From d8e436f8c539e7742e2564d2eb291d3c22a2b080 Mon Sep 17 00:00:00 2001 From: thieneret <123479547+thieneret@users.noreply.github.com> Date: Thu, 3 Sep 2026 08:04:29 +0200 Subject: [PATCH] Authentik update 2026.8.1 (#16980) * update-authentik-2026.8.1 * fix --- ct/authentik.sh | 53 ++++++++++++++++++++++++++++-------- install/authentik-install.sh | 10 ++++--- 2 files changed, 47 insertions(+), 16 deletions(-) diff --git a/ct/authentik.sh b/ct/authentik.sh index 4290c6bd1..4e01be7dc 100644 --- a/ct/authentik.sh +++ b/ct/authentik.sh @@ -50,7 +50,7 @@ function update_script() { RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust setup_yq - AUTHENTIK_VERSION="version/2026.8.0" + AUTHENTIK_VERSION="version/2026.8.1" # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26 XMLSEC_VERSION="1.3.12" @@ -85,6 +85,16 @@ function update_script() { fi msg_ok "Stopped Services" + if [[ ! -d /opt/authentik-data/blueprints ]]; then + msg_info "Moving blueprints to presistent directory" + cp -r /opt/authentik/blueprints /opt/authentik-data/ + rm -r /opt/authentik/blueprints + chown -R authentik:authentik /opt/authentik-data + yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml + msg_ok "blueprints moved to presistent directory" + msg_warn "The blueprints provided by authentik are always overwritten when updated! Only manually created custom blueprints remain unchanged between updates." + fi + CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik" msg_info "Configuring rust" @@ -143,21 +153,39 @@ function update_script() { chown -R authentik:authentik /opt/authentik msg_ok "Updated python server" - msg_info "Updating Worker and Server config" - cat <>/etc/default/authentik-server + cp -r /opt/authentik/blueprints /opt/authentik-data/ + rm -r /opt/authentik/blueprints + chown -R authentik:authentik /opt/authentik-data + + if [[ $MAJOR == 2026 && $MINOR -lt 8 ]]; then + msg_info "Updating Worker and Server config (from $MAJOR.$MINOR)" + cat <>/etc/default/authentik-server RUST_BACKTRACE=full EOF - cat <>/etc/default/authentik-worker + cat <>/etc/default/authentik-worker RUST_BACKTRACE=full EOF - msg_ok "Updated Worker and Server config!" + msg_ok "Updated Worker and Server config (from $MAJOR.$MINOR)" + + msg_info "Updating services (from $MAJOR.$MINOR)" + sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service + sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service + sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service + sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service + sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service + systemctl daemon-reload + msg_ok "Updated services (from $MAJOR.$MINOR)" + fi + + msg_info "Updating Worker and Server config" + sed -i "s|/dev/shm$|/dev/shm/authentik-server|g" /etc/default/authentik-server + sed -i "s|/dev/shm$|/dev/shm/authentik-worker|g" /etc/default/authentik-worker + msg_ok "Updated Worker and Server config" msg_info "Updating services" - sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service - sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service - sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service - sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service - sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service + sed -i 's/authentik Go Server (API Gateway)/authentik Server/g' /etc/systemd/system/authentik-server.service + sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service + sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service systemctl daemon-reload msg_ok "Updated services" @@ -198,8 +226,9 @@ done $STD pct exec "$CTID" -- bash -c "mkdir -p /opt/authentik-data/{certs,media,geoip,templates}; \ cp /opt/authentik/tests/GeoLite2-ASN-Test.mmdb /opt/authentik-data/geoip/GeoLite2-ASN.mmdb; \ cp /opt/authentik/tests/GeoLite2-City-Test.mmdb /opt/authentik-data/geoip/GeoLite2-City.mmdb; \ - chown authentik:authentik /opt/authentik-data; \ - chown -R authentik:authentik /opt/authentik-data/{certs,media,geoip,templates}" + cp -r /opt/authentik/blueprints /opt/authentik-data/; \ + rm -r /opt/authentik/blueprints; \ + chown -R authentik:authentik /opt/authentik-data" msg_ok "Attached data storage volume" msg_info "Starting Services" diff --git a/install/authentik-install.sh b/install/authentik-install.sh index 7f089b759..6676a3eb1 100644 --- a/install/authentik-install.sh +++ b/install/authentik-install.sh @@ -59,7 +59,7 @@ PG_VERSION="17" setup_postgresql PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db XMLSEC_VERSION="1.3.12" -AUTHENTIK_VERSION="version/2026.8.0" +AUTHENTIK_VERSION="version/2026.8.1" fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec" fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik" fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary" @@ -146,7 +146,7 @@ yq -i ".secret_key = \"$(openssl rand -base64 128 | tr -dc 'a-zA-Z0-9' | head -c yq -i ".postgresql.password = \"${PG_DB_PASS}\"" /etc/authentik/config.yml yq -i ".events.context_processors.geoip = \"/opt/authentik-data/geoip/GeoLite2-City.mmdb\"" /etc/authentik/config.yml yq -i ".events.context_processors.asn = \"/opt/authentik-data/geoip/GeoLite2-ASN.mmdb\"" /etc/authentik/config.yml -yq -i ".blueprints_dir = \"/opt/authentik/blueprints\"" /etc/authentik/config.yml +yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml yq -i ".cert_discovery_dir = \"/opt/authentik-data/certs\"" /etc/authentik/config.yml yq -i ".email.template_dir = \"/opt/authentik-data/templates\"" /etc/authentik/config.yml yq -i ".storage.file.path = \"/opt/authentik-data\"" /etc/authentik/config.yml @@ -154,7 +154,7 @@ yq -i ".disable_startup_analytics = \"true\"" /etc/authentik/config.yml $STD useradd -U -s /usr/sbin/nologin -r -M -d /opt/authentik authentik chown -R authentik:authentik /opt/authentik cat </etc/default/authentik-server -TMPDIR=/dev/shm/ +TMPDIR=/dev/shm/authentik-server UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=0 UV_NATIVE_TLS=1 @@ -170,7 +170,7 @@ AUTHENTIK_LISTEN__HTTPS="[::]:9443" AUTHENTIK_LISTEN__METRICS="[::]:9300" EOF cat </etc/default/authentik-worker -TMPDIR=/dev/shm/ +TMPDIR=/dev/shm/authentik-worker UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=0 UV_NATIVE_TLS=1 @@ -214,6 +214,7 @@ User=authentik Group=authentik EnvironmentFile=/etc/default/authentik-server ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}" +ExecStartPre=/usr/bin/mkdir -p "\${TMPDIR}" ExecStart=/opt/authentik/bin/authentik server WorkingDirectory=/opt/authentik/ Restart=always @@ -234,6 +235,7 @@ Group=authentik Type=simple EnvironmentFile=/etc/default/authentik-worker ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}" +ExecStartPre=/usr/bin/mkdir -p "\${TMPDIR}" ExecStart=/opt/authentik/bin/authentik worker WorkingDirectory=/opt/authentik Restart=always