chore: publish 12.0.2+2026.5.2 release

.env.sample

@@ -28,6 +28,9 @@ AUTHENTIK_LOG_LEVEL=info
 
 ## ADMIN
 AUTHENTIK_BOOTSTRAP_EMAIL=admin@example.com
+# The admin password will be overwritten by set_admin_pass() use this env only to skip the manual setup process
+#AUTHENTIK_BOOTSTRAP_PASSWORD=changemeimmediately!
+
 
 ## EMAIL
 AUTHENTIK_EMAIL__HOST=smtp
@@ -128,6 +131,7 @@ COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
 # SECRET_KIMAI_ID_VERSION=v1
 # SECRET_KIMAI_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS kimai:~/.abra/recipes/authentik/icons/kimai_logo.png"
+# KIMAI_GROUP='kimai_admin'
 # KIMAI_APPGROUP="$GROUP_ORGANISATION"
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.zammad.yml"
@@ -162,6 +166,7 @@ COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
 # SECRET_MILA_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS mila:~/.abra/recipes/authentik/icons/mila.svg"
 # MILA_APPGROUP=""
+# MILA_GROUP='mv_admin'
 
 # APPLICATIONS='{"Calendar": {"url":"https://nextcloud.example.com/apps/calendar/", "group": ""}, "BBB": {"url":"https://nextcloud.example.com/apps/bbb/", "group":""}, "Pretix": {"url":"https://pretix.example.com/control/", "group":""}}'
 # EXTRA_ICONS={"Calendar": "~/.abra/recipes/authentik/icons/calendar.svg", "BBB": "~/.abra/recipes/authentik/icons/bbb.png", "Pretix": "~/.abra/recipes/authentik/icons/pretix.svg"}

abra.sh

@@ -1,22 +1,22 @@
 export CUSTOM_CSS_VERSION=v3
 export FLOW_AUTHENTICATION_VERSION=v4
-export FLOW_INVITATION_VERSION=v2
+export FLOW_INVITATION_VERSION=v3
 export FLOW_INVALIDATION_VERSION=v2
 export FLOW_RECOVERY_VERSION=v2
 export FLOW_TRANSLATION_VERSION=v3
 export SYSTEM_BRAND_VERSION=v4
-export NEXTCLOUD_CONFIG_VERSION=v3
-export WORDPRESS_CONFIG_VERSION=v6
-export MATRIX_CONFIG_VERSION=v3
-export WEKAN_CONFIG_VERSION=v5
-export VIKUNJA_CONFIG_VERSION=v3
-export OUTLINE_CONFIG_VERSION=v4
+export NEXTCLOUD_CONFIG_VERSION=v4
+export WORDPRESS_CONFIG_VERSION=v8
+export MATRIX_CONFIG_VERSION=v4
+export WEKAN_CONFIG_VERSION=v6
+export VIKUNJA_CONFIG_VERSION=v4
+export OUTLINE_CONFIG_VERSION=v5
 export KIMAI_CONFIG_VERSION=v3
 export ZAMMAD_CONFIG_VERSION=v4
-export RALLLY_CONFIG_VERSION=v4
-export HEDGEDOC_CONFIG_VERSION=v3
-export MONITORING_CONFIG_VERSION=v4
-export MILA_CONFIG_VERSION=v1
+export RALLLY_CONFIG_VERSION=v5
+export HEDGEDOC_CONFIG_VERSION=v4
+export MONITORING_CONFIG_VERSION=v5
+export MILA_CONFIG_VERSION=v2
 export DB_ENTRYPOINT_VERSION=v1
 export PG_BACKUP_VERSION=v2
 export ENTRYPOINT_CSS_VERSION=v1
@@ -54,6 +54,33 @@ import_user() {
   abra app cmd -C -T $APP_NAME worker _import_user $filename
 }
 
+init_admin_groups() {
+
+  /manage.py shell -c """
+from authentik.core.models import Group
+
+groups = [
+    os.environ.get('WORDPRESS_GROUP', ''),
+    os.environ.get('MILA_GROUP', ''),
+    os.environ.get('KIMAI_GROUP', '')
+]
+groups = [g.strip() for g in groups if g.strip()]
+if not groups:
+    print('Keine Gruppen definiert.')
+admin = User.objects.get(username='akadmin')
+for group_name in groups:
+    group_name = group_name.strip()
+    if Group.objects.filter(name=group_name):
+        group = Group.objects.get(name=group_name)
+    else:
+        group = Group.objects.create(name=group_name)
+        print(f'{group_name} created')
+    group.users.add(admin)
+    print(f'add akadmin to group {group_name}')
+""" 2>&1 | quieten
+
+}
+
 _import_user() {
   /manage.py shell -c """
 from authentik.core.models import Group

