Merge branch 'main' into feature/writefreely-integration

.env.sample

@@ -28,9 +28,6 @@ AUTHENTIK_LOG_LEVEL=info
 
 ## ADMIN
 AUTHENTIK_BOOTSTRAP_EMAIL=admin@example.com
-# The admin password will be overwritten by set_admin_pass() use this env only to skip the manual setup process
-#AUTHENTIK_BOOTSTRAP_PASSWORD=changemeimmediately!
-
 
 ## EMAIL
 AUTHENTIK_EMAIL__HOST=smtp
@@ -131,7 +128,6 @@ COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
 # SECRET_KIMAI_ID_VERSION=v1
 # SECRET_KIMAI_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS kimai:~/.abra/recipes/authentik/icons/kimai_logo.png"
-# KIMAI_GROUP='kimai_admin'
 # KIMAI_APPGROUP="$GROUP_ORGANISATION"
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.zammad.yml"
@@ -166,7 +162,13 @@ COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
 # SECRET_MILA_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS mila:~/.abra/recipes/authentik/icons/mila.svg"
 # MILA_APPGROUP=""
-# MILA_GROUP='mv_admin'
+
+# COMPOSE_FILE="$COMPOSE_FILE:compose.writefreely.yml"
+# WRITEFREELY_DOMAIN=writefreely.example.com
+# SECRET_WRITEFREELY_ID_VERSION=v1
+# SECRET_WRITEFREELY_SECRET_VERSION=v1
+# APP_ICONS="nextcloud:~/.abra/recipes/authentik/icons/writefreely.png"
+# WRITEFREELY_APPGROUP="$GROUP_DOCUMENTATION"
 
 # APPLICATIONS='{"Calendar": {"url":"https://nextcloud.example.com/apps/calendar/", "group": ""}, "BBB": {"url":"https://nextcloud.example.com/apps/bbb/", "group":""}, "Pretix": {"url":"https://pretix.example.com/control/", "group":""}}'
 # EXTRA_ICONS={"Calendar": "~/.abra/recipes/authentik/icons/calendar.svg", "BBB": "~/.abra/recipes/authentik/icons/bbb.png", "Pretix": "~/.abra/recipes/authentik/icons/pretix.svg"}

abra.sh

@@ -1,22 +1,23 @@
 export CUSTOM_CSS_VERSION=v3
 export FLOW_AUTHENTICATION_VERSION=v4
-export FLOW_INVITATION_VERSION=v3
+export FLOW_INVITATION_VERSION=v2
 export FLOW_INVALIDATION_VERSION=v2
 export FLOW_RECOVERY_VERSION=v2
 export FLOW_TRANSLATION_VERSION=v3
 export SYSTEM_BRAND_VERSION=v4
-export NEXTCLOUD_CONFIG_VERSION=v4
-export WORDPRESS_CONFIG_VERSION=v8
-export MATRIX_CONFIG_VERSION=v4
-export WEKAN_CONFIG_VERSION=v6
-export VIKUNJA_CONFIG_VERSION=v4
-export OUTLINE_CONFIG_VERSION=v5
+export NEXTCLOUD_CONFIG_VERSION=v3
+export WORDPRESS_CONFIG_VERSION=v6
+export MATRIX_CONFIG_VERSION=v3
+export WEKAN_CONFIG_VERSION=v5
+export VIKUNJA_CONFIG_VERSION=v3
+export OUTLINE_CONFIG_VERSION=v4
 export KIMAI_CONFIG_VERSION=v3
 export ZAMMAD_CONFIG_VERSION=v4
-export RALLLY_CONFIG_VERSION=v5
-export HEDGEDOC_CONFIG_VERSION=v4
-export MONITORING_CONFIG_VERSION=v5
-export MILA_CONFIG_VERSION=v2
+export RALLLY_CONFIG_VERSION=v4
+export HEDGEDOC_CONFIG_VERSION=v3
+export MONITORING_CONFIG_VERSION=v4
+export WRITEFREELY_CONFIG_VERSION=v1
+export MILA_CONFIG_VERSION=v1
 export DB_ENTRYPOINT_VERSION=v1
 export PG_BACKUP_VERSION=v2
 export ENTRYPOINT_CSS_VERSION=v1
@@ -54,33 +55,6 @@ import_user() {
   abra app cmd -C -T $APP_NAME worker _import_user $filename
 }
 
