Merge branch 'main' into authentik-upgrade

Intermediate step for upgrading to 2026.2.x.
Bump authentik to 2025.12.4, postgres to 15.17.

abra.sh

@@ -21,11 +21,6 @@ export DB_ENTRYPOINT_VERSION=v1
 export PG_BACKUP_VERSION=v2
 export ENTRYPOINT_CSS_VERSION=v1
 
-clear_assets() {
-  rm -rf /web/dist/assets/*
-  echo "Assets cleared. Redeploy to repopulate from image, then run 'customize' if needed."
-}
-
 customize() {
   if [ -z "$1" ]; then
     echo "Usage: ... customize <assets_path>"

compose.yml

@@ -62,7 +62,7 @@ services:
     deploy:
       labels:
         - "traefik.enable=true"
-        - "traefik.swarm.network=proxy"
+        - "traefik.docker.network=proxy"
         - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=9000"
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
@@ -70,7 +70,7 @@ services:
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect,${STACK_NAME}-frameOptions,${STACK_NAME}-redirect"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.customFrameOptionsValue=SAMEORIGIN"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.contentSecurityPolicy=frame-ancestors ${X_FRAME_OPTIONS_ALLOW_FROM}"
-        - "coop-cloud.${STACK_NAME}.version=11.0.2+2026.2.1"
+        - "coop-cloud.${STACK_NAME}.version=10.2.0+2026.2.1"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.regex=^https://(${REDIRECTS})/(.*)"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"

release/10.2.0+2026.2.1

@@ -1,3 +1,3 @@
-You must deploy 10.2.0+2025.12.4 first, before deploying this version, if upgrading from 2025.10 or earlier.
+You must deploy 10.1.5+2025.12.4 first, before deploying this version, if upgrading from 2025.10 or earlier.
 Skipping the intermediate version will cause a migration error (although rolled back safely, no data loss).
 

release/11.0.2+2026.2.1

@@ -1,9 +0,0 @@
-This patch release adds a `clear_assets` command to fix stale font files after upgrading authentik.
-
-If fonts are missing after an upgrade (404 errors in browser console, or missing icons), the `assets` Docker volume contains stale files from the previous image. To fix:
-
-    abra app cmd <app-name> app clear_assets --user root
-    abra app undeploy <app-name> 
-    abra app deploy <app-name> 
-
-After redeploying, Docker repopulates the empty volume from the new image. If customize assets was used before, re-run `customize` afterwards.

wordpress.yaml.tmpl

@@ -52,7 +52,7 @@ entries:
     name: {{ env "WORDPRESS_GROUP" }}
   attrs:
     users:
-    - 6
+    - 1
   id: wordpress_group
   model: authentik_core.group