chore: publish 3.1.0+2023.3.1 release

.drone.yml

@@ -18,7 +18,13 @@ steps:
       STACK_NAME: authentik
       LETS_ENCRYPT_ENV: production
       CUSTOM_CSS_VERSION: v1
-      CUSTOM_FLOWS_VERSION: v1
+      FLOW_AUTHENTICATION_VERSION: v1
+      FLOW_INVITATION_VERSION: v1
+      FLOW_INVALIDATION_VERSION: v1
+      FLOW_RECOVERY_VERSION: v1
+      FLOW_TRANSLATION_VERSION: v1
+      SYSTEM_TENANT_VERSION: v1
+      NEXTCLOUD_CONFIG_VERSION: v1
       SECRET_SECRET_KEY_VERSION: v1
       SECRET_DB_PASSWORD_VERSION: v1
       SECRET_ADMIN_TOKEN_VERSION: v1

.env.sample

@@ -2,24 +2,23 @@ TYPE=authentik
 LETS_ENCRYPT_ENV=production
 
 DOMAIN=authentik.example.com
-AUTHENTIK_POSTGRESQL__USER=authentik
-AUTHENTIK_POSTGRESQL__NAME=authentik
-AUTHENTIK_POSTGRESQL__HOST=db
-AUTHENTIK_REDIS__HOST=redis
-AUTHENTIK_ERROR_REPORTING__ENABLED=true
+COMPOSE_FILE="compose.yml"
+AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME=false
+AUTHENTIK_LOG_LEVEL=info
+# AUTHENTIK_IMPERSONATION=true
+# AUTHENTIK_FOOTER_LINKS='[{"name": "My Organization","href":"https://example.com"}]'
 # WORKERS=1
 
-# EMAIL
+## EMAIL
 AUTHENTIK_EMAIL__HOST=smtp
-AUTHENTIK_EMAIL__PORT=25
-# AUTHENTIK_EMAIL__USERNAME=""
-AUTHENTIK_EMAIL__USE_TLS=false
+AUTHENTIK_EMAIL__PORT=587
+AUTHENTIK_EMAIL__USERNAME="noreply@example.com"
+AUTHENTIK_EMAIL__USE_TLS=true
 AUTHENTIK_EMAIL__USE_SSL=false
 AUTHENTIK_EMAIL__TIMEOUT=10
 AUTHENTIK_EMAIL__FROM=noreply@example.com
-AUTHENTIK_LOG_LEVEL=info
 
-# Secret Versions
+## Secret Versions
 SECRET_SECRET_KEY_VERSION=v1
 SECRET_DB_PASSWORD_VERSION=v1
 SECRET_ADMIN_TOKEN_VERSION=v1
@@ -28,18 +27,27 @@ SECRET_EMAIL_PASS_VERSION=v1
 
 # X_FRAME_OPTIONS_ALLOW_FROM=dashboard.example.org
 AUTHENTIK_COLOR_BACKGROUND_LIGHT=#1c1e21
-AUTHENTIK_IMPERSONATION=true
 
 ## FLOW OPTIONS
-WELCOME_MESSAGE="Welcome to Authentik"
-DEFAULT_LANGUAGE=en
-AUTHENTIK_FOOTER_LINKS='[{"name": "My Organization","href":"https://example.com"}]'
-LOGOUT_REDIRECT="https://$DOMAIN"
-#COPY_ASSETS="flow_background.jpg|app:/web/dist/assets/images/"
-#COPY_ASSETS="$COPY_ASSETS icon_left_brand.svg|app:/web/dist/assets/icons/
-#COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
+# WELCOME_MESSAGE="Welcome to Authentik"
+# DEFAULT_LANGUAGE=en
+# LOGOUT_REDIRECT="https://$DOMAIN"
+# EMAIL_SUBJECT="Account Recovery"
+# EMAIL_TOKEN_EXPIRY_MINUTES=30
 
-EMAIL_SUBJECT="Account Recovery"
-EMAIL_TOKEN_EXPIRY_MINUTES=30
+COPY_ASSETS="flow_background.jpg|app:/web/dist/assets/images/"
+COPY_ASSETS="$COPY_ASSETS icon_left_brand.svg|app:/web/dist/assets/icons/"
+COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
 
-LOGOUT_REDIRECT=$DOMAIN
+# COMPOSE_FILE="$COMPOSE_FILE:compose.nextcloud.yml"
+# NEXTCLOUD_DOMAIN=nextcloud.example.com
+# SECRET_NEXTCLOUD_ID_VERSION=v1
+# SECRET_NEXTCLOUD_SECRET_VERSION=v1
+# APP_ICONS="nextcloud:~/.abra/recipes/authentik/icons/nextcloud.png"
+
+
+# COMPOSE_FILE="$COMPOSE_FILE:compose.wordpress.yml"
+# WORDPRESS_DOMAIN=wordpress.example.com
+# SECRET_WORDPRESS_ID_VERSION=v1
+# SECRET_WORDPRESS_SECRET_VERSION=v1
+# APP_ICONS="$APP_ICONS wordpress:~/.abra/recipes/authentik/icons/wordpress.png"