-init_admin_groups() {
-
-  /manage.py shell -c """
-from authentik.core.models import Group
-
-groups = [
-    os.environ.get('WORDPRESS_GROUP', ''),
-    os.environ.get('MILA_GROUP', ''),
-    os.environ.get('KIMAI_GROUP', '')
-]
-groups = [g.strip() for g in groups if g.strip()]
-if not groups:
-    print('Keine Gruppen definiert.')
-admin = User.objects.get(username='akadmin')
-for group_name in groups:
-    group_name = group_name.strip()
-    if Group.objects.filter(name=group_name):
-        group = Group.objects.get(name=group_name)
-    else:
-        group = Group.objects.create(name=group_name)
-        print(f'{group_name} created')
-    group.users.add(admin)
-    print(f'add akadmin to group {group_name}')
-""" 2>&1 | quieten
-
-}
-
 _import_user() {
   /manage.py shell -c """
 from authentik.core.models import Group

compose.outposts.ldap.yml

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   authentik_ldap:
-      image: ghcr.io/goauthentik/ldap:2026.5.2
+      image: ghcr.io/goauthentik/ldap:2026.2.1
       # Optionally specify which networks the container should be
       # might be needed to reach the core authentik server
       networks:

compose.writefreely.yml

@@ -0,0 +1,26 @@
+version: "3.8"
+services:
+  worker:
+    secrets:
+      - writefreely_id
+      - writefreely_secret
+    environment:
+      - WRITEFREELY_DOMAIN
+    configs:
+      - source: writefreely
+        target: /blueprints/writefreely.yaml
+
+secrets:
+  writefreely_id:
+    external: true
+    name: ${STACK_NAME}_writefreely_id_${SECRET_WRITEFREELY_ID_VERSION}
+  writefreely_secret:
+    external: true
+    name: ${STACK_NAME}_writefreely_secret_${SECRET_WRITEFREELY_SECRET_VERSION}
+
+
+configs:
+  writefreely:
+    name: ${STACK_NAME}_writefreely_${WRITEFREELY_CONFIG_VERSION}
+    file: writefreely.yaml.tmpl
+    template_driver: golang

compose.yml

@@ -22,7 +22,6 @@ x-env: &env
     - AUTHENTIK_FOOTER_LINKS
     - AUTHENTIK_IMPERSONATION
     - AUTHENTIK_BOOTSTRAP_EMAIL
-    - AUTHENTIK_BOOTSTRAP_PASSWORD
     - WELCOME_MESSAGE
     - DEFAULT_LANGUAGE
     - EMAIL_SUBJECT
@@ -35,7 +34,7 @@ x-env: &env
 version: '3.8'
 services:
   app:
-    image: ghcr.io/goauthentik/server:2026.5.2
+    image: ghcr.io/goauthentik/server:2026.2.1
     command: server
     depends_on:
       - db
@@ -71,14 +70,14 @@ services:
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect,${STACK_NAME}-frameOptions,${STACK_NAME}-redirect"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.customFrameOptionsValue=SAMEORIGIN"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.contentSecurityPolicy=frame-ancestors ${X_FRAME_OPTIONS_ALLOW_FROM}"
-        - "coop-cloud.${STACK_NAME}.version=12.0.2+2026.5.2"
+        - "coop-cloud.${STACK_NAME}.version=11.0.4+2026.2.1"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.regex=^https://(${REDIRECTS})/(.*)"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
 
   worker:
-    image: ghcr.io/goauthentik/server:2026.5.2
+    image: ghcr.io/goauthentik/server:2026.2.1
     command: worker
     depends_on:
       - db
@@ -94,6 +93,7 @@ services:
     volumes:
       - data:/data
       - media:/media
+      - /dev/null:/blueprints/default/flow-oobe.yaml
       - templates:/templates
       - certs:/certs
     configs:
@@ -118,13 +118,18 @@ services:
       start_period: 5m
 
