mirror of
https://github.com/community-scripts/ProxmoxVE.git
synced 2026-08-24 21:35:42 +02:00
update authentik to 2026.8.0 (#16674)
This commit is contained in:
thieneret
+54
-126
@@ -32,18 +32,23 @@ function update_script() {
|
||||
|
||||
read -r MAJOR MINOR PATCH <<<"$(sed 's/^version\///; s/\./ /g' "$HOME/.authentik")"
|
||||
|
||||
if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
|
||||
msg_error "Updating from version ${MAJOR}.${MINOR}.${PATCH} is not supported. A minimum version of 2026.5.x is required to update. See: https://docs.goauthentik.io/releases/2026.8/"
|
||||
exit
|
||||
fi
|
||||
|
||||
msg_info "Update dependencies"
|
||||
ensure_dependencies crossbuild-essential-$(arch_resolve) gcc-$(arch_resolve "x86-64" "aarch64")-linux-gnu cmake clang libunwind-18-dev
|
||||
msg_ok "Update dependencies"
|
||||
|
||||
NODE_VERSION="24" setup_nodejs
|
||||
NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
|
||||
setup_go
|
||||
$STD uv cache clean
|
||||
UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
|
||||
UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
|
||||
RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
|
||||
setup_yq
|
||||
|
||||
AUTHENTIK_VERSION="version/2026.5.6"
|
||||
AUTHENTIK_VERSION="version/2026.8.0"
|
||||
# Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
|
||||
XMLSEC_VERSION="1.3.12"
|
||||
|
||||
@@ -87,30 +92,32 @@ function update_script() {
|
||||
msg_ok "Configured rust"
|
||||
|
||||
msg_info "Updating web"
|
||||
cd /opt/authentik/web
|
||||
export NODE_ENV="production"
|
||||
$STD npm install
|
||||
$STD npm run build
|
||||
$STD npm run build:sfe
|
||||
cd /opt/authentik
|
||||
$STD node ./scripts/node/lint-runtime.mjs ./web
|
||||
cd /opt/authentik/web
|
||||
$STD pnpm install --frozen-lockfile
|
||||
$STD pnpm run build
|
||||
$STD pnpm run build:sfe
|
||||
msg_ok "Updated web"
|
||||
|
||||
msg_info "Updating go proxy"
|
||||
msg_info "Updating outposts"
|
||||
cd /opt/authentik
|
||||
mkdir -p /opt/authentik/bin
|
||||
export CGO_ENABLED="1"
|
||||
export CC="$(arch_resolve "x86_64" "aarch64")-linux-gnu-gcc"
|
||||
$STD go mod download
|
||||
$STD go build -o /opt/authentik/authentik-server ./cmd/server
|
||||
$STD go build -o /opt/authentik/ldap ./cmd/ldap
|
||||
$STD go build -o /opt/authentik/rac ./cmd/rac
|
||||
$STD go build -o /opt/authentik/radius ./cmd/radius
|
||||
msg_ok "Updated go proxy"
|
||||
$STD go build -o /opt/authentik/bin/ldap ./cmd/ldap
|
||||
$STD go build -o /opt/authentik/bin/rac ./cmd/rac
|
||||
$STD go build -o /opt/authentik/bin/radius ./cmd/radius
|
||||
msg_ok "Updated outposts"
|
||||
|
||||
msg_info "Building worker. It may take more than 10 minutes, please be patient."
|
||||
export AWS_LC_FIPS_SYS_CC="clang"
|
||||
cd /opt/authentik
|
||||
$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
|
||||
cp ./target/release/authentik /opt/authentik/authentik-worker
|
||||
rm -r ./target
|
||||
msg_info "Building binary. It may take more than 10 minutes, please be patient."
|
||||
export AWS_LC_FIPS_SYS_CC="clang"
|
||||
cd /opt/authentik
|
||||
$STD cargo build --package authentik --no-default-features --features core --locked --release
|
||||
cp ./target/release/authentik /opt/authentik/bin/
|
||||
rm -r ./target
|
||||
msg_ok "Built worker"
|
||||
|
||||
msg_info "Updating python server"
|
||||
@@ -124,126 +131,47 @@ function update_script() {
|
||||
cd /opt/authentik
|
||||
for attempt in 1 2 3; do
|
||||
if [[ $attempt -eq 3 ]]; then
|
||||
$STD uv sync --frozen --no-install-project --no-dev
|
||||
$STD uv sync --locked --no-install-project --no-dev
|
||||
break
|
||||
fi
|
||||
$STD uv sync --frozen --no-install-project --no-dev && break
|
||||
$STD uv sync --locked --no-install-project --no-dev && break
|
||||
msg_warn "uv sync attempt $attempt failed, retrying..."