README.md

@@ -26,6 +26,7 @@
 * `abra app secret generate -a <app_name>`
 * `abra app deploy <app-name>`
 * `abra app cmd <app_name> app set_admin_pass`
+* `abra app cmd <app_name> worker apply_blueprints`
 
 ## Rotate Secrets
 
@@ -39,6 +40,22 @@ abra app cmd <app_name> db rotate_db_pass
 abra app cmd <app_name> app set_admin_pass
 ```
 
+## Add SSO for Nextcloud
+
+Uncomment Nextcloud configuration and set `NEXTCLOUD_DOMAIN` the using `abra app config <app_name>`:
+
+```
+COMPOSE_FILE="$COMPOSE_FILE:compose.nextcloud.yml"
+NEXTCLOUD_DOMAIN=nextcloud.example.com
+SECRET_NEXTCLOUD_ID_VERSION=v1
+SECRET_NEXTCLOUD_SECRET_VERSION=v1
+APP_ICONS="nextcloud:~/.abra/recipes/authentik/icons/nextcloud.png"
+```
+
+Set the nextcloud Icon using `abra app cmd -l -d <app_name> set_icons`
+
+The configuration inside Nextcloud can be found in the [nextcloud recipe](https://git.coopcloud.tech/coop-cloud/nextcloud#authentik-integration)
+
 ## Customization
 
 Place the files you want to overwrite in a directory `<assets_path>`.
@@ -60,4 +77,46 @@ Run this command after every deploy/upgrade:
 
 `abra app command --local <app-name> customize <assets_path>`
 
+## Blueprints
+
+Blueprint Dependency Requirements:
+
+- Recovery with email verification
+    - Default - Password change flow
+    - Default - Authentication flow
+- Custom Authentication Flow
+    - Default - Authentication flow
+    - Recovery with email verification
+- Invitation Enrollment Flow
+    - Default - User settings flow
+    - Default - Authentication flow
+    - Default - Source enrollment flow
+- Custom Invalidation Flow
+    - Default - Invalidation flow
+- Flow Translations
+    - Recovery with email verification
+    - Default - Password change flow
+    - Default - User settings flow
+    - Default - Source enrollment flow
+- Custom System Tenant
+    - Default - Tenant
+    - Recovery with email verification
+
+
+Blueprint Dependency Graph:
+
+5. Custom System Tenant
+    - Default - Tenant
+    4. Invitation Enrollment Flow
+        3. Flow Translations
+            - Default - User settings flow
+            - Default - Source enrollment flow
+            2. Custom Authentication Flow
+                1. Recovery with email verification
+                    - Default - Authentication flow
+                        - Default - Password change flow
+6. Custom Invalidation Flow
+    - Default - Invalidation flow
+
+
 For more, see [`docs.coopcloud.tech`](https://docs.coopcloud.tech).

abra.sh

@@ -1,5 +1,12 @@
 export CUSTOM_CSS_VERSION=v2
-export CUSTOM_FLOWS_VERSION=v4
+export FLOW_AUTHENTICATION_VERSION=v1
+export FLOW_INVITATION_VERSION=v1
+export FLOW_INVALIDATION_VERSION=v1
+export FLOW_RECOVERY_VERSION=v1
+export FLOW_TRANSLATION_VERSION=v1
+export SYSTEM_TENANT_VERSION=v1
+export NEXTCLOUD_CONFIG_VERSION=v1
+export WORDPRESS_CONFIG_VERSION=v1
 
 customize() {
     if [ -z "$1" ]
@@ -47,3 +54,88 @@ rotate_db_pass() {
     db_password=$(cat /run/secrets/db_password)
     psql -U authentik -c """ALTER USER authentik WITH PASSWORD '$db_password';"""
 }
+
+apply_blueprints() {
+    enable_blueprint default/flow-default-authentication-flow.yaml
+    enable_blueprint default/flow-default-user-settings-flow.yaml
+    enable_blueprint default/flow-password-change.yaml
+    ak apply_blueprint 6_flow_invalidation.yaml 
+    ak apply_blueprint 5_system_tenant.yaml
+    disable_blueprint default/flow-default-authentication-flow.yaml
+    disable_blueprint default/flow-default-user-settings-flow.yaml
+    disable_blueprint default/flow-password-change.yaml
+}
+
+disable_blueprint() {
+    blueprint_state False $@
+}
+
+enable_blueprint() {
+    blueprint_state True $@
+}
+
+blueprint_state() {
+TOKEN=$(cat /run/secrets/admin_token)
+python -c """
+import requests
+session = requests.Session()
+my_token='$TOKEN'
+blueprint_state=$1
+blueprint_path='$2'
+resp = session.get(f'https://$DOMAIN/api/v3/managed/blueprints/?path={blueprint_path}', headers={'Authorization':f'Bearer {my_token}'})
+if not resp.ok:
+    print(f'Error fetching blueprint: {resp.content}')
+    exit()
+auth_flow_uuid = resp.json()['results'][0]['pk']
+blueprint_name = resp.json()['results'][0]['name']
+params = {'name': blueprint_name,'path': blueprint_path,'context':{},'enabled': blueprint_state}
+resp = session.put(f'https://$DOMAIN/api/v3/managed/blueprints/{auth_flow_uuid}/', json=params, headers={'Authorization':f'Bearer {my_token}'})
+if resp.ok:
+    print(f'{blueprint_name} enabled: {blueprint_state}')
+else:
+    print(f'Error changing blueprint state: {resp.content}')
+"""
+
+}
+
+set_icons(){
+for icon in $APP_ICONS; do
+    app=$(echo $icon | cut -d ":" -f1)
+    file_path=$(eval echo $(echo $icon | cut -d ":" -f2))
+    file=$(basename $file_path)
+    echo copy icon $file_path for $app
+    abra app cp $APP_NAME $file_path app:/media/
+    abra app cmd -T $APP_NAME app set_app_icon $app /media/$file
+done
+}
+
+set_app_icon() {
+TOKEN=$(cat /run/secrets/admin_token)
+python -c """
+import requests
+import os
+my_token = '$TOKEN'
+application = '$1'
+icon_path = '$2'
+url = f'https://$DOMAIN/api/v3/core/applications/{application}/set_icon/'
+headers = {'Authorization':f'Bearer {my_token}'}
+with open(icon_path, 'rb') as img:
+  name_img = os.path.basename(icon_path)
+  files= {'file': (name_img,img,'image/png') }
+  with requests.Session() as s:
+    r = s.post(url,files=files,headers=headers)
+    print(r.status_code)
+"""
+
+}
+
+blueprint_cleanup() {
+/manage.py shell -c """
+delete_flows = ['default-recovery-flow' , 'custom-authentication-flow' , 'invitation-enrollment-flow' , 'initial-setup']
+Flow.objects.filter(slug__in=delete_flows).delete()
+Stage.objects.filter(flow=None).delete()
+Prompt.objects.filter(promptstage=None).delete()
+Tenant.objects.filter(default=True).delete()
+"""
+apply_blueprints
+}

compose.nextcloud.yml

@@ -0,0 +1,26 @@
+version: "3.8"
+services:
+  worker:
+    secrets:
+      - nextcloud_id
+      - nextcloud_secret
+    environment:
+      - NEXTCLOUD_DOMAIN
+    configs:
+      - source: nextcloud
+        target: /blueprints/nextcloud.yaml
+
+secrets:
+  nextcloud_id:
+    external: true
+    name: ${STACK_NAME}_nextcloud_id_${SECRET_NEXTCLOUD_ID_VERSION}
+  nextcloud_secret:
+    external: true
+    name: ${STACK_NAME}_nextcloud_secret_${SECRET_NEXTCLOUD_SECRET_VERSION}
+
+
+configs:
+  nextcloud:
+    name: ${STACK_NAME}_nextcloud_${NEXTCLOUD_CONFIG_VERSION}
+    file: nextcloud.yaml.tmpl
+    template_driver: golang

compose.wordpress.yml

@@ -0,0 +1,26 @@
+version: "3.8"
+services:
+  worker:
+    secrets:
+      - wordpress_id
+      - wordpress_secret
+    environment:
+      - WORDPRESS_DOMAIN
+    configs:
+      - source: wordpress
+        target: /blueprints/wordpress.yaml
+
+secrets:
+  wordpress_id:
+    external: true
+    name: ${STACK_NAME}_wordpress_id_${SECRET_WORDPRESS_ID_VERSION}
+  wordpress_secret:
+    external: true
+    name: ${STACK_NAME}_wordpress_secret_${SECRET_WORDPRESS_SECRET_VERSION}
+
+
+configs:
+  wordpress:
+    name: ${STACK_NAME}_wordpress_${WORDPRESS_CONFIG_VERSION}
+    file: wordpress.yaml.tmpl
+    template_driver: golang

compose.yml

@@ -2,10 +2,10 @@
 
 x-env: &env
     - AUTHENTIK_POSTGRESQL__PASSWORD=file:///run/secrets/db_password
-    - AUTHENTIK_POSTGRESQL__USER
-    - AUTHENTIK_POSTGRESQL__NAME
-    - AUTHENTIK_POSTGRESQL__HOST
-    - AUTHENTIK_REDIS__HOST
+    - AUTHENTIK_POSTGRESQL__USER=authentik
+    - AUTHENTIK_POSTGRESQL__NAME=authentik
+    - AUTHENTIK_POSTGRESQL__HOST=db
+    - AUTHENTIK_REDIS__HOST=redis
     - AUTHENTIK_ERROR_REPORTING__ENABLED
     - AUTHENTIK_SECRET_KEY=file:///run/secrets/secret_key
     - AUTHENTIK_EMAIL__HOST
@@ -31,7 +31,7 @@ x-env: &env
 version: '3.8'
 services:
   app:
-    image: ghcr.io/goauthentik/server:2023.2.3
+    image: ghcr.io/goauthentik/server:2023.3.1
     command: server
     secrets:
       - db_password
@@ -41,7 +41,7 @@ services:
       - email_pass
     volumes:
       - media:/media
-      - custom-templates:/templates
+      - assets:/web/dist/assets
     configs:
       - source: custom_css
         target: /web/dist/custom.css
@@ -71,10 +71,10 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.customFrameOptionsValue=SAMEORIGIN"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.contentSecurityPolicy=frame-ancestors ${X_FRAME_OPTIONS_ALLOW_FROM}"
-        - "coop-cloud.${STACK_NAME}.version=2.0.0+2023.2.3"
+        - "coop-cloud.${STACK_NAME}.version=3.1.0+2023.3.1"
 
   worker:
-    image: ghcr.io/goauthentik/server:2023.2.3
+    image: ghcr.io/goauthentik/server:2023.3.1
     command: worker
     secrets:
       - db_password
@@ -90,12 +90,20 @@ services:
       - backups:/backups
       - media:/media
       - /var/run/docker.sock:/var/run/docker.sock
-      - custom-templates:/templates
-      - /dev/null:/blueprints/default/10-flow-default-authentication-flow.yaml
-      - /dev/null:/blueprints/default/10-flow-default-invalidation-flow.yaml
+      - /dev/null:/blueprints/default/flow-oobe.yaml
     configs:
-      - source: custom_flows
-        target: /blueprints/custom_flows.yaml
+      - source: flow_recovery
+        target: /blueprints/1_flow_recovery.yaml
+      - source: flow_authentication
+        target: /blueprints/2_flow_authentication.yaml
+      - source: flow_translation
+        target: /blueprints/3_flow_translation.yaml
+      - source: flow_invitation
+        target: /blueprints/4_flow_invitation.yaml
+      - source: system_tenant
+        target: /blueprints/5_system_tenant.yaml
+      - source: flow_invalidation
+        target: /blueprints/6_flow_invalidation.yaml
     environment: *env
 
   db:
@@ -114,8 +122,8 @@ services:
       start_period: 1m
     environment:
       - POSTGRES_PASSWORD_FILE=/run/secrets/db_password
-      - POSTGRES_USER=${AUTHENTIK_POSTGRESQL__USER}
-      - POSTGRES_DB=${AUTHENTIK_POSTGRESQL__NAME}
+      - POSTGRES_USER=authentik
+      - POSTGRES_DB=authentik
     deploy:
       labels:
           backupbot.backup: "true"
@@ -124,7 +132,7 @@ services:
           backupbot.backup.path: "/tmp/backup/"
 
   redis:
-    image:  redis:7.0.9-alpine
+    image:  redis:7.0.10-alpine
     networks:
       - internal
     healthcheck:
@@ -159,7 +167,7 @@ networks:
 volumes:
   backups:
   media:
-  custom-templates:
+  assets:
   database:
 
 configs:
@@ -167,7 +175,27 @@ configs:
     name: ${STACK_NAME}_custom_css_${CUSTOM_CSS_VERSION}
     file: custom.css.tmpl
     template_driver: golang
-  custom_flows:
-    name: ${STACK_NAME}_custom_flows_${CUSTOM_FLOWS_VERSION}
-    file: custom_flows.yaml.tmpl
+  flow_authentication:
+    name: ${STACK_NAME}_flow_authentication_${FLOW_AUTHENTICATION_VERSION}
+    file: flow_authentication.yaml.tmpl
+    template_driver: golang
+  flow_invitation:
+    name: ${STACK_NAME}_flow_invitation_${FLOW_INVITATION_VERSION}
+    file: flow_invitation.yaml.tmpl
+    template_driver: golang
+  flow_invalidation:
+    name: ${STACK_NAME}_flow_invalidation_${FLOW_INVALIDATION_VERSION}
+    file: flow_invalidation.yaml.tmpl
+    template_driver: golang
+  flow_recovery:
+    name: ${STACK_NAME}_flow_recovery_${FLOW_RECOVERY_VERSION}
+    file: flow_recovery.yaml.tmpl
+    template_driver: golang
+  flow_translation:
+    name: ${STACK_NAME}_flow_translation_${FLOW_TRANSLATION_VERSION}
+    file: flow_translation.yaml.tmpl
+    template_driver: golang
+  system_tenant:
+    name: ${STACK_NAME}_system_tenant_${SYSTEM_TENANT_VERSION}
+    file: system_tenant.yaml.tmpl
     template_driver: golang

custom_flows.yaml.tmpl

@@ -4,12 +4,13 @@ metadata:
     blueprints.goauthentik.io/instantiate: "true"
   name: Custom - Flows
 context:
+  welcome_message: {{ if eq (env "WELCOME_MESSAGE") "" }} "Welcome to authentik!" {{ else }} {{ env "WELCOME_MESSAGE" }} {{ end }}
 ####### Translations ########
-  transl_recovery: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Passwort Zurücksetzen {{ else }} Reset your password {{ end }}
-  transl_password: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Passwort {{ else }} Password {{ end }}
-  transl_password_repeat: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Passwort (wiederholen) {{ else }} Password (repeat) {{ end }}
-  transl_username: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Benutzername {{ else }} Username {{ end }}
-  transl_name: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Vor- und Nachname {{ else }} Full name {{ end }}
+  transl_recovery: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Passwort Zurücksetzen" {{ else }} "Reset your password" {{ end }}
+  transl_password: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Passwort" {{ else }} "Password" {{ end }}
+  transl_password_repeat: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Passwort (wiederholen)" {{ else }} "Password (repeat)" {{ end }}
+  transl_username: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Benutzername" {{ else }} "Username" {{ end }}
+  transl_name: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Vor- und Nachname" {{ else }} "Full name" {{ end }}
 
 entries:
 ######## Email Recovery Flow ########
@@ -25,10 +26,10 @@ entries:
 ### PROMPTS
 - identifiers:
     field_key: password
-    label: !Context transl_password
   id: prompt-field-password
   model: authentik_stages_prompt.prompt
   attrs:
+    label: !Context transl_password
     type: password
     required: true
     placeholder: !Context transl_password
@@ -36,10 +37,10 @@ entries:
     placeholder_expression: false
 - identifiers:
     field_key: password_repeat
-    label: !Context transl_password_repeat
   id: prompt-field-password-repeat
   model: authentik_stages_prompt.prompt
   attrs:
+    label: !Context transl_password_repeat
     type: password
     required: true
     placeholder: !Context transl_password_repeat
@@ -54,8 +55,8 @@ entries:
   model: authentik_stages_email.emailstage
   attrs:
     use_global_settings: true
-    token_expiry: {{ env "EMAIL_TOKEN_EXPIRY_MINUTES" }}
-    subject: "{{ env "EMAIL_SUBJECT" }}"
+    token_expiry: {{ if eq (env "EMAIL_TOKEN_EXPIRY_MINUTES") "" }} 30 {{ else }} {{ env "EMAIL_TOKEN_EXPIRY_MINUTES" }} {{ end }}
+    subject: {{ if eq (env "EMAIL_SUBJECT") "" }} "Account Recovery" {{ else }} "{{ env "EMAIL_SUBJECT" }}" {{ end }} 
     template: email/password_reset.html
     activate_user_on_success: true
 - identifiers:
@@ -178,7 +179,7 @@ entries:
 - attrs:
     designation: authentication
     name: custom-authentication-flow
-    title: {{ env "WELCOME_MESSAGE" }}
+    title: !Context welcome_message
   identifiers:
     slug: custom-authentication-flow
   id: authentication_flow
@@ -240,7 +241,7 @@ entries:
 - attrs:
     designation: enrollment
     name: invitation-enrollment-flow
-    title: {{ env "WELCOME_MESSAGE" }}
+    title: !Context welcome_message
   identifiers:
     slug: invitation-enrollment-flow
   id: invitation-enrollment-flow
@@ -249,10 +250,10 @@ entries:
 ### PROMPTS
 - identifiers:
     field_key: username
-    label: !Context transl_username
   id: prompt-field-username
   model: authentik_stages_prompt.prompt
   attrs:
+    label: !Context transl_username
     type: username
     required: true
     placeholder: !Context transl_username
@@ -260,10 +261,10 @@ entries:
     placeholder_expression: false
 - identifiers:
     field_key: name
-    label: !Context transl_name
   id: prompt-field-name
   model: authentik_stages_prompt.prompt
   attrs:
+    label: !Context transl_name
     type: text
     required: true
     placeholder: !Context transl_name
@@ -387,7 +388,7 @@ entries:
 - attrs:
     attributes:
       settings:
-        locale: {{ env "DEFAULT_LANGUAGE" }}
+        locale: {{ if eq (env "DEFAULT_LANGUAGE") "" }} en {{ else }} {{ env "DEFAULT_LANGUAGE" }} {{ end }}
     # branding_favicon: /static/dist/assets/icons/icon.png
     # branding_logo: /static/dist/assets/icons/icon_left_brand.svg
     # branding_title: Authentik

flow_authentication.yaml.tmpl

@@ -0,0 +1,45 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: Custom Authentication Flow
+context:
+  welcome_message: {{ if eq (env "WELCOME_MESSAGE") "" }} "Welcome to authentik!" {{ else }} {{ env "WELCOME_MESSAGE" }} {{ end }}
+
+entries:
+### DEPENDENCIES
+- model: authentik_blueprints.metaapplyblueprint
+  attrs:
+    identifiers:
+      name: Recovery with email verification
+    required: true
+
+### FLOW
+- model: authentik_flows.flow
+  identifiers:
+    slug: default-authentication-flow
+  id: flow
+  attrs:
+    name: !Context welcome_message
+    title: !Context welcome_message
+
+### STAGES
+- identifiers:
+    name: default-authentication-identification
+  model: authentik_stages_identification.identificationstage
+  attrs:
+    password_stage: !Find [authentik_stages_password.passwordstage, [name, default-authentication-password]]
+    recovery_flow: !Find [authentik_flows.flow, [slug, default-recovery-flow]]
+
+- identifiers:
+    name: default-authentication-login
+  model: authentik_stages_user_login.userloginstage
+  attrs:
+    session_duration: seconds=0
+
+- identifiers:
+    order: 20
+    stage: !Find [authentik_stages_password.passwordstage, [name, default-authentication-password]]
+    target: !KeyOf flow
+  model: authentik_flows.flowstagebinding
+  state: absent

flow_invalidation.yaml.tmpl

@@ -0,0 +1,44 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: Custom Invalidation Flow
+entries:
+### DEPENDENCIES
+- model: authentik_blueprints.metaapplyblueprint
+  attrs:
+    identifiers:
+      name: Default - Invalidation flow
+    required: true
+
+### STAGE BINDINGS
+
+- identifiers:
+    order: 0
+    stage: !Find [authentik_stages_user_logout.userlogoutstage, [name, default-invalidation-logout]]
+    target: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
+  model: authentik_flows.flowstagebinding
+  attrs:
+    re_evaluate_policies: true
+  id: logout-stage-binding
+
+### POLICIES
+- attrs:
+    execution_logging: true
+    expression: 'context[''flow_plan''].context[''redirect''] = ''{{ env "LOGOUT_REDIRECT" }}''
