From d4771cbf98d119da8d2e8b04fac1272244fbe2ef Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Sat, 5 Sep 2026 22:41:58 +0200
Subject: [PATCH] authentik: scope blueprints chown to avoid recursing into the
 mp0 bind mount (#17008)

---
 ct/authentik.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/ct/authentik.sh b/ct/authentik.sh
index ff587b374..d66330719 100644
--- a/ct/authentik.sh
+++ b/ct/authentik.sh
@@ -88,7 +88,7 @@ function update_script() {
       msg_info "Moving blueprints to presistent directory"
       cp -r /opt/authentik/blueprints /opt/authentik-data/
       rm -r /opt/authentik/blueprints
-      chown -Rf authentik:authentik /opt/authentik-data
+      $STD find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +
       yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml
       msg_ok "blueprints moved to presistent directory"
       msg_warn "The blueprints provided by authentik are always overwritten when updated! Only manually created custom blueprints remain unchanged between updates."
@@ -155,8 +155,8 @@ function update_script() {
 
     cp -r /opt/authentik/blueprints /opt/authentik-data/
     rm -r /opt/authentik/blueprints
-    chown -Rf authentik:authentik /opt/authentik-data
-    
+    $STD find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +
+
     if [[ $MAJOR == 2026 && $MINOR -lt 8 ]]; then
 	    msg_info "Updating Worker and Server config (from $MAJOR.$MINOR)"
       cat <<EOF >>/etc/default/authentik-server
@@ -178,8 +178,8 @@ EOF
     fi
 
     msg_info "Updating Worker and Server config"
-    sed -i "s|/dev/shm$|/dev/shm/authentik-server|g" /etc/default/authentik-server
-	  sed -i "s|/dev/shm$|/dev/shm/authentik-worker|g" /etc/default/authentik-worker
+    sed -i "s|/dev/shm\/\?$|/dev/shm/authentik-server|g" /etc/default/authentik-server
+	  sed -i "s|/dev/shm\/\?$|/dev/shm/authentik-worker|g" /etc/default/authentik-worker
     msg_ok "Updated Worker and Server config"
 
     msg_info "Updating services"
@@ -228,7 +228,7 @@ $STD pct exec "$CTID" -- bash -c "mkdir -p /opt/authentik-data/{certs,media,geoi
   cp /opt/authentik/tests/GeoLite2-City-Test.mmdb /opt/authentik-data/geoip/GeoLite2-City.mmdb; \
   cp -r /opt/authentik/blueprints /opt/authentik-data/; \
   rm -r /opt/authentik/blueprints; \
-  chown -Rf authentik:authentik /opt/authentik-data"
+  find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +"
 msg_ok "Attached data storage volume"
 
 msg_info "Starting Services"