compose.outposts.ldap.yml

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   authentik_ldap:
-      image: ghcr.io/goauthentik/ldap:2026.2.1
+      image: ghcr.io/goauthentik/ldap:2026.5.2
       # Optionally specify which networks the container should be
       # might be needed to reach the core authentik server
       networks:

compose.yml

@@ -22,6 +22,7 @@ x-env: &env
     - AUTHENTIK_FOOTER_LINKS
     - AUTHENTIK_IMPERSONATION
     - AUTHENTIK_BOOTSTRAP_EMAIL
+    - AUTHENTIK_BOOTSTRAP_PASSWORD
     - WELCOME_MESSAGE
     - DEFAULT_LANGUAGE
     - EMAIL_SUBJECT
@@ -34,7 +35,7 @@ x-env: &env
 version: '3.8'
 services:
   app:
-    image: ghcr.io/goauthentik/server:2026.2.1
+    image: ghcr.io/goauthentik/server:2026.5.2
     command: server
     depends_on:
       - db
@@ -70,14 +71,14 @@ services:
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect,${STACK_NAME}-frameOptions,${STACK_NAME}-redirect"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.customFrameOptionsValue=SAMEORIGIN"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.contentSecurityPolicy=frame-ancestors ${X_FRAME_OPTIONS_ALLOW_FROM}"
-        - "coop-cloud.${STACK_NAME}.version=11.0.4+2026.2.1"
+        - "coop-cloud.${STACK_NAME}.version=12.0.2+2026.5.2"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.regex=^https://(${REDIRECTS})/(.*)"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
 
   worker:
-    image: ghcr.io/goauthentik/server:2026.2.1
+    image: ghcr.io/goauthentik/server:2026.5.2
     command: worker
     depends_on:
       - db
@@ -93,7 +94,6 @@ services:
     volumes:
       - data:/data
       - media:/media
-      - /dev/null:/blueprints/default/flow-oobe.yaml
       - templates:/templates
       - certs:/certs
     configs:
@@ -118,18 +118,13 @@ services:
       start_period: 5m
 
   db:
-    image: postgres:15.17
+    image: pgautoupgrade/pgautoupgrade:16-trixie
     secrets:
       - db_password
     configs:
-      - source: db_entrypoint
-        target: /docker-entrypoint.sh
-        mode: 0555
       - source: pg_backup
         target: /pg_backup.sh
         mode: 0555
-    entrypoint:
-      /docker-entrypoint.sh
     volumes:
       - database:/var/lib/postgresql/data
     networks:
@@ -207,10 +202,6 @@ configs:
     name: ${STACK_NAME}_system_brand_${SYSTEM_BRAND_VERSION}
     file: system_brand.yaml.tmpl
     template_driver: golang
-  db_entrypoint:
-    name: ${STACK_NAME}_db_entrypoint_${DB_ENTRYPOINT_VERSION}
-    file: entrypoint.postgres.sh.tmpl
-    template_driver: golang
   pg_backup:
     name: ${STACK_NAME}_pg_backup_${PG_BACKUP_VERSION}
     file: pg_backup.sh

entrypoint.postgres.sh.tmpl

@@ -1,45 +0,0 @@
-#!/bin/bash
-
-set -e
-
-MIGRATION_MARKER=$PGDATA/migration_in_progress
-OLDDATA=$PGDATA/old_data
-NEWDATA=$PGDATA/new_data
-
-if [ -e $MIGRATION_MARKER ]; then
-  echo "FATAL: migration was started but did not complete in a previous run. manual recovery necessary"
-  exit 1
-fi
-
-if [ -f $PGDATA/PG_VERSION ]; then
-  DATA_VERSION=$(cat $PGDATA/PG_VERSION)
-
-  if [ -n "$DATA_VERSION" -a "$PG_MAJOR" != "$DATA_VERSION" ]; then
-    echo "postgres data version $DATA_VERSION found, but need $PG_MAJOR. Starting migration"
-    echo "Installing postgres $DATA_VERSION"
-    sed -i "s/$/ $DATA_VERSION/" /etc/apt/sources.list.d/pgdg.list
-    apt-get update && apt-get install -y --no-install-recommends \
-      postgresql-$DATA_VERSION \
-      && rm -rf /var/lib/apt/lists/*
-    echo "shuffling around"
-    chown -R postgres:postgres $PGDATA
-    gosu postgres mkdir $OLDDATA $NEWDATA
-    chmod 700 $OLDDATA $NEWDATA
-    mv $PGDATA/* $OLDDATA/ || true
-    touch $MIGRATION_MARKER
-    echo "running initdb"
-    # abuse entrypoint script for initdb by making server error out
-    gosu postgres bash -c "export PGDATA=$NEWDATA ; /usr/local/bin/docker-entrypoint.sh --invalid-arg || true"
-    echo "running pg_upgrade"
-    cd /tmp
-    gosu postgres pg_upgrade --link -b /usr/lib/postgresql/$DATA_VERSION/bin -d $OLDDATA -D $NEWDATA -U $POSTGRES_USER
-    cp $OLDDATA/pg_hba.conf $NEWDATA/
-    mv $NEWDATA/* $PGDATA
-    rm -rf $OLDDATA
-    rmdir $NEWDATA
-    rm $MIGRATION_MARKER
-    echo "migration complete"
-  fi
-fi
-
-/usr/local/bin/docker-entrypoint.sh postgres