|
||||
sleep $((attempt * 15))
|
||||
done
|
||||
chown -R authentik:authentik /opt/authentik
|
||||
msg_ok "Updated python server"
|
||||
|
||||
if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
|
||||
msg_info "Updating Worker and Server config"
|
||||
cp /etc/authentik/config.yml /etc/authentik/config.bak
|
||||
yq -i ".postgresql.conn_max_age = 0" /etc/authentik/config.yml
|
||||
yq -i ".postgresql.conn_health_checks = false" /etc/authentik/config.yml
|
||||
yq -i '.listen.debug_tokio = "[::]:6669"' /etc/authentik/config.yml
|
||||
yq -i '.log.rust_log.console_subscriber = "info"' /etc/authentik/config.yml
|
||||
yq -i '.log.rust_log.h2 = "info"' /etc/authentik/config.yml
|
||||
yq -i '.log.rust_log.hyper_util = "warn"' /etc/authentik/config.yml
|
||||
yq -i '.log.rust_log.mio = "info"' /etc/authentik/config.yml
|
||||
yq -i '.log.rust_log.notify = "info"' /etc/authentik/config.yml
|
||||
yq -i '.log.rust_log.reqwest = "info"' /etc/authentik/config.yml
|
||||
yq -i '.log.rust_log.runtime = "info"' /etc/authentik/config.yml
|
||||
yq -i '.log.rust_log.rustls = "info"' /etc/authentik/config.yml
|
||||
yq -i '.log.rust_log.sqlx = "info"' /etc/authentik/config.yml
|
||||
yq -i '.log.rust_log.sqlx_postgres = "info"' /etc/authentik/config.yml
|
||||
yq -i '.log.rust_log.tokio = "info"' /etc/authentik/config.yml
|
||||
yq -i '.log.rust_log.tungstenite = "info"' /etc/authentik/config.yml
|
||||
yq -i ".web.workers = 2" /etc/authentik/config.yml
|
||||
mv /etc/default/authentik /etc/default/authentik.bak
|
||||
cat <<EOF >/etc/default/authentik-server
|
||||
TMPDIR=/dev/shm/
|
||||
UV_LINK_MODE=copy
|
||||
UV_PYTHON_DOWNLOADS=0
|
||||
UV_NATIVE_TLS=1
|
||||
VENV_PATH=/opt/authentik/.venv
|
||||
PYTHONDONTWRITEBYTECODE=1
|
||||
PYTHONUNBUFFERED=1
|
||||
PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
DJANGO_SETTINGS_MODULE=authentik.root.settings
|
||||
PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
|
||||
AUTHENTIK_LISTEN__HTTP="[::]:9000"
|
||||
AUTHENTIK_LISTEN__HTTPS="[::]:9443"
|
||||
AUTHENTIK_LISTEN__METRICS="[::]:9300"
|
||||
msg_info "Updating Worker and Server config"
|
||||
cat <<EOF >>/etc/default/authentik-server
|
||||
RUST_BACKTRACE=full
|
||||
EOF
|
||||
cat <<EOF >/etc/default/authentik-worker
|
||||
TMPDIR=/dev/shm/
|
||||
UV_LINK_MODE=copy
|
||||
UV_PYTHON_DOWNLOADS=0
|
||||
UV_NATIVE_TLS=1
|
||||
VENV_PATH=/opt/authentik/.venv
|
||||
PYTHONDONTWRITEBYTECODE=1
|
||||
PYTHONUNBUFFERED=1
|
||||
PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
DJANGO_SETTINGS_MODULE=authentik.root.settings
|
||||
PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
|
||||
AUTHENTIK_LISTEN__HTTP="[::]:8000"
|
||||
AUTHENTIK_LISTEN__HTTPS="[::]:8443"
|
||||
AUTHENTIK_LISTEN__METRICS="[::]:8300"
|
||||
cat <<EOF >>/etc/default/authentik-worker
|
||||
RUST_BACKTRACE=full
|
||||
EOF
|
||||
msg_ok "Updated Worker and Server config!"
|
||||
msg_warn "Please check /etc/default/authentik-worker and /etc/default/authentik-server config files for port configurations!"
|
||||
msg_ok "Updated Worker and Server config!"
