web"
Comment thread
MickLesk marked this conversation as resolved.
Outdated
cd /opt/authentik/web
export NODE_ENV="production"
$STD npm install
$STD npm run build
$STD npm run build:sfe
msg_ok "Web installed"
msg_ok "Setup web"

msg_info "Setup go proxy"
Comment thread
MickLesk marked this conversation as resolved.
Outdated
cd /opt/authentik
export CGO_ENABLED="1"
export CC="x86_64-linux-gnu-gcc"
$STD go mod download
$STD go build -o /opt/authentik/authentik-server ./cmd/server
$STD go build -o /opt/authentik/ldap ./cmd/ldap
$STD go build -o /opt/authentik/rac ./cmd/rac
$STD go build -o /opt/authentik/radius ./cmd/radius
msg_ok "Go proxy installed"
msg_ok "Setup go proxy"

cat <<EOF >/usr/local/etc/GeoIP.conf
AccountID ChangeME
Expand All @@ -99,17 +109,24 @@ EOF

echo "#39 19 * * 6,4 /usr/bin/geoipupdate -f /usr/local/etc/GeoIP.conf" | crontab -

msg_info "Building worker"
export AWS_LC_FIPS_SYS_CC="clang"
cd /opt/authentik
$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
cp ./target/release/authentik /opt/authentik/authentik-worker
rm -r ./target
msg_ok "Building worker"
Comment thread
MickLesk marked this conversation as resolved.
Outdated

msg_info "Setup python server"
Comment thread
MickLesk marked this conversation as resolved.
Outdated
export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
export UV_COMPILE_BYTECODE="1"
export UV_LINK_MODE="copy"
export UV_NATIVE_TLS="1"
export RUSTUP_PERMIT_COPY_RENAME="true"
export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
cd /opt/authentik
$STD uv sync --frozen --no-install-project --no-dev
cp /opt/authentik/authentik/sources/kerberos/krb5.conf /etc/krb5.conf
msg_ok "Installed python server"
msg_ok "Setup python server"

msg_info "Creating authentik config"
mkdir -p /etc/authentik
Expand All @@ -125,7 +142,22 @@ yq -i ".storage.file.path = \"/opt/authentik-data\"" /etc/authentik/config.yml
yq -i ".disable_startup_analytics = \"true\"" /etc/authentik/config.yml
$STD useradd -U -s /usr/sbin/nologin -r -M -d /opt/authentik authentik
chown -R authentik:authentik /opt/authentik
cat <<EOF >/etc/default/authentik
cat <<EOF >/etc/default/authentik-server
TMPDIR=/dev/shm/
UV_LINK_MODE=copy
UV_PYTHON_DOWNLOADS=0
UV_NATIVE_TLS=1
VENV_PATH=/opt/authentik/.venv
PYTHONDONTWRITEBYTECODE=1
PYTHONUNBUFFERED=1
PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
DJANGO_SETTINGS_MODULE=authentik.root.settings
PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
AUTHENTIK_LISTEN__HTTP="[::]:9000"
AUTHENTIK_LISTEN__HTTPS="[::]:9443"
AUTHENTIK_LISTEN__METRICS="[::]:9300"
EOF
cat <<EOF >/etc/default/authentik-worker
TMPDIR=/dev/shm/
UV_LINK_MODE=copy
UV_PYTHON_DOWNLOADS=0
Expand All @@ -136,6 +168,9 @@ PYTHONUNBUFFERED=1
PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
DJANGO_SETTINGS_MODULE=authentik.root.settings
PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
AUTHENTIK_LISTEN__HTTP="[::]:8000"
AUTHENTIK_LISTEN__HTTPS="[::]:8443"
AUTHENTIK_LISTEN__METRICS="[::]:8300"
EOF
cat <<EOF >/etc/default/authentik_ldap
AUTHENTIK_HOST="https://127.0.0.1:9443"
Expand All @@ -152,7 +187,7 @@ AUTHENTIK_HOST="https://127.0.0.1:9443"
AUTHENTIK_INSECURE="true"
AUTHENTIK_TOKEN="token-generated-by-authentik"
EOF
msg_ok "authentik config created"
msg_ok "Created authentik config"

msg_info "Creating services"
cat <<EOF >/etc/systemd/system/authentik-server.service
Expand All @@ -164,12 +199,12 @@ Wants=postgresql.service
[Service]
User=authentik
Group=authentik
EnvironmentFile=/etc/default/authentik-server
ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
ExecStart=/opt/authentik/authentik-server
WorkingDirectory=/opt/authentik/
Restart=always
RestartSec=5
EnvironmentFile=/etc/default/authentik

[Install]
WantedBy=multi-user.target
Expand All @@ -184,8 +219,9 @@ After=network.target postgresql.service
User=authentik
Group=authentik
Type=simple
EnvironmentFile=/etc/default/authentik
ExecStart=/usr/local/bin/uv run python -m manage worker --pid-file /dev/shm/authentik-worker.pid
EnvironmentFile=/etc/default/authentik-worker
ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
ExecStart=/opt/authentik/authentik-worker worker
WorkingDirectory=/opt/authentik
Restart=always
RestartSec=5
Expand Down Expand Up @@ -250,7 +286,7 @@ EnvironmentFile=/etc/default/authentik_radius
[Install]
WantedBy=multi-user.target
EOF
msg_ok "Services created"
msg_ok "Created services"

motd_ssh
customize
Expand Down
Loading