From f884cb704b3305c2d14a3a7a5c6274480185f15d Mon Sep 17 00:00:00 2001 From: thieneret <123479547+thieneret@users.noreply.github.com> Date: Sat, 22 Aug 2026 06:30:52 +0200 Subject: [PATCH] update authentik to 2026.8.0 (#16674) --- ct/authentik.sh | 180 +++++++++++------------------------ install/authentik-install.sh | 54 ++++++----- 2 files changed, 83 insertions(+), 151 deletions(-) diff --git a/ct/authentik.sh b/ct/authentik.sh index 95a97e1a1..ec20f6d51 100644 --- a/ct/authentik.sh +++ b/ct/authentik.sh @@ -32,18 +32,23 @@ function update_script() { read -r MAJOR MINOR PATCH <<<"$(sed 's/^version\///; s/\./ /g' "$HOME/.authentik")" + if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then + msg_error "Updating from version ${MAJOR}.${MINOR}.${PATCH} is not supported. A minimum version of 2026.5.x is required to update. See: https://docs.goauthentik.io/releases/2026.8/" + exit + fi + msg_info "Update dependencies" ensure_dependencies crossbuild-essential-$(arch_resolve) gcc-$(arch_resolve "x86-64" "aarch64")-linux-gnu cmake clang libunwind-18-dev msg_ok "Update dependencies" - NODE_VERSION="24" setup_nodejs + NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs setup_go $STD uv cache clean - UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv + UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust setup_yq - AUTHENTIK_VERSION="version/2026.5.6" + AUTHENTIK_VERSION="version/2026.8.0" # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26 XMLSEC_VERSION="1.3.12" @@ -87,30 +92,32 @@ function update_script() { msg_ok "Configured rust" msg_info "Updating web" - cd /opt/authentik/web export NODE_ENV="production" - $STD npm install - $STD npm run build - $STD npm run build:sfe + cd /opt/authentik + $STD node ./scripts/node/lint-runtime.mjs ./web + cd /opt/authentik/web + $STD pnpm install --frozen-lockfile + $STD pnpm run build + $STD pnpm run build:sfe msg_ok "Updated web" - msg_info "Updating go proxy" + msg_info "Updating outposts" cd /opt/authentik + mkdir -p /opt/authentik/bin export CGO_ENABLED="1" export CC="$(arch_resolve "x86_64" "aarch64")-linux-gnu-gcc" $STD go mod download - $STD go build -o /opt/authentik/authentik-server ./cmd/server - $STD go build -o /opt/authentik/ldap ./cmd/ldap - $STD go build -o /opt/authentik/rac ./cmd/rac - $STD go build -o /opt/authentik/radius ./cmd/radius - msg_ok "Updated go proxy" + $STD go build -o /opt/authentik/bin/ldap ./cmd/ldap + $STD go build -o /opt/authentik/bin/rac ./cmd/rac + $STD go build -o /opt/authentik/bin/radius ./cmd/radius + msg_ok "Updated outposts" - msg_info "Building worker. It may take more than 10 minutes, please be patient." - export AWS_LC_FIPS_SYS_CC="clang" - cd /opt/authentik - $STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1 - cp ./target/release/authentik /opt/authentik/authentik-worker - rm -r ./target + msg_info "Building binary. It may take more than 10 minutes, please be patient." + export AWS_LC_FIPS_SYS_CC="clang" + cd /opt/authentik + $STD cargo build --package authentik --no-default-features --features core --locked --release + cp ./target/release/authentik /opt/authentik/bin/ + rm -r ./target msg_ok "Built worker" msg_info "Updating python server" @@ -124,126 +131,47 @@ function update_script() { cd /opt/authentik for attempt in 1 2 3; do if [[ $attempt -eq 3 ]]; then - $STD uv sync --frozen --no-install-project --no-dev + $STD uv sync --locked --no-install-project --no-dev break fi - $STD uv sync --frozen --no-install-project --no-dev && break + $STD uv sync --locked --no-install-project --no-dev && break msg_warn "uv sync attempt $attempt failed, retrying..." sleep $((attempt * 15)) done chown -R authentik:authentik /opt/authentik msg_ok "Updated python server" - if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then - msg_info "Updating Worker and Server config" - cp /etc/authentik/config.yml /etc/authentik/config.bak - yq -i ".postgresql.conn_max_age = 0" /etc/authentik/config.yml - yq -i ".postgresql.conn_health_checks = false" /etc/authentik/config.yml - yq -i '.listen.debug_tokio = "[::]:6669"' /etc/authentik/config.yml - yq -i '.log.rust_log.console_subscriber = "info"' /etc/authentik/config.yml - yq -i '.log.rust_log.h2 = "info"' /etc/authentik/config.yml - yq -i '.log.rust_log.hyper_util = "warn"' /etc/authentik/config.yml - yq -i '.log.rust_log.mio = "info"' /etc/authentik/config.yml - yq -i '.log.rust_log.notify = "info"' /etc/authentik/config.yml - yq -i '.log.rust_log.reqwest = "info"' /etc/authentik/config.yml - yq -i '.log.rust_log.runtime = "info"' /etc/authentik/config.yml - yq -i '.log.rust_log.rustls = "info"' /etc/authentik/config.yml - yq -i '.log.rust_log.sqlx = "info"' /etc/authentik/config.yml - yq -i '.log.rust_log.sqlx_postgres = "info"' /etc/authentik/config.yml - yq -i '.log.rust_log.tokio = "info"' /etc/authentik/config.yml - yq -i '.log.rust_log.tungstenite = "info"' /etc/authentik/config.yml - yq -i ".web.workers = 2" /etc/authentik/config.yml - mv /etc/default/authentik /etc/default/authentik.bak - cat </etc/default/authentik-server -TMPDIR=/dev/shm/ -UV_LINK_MODE=copy -UV_PYTHON_DOWNLOADS=0 -UV_NATIVE_TLS=1 -VENV_PATH=/opt/authentik/.venv -PYTHONDONTWRITEBYTECODE=1 -PYTHONUNBUFFERED=1 -PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin -DJANGO_SETTINGS_MODULE=authentik.root.settings -PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp" -AUTHENTIK_LISTEN__HTTP="[::]:9000" -AUTHENTIK_LISTEN__HTTPS="[::]:9443" -AUTHENTIK_LISTEN__METRICS="[::]:9300" + msg_info "Updating Worker and Server config" + cat <>/etc/default/authentik-server +RUST_BACKTRACE=full EOF - cat </etc/default/authentik-worker -TMPDIR=/dev/shm/ -UV_LINK_MODE=copy -UV_PYTHON_DOWNLOADS=0 -UV_NATIVE_TLS=1 -VENV_PATH=/opt/authentik/.venv -PYTHONDONTWRITEBYTECODE=1 -PYTHONUNBUFFERED=1 -PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin -DJANGO_SETTINGS_MODULE=authentik.root.settings -PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp" -AUTHENTIK_LISTEN__HTTP="[::]:8000" -AUTHENTIK_LISTEN__HTTPS="[::]:8443" -AUTHENTIK_LISTEN__METRICS="[::]:8300" + cat <>/etc/default/authentik-worker +RUST_BACKTRACE=full EOF - msg_ok "Updated Worker and Server config!" - msg_warn "Please check /etc/default/authentik-worker and /etc/default/authentik-server config files for port configurations!" + msg_ok "Updated Worker and Server config!" - msg_info "Updating services" - cat </etc/systemd/system/authentik-server.service -[Unit] -Description=authentik Go Server (API Gateway) -After=network.target -Wants=postgresql.service + msg_info "Updating services" + sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service + sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service + sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service + sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service + sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service + systemctl daemon-reload + msg_ok "Updated services" -[Service] -User=authentik -Group=authentik -ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}" -ExecStart=/opt/authentik/authentik-server -WorkingDirectory=/opt/authentik/ -Restart=always -RestartSec=5 -EnvironmentFile=/etc/default/authentik-server - -[Install] -WantedBy=multi-user.target -EOF - - cat </etc/systemd/system/authentik-worker.service -[Unit] -Description=authentik Worker -After=network.target postgresql.service - -[Service] -User=authentik -Group=authentik -Type=simple -EnvironmentFile=/etc/default/authentik-worker -ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}" -ExecStart=/opt/authentik/authentik-worker worker -WorkingDirectory=/opt/authentik -Restart=always -RestartSec=5 - -[Install] -WantedBy=multi-user.target -EOF - systemctl daemon-reload - msg_ok "Updated services" - fi + msg_info "Starting Services" + systemctl start authentik-server authentik-worker + if [[ $(systemctl is-enabled authentik-ldap) == enabled ]]; then + systemctl start authentik-ldap + fi + if [[ $(systemctl is-enabled authentik-rac) == enabled ]]; then + systemctl start authentik-rac + fi + if [[ $(systemctl is-enabled authentik-radius) == enabled ]]; then + systemctl start authentik-radius + fi + msg_ok "Started Services" fi - - msg_info "Starting Services" - systemctl start authentik-server authentik-worker - if [[ $(systemctl is-enabled authentik-ldap) == enabled ]]; then - systemctl start authentik-ldap - fi - if [[ $(systemctl is-enabled authentik-rac) == enabled ]]; then - systemctl start authentik-rac - fi - if [[ $(systemctl is-enabled authentik-radius) == enabled ]]; then - systemctl start authentik-radius - fi - msg_ok "Started Services" msg_ok "Updated successfully!" exit } diff --git a/install/authentik-install.sh b/install/authentik-install.sh index 885d77dd8..7f089b759 100644 --- a/install/authentik-install.sh +++ b/install/authentik-install.sh @@ -50,16 +50,16 @@ $STD apt install -y \ git msg_ok "Installed Dependencies" -NODE_VERSION="24" setup_nodejs +NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs setup_yq setup_go RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust -UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv +UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv PG_VERSION="17" setup_postgresql PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db