Compare commits

..

17 Commits

12 changed files with 209 additions and 40 deletions

View File

@ -1,10 +1,12 @@
TYPE=authentik
TIMEOUT=300
ENABLE_AUTO_UPDATE=true
POST_DEPLOY_CMDS="worker set_admin_pass|worker apply_blueprints|worker add_applications"
# POST_DEPLOY_CMDS="worker set_admin_pass|worker apply_blueprints|worker add_applications"
LETS_ENCRYPT_ENV=production
DOMAIN=authentik.example.com
## Domain aliases
#EXTRA_DOMAINS=', `www.authentik.example.com`'
COMPOSE_FILE="compose.yml"
AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME=false
AUTHENTIK_LOG_LEVEL=info
@ -12,6 +14,9 @@ AUTHENTIK_LOG_LEVEL=info
# AUTHENTIK_FOOTER_LINKS='[{"name": "My Organization","href":"https://example.com"}]'
# WORKERS=1
## Outpost Integration
# COMPOSE_FILE="$COMPOSE_FILE:compose.outposts.yml"
## EMAIL
AUTHENTIK_EMAIL__HOST=smtp
AUTHENTIK_EMAIL__PORT=587
@ -56,7 +61,7 @@ COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
# APP_ICONS="$APP_ICONS wordpress:~/.abra/recipes/authentik/icons/wordpress.png"
# COMPOSE_FILE="$COMPOSE_FILE:compose.matrix.yml"
# ELEMENT_DOMAIN=element.example.com
# ELEMENT_DOMAIN=element-web.example.com
# SECRET_MATRIX_ID_VERSION=v1
# SECRET_MATRIX_SECRET_VERSION=v1
# APP_ICONS="$APP_ICONS matrix:~/.abra/recipes/authentik/icons/matrix.svg"
@ -79,7 +84,7 @@ COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
# SECRET_MONITORING_SECRET_VERSION=v1
# APP_ICONS="$APP_ICONS monitoring:~/.abra/recipes/authentik/icons/monitoring.png"
# APPLICATIONS='{"Calendar": "https://nextcloud.example.com/apps/calendar/", "Rallly":"https://rallly.example.cloud/"}'
# APPLICATIONS='{"Calendar": "https://nextcloud.example.com/apps/calendar/", "BBB": "https://nextcloud.example.com/apps/bbb/", "Rallly":"https://rallly.example.cloud/"}'
# APP_ICONS="$APP_ICONS Calendar:~/.abra/recipes/authentik/icons/calendar.svg"
# APP_ICONS="$APP_ICONS Rallly:~/.abra/recipes/authentik/icons/rallly.png"
# APP_ICONS="$APP_ICONS BBB:~/.abra/recipes/authentik/icons/bbb.jpg"