+
+    return True'
+  identifiers:
+    name: redirect-policy
+  id: redirect-policy
+  model: authentik_policies_expression.expressionpolicy
+
+### POLICY BINDINGS
+- identifiers:
+    policy: !KeyOf redirect-policy
+    target: !KeyOf logout-stage-binding
+    order: 0
+  model: authentik_policies.policybinding
+  attrs:
+    enabled: {{ if eq (env "LOGOUT_REDIRECT") "" }} false {{ else }} true {{ end }}
+    timeout: 30

flow_invitation.yaml.tmpl

@@ -0,0 +1,65 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: Invitation Enrollment Flow
+context:
+  welcome_message: {{ if eq (env "WELCOME_MESSAGE") "" }} "Welcome to authentik!" {{ else }} {{ env "WELCOME_MESSAGE" }} {{ end }}
+
+entries:
+### DEPENDENCIES
+- model: authentik_blueprints.metaapplyblueprint
+  attrs:
+    identifiers:
+      name: Flow Translations
+    required: true
+
+### FLOW
+- attrs:
+    designation: enrollment
+    name: invitation-enrollment-flow
+    title: !Context welcome_message
+  identifiers:
+    slug: invitation-enrollment-flow
+  id: invitation-enrollment-flow
+  model: authentik_flows.flow
+
+### STAGES
+- identifiers:
+    name: invitation-stage
+  id: invitation-stage
+  model: authentik_stages_invitation.invitationstage
+
+- identifiers:
+    name: enrollment-prompt-userdata
+  id: enrollment-prompt-userdata
+  model: authentik_stages_prompt.promptstage
+  attrs:
+    fields:
+      - !Find [authentik_stages_prompt.prompt, [name, default-source-enrollment-field-username]]
+      - !Find [authentik_stages_prompt.prompt, [name, default-user-settings-field-name]]
+      - !Find [authentik_stages_prompt.prompt, [name, default-user-settings-field-email]]
+      - !Find [authentik_stages_prompt.prompt, [name, default-password-change-field-password]]
+      - !Find [authentik_stages_prompt.prompt, [name, default-password-change-field-password-repeat]]
+
+### STAGE BINDINGS
+- identifiers:
+    order: 1
+    stage: !KeyOf invitation-stage
+    target: !KeyOf invitation-enrollment-flow
+  model: authentik_flows.flowstagebinding
+- identifiers:
+    order: 10
+    stage: !KeyOf enrollment-prompt-userdata
+    target: !KeyOf invitation-enrollment-flow
+  model: authentik_flows.flowstagebinding
+- identifiers:
+    order: 20
+    stage: !Find [authentik_stages_user_write.userwritestage, [name,  default-source-enrollment-write]]
+    target: !KeyOf invitation-enrollment-flow
+  model: authentik_flows.flowstagebinding
+- identifiers:
+    order: 100
+    stage: !Find [authentik_stages_user_login.userloginstage, [name,  default-authentication-login]]
+    target: !KeyOf invitation-enrollment-flow
+  model: authentik_flows.flowstagebinding

flow_recovery.yaml.tmpl

@@ -0,0 +1,128 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: Recovery with email verification
+context:
+  token_expiry: {{ if eq (env "EMAIL_TOKEN_EXPIRY_MINUTES") "" }} 30 {{ else }} {{ env "EMAIL_TOKEN_EXPIRY_MINUTES" }} {{ end }}
+  subject: {{ if eq (env "EMAIL_SUBJECT") "" }} Account Recovery {{ else }} {{ env "EMAIL_SUBJECT" }} {{ end }} 
+entries:
+### DEPENDENCIES
+- model: authentik_blueprints.metaapplyblueprint
+  attrs:
+    identifiers:
+      name: Default - Authentication flow
+    required: true
+
+### FLOW
+- identifiers:
+    slug: default-recovery-flow
+  model: authentik_flows.flow
+  state: created
+  attrs:
+    name: Default recovery flow
+    title: Reset your password
+    designation: recovery
+    authentication: require_unauthenticated
+
+### STAGES
+- identifiers:
+    name: default-recovery-email
+  id: default-recovery-email
+  model: authentik_stages_email.emailstage
+  attrs:
+    use_global_settings: true
+    token_expiry: !Context token_expiry
+    subject: !Context subject
+    template: email/password_reset.html
+    activate_user_on_success: true
+- identifiers:
+    name: default-recovery-identification
+  id: default-recovery-identification
+  model: authentik_stages_identification.identificationstage
+  attrs:
+    user_fields:
+      - email
+      - username
+
+### STAGE BINDINGS
+- identifiers:
+    target: !Find [authentik_flows.flow, [slug, default-recovery-flow]]
+    stage: !KeyOf default-recovery-identification
+    order: 10
+  model: authentik_flows.flowstagebinding
+  id: flow-binding-identification
+  attrs:
+    evaluate_on_plan: true
+    re_evaluate_policies: true
+    policy_engine_mode: any
+    invalid_response_action: retry
+- identifiers:
+    target: !Find [authentik_flows.flow, [slug, default-recovery-flow]]
