update authentik to 2026.5.2 (#14846)

* update authentik

* Apply e

Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>

* Apply requested change

* refactored

* Update install/authentik-install.sh

Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>

* Update install/authentik-install.sh

Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>

* Update install/authentik-install.sh

Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>

* Update install/authentik-install.sh

Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>

* Update install/authentik-install.sh

Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>

* Update ct/authentik.sh

Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>

* Update ct/authentik.sh

Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>

* Update ct/authentik.sh

Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>

* Update install/authentik-install.sh

Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>

* update rust

* Update install/authentik-install.sh

Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>

* add setup_yq

* update current version check

* Update ct/authentik.sh

Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>

---------

Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>

ct/authentik.sh

@@ -8,7 +8,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 APP="authentik"
 var_tags="${var_tags:-auth}"
 var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-4096}"
+var_ram="${var_ram:-8192}"
 var_disk="${var_disk:-16}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -30,12 +30,20 @@ function update_script() {
     exit
   fi
 
+  read -r MAJOR MINOR PATCH <<< "$(sed 's/^version\///; s/\./ /g' "$HOME/.authentik")"
+
+  msg_info "Update dependencies"
+  ensure_dependencies crossbuild-essential-amd64 gcc-x86-64-linux-gnu cmake clang libunwind-18-dev
+  msg_ok "Update dependencies"
+
   NODE_VERSION="24" setup_nodejs
   setup_go
   UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
-  setup_rust
+  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
+  setup_yq
 
-  AUTHENTIK_VERSION="version/2026.2.3"
+  AUTHENTIK_VERSION="version/2026.5.2"
+  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
   XMLSEC_VERSION="1.3.11"
 
   if check_for_gh_release "geoipupdate" "maxmind/geoipupdate"; then
@@ -71,7 +79,13 @@ function update_script() {
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 
-    msg_info "Updating web"
+	msg_info "Configuring rust"
+	cd /opt/authentik
+	$STD rustup install
+	$STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
+	msg_ok "Configured rust"
+
+	msg_info "Updating web"
     cd /opt/authentik/web
     export NODE_ENV="production"
     $STD npm install
@@ -89,6 +103,14 @@ function update_script() {
 	$STD go build -o /opt/authentik/radius ./cmd/radius
     msg_ok "Updated go proxy"
 
+	msg_info "Building worker"
+	export AWS_LC_FIPS_SYS_CC="clang"
+	cd /opt/authentik
+	$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
+	cp ./target/release/authentik /opt/authentik/authentik-worker
+	rm -r ./target
+	msg_ok "Built worker"
+
     msg_info "Updating python server"
     export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
     export UV_COMPILE_BYTECODE="1"
@@ -100,6 +122,103 @@ function update_script() {
     $STD uv sync --frozen --no-install-project --no-dev
     chown -R authentik:authentik /opt/authentik
     msg_ok "Updated python server"
+
+    if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
+	  msg_info "Updating Worker and Server config"
+	  cp /etc/authentik/config.yml /etc/authentik/config.bak
+	  yq -i ".postgresql.conn_max_age = 0" /etc/authentik/config.yml
+	  yq -i ".postgresql.conn_health_checks = false" /etc/authentik/config.yml
+	  yq -i ".listen.debug_tokio = \"[::]:6669\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.console_subscriber = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.h2 = \"info\""  /etc/authentik/config.yml
+      yq -i ".log.rust_log.hyper_util = \"warn\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.mio = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.notify = \"info\"" /etc/authentik/config.yml
+	  yq -i ".log.rust_log.reqwest = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.runtime = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.rustls = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.sqlx = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.sqlx_postgres = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.tokio = \"info\"" /etc/authentik/config.yml
+      yq -i ".log.rust_log.tungstenite = \"info\"" /etc/authentik/config.yml
+	  yq -i ".web.workers = 2" /etc/authentik/config.yml
+	  mv /etc/default/authentik /etc/default/authentik.bak
+	  cat <<EOF >/etc/default/authentik-server
+TMPDIR=/dev/shm/
+UV_LINK_MODE=copy
+UV_PYTHON_DOWNLOADS=0
+UV_NATIVE_TLS=1
+VENV_PATH=/opt/authentik/.venv
+PYTHONDONTWRITEBYTECODE=1
+PYTHONUNBUFFERED=1
+PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
+DJANGO_SETTINGS_MODULE=authentik.root.settings
+PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
+AUTHENTIK_LISTEN__HTTP="[::]:9000"
+AUTHENTIK_LISTEN__HTTPS="[::]:9443"
+AUTHENTIK_LISTEN__METRICS="[::]:9300"
+EOF
+	  cat <<EOF >/etc/default/authentik-worker
+TMPDIR=/dev/shm/
+UV_LINK_MODE=copy
+UV_PYTHON_DOWNLOADS=0
+UV_NATIVE_TLS=1
+VENV_PATH=/opt/authentik/.venv
+PYTHONDONTWRITEBYTECODE=1
+PYTHONUNBUFFERED=1
+PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
+DJANGO_SETTINGS_MODULE=authentik.root.settings
+PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
+AUTHENTIK_LISTEN__HTTP="[::]:8000"
+AUTHENTIK_LISTEN__HTTPS="[::]:8443"
+AUTHENTIK_LISTEN__METRICS="[::]:8300"
+EOF
+	  msg_ok "Updated Worker and Server config!"
+	  msg_warn "Please check /etc/default/authentik-worker and /etc/default/authentik-server config files for port configurations!"
+
+	  msg_info "Updating services"
+	  cat <<EOF >/etc/systemd/system/authentik-server.service
+[Unit]
+Description=authentik Go Server (API Gateway)
+After=network.target
+Wants=postgresql.service
+
+[Service]
+User=authentik
+Group=authentik
+ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
+ExecStart=/opt/authentik/authentik-server
+WorkingDirectory=/opt/authentik/
+Restart=always
+RestartSec=5
+EnvironmentFile=/etc/default/authentik-server
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+	  cat <<EOF >/etc/systemd/system/authentik-worker.service
+[Unit]
+Description=authentik Worker
+After=network.target postgresql.service
+
+[Service]
+User=authentik
+Group=authentik
+Type=simple
+EnvironmentFile=/etc/default/authentik-worker
+ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
+ExecStart=/opt/authentik/authentik-worker worker
+WorkingDirectory=/opt/authentik
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+	  systemctl daemon-reload
+	  msg_ok "Updated services"
+	fi
   fi
 