XMLSEC_VERSION="1.3.12" -AUTHENTIK_VERSION="version/2026.5.6" +AUTHENTIK_VERSION="version/2026.8.0" fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec" fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik" fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary" @@ -80,23 +80,25 @@ $STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)" msg_ok "Configured rust" msg_info "Setting up web" -cd /opt/authentik/web export NODE_ENV="production" -$STD npm install -$STD npm run build -$STD npm run build:sfe +cd /opt/authentik +$STD node ./scripts/node/lint-runtime.mjs ./web +cd /opt/authentik/web +$STD pnpm install --frozen-lockfile +$STD pnpm run build +$STD pnpm run build:sfe msg_ok "Setup web" -msg_info "Setting up go proxy" +msg_info "Building outposts" cd /opt/authentik +mkdir -p /opt/authentik/bin export CGO_ENABLED="1" export CC="$(arch_resolve "x86_64" "aarch64")-linux-gnu-gcc" $STD go mod download -$STD go build -o /opt/authentik/authentik-server ./cmd/server -$STD go build -o /opt/authentik/ldap ./cmd/ldap -$STD go build -o /opt/authentik/rac ./cmd/rac -$STD go build -o /opt/authentik/radius ./cmd/radius -msg_ok "Setup go proxy" +$STD go build -o /opt/authentik/bin/ldap ./cmd/ldap +$STD go build -o /opt/authentik/bin/rac ./cmd/rac +$STD go build -o /opt/authentik/bin/radius ./cmd/radius +msg_ok "Built outposts" cat </usr/local/etc/GeoIP.conf AccountID ChangeME @@ -109,13 +111,13 @@ EOF echo "#39 19 * * 6,4 /usr/bin/geoipupdate -f /usr/local/etc/GeoIP.conf" | crontab - -msg_info "Building worker. It may take more than 10 minutes, please be patient." +msg_info "Building binary. It may take more than 10 minutes, please be patient." export AWS_LC_FIPS_SYS_CC="clang" cd /opt/authentik -$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1 -cp ./target/release/authentik /opt/authentik/authentik-worker +$STD cargo build --package authentik --no-default-features --features core --locked --release +cp ./target/release/authentik /opt/authentik/bin/ rm -r ./target -msg_ok "Built worker" +msg_ok "Built binary" msg_info "Setting up python server" export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec" @@ -127,10 +129,10 @@ export UV_PYTHON_INSTALL_DIR="/usr/local/bin" cd /opt/authentik for attempt in 1 2 3; do if [[ $attempt -eq 3 ]]; then - $STD uv sync --frozen --no-install-project --no-dev + $STD uv sync --locked --no-install-project --no-dev break fi - $STD uv sync --frozen --no-install-project --no-dev && break + $STD uv sync --locked --no-install-project --no-dev && break msg_warn "uv sync attempt $attempt failed, retrying..." sleep $((attempt * 15)) done @@ -159,6 +161,7 @@ UV_NATIVE_TLS=1 VENV_PATH=/opt/authentik/.venv PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 +RUST_BACKTRACE=full PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin DJANGO_SETTINGS_MODULE=authentik.root.settings PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp" @@ -174,6 +177,7 @@ UV_NATIVE_TLS=1 VENV_PATH=/opt/authentik/.venv PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 +RUST_BACKTRACE=full PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin DJANGO_SETTINGS_MODULE=authentik.root.settings PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp" @@ -201,7 +205,7 @@ msg_ok "Created authentik config" msg_info "Creating services" cat </etc/systemd/system/authentik-server.service [Unit] -Description=authentik Go Server (API Gateway) +Description=authentik Server After=network.target Wants=postgresql.service @@ -210,7 +214,7 @@ User=authentik Group=authentik EnvironmentFile=/etc/default/authentik-server ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}" -ExecStart=/opt/authentik/authentik-server +ExecStart=/opt/authentik/bin/authentik server WorkingDirectory=/opt/authentik/ Restart=always RestartSec=5 @@ -230,7 +234,7 @@ Group=authentik Type=simple EnvironmentFile=/etc/default/authentik-worker ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}" -ExecStart=/opt/authentik/authentik-worker worker +ExecStart=/opt/authentik/bin/authentik worker WorkingDirectory=/opt/authentik Restart=always RestartSec=5 @@ -248,7 +252,7 @@ Wants=postgresql.service [Service] User=authentik Group=authentik -ExecStart=/opt/authentik/ldap +ExecStart=/opt/authentik/bin/ldap WorkingDirectory=/opt/authentik/ Restart=always RestartSec=5 @@ -267,7 +271,7 @@ Wants=postgresql.service [Service] User=authentik Group=authentik -ExecStart=/opt/authentik/rac +ExecStart=/opt/authentik/bin/rac WorkingDirectory=/opt/authentik/ Restart=always RestartSec=5 @@ -286,7 +290,7 @@ Wants=postgresql.service [Service] User=authentik Group=authentik -ExecStart=/opt/authentik/radius +ExecStart=/opt/authentik/bin/radius WorkingDirectory=/opt/authentik/ Restart=always RestartSec=5