|
||||
|
||||
msg_info "Updating services"
|
||||
cat <<EOF >/etc/systemd/system/authentik-server.service
|
||||
[Unit]
|
||||
Description=authentik Go Server (API Gateway)
|
||||
After=network.target
|
||||
Wants=postgresql.service
|
||||
msg_info "Updating services"
|
||||
sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
|
||||
sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
|
||||
sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
|
||||
sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
|
||||
sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
|
||||
systemctl daemon-reload
|
||||
msg_ok "Updated services"
|
||||
|
||||
[Service]
|
||||
User=authentik
|
||||
Group=authentik
|
||||
ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
|
||||
ExecStart=/opt/authentik/authentik-server
|
||||
WorkingDirectory=/opt/authentik/
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
EnvironmentFile=/etc/default/authentik-server
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
cat <<EOF >/etc/systemd/system/authentik-worker.service
|
||||
[Unit]
|
||||
Description=authentik Worker
|
||||
After=network.target postgresql.service
|
||||
|
||||
[Service]
|
||||
User=authentik
|
||||
Group=authentik
|
||||
Type=simple
|
||||
EnvironmentFile=/etc/default/authentik-worker
|
||||
ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
|
||||
ExecStart=/opt/authentik/authentik-worker worker
|
||||
WorkingDirectory=/opt/authentik
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
systemctl daemon-reload
|
||||
msg_ok "Updated services"
|
||||
fi
|
||||
msg_info "Starting Services"
|
||||
systemctl start authentik-server authentik-worker
|
||||
if [[ $(systemctl is-enabled authentik-ldap) == enabled ]]; then
|
||||
systemctl start authentik-ldap
|
||||
fi
|
||||
if [[ $(systemctl is-enabled authentik-rac) == enabled ]]; then
|
||||
systemctl start authentik-rac
|
||||
fi
|
||||
if [[ $(systemctl is-enabled authentik-radius) == enabled ]]; then
|
||||
systemctl start authentik-radius
|
||||
fi
|
||||
msg_ok "Started Services"
|
||||
fi
|
||||
|
||||
msg_info "Starting Services"
|
||||
systemctl start authentik-server authentik-worker
|
||||
if [[ $(systemctl is-enabled authentik-ldap) == enabled ]]; then
|
||||
systemctl start authentik-ldap
|
||||
fi
|
||||
if [[ $(systemctl is-enabled authentik-rac) == enabled ]]; then
|
||||
systemctl start authentik-rac
|
||||
fi
|
||||
if [[ $(systemctl is-enabled authentik-radius) == enabled ]]; then
|
||||
systemctl start authentik-radius
|
||||
fi
|
||||
msg_ok "Started Services"
|
||||
msg_ok "Updated successfully!"
|
||||
exit
|
||||
}
|
||||
|
||||
@@ -50,16 +50,16 @@ $STD apt install -y \
|
||||
git
|
||||
msg_ok "Installed Dependencies"
|
||||
|
||||
NODE_VERSION="24" setup_nodejs
|
||||
NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
|
||||
setup_yq
|
||||
setup_go
|
||||
RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
|
||||
UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
|
||||
UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
|
||||
PG_VERSION="17" setup_postgresql
|
||||
PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
|
||||
|
||||
XMLSEC_VERSION="1.3.12"
|
||||
AUTHENTIK_VERSION="version/2026.5.6"
|
||||
AUTHENTIK_VERSION="version/2026.8.0"
|
||||
fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
|
||||
fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
|
||||
fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
|
||||
@@ -80,23 +80,25 @@ $STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
|
||||
msg_ok "Configured rust"
|
||||
|
||||
msg_info "Setting up web"
|
||||
cd /opt/authentik/web
|
||||
export NODE_ENV="production"
|
||||
$STD npm install
|
||||
$STD npm run build
|
||||
$STD npm run build:sfe
|
||||
cd /opt/authentik
|
||||
$STD node ./scripts/node/lint-runtime.mjs ./web
|
||||
cd /opt/authentik/web
|
||||
$STD pnpm install --frozen-lockfile
|
||||
$STD pnpm run build
|
||||
$STD pnpm run build:sfe
|
||||
msg_ok "Setup web"
|
||||
|
||||
msg_info "Setting up go proxy"
|
||||
msg_info "Building outposts"
|
||||
cd /opt/authentik
|
||||
mkdir -p /opt/authentik/bin
|
||||
export CGO_ENABLED="1"
|
||||
export CC="$(arch_resolve "x86_64" "aarch64")-linux-gnu-gcc"
|
||||
$STD go mod download
|
||||
$STD go build -o /opt/authentik/authentik-server ./cmd/server
|
||||
$STD go build -o /opt/authentik/ldap ./cmd/ldap
|
||||
$STD go build -o /opt/authentik/rac ./cmd/rac
|
||||
$STD go build -o /opt/authentik/radius ./cmd/radius
|
||||
msg_ok "Setup go proxy"
|
||||
$STD go build -o /opt/authentik/bin/ldap ./cmd/ldap
|
||||
$STD go build -o /opt/authentik/bin/rac ./cmd/rac
|
||||
$STD go build -o /opt/authentik/bin/radius ./cmd/radius
|
||||
msg_ok "Built outposts"
|
||||
|
||||
cat <<EOF >/usr/local/etc/GeoIP.conf
|
||||
AccountID ChangeME
|
||||
@@ -109,13 +111,13 @@ EOF
|
||||
|
||||
echo "#39 19 * * 6,4 /usr/bin/geoipupdate -f /usr/local/etc/GeoIP.conf" | crontab -
|
||||
|
||||
msg_info "Building worker. It may take more than 10 minutes, please be patient."