   msg_info "Starting Services"
@@ -150,7 +269,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Initial setup URL:${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:9000/if/flow/initial-setup/${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}https://${IP}:9443${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:9000${CL}"

install/authentik-install.sh

@@ -29,8 +29,6 @@ $STD apt install -y \
   libltdl-dev \
   libpq5 \
   libmaxminddb0 \
-  libkrb5-3 \
-  libkdb5-10 \
   libkadm5clnt-mit12 \
   libkadm5clnt7t64-heimdal \
   libltdl7 \
@@ -44,49 +42,61 @@ $STD apt install -y \
   libtool \
   libtool-bin \
   gcc \
+  crossbuild-essential-amd64 \
+  gcc-x86-64-linux-gnu \
+  cmake \
+  clang \
+  libunwind-18-dev \
   git
 msg_ok "Installed Dependencies"
 
 NODE_VERSION="24" setup_nodejs
 setup_yq
 setup_go
+RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
 UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
-setup_rust
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
 XMLSEC_VERSION="1.3.11"
-AUTHENTIK_VERSION="version/2026.2.3"
+AUTHENTIK_VERSION="version/2026.5.2"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
 
-msg_info "Setup xmlsec"
+msg_info "Setting up xmlsec"
 cd /opt/xmlsec
 $STD ./autogen.sh
 $STD make -j $(nproc)
 $STD make check
 $STD make install
 $STD ldconfig
-msg_ok "xmlsec installed"
+msg_ok "Setup xmlsec"
 
-msg_info "Setup web"
+msg_info "Configuring rust"
+cd /opt/authentik
+$STD rustup install
+$STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
+msg_ok "Configured rust"
+
+msg_info "Setting up web"
 cd /opt/authentik/web
 export NODE_ENV="production"
 $STD npm install
 $STD npm run build
 $STD npm run build:sfe
-msg_ok "Web installed"
+msg_ok "Setup web"
 
-msg_info "Setup go proxy"
+msg_info "Setting up go proxy"
 cd /opt/authentik
 export CGO_ENABLED="1"
+export CC="x86_64-linux-gnu-gcc"
 $STD go mod download
 $STD go build -o /opt/authentik/authentik-server ./cmd/server
 $STD go build -o /opt/authentik/ldap ./cmd/ldap
 $STD go build -o /opt/authentik/rac ./cmd/rac
 $STD go build -o /opt/authentik/radius ./cmd/radius
-msg_ok "Go proxy installed"
+msg_ok "Setup go proxy"
 
 cat <<EOF >/usr/local/etc/GeoIP.conf
 AccountID ChangeME
@@ -99,17 +109,24 @@ EOF
 
 echo "#39 19 * * 6,4 /usr/bin/geoipupdate -f /usr/local/etc/GeoIP.conf" | crontab -
 