flow_invitation.yaml.tmpl

@@ -27,7 +27,7 @@ entries:
 ### POLICIES
 - attrs:
     expression: |
-      if not regex_match(request.context.get('prompt_data').get('username'), '\s'):
+      if not regex_match(request.context.get('prompt_data').get('username'), '\\s'):
           return True
       ak_message("Username must not contain any whitespace!")
       return False

hedgedoc.yaml.tmpl

@@ -27,6 +27,9 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: hashed_user_id
     token_validity: days=30
+    grant_types:
+      - authorization_code
+      - refresh_token
   conditions: []
   id: hedgedoc_provider
   identifiers:

matrix.yaml.tmpl

@@ -27,6 +27,9 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: user_username
     token_validity: days=30
+    grant_types:
+      - authorization_code
+      - refresh_token
   conditions: []
   id: matrix_provider
   identifiers:

mila.yaml.tmpl

@@ -27,6 +27,9 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: hashed_user_id
     token_validity: days=30
+    grant_types:
+      - authorization_code
+      - refresh_token
   conditions: []
   id: mila_provider
   identifiers:

monitoring.yaml.tmpl

@@ -27,6 +27,9 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: user_username
     token_validity: days=30
+    grant_types:
+      - authorization_code
+      - refresh_token
   conditions: []
   id: monitoring_provider
   identifiers:

nextcloud.yaml.tmpl

@@ -40,6 +40,9 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: user_username
     token_validity: days=30
+    grant_types:
+      - authorization_code
+      - refresh_token
   conditions: []
   id: nextcloud_provider
   identifiers:

outline.yaml.tmpl

@@ -27,6 +27,9 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: hashed_user_id
     token_validity: days=30
+    grant_types:
+      - authorization_code
+      - refresh_token
   conditions: []
   id: outline_provider
   identifiers:

rallly.yaml.tmpl

@@ -27,6 +27,9 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: hashed_user_id
     token_validity: days=30
+    grant_types:
+      - authorization_code
+      - refresh_token
   conditions: []
   id: rallly_provider
   identifiers:

release/12.0.0+2026.5.2

@@ -0,0 +1 @@
+postgres image was replaced py pgautoupdate. Make an database backup to prevent any dataloss before updating.

release/12.0.1+2026.5.2

@@ -0,0 +1 @@
+adds admin group for kimai

renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}

vikunja.yaml.tmpl

@@ -27,6 +27,9 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: hashed_user_id
     token_validity: days=30
+    grant_types:
+      - authorization_code
+      - refresh_token
   conditions: []
   id: vikunja_provider
   identifiers:

wekan.yaml.tmpl

@@ -45,6 +45,9 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: hashed_user_id
     token_validity: days=30
+    grant_types:
+      - authorization_code
+      - refresh_token
   conditions: []
   id: wekan_provider
   identifiers:

wordpress.yaml.tmpl

@@ -27,6 +27,9 @@ entries:
     signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
     sub_mode: user_username
     token_validity: days=30
+    grant_types:
+      - authorization_code
+      - refresh_token
   conditions: []
   id: wordpress_provider
   identifiers:
@@ -50,9 +53,6 @@ entries:
 {{ if ne (env "WORDPRESS_GROUP") "" }} 
 - identifiers:
     name: {{ env "WORDPRESS_GROUP" }}
-  attrs:
-    users:
-    - !Find [authentik_core.user, [username, "akadmin"]]
   id: wordpress_group
   model: authentik_core.group