+    stage: !KeyOf default-recovery-email
+    order: 20
+  model: authentik_flows.flowstagebinding
+  id: flow-binding-email
+  attrs:
+    evaluate_on_plan: true
+    re_evaluate_policies: true
+    policy_engine_mode: any
+    invalid_response_action: retry
+- identifiers:
+    target: !Find [authentik_flows.flow, [slug, default-recovery-flow]]
+    stage: !Find [authentik_stages_prompt.promptstage, [name,  default-password-change-prompt]]
+    order: 30
+  model: authentik_flows.flowstagebinding
+  attrs:
+    evaluate_on_plan: true
+    re_evaluate_policies: false
+    policy_engine_mode: any
+    invalid_response_action: retry
+- identifiers:
+    target: !Find [authentik_flows.flow, [slug, default-recovery-flow]]
+    stage: !Find [authentik_stages_user_write.userwritestage, [name,  default-password-change-write]]
+    order: 40
+  model: authentik_flows.flowstagebinding
+  attrs:
+    evaluate_on_plan: true
+    re_evaluate_policies: false
+    policy_engine_mode: any
+    invalid_response_action: retry
+- identifiers:
+    target: !Find [authentik_flows.flow, [slug, default-recovery-flow]]
+    stage: !Find [authentik_stages_user_login.userloginstage, [name,  default-authentication-login]]
+    order: 100
+  model: authentik_flows.flowstagebinding
+  attrs:
+    evaluate_on_plan: true
+    re_evaluate_policies: false
+    policy_engine_mode: any
+    invalid_response_action: retry
+
+### POLICIES
+- identifiers:
+    name: default-recovery-skip-if-restored
+  id: default-recovery-skip-if-restored
+  model: authentik_policies_expression.expressionpolicy
+  attrs:
+    expression: |
+      return request.context.get('is_restored', False)
+- identifiers:
+    policy: !KeyOf default-recovery-skip-if-restored
+    target: !KeyOf flow-binding-identification
+    order: 0
+  model: authentik_policies.policybinding
+  attrs:
+    negate: false
+    enabled: false # TODO: why does this doesn't work?
+    timeout: 30
+- identifiers:
+    policy: !KeyOf default-recovery-skip-if-restored
+    target: !KeyOf flow-binding-email
+    order: 0
+  state: absent
+  model: authentik_policies.policybinding
+  attrs:
+    negate: false
+    enabled: true
+    timeout: 30

flow_translation.yaml.tmpl

@@ -0,0 +1,71 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: Flow Translations
+context:
+  transl_recovery: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Passwort Zurücksetzen" {{ else }} "Reset your password" {{ end }}
+  transl_password: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Passwort" {{ else }} "Password" {{ end }}
+  transl_password_repeat: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Passwort (wiederholen)" {{ else }} "Password (repeat)" {{ end }}
+  transl_username: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Benutzername" {{ else }} "Username" {{ end }}
+  transl_name: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Vor- und Nachname" {{ else }} "Full name" {{ end }}
+
+entries:
+### DEPENDENCIES
+- model: authentik_blueprints.metaapplyblueprint
+  attrs:
+    identifiers:
+      name: Custom Authentication Flow
+    required: true
+- model: authentik_blueprints.metaapplyblueprint
+  attrs:
+    identifiers:
+      name: Default - User settings flow
+    required: true
+- model: authentik_blueprints.metaapplyblueprint
+  attrs:
+    identifiers:
+      name: Default - Source enrollment flow
+    required: true
+
+### FLOWS
+- model: authentik_flows.flow 
+  identifiers:
+    slug: default-recovery-flow
+  id: recovery_flow
+  model: authentik_flows.flow
+  attrs:
+    name: Default recovery flow
+    title: !Context transl_recovery
+    designation: recovery
+
+
+### PROMPTS
+- model: authentik_stages_prompt.prompt
+  identifiers:
+    name: default-password-change-field-password
+  attrs:
+    label: !Context transl_password
+    placeholder: !Context transl_password
+- model: authentik_stages_prompt.prompt
+  identifiers:
+    name: default-password-change-field-password-repeat
+  attrs:
+    label: !Context transl_password_repeat
+    placeholder: !Context transl_password_repeat
+- model: authentik_stages_prompt.prompt
+  identifiers:
+    name: default-user-settings-field-username
+  attrs:
+    label: !Context transl_username
+- model: authentik_stages_prompt.prompt
+  identifiers:
+    name: default-user-settings-field-name
+  attrs:
+    label: !Context transl_name
+- model: authentik_stages_prompt.prompt
+  identifiers:
+    name: default-source-enrollment-field-username
+  attrs:
+    label: !Context transl_username