   db:
-    image: pgautoupgrade/pgautoupgrade:16-trixie
+    image: postgres:15.17
     secrets:
       - db_password
     configs:
+      - source: db_entrypoint
+        target: /docker-entrypoint.sh
+        mode: 0555
       - source: pg_backup
         target: /pg_backup.sh
         mode: 0555
+    entrypoint:
+      /docker-entrypoint.sh
     volumes:
       - database:/var/lib/postgresql/data
     networks:
@@ -202,6 +207,10 @@ configs:
     name: ${STACK_NAME}_system_brand_${SYSTEM_BRAND_VERSION}
     file: system_brand.yaml.tmpl
     template_driver: golang
+  db_entrypoint:
+    name: ${STACK_NAME}_db_entrypoint_${DB_ENTRYPOINT_VERSION}
+    file: entrypoint.postgres.sh.tmpl
+    template_driver: golang
   pg_backup:
     name: ${STACK_NAME}_pg_backup_${PG_BACKUP_VERSION}
     file: pg_backup.sh

entrypoint.postgres.sh.tmpl

@@ -0,0 +1,45 @@
+#!/bin/bash
+
+set -e
+
+MIGRATION_MARKER=$PGDATA/migration_in_progress
+OLDDATA=$PGDATA/old_data
+NEWDATA=$PGDATA/new_data
+
+if [ -e $MIGRATION_MARKER ]; then
+  echo "FATAL: migration was started but did not complete in a previous run. manual recovery necessary"
+  exit 1
+fi
+
+if [ -f $PGDATA/PG_VERSION ]; then
+  DATA_VERSION=$(cat $PGDATA/PG_VERSION)
+
+  if [ -n "$DATA_VERSION" -a "$PG_MAJOR" != "$DATA_VERSION" ]; then
+    echo "postgres data version $DATA_VERSION found, but need $PG_MAJOR. Starting migration"
+    echo "Installing postgres $DATA_VERSION"
+    sed -i "s/$/ $DATA_VERSION/" /etc/apt/sources.list.d/pgdg.list
+    apt-get update && apt-get install -y --no-install-recommends \
+      postgresql-$DATA_VERSION \
+      && rm -rf /var/lib/apt/lists/*
+    echo "shuffling around"
+    chown -R postgres:postgres $PGDATA
+    gosu postgres mkdir $OLDDATA $NEWDATA
+    chmod 700 $OLDDATA $NEWDATA
+    mv $PGDATA/* $OLDDATA/ || true
+    touch $MIGRATION_MARKER
+    echo "running initdb"
+    # abuse entrypoint script for initdb by making server error out
+    gosu postgres bash -c "export PGDATA=$NEWDATA ; /usr/local/bin/docker-entrypoint.sh --invalid-arg || true"
+    echo "running pg_upgrade"
+    cd /tmp
+    gosu postgres pg_upgrade --link -b /usr/lib/postgresql/$DATA_VERSION/bin -d $OLDDATA -D $NEWDATA -U $POSTGRES_USER
+    cp $OLDDATA/pg_hba.conf $NEWDATA/
+    mv $NEWDATA/* $PGDATA
+    rm -rf $OLDDATA
+    rmdir $NEWDATA
+    rm $MIGRATION_MARKER
+    echo "migration complete"
+  fi
+fi
+
+/usr/local/bin/docker-entrypoint.sh postgres

flow_invitation.yaml.tmpl

@@ -27,7 +27,7 @@ entries:
 ### POLICIES
 - attrs:
     expression: |
-      if not regex_match(request.context.get('prompt_data').get('username'), '\\s'):
+      if not regex_match(request.context.get('prompt_data').get('username'), '\s'):
           return True
       ak_message("Username must not contain any whitespace!")
       return False

hedgedoc.yaml.tmpl

@@ -27,9 +27,6 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: hashed_user_id
     token_validity: days=30
-    grant_types:
-      - authorization_code
-      - refresh_token
   conditions: []
   id: hedgedoc_provider
   identifiers:

matrix.yaml.tmpl

@@ -27,9 +27,6 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: user_username
     token_validity: days=30
-    grant_types:
-      - authorization_code
-      - refresh_token
   conditions: []
   id: matrix_provider
   identifiers:

mila.yaml.tmpl

@@ -27,9 +27,6 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: hashed_user_id
     token_validity: days=30
-    grant_types:
-      - authorization_code
-      - refresh_token
   conditions: []
   id: mila_provider
   identifiers:

monitoring.yaml.tmpl

@@ -27,9 +27,6 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: user_username
     token_validity: days=30
-    grant_types:
-      - authorization_code
-      - refresh_token
   conditions: []
   id: monitoring_provider
   identifiers:

nextcloud.yaml.tmpl

@@ -40,9 +40,6 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: user_username
     token_validity: days=30
-    grant_types:
-      - authorization_code
-      - refresh_token
   conditions: []
   id: nextcloud_provider
   identifiers:

outline.yaml.tmpl

@@ -27,9 +27,6 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: hashed_user_id
     token_validity: days=30
-    grant_types:
-      - authorization_code
-      - refresh_token
   conditions: []
   id: outline_provider
   identifiers:

rallly.yaml.tmpl

@@ -27,9 +27,6 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: hashed_user_id
     token_validity: days=30
-    grant_types:
-      - authorization_code
-      - refresh_token
   conditions: []
   id: rallly_provider
   identifiers:

release/12.0.0+2026.5.2

@@ -1 +0,0 @@
-postgres image was replaced py pgautoupdate. Make an database backup to prevent any dataloss before updating.

release/12.0.1+2026.5.2

@@ -1 +0,0 @@
-adds admin group for kimai

vikunja.yaml.tmpl

@@ -27,9 +27,6 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: hashed_user_id
     token_validity: days=30
-    grant_types:
-      - authorization_code
-      - refresh_token
   conditions: []
   id: vikunja_provider
   identifiers:

wekan.yaml.tmpl

@@ -45,9 +45,6 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: hashed_user_id
     token_validity: days=30
-    grant_types:
-      - authorization_code
-      - refresh_token
   conditions: []
   id: wekan_provider
   identifiers:

wordpress.yaml.tmpl

@@ -27,9 +27,6 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: user_username
     token_validity: days=30
-    grant_types:
-      - authorization_code
-      - refresh_token
   conditions: []
   id: wordpress_provider
   identifiers:
@@ -53,6 +50,9 @@ entries:
 {{ if ne (env "WORDPRESS_GROUP") "" }} 
 - identifiers:
     name: {{ env "WORDPRESS_GROUP" }}
+  attrs:
+    users:
+    - !Find [authentik_core.user, [username, "akadmin"]]
   id: wordpress_group
   model: authentik_core.group
 

writefreely.yaml.tmpl

@@ -0,0 +1,61 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: Writefreely
+
+entries:
+- attrs:
+    description: writefreely
+    expression: 'return { "writefreely_groups": [{"gid": group.name, "displayName":
+      group.name} for group in request.user.ak_groups.all()], }'
+    managed: null
+    scope_name: writefreely
+  conditions: []
+  id: writefreely_group_mapping
+  identifiers:
+    name: writefreely
+  model: authentik_providers_oauth2.scopemapping
+  state: present
+
+- attrs:
+    access_code_validity: minutes=1
+    authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+    authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+    invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+    client_id: {{ secret  "writefreely_id" }}
+    client_secret: {{ secret  "writefreely_secret" }}
+    client_type: confidential
+    include_claims_in_id_token: true
+    issuer_mode: per_provider
+    redirect_uris:
+    - matching_mode: strict
+      url: https://{{ env  "WRITEFREELY_DOMAIN" }}/oauth/callback/generic
+    name: Writefreely
+    property_mappings:
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
+    - !KeyOf writefreely_group_mapping
+    signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+    sub_mode: user_username
+    token_validity: days=30
+  conditions: []
+  id: writefreely_provider
+  identifiers:
+    pk: 9988
+  model: authentik_providers_oauth2.oauth2provider
+  state: present
+
+- attrs:
+    meta_launch_url: https://{{ env  "WRITEFREELY_DOMAIN" }}
+    open_in_new_tab: true
+    policy_engine_mode: any
+    provider: !KeyOf writefreely_provider
+    slug: writefreely
+  conditions: []
+  id: writefreely_application
+  identifiers:
+    name: Writefreely
+  model: authentik_core.application
+  state: present