|
||||
msg_info "Building binary. It may take more than 10 minutes, please be patient."
|
||||
export AWS_LC_FIPS_SYS_CC="clang"
|
||||
cd /opt/authentik
|
||||
$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
|
||||
cp ./target/release/authentik /opt/authentik/authentik-worker
|
||||
$STD cargo build --package authentik --no-default-features --features core --locked --release
|
||||
cp ./target/release/authentik /opt/authentik/bin/
|
||||
rm -r ./target
|
||||
msg_ok "Built worker"
|
||||
msg_ok "Built binary"
|
||||
|
||||
msg_info "Setting up python server"
|
||||
export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
|
||||
@@ -127,10 +129,10 @@ export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
|
||||
cd /opt/authentik
|
||||
for attempt in 1 2 3; do
|
||||
if [[ $attempt -eq 3 ]]; then
|
||||
$STD uv sync --frozen --no-install-project --no-dev
|
||||
$STD uv sync --locked --no-install-project --no-dev
|
||||
break
|
||||
fi
|
||||
$STD uv sync --frozen --no-install-project --no-dev && break
|
||||
$STD uv sync --locked --no-install-project --no-dev && break
|
||||
msg_warn "uv sync attempt $attempt failed, retrying..."
|
||||
sleep $((attempt * 15))
|
||||
done
|
||||
@@ -159,6 +161,7 @@ UV_NATIVE_TLS=1
|
||||
VENV_PATH=/opt/authentik/.venv
|
||||
PYTHONDONTWRITEBYTECODE=1
|
||||
PYTHONUNBUFFERED=1
|
||||
RUST_BACKTRACE=full
|
||||
PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
DJANGO_SETTINGS_MODULE=authentik.root.settings
|
||||
PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
|
||||
@@ -174,6 +177,7 @@ UV_NATIVE_TLS=1
|
||||
VENV_PATH=/opt/authentik/.venv
|
||||
PYTHONDONTWRITEBYTECODE=1
|
||||
PYTHONUNBUFFERED=1
|
||||
RUST_BACKTRACE=full
|
||||
PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
DJANGO_SETTINGS_MODULE=authentik.root.settings
|
||||
PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
|
||||
@@ -201,7 +205,7 @@ msg_ok "Created authentik config"
|
||||
msg_info "Creating services"
|
||||
cat <<EOF >/etc/systemd/system/authentik-server.service
|
||||
[Unit]
|
||||
Description=authentik Go Server (API Gateway)
|
||||
Description=authentik Server
|
||||
After=network.target
|
||||
Wants=postgresql.service
|
||||
|
||||
@@ -210,7 +214,7 @@ User=authentik
|
||||
Group=authentik
|
||||
EnvironmentFile=/etc/default/authentik-server
|
||||
ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
|
||||
ExecStart=/opt/authentik/authentik-server
|
||||
ExecStart=/opt/authentik/bin/authentik server
|
||||
WorkingDirectory=/opt/authentik/
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
@@ -230,7 +234,7 @@ Group=authentik
|
||||
Type=simple
|
||||
EnvironmentFile=/etc/default/authentik-worker
|
||||
ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
|
||||
ExecStart=/opt/authentik/authentik-worker worker
|
||||
ExecStart=/opt/authentik/bin/authentik worker
|
||||
WorkingDirectory=/opt/authentik
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
@@ -248,7 +252,7 @@ Wants=postgresql.service
|
||||
[Service]
|
||||
User=authentik
|
||||
Group=authentik
|
||||
ExecStart=/opt/authentik/ldap
|
||||
ExecStart=/opt/authentik/bin/ldap
|
||||
WorkingDirectory=/opt/authentik/
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
@@ -267,7 +271,7 @@ Wants=postgresql.service
|
||||
[Service]
|
||||
User=authentik
|
||||
Group=authentik
|
||||
ExecStart=/opt/authentik/rac
|
||||
ExecStart=/opt/authentik/bin/rac
|
||||
WorkingDirectory=/opt/authentik/
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
@@ -286,7 +290,7 @@ Wants=postgresql.service
|
||||
[Service]
|
||||
User=authentik
|
||||
Group=authentik
|
||||
ExecStart=/opt/authentik/radius
|
||||
ExecStart=/opt/authentik/bin/radius
|
||||
WorkingDirectory=/opt/authentik/
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
|
||||
Reference in New Issue
Block a user