View File

@ -87,41 +87,109 @@ Run this command after every deploy/upgrade:
`abra app command --local <app-name> customize <assets_path>`
## Email templates
Add custom [email templates](https://goauthentik.io/docs/flow/stages/email/#custom-templates):
`abra app cmd -l <app_name> add_email_templates local/path/to/mail_template.html`
## Blueprints
Blueprint Dependency Requirements:
These blueprints overwrite default blueprint values:
- flow_translation.yaml
- flow_authentication.yaml
The following default blueprints will be overwritten by customizations:
- flow-password-change.yaml
- flow-default-authentication-flow.yaml
- flow-default-user-settings-flow.yaml
- flow-default-source-enrollment.yaml
The `abra.sh` function `apply_blueprints` needs to be executed to deactivate these blueprints to ensure that the customizations won't be overwritten. It will further execute flow_translation.yaml and flow_authentication.yaml again.
### Blueprint Overwrite/Use Dependencies
- Recovery with email verification
- Default - Password change flow
- USE:
- `default-password-change-prompt`
- `default-password-change-write`
- Default - Authentication flow
- USE:
- `default-authentication-login`
- Custom Authentication Flow
- Default - Authentication flow
- USE:
- `default-authentication-password`
- OVERWRITE:
- `default-authentication-flow`
- APPEND:
- `default-authentication-identification`
- `default-authentication-login`
- REMOVE: `authentik_flows.flowstagebinding order:20`
- Recovery with email verification
- USE:
- `default-recovery-flow`
- Invitation Enrollment Flow
- Default - User settings flow
- USE:
- `default-user-settings-field-name`
- `default-user-settings-field-email`
- Default - Password change flow
- USE:
- `default-password-change-field-password`
- `default-password-change-field-password-repeat`
- Default - Authentication flow
- USE:
- `default-authentication-login`
- Default - Source enrollment flow
- USE:
- `default-source-enrollment-field-username`
- `default-source-enrollment-write`
- Custom Invalidation Flow
- Default - Invalidation flow
- APPEND_ATTR:
- `authentik_flows.flowstagebinding order: 0`
- Flow Translations
- Recovery with email verification
- APPEND: `default-recovery-flow`
- Default - Password change flow
- OVERWRITE:
- `default-password-change-field-password`
- `default-password-change-field-password-repeat`
- Default - User settings flow
- OVERWRITE:
- `default-user-settings-field-username`
- `default-user-settings-field-name`
- Default - Source enrollment flow
- OVERWRITE:
- `default-source-enrollment-field-username`
- Custom System Tenant
- Default - Tenant
- APPEND: `authentik_tenants.tenant domain: authentik-default`
- Recovery with email verification
- USE:
- `default-recovery-flow`
Blueprint Dependency Graph:
### Blueprint Dependency Execution Order
5. Custom System Tenant
- Default - Tenant
4. Invitation Enrollment Flow
1. Recovery with email verification
- Default - Authentication flow
- Default - Password change flow
4. Invitation Enrollment Flow
3. Flow Translations
- Default - User settings flow
- Default - Source enrollment flow
2. Custom Authentication Flow
1. Recovery with email verification
- Default - Authentication flow
- Default - Password change flow
2. Custom Authentication Flow
1. Recovery with email verification
- Default - Authentication flow
- Default - Password change flow

55
abra.sh
View File

@ -1,16 +1,17 @@
export CUSTOM_CSS_VERSION=v2
export FLOW_AUTHENTICATION_VERSION=v1
export FLOW_AUTHENTICATION_VERSION=v3
export FLOW_INVITATION_VERSION=v1
export FLOW_INVALIDATION_VERSION=v1
export FLOW_INVALIDATION_VERSION=v2
export FLOW_RECOVERY_VERSION=v1
export FLOW_TRANSLATION_VERSION=v1
export SYSTEM_TENANT_VERSION=v1
export FLOW_TRANSLATION_VERSION=v2
export SYSTEM_TENANT_VERSION=v2
export NEXTCLOUD_CONFIG_VERSION=v1
export WORDPRESS_CONFIG_VERSION=v2
export MATRIX_CONFIG_VERSION=v1
export WEKAN_CONFIG_VERSION=v3
export VIKUNJA_CONFIG_VERSION=v1
export MONITORING_CONFIG_VERSION=v1
export DB_ENTRYPOINT_VERSION=v1
customize() {
if [ -z "$1" ]
@ -95,15 +96,24 @@ rotate_db_pass() {
psql -U authentik -c """ALTER USER authentik WITH PASSWORD '$db_password';"""
}
# This function is for blueprints that are overwriting custom blueprints
# It deactivates the affected custom blueprints to avoid changes to be reverted
apply_blueprints() {
enable_blueprint default/flow-default-authentication-flow.yaml
enable_blueprint default/flow-default-user-settings-flow.yaml
enable_blueprint default/flow-password-change.yaml
ak apply_blueprint 6_flow_invalidation.yaml 2>&1 | quieten
ak apply_blueprint 5_system_tenant.yaml 2>&1 | quieten
disable_blueprint default/flow-default-authentication-flow.yaml
disable_blueprint default/flow-default-user-settings-flow.yaml
disable_blueprint default/flow-password-change.yaml
update_and_disable_blueprint default/flow-password-change.yaml
update_and_disable_blueprint default/flow-default-authentication-flow.yaml
update_and_disable_blueprint default/flow-default-user-settings-flow.yaml
update_and_disable_blueprint default/flow-default-source-enrollment.yaml
apply_blueprint 3_flow_translation.yaml
apply_blueprint 2_flow_authentication.yaml
}
update_and_disable_blueprint() {
enable_blueprint $@ 2>&1 | quieten
sleep 1
apply_blueprint $@
sleep 1
disable_blueprint $@ 2>&1 | quieten
}
disable_blueprint() {
@ -114,12 +124,24 @@ enable_blueprint() {
blueprint_state True $@
}
apply_blueprint() {
echo apply blueprint $@
ak apply_blueprint $@ 2>&1 | quieten
}
blueprint_state() {
/manage.py shell -c """
import time
blueprint_state=$1
blueprint_path='$2'
blueprint = BlueprintInstance.objects.filter(path=blueprint_path).first()
blueprint.enabled = blueprint_state
# Hacky workaround to reduce chance of a race condition
blueprint.save()
time.sleep(1)
blueprint.save()
time.sleep(1)
blueprint.save()
print(f'{blueprint.name} enabled: {blueprint.enabled}')
""" 2>&1 | quieten
@ -146,7 +168,14 @@ for name, url in applications.items():
quieten(){
grep -v '{"event"'
grep -v -e '{"event"' -e '{"action"'
}
add_email_templates(){
for file_path in "$@"; do
echo copy template $file_path
abra app cp $APP_NAME $file_path app:/templates/
done
}
set_icons(){