-msg_info "Setup python server"
+msg_info "Building worker"
+export AWS_LC_FIPS_SYS_CC="clang"
+cd /opt/authentik
+$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
+cp ./target/release/authentik /opt/authentik/authentik-worker
+rm -r ./target
+msg_ok "Built worker"
+
+msg_info "Setting up python server"
 export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
 export UV_COMPILE_BYTECODE="1"
 export UV_LINK_MODE="copy"
 export UV_NATIVE_TLS="1"
-export RUSTUP_PERMIT_COPY_RENAME="true"
 export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
 cd /opt/authentik
 $STD uv sync --frozen --no-install-project --no-dev
 cp /opt/authentik/authentik/sources/kerberos/krb5.conf /etc/krb5.conf
-msg_ok "Installed python server"
+msg_ok "Setup python server"
 
 msg_info "Creating authentik config"
 mkdir -p /etc/authentik
@@ -125,7 +142,7 @@ yq -i ".storage.file.path = \"/opt/authentik-data\"" /etc/authentik/config.yml
 yq -i ".disable_startup_analytics = \"true\"" /etc/authentik/config.yml
 $STD useradd -U -s /usr/sbin/nologin -r -M -d /opt/authentik authentik
 chown -R authentik:authentik /opt/authentik
-cat <<EOF >/etc/default/authentik
+cat <<EOF >/etc/default/authentik-server
 TMPDIR=/dev/shm/
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
@@ -136,6 +153,24 @@ PYTHONUNBUFFERED=1
 PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
 DJANGO_SETTINGS_MODULE=authentik.root.settings
 PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
+AUTHENTIK_LISTEN__HTTP="[::]:9000"
+AUTHENTIK_LISTEN__HTTPS="[::]:9443"
+AUTHENTIK_LISTEN__METRICS="[::]:9300"
+EOF
+cat <<EOF >/etc/default/authentik-worker
+TMPDIR=/dev/shm/
+UV_LINK_MODE=copy
+UV_PYTHON_DOWNLOADS=0
+UV_NATIVE_TLS=1
+VENV_PATH=/opt/authentik/.venv
+PYTHONDONTWRITEBYTECODE=1
+PYTHONUNBUFFERED=1
+PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
+DJANGO_SETTINGS_MODULE=authentik.root.settings
+PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
+AUTHENTIK_LISTEN__HTTP="[::]:8000"
+AUTHENTIK_LISTEN__HTTPS="[::]:8443"
+AUTHENTIK_LISTEN__METRICS="[::]:8300"
 EOF
 cat <<EOF >/etc/default/authentik_ldap
 AUTHENTIK_HOST="https://127.0.0.1:9443"
@@ -152,7 +187,7 @@ AUTHENTIK_HOST="https://127.0.0.1:9443"
 AUTHENTIK_INSECURE="true"
 AUTHENTIK_TOKEN="token-generated-by-authentik"
 EOF
-msg_ok "authentik config created"
+msg_ok "Created authentik config"
 
 msg_info "Creating services"
 cat <<EOF >/etc/systemd/system/authentik-server.service
@@ -164,12 +199,12 @@ Wants=postgresql.service
 [Service]
 User=authentik
 Group=authentik
+EnvironmentFile=/etc/default/authentik-server
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
 ExecStart=/opt/authentik/authentik-server
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5
-EnvironmentFile=/etc/default/authentik
 
 [Install]
 WantedBy=multi-user.target
@@ -184,8 +219,9 @@ After=network.target postgresql.service
 User=authentik
 Group=authentik
 Type=simple
-EnvironmentFile=/etc/default/authentik
+EnvironmentFile=/etc/default/authentik-worker
-ExecStart=/usr/local/bin/uv run python -m manage worker --pid-file /dev/shm/authentik-worker.pid
+ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
+ExecStart=/opt/authentik/authentik-worker worker
 WorkingDirectory=/opt/authentik
 Restart=always
 RestartSec=5
@@ -250,7 +286,7 @@ EnvironmentFile=/etc/default/authentik_radius
 [Install]
 WantedBy=multi-user.target
 EOF
-msg_ok "Services created"
+msg_ok "Created services"
 
 motd_ssh
 customize