update authentik to 2026.5.2 (#14846)

* update authentik * Apply e Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com> * Apply requested change * refactored * Update install/authentik-install.sh Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com> * Update install/authentik-install.sh Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com> * Update install/authentik-install.sh Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com> * Update install/authentik-install.sh Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com> * Update install/authentik-install.sh Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com> * Update ct/authentik.sh Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com> * Update ct/authentik.sh Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com> * Update ct/authentik.sh Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com> * Update install/authentik-install.sh Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com> * update rust * Update install/authentik-install.sh Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com> * add setup_yq * update current version check * Update ct/authentik.sh Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com> --------- Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com> Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
2026-09-21 20:05:48 +02:00 · 2026-06-05 12:02:00 +02:00
parent f09b8ff9a8
commit e280a2d8ba
2 changed files with 180 additions and 27 deletions
@@ -8,7 +8,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 APP="authentik"
 var_tags="${var_tags:-auth}"
 var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-4096}"
+var_ram="${var_ram:-8192}"
 var_disk="${var_disk:-16}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -30,12 +30,20 @@ function update_script() {
    exit
  fi

+  read -r MAJOR MINOR PATCH <<< "$(sed 's/^version\///; s/\./ /g' "$HOME/.authentik")"
+
+  msg_info "Update dependencies"
+  ensure_dependencies crossbuild-essential-amd64 gcc-x86-64-linux-gnu cmake clang libunwind-18-dev
+  msg_ok "Update dependencies"
+
  NODE_VERSION="24" setup_nodejs
  setup_go
  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
-  setup_rust
+  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
+  setup_yq

-  AUTHENTIK_VERSION="version/2026.2.3"
+  AUTHENTIK_VERSION="version/2026.5.2"
+  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
  XMLSEC_VERSION="1.3.11"

  if check_for_gh_release "geoipupdate" "maxmind/geoipupdate"; then
@@ -71,7 +79,13 @@ function update_script() {

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"

-    msg_info "Updating web"
+	msg_info "Configuring rust"
+	cd /opt/authentik
+	$STD rustup install
+	$STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
+	msg_ok "Configured rust"
+
+	msg_info "Updating web"
    cd /opt/authentik/web
    export NODE_ENV="production"
    $STD npm install
@@ -89,6 +103,14 @@ function update_script() {
 	$STD go build -o /opt/authentik/radius ./cmd/radius
    msg_ok "Updated go proxy"

+	msg_info "Building worker"
+	export AWS_LC_FIPS_SYS_CC="clang"
+	cd /opt/authentik
+	$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
+	cp ./target/release/authentik /opt/authentik/authentik-worker
+	rm -r ./target
+	msg_ok "Built worker"
+
    msg_info "Updating python server"
    export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
    export UV_COMPILE_BYTECODE="1"
@@ -100,6 +122,103 @@ function update_script() {
    $STD uv sync --frozen --no-install-project --no-dev
    chown -R authentik:authentik /opt/authentik
    msg_ok "Updated python server"
+
+    if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
+	  msg_info "Updating Worker and Server config"
+	  cp /etc/authentik/config.yml /etc/authentik/config.bak
+	  yq -i ".postgresql.conn_max_age = 0" /etc/authentik/config.yml
+	  yq -i ".postgresql.conn_health_checks = false" /etc/authentik/config.yml
+	  yq -i ".listen.debug_tokio = \"[::]:6669\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.console_subscriber = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.h2 = \"info\""  /etc/authentik/config.yml
+      yq -i ".log.rust_log.hyper_util = \"warn\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.mio = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.notify = \"info\"" /etc/authentik/config.yml
+	  yq -i ".log.rust_log.reqwest = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.runtime = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.rustls = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.sqlx = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.sqlx_postgres = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.tokio = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.tungstenite = \"info\"" /etc/authentik/config.yml
+	  yq -i ".web.workers = 2" /etc/authentik/config.yml
+	  mv /etc/default/authentik /etc/default/authentik.bak
+	  cat <<EOF >/etc/default/authentik-server
+TMPDIR=/dev/shm/
+UV_LINK_MODE=copy
+UV_PYTHON_DOWNLOADS=0
+UV_NATIVE_TLS=1
+VENV_PATH=/opt/authentik/.venv
+PYTHONDONTWRITEBYTECODE=1
+PYTHONUNBUFFERED=1
+PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
+DJANGO_SETTINGS_MODULE=authentik.root.settings
+PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
+AUTHENTIK_LISTEN__HTTP="[::]:9000"
+AUTHENTIK_LISTEN__HTTPS="[::]:9443"
+AUTHENTIK_LISTEN__METRICS="[::]:9300"
+EOF
+	  cat <<EOF >/etc/default/authentik-worker
+TMPDIR=/dev/shm/
+UV_LINK_MODE=copy
+UV_PYTHON_DOWNLOADS=0
+UV_NATIVE_TLS=1
+VENV_PATH=/opt/authentik/.venv
+PYTHONDONTWRITEBYTECODE=1
+PYTHONUNBUFFERED=1
+PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
+DJANGO_SETTINGS_MODULE=authentik.root.settings
+PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
+AUTHENTIK_LISTEN__HTTP="[::]:8000"
+AUTHENTIK_LISTEN__HTTPS="[::]:8443"
+AUTHENTIK_LISTEN__METRICS="[::]:8300"
+EOF
+	  msg_ok "Updated Worker and Server config!"
+	  msg_warn "Please check /etc/default/authentik-worker and /etc/default/authentik-server config files for port configurations!"
+
+	  msg_info "Updating services"
+	  cat <<EOF >/etc/systemd/system/authentik-server.service
+[Unit]
+Description=authentik Go Server (API Gateway)
+After=network.target
+Wants=postgresql.service
+
+[Service]
+User=authentik
+Group=authentik
+ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
+ExecStart=/opt/authentik/authentik-server
+WorkingDirectory=/opt/authentik/
+Restart=always
+RestartSec=5
+EnvironmentFile=/etc/default/authentik-server
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+	  cat <<EOF >/etc/systemd/system/authentik-worker.service
+[Unit]
+Description=authentik Worker
+After=network.target postgresql.service
+
+[Service]
+User=authentik
+Group=authentik
+Type=simple
+EnvironmentFile=/etc/default/authentik-worker
+ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
+ExecStart=/opt/authentik/authentik-worker worker
+WorkingDirectory=/opt/authentik
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+	  systemctl daemon-reload
+	  msg_ok "Updated services"
+	fi
  fi

  msg_info "Starting Services"
@@ -150,7 +269,5 @@ description

 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Initial setup URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:9000/if/flow/initial-setup/${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:9000${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}https://${IP}:9443${CL}"