6
compose.outposts.yml Normal file
View File

@ -0,0 +1,6 @@
version: "3.8"
services:
worker:
user: root
volumes:
- /var/run/docker.sock:/var/run/docker.sock

View File

@ -32,7 +32,7 @@ x-env: &env
version: '3.8'
services:
app:
image: ghcr.io/goauthentik/server:2023.3.1
image: ghcr.io/goauthentik/server:2023.8.5
command: server
secrets:
- db_password
@ -43,6 +43,7 @@ services:
volumes:
- media:/media
- assets:/web/dist/assets
- templates:/templates
configs:
- source: custom_css
target: /web/dist/custom.css
@ -50,7 +51,7 @@ services:
- internal
- proxy
healthcheck:
test: ["CMD", "curl", "-f", "localhost:9000/-/health/live/"]
test: "bash -c 'printf \"GET / HTTP/1.1\n\n\" > /dev/tcp/127.0.0.1/9000; exit $$?;'"
interval: 30s
timeout: 10s
retries: 10
@ -64,7 +65,7 @@ services:
- "traefik.enable=true"
- "traefik.docker.network=proxy"
- "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=9000"
- "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
- "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
- "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
- "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
- "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect,${STACK_NAME}-frameOptions"
@ -72,11 +73,11 @@ services:
- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
- "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.customFrameOptionsValue=SAMEORIGIN"
- "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.contentSecurityPolicy=frame-ancestors ${X_FRAME_OPTIONS_ALLOW_FROM}"
- "coop-cloud.${STACK_NAME}.version=3.1.2+2023.3.1"
- "coop-cloud.${STACK_NAME}.version=3.3.1+2023.8.5"
- "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
worker:
image: ghcr.io/goauthentik/server:2023.3.1
image: ghcr.io/goauthentik/server:2023.8.5
command: worker
secrets:
- db_password
@ -87,12 +88,11 @@ services:
networks:
- internal
- proxy
user: root
volumes:
- backups:/backups
- media:/media
- /var/run/docker.sock:/var/run/docker.sock
- /dev/null:/blueprints/default/flow-oobe.yaml
- templates:/templates
configs:
- source: flow_recovery
target: /blueprints/1_flow_recovery.yaml
@ -109,9 +109,15 @@ services:
environment: *env
db:
image: postgres:12.14-alpine
image: postgres:15.5
secrets:
- db_password
configs:
- source: db_entrypoint
target: /docker-entrypoint.sh
mode: 0555
entrypoint:
/docker-entrypoint.sh
volumes:
- database:/var/lib/postgresql/data
networks:
@ -134,7 +140,7 @@ services:
backupbot.backup.path: "/var/lib/postgresql/data"
redis:
image: redis:7.0.10-alpine
image: redis:7.2.3-alpine
networks:
- internal
healthcheck:
@ -169,6 +175,7 @@ networks:
volumes:
backups:
media:
templates:
assets:
database:
@ -201,3 +208,7 @@ configs:
name: ${STACK_NAME}_system_tenant_${SYSTEM_TENANT_VERSION}
file: system_tenant.yaml.tmpl
template_driver: golang
db_entrypoint:
name: ${STACK_NAME}_db_entrypoint_${DB_ENTRYPOINT_VERSION}
file: entrypoint.postgres.sh.tmpl
template_driver: golang

