chore: publish 11.0.2+2026.2.1 release

Intermediate step for upgrading to 2026.2.x.
Bump authentik to 2025.12.4, postgres to 15.17.

abra.sh

@@ -21,6 +21,11 @@ export DB_ENTRYPOINT_VERSION=v1
 export PG_BACKUP_VERSION=v2
 export ENTRYPOINT_CSS_VERSION=v1
 
+clear_assets() {
+  rm -rf /web/dist/assets/*
+  echo "Assets cleared. Redeploy to repopulate from image, then run 'customize' if needed."
+}
+
 customize() {
   if [ -z "$1" ]; then
     echo "Usage: ... customize <assets_path>"

compose.yml

@@ -62,7 +62,7 @@ services:
     deploy:
       labels:
         - "traefik.enable=true"
-        - "traefik.docker.network=proxy"
+        - "traefik.swarm.network=proxy"
         - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=9000"
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
@@ -70,7 +70,7 @@ services:
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect,${STACK_NAME}-frameOptions,${STACK_NAME}-redirect"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.customFrameOptionsValue=SAMEORIGIN"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.contentSecurityPolicy=frame-ancestors ${X_FRAME_OPTIONS_ALLOW_FROM}"
-        - "coop-cloud.${STACK_NAME}.version=10.2.0+2026.2.1"
+        - "coop-cloud.${STACK_NAME}.version=11.0.2+2026.2.1"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.regex=^https://(${REDIRECTS})/(.*)"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"

release/11.0.0+2026.2.1

@@ -1,3 +1,3 @@
-You must deploy 10.1.5+2025.12.4 first, before deploying this version, if upgrading from 2025.10 or earlier.
+You must deploy 10.2.0+2025.12.4 first, before deploying this version, if upgrading from 2025.10 or earlier.
 Skipping the intermediate version will cause a migration error (although rolled back safely, no data loss).
 

release/11.0.2+2026.2.1

@@ -0,0 +1,9 @@
+This patch release adds a `clear_assets` command to fix stale font files after upgrading authentik.
+
+If fonts are missing after an upgrade (404 errors in browser console, or missing icons), the `assets` Docker volume contains stale files from the previous image. To fix:
+
+    abra app cmd <app-name> app clear_assets --user root
+    abra app undeploy <app-name> 
+    abra app deploy <app-name> 
+
+After redeploying, Docker repopulates the empty volume from the new image. If customize assets was used before, re-run `customize` afterwards.

wordpress.yaml.tmpl

@@ -52,7 +52,7 @@ entries:
     name: {{ env "WORDPRESS_GROUP" }}
   attrs:
     users:
-    - 1
+    - 6
   id: wordpress_group
   model: authentik_core.group