+    placeholder: !Context transl_username

nextcloud.yaml.tmpl

@@ -0,0 +1,56 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: Nextcloud
+
+entries:
+- attrs:
+    description: nextcloud
+    expression: 'return { "nextcloud_groups": [{"gid": group.name, "displayName":
+      group.name} for group in request.user.ak_groups.all()], }'
+    managed: null
+    scope_name: nextcloud
+  conditions: []
+  id: nextcloud_group_mapping
+  identifiers:
+    name: nextcloud
+  model: authentik_providers_oauth2.scopemapping
+  state: present
+
+- attrs:
+    access_code_validity: minutes=1
+    authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+    client_id: {{ secret  "nextcloud_id" }}
+    client_secret: {{ secret  "nextcloud_secret" }}
+    client_type: confidential
+    include_claims_in_id_token: true
+    issuer_mode: per_provider
+    name: Nextcloud
+    property_mappings:
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
+    - !KeyOf nextcloud_group_mapping
+    signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+    sub_mode: user_username
+    token_validity: days=30
+  conditions: []
+  id: nextcloud_provider
+  identifiers:
+    pk: 9999
+  model: authentik_providers_oauth2.oauth2provider
+  state: present
+
+- attrs:
+    meta_launch_url: https://{{ env  "NEXTCLOUD_DOMAIN" }}
+    open_in_new_tab: true
+    policy_engine_mode: any
+    provider: !KeyOf nextcloud_provider
+    slug: nextcloud
+  conditions: []
+  id: nextcloud_application
+  identifiers:
+    name: Nextcloud
+  model: authentik_core.application
+  state: present

release/3.0.0+2023.2.3

@@ -0,0 +1,16 @@
+Run `abra app cmd <app_name> worker blueprint_cleanup` to apply the new blueprint configuration and delete the old configuration.
+
+If the nextcloud provider should be managed by abra add the following to the env:
+
+    COMPOSE_FILE="compose.yml:compose.nextcloud.yml"
+    NEXTCLOUD_DOMAIN=nextcloud.example.com
+    SECRET_NEXTCLOUD_ID_VERSION=v1
+    SECRET_NEXTCLOUD_SECRET_VERSION=v1
+
+and generate the secrets:
+
+    abra app secret generate -a <app_name>
+
+Eventuelly you need to manually remove the old nextcloud provider and application
+
+Don't forget to update the nextcloud config for authentik as well.

release/3.1.0+2023.3.1

@@ -0,0 +1,3 @@
+Env recommendation: AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME=false
+This prevents users from changing their username.
+Changing the username can be a security risk and it can break things.

system_tenant.yaml.tmpl

@@ -0,0 +1,35 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: Custom System Tenant
+entries:
+### DEPENDENCIES
+- model: authentik_blueprints.metaapplyblueprint
+  attrs:
+    identifiers:
+      name: Default - Tenant
+    required: true
+- model: authentik_blueprints.metaapplyblueprint
+  attrs:
+    identifiers:
+      name: Invitation Enrollment Flow
+    required: true
+
+
+### SYSTEM TENANT
+# remove custom tenant from old recipe
+- identifiers:
+    domain: {{ env "DOMAIN" }}
+  model: authentik_tenants.tenant
+  state: absent
+
+- attrs:
+    attributes:
+      settings:
+        locale: {{ if eq (env "DEFAULT_LANGUAGE") "" }} en {{ else }} {{ env "DEFAULT_LANGUAGE" }} {{ end }}
+    flow_recovery: !Find [authentik_flows.flow, [slug,  default-recovery-flow]]
+  identifiers:
+    default: true
+    domain: authentik-default
+  model: authentik_tenants.tenant

wordpress.yaml.tmpl

@@ -0,0 +1,43 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: Wordpress
+
+entries:
+
+- attrs:
+    access_code_validity: minutes=1
+    authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+    client_id: {{ secret  "wordpress_id" }}
+    client_secret: {{ secret  "wordpress_secret" }}
+    client_type: confidential
+    include_claims_in_id_token: true
+    issuer_mode: per_provider
+    name: Wordpress
+    property_mappings:
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
+    signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+    sub_mode: user_username
+    token_validity: days=30
+  conditions: []
+  id: wordpress_provider
+  identifiers:
+    pk: 9998
+  model: authentik_providers_oauth2.oauth2provider
+  state: present
+
+- attrs:
+    meta_launch_url: https://{{ env  "WORDPRESS_DOMAIN" }}/wp-login.php
+    open_in_new_tab: true
+    policy_engine_mode: any
+    provider: !KeyOf wordpress_provider
+    slug: wordpress
+  conditions: []
+  id: wordpress_application
+  identifiers:
+    name: Wordpress
+  model: authentik_core.application
+  state: present