View File

@ -0,0 +1,45 @@
#!/bin/bash
set -e
MIGRATION_MARKER=$PGDATA/migration_in_progress
OLDDATA=$PGDATA/old_data
NEWDATA=$PGDATA/new_data
if [ -e $MIGRATION_MARKER ]; then
echo "FATAL: migration was started but did not complete in a previous run. manual recovery necessary"
exit 1
fi
if [ -f $PGDATA/PG_VERSION ]; then
DATA_VERSION=$(cat $PGDATA/PG_VERSION)
if [ -n "$DATA_VERSION" -a "$PG_MAJOR" != "$DATA_VERSION" ]; then
echo "postgres data version $DATA_VERSION found, but need $PG_MAJOR. Starting migration"
echo "Installing postgres $DATA_VERSION"
sed -i "s/$/ $DATA_VERSION/" /etc/apt/sources.list.d/pgdg.list
apt-get update && apt-get install -y --no-install-recommends \
postgresql-$DATA_VERSION \
&& rm -rf /var/lib/apt/lists/*
echo "shuffling around"
chown -R postgres:postgres $PGDATA
gosu postgres mkdir $OLDDATA $NEWDATA
chmod 700 $OLDDATA $NEWDATA
mv $PGDATA/* $OLDDATA/ || true
touch $MIGRATION_MARKER
echo "running initdb"
# abuse entrypoint script for initdb by making server error out
gosu postgres bash -c "export PGDATA=$NEWDATA ; /usr/local/bin/docker-entrypoint.sh --invalid-arg || true"
echo "running pg_upgrade"
cd /tmp
gosu postgres pg_upgrade --link -b /usr/lib/postgresql/$DATA_VERSION/bin -d $OLDDATA -D $NEWDATA -U $POSTGRES_USER
cp $OLDDATA/pg_hba.conf $NEWDATA/
mv $NEWDATA/* $PGDATA
rm -rf $OLDDATA
rmdir $NEWDATA
rm $MIGRATION_MARKER
echo "migration complete"
fi
fi
/usr/local/bin/docker-entrypoint.sh postgres

View File

@ -22,7 +22,6 @@ entries:
attrs:
name: !Context welcome_message
title: !Context welcome_message
### STAGES
- identifiers:
name: default-authentication-identification
@ -30,6 +29,9 @@ entries:
attrs:
password_stage: !Find [authentik_stages_password.passwordstage, [name, default-authentication-password]]
recovery_flow: !Find [authentik_flows.flow, [slug, default-recovery-flow]]
user_fields:
- email
- username
- identifiers:
name: default-authentication-login
@ -37,6 +39,7 @@ entries:
attrs:
session_duration: seconds=0
# After the first run this will produce a RelatedObjectDoesNotExist error
- identifiers:
order: 20
stage: !Find [authentik_stages_password.passwordstage, [name, default-authentication-password]]

View File

@ -13,6 +13,7 @@ entries:
### STAGE BINDINGS
# This is specified only for setting an id (this stagebinding does not have an identifier)
- identifiers:
order: 0
stage: !Find [authentik_stages_user_logout.userlogoutstage, [name, default-invalidation-logout]]

View File

@ -4,7 +4,7 @@ metadata:
blueprints.goauthentik.io/instantiate: "true"
name: Flow Translations
context:
transl_recovery: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Passwort Zurücksetzen" {{ else }} "Reset your password" {{ end }}
transl_recovery: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Passwort zurücksetzen" {{ else }} "Reset your password" {{ end }}
transl_password: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Passwort" {{ else }} "Password" {{ end }}
transl_password_repeat: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Passwort (wiederholen)" {{ else }} "Password (repeat)" {{ end }}
transl_username: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} "Benutzername" {{ else }} "Username" {{ end }}
@ -15,7 +15,7 @@ entries:
- model: authentik_blueprints.metaapplyblueprint
attrs:
identifiers:
name: Custom Authentication Flow
name: Recovery with email verification
required: true
- model: authentik_blueprints.metaapplyblueprint
attrs:

BIN
icons/bbb.jpg Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 6.7 KiB

1
release/3.2.0+2023.6.1 Normal file
View File

@ -0,0 +1 @@
If you use your own outpost you need to uncomment COMPOSE_FILE="$COMPOSE_FILE:compose.outposts.yml" to expose the docker socket again.

View File

@ -13,7 +13,7 @@ entries:
- model: authentik_blueprints.metaapplyblueprint
attrs:
identifiers:
name: Invitation Enrollment Flow
name: Recovery with email verification
required: true