chore: publish 6.7.0+2024.8.3 release

.env.sample

@@ -70,6 +70,7 @@ AUTHENTIK_COLOR_BACKGROUND_LIGHT=#1c1e21
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.matrix.yml"
 # ELEMENT_DOMAIN=element-web.example.com
+# MATRIX_DOMAIN=matrix-synapse.example.com
 # SECRET_MATRIX_ID_VERSION=v1
 # SECRET_MATRIX_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS matrix:~/.abra/recipes/authentik/icons/matrix.svg"
@@ -122,4 +123,4 @@ AUTHENTIK_COLOR_BACKGROUND_LIGHT=#1c1e21
 
 # APPLICATIONS='{"Calendar": "https://nextcloud.example.com/apps/calendar/", "BBB": "https://nextcloud.example.com/apps/bbb/"}'
 # APP_ICONS="$APP_ICONS Calendar:~/.abra/recipes/authentik/icons/calendar.svg"
-# APP_ICONS="$APP_ICONS BBB:~/.abra/recipes/authentik/icons/bbb.jpg"
+# APP_ICONS="$APP_ICONS BBB:~/.abra/recipes/authentik/icons/bbb.png"

alaconnect.yml

@@ -17,6 +17,7 @@ matrix-synapse:
     uncomment:
         - compose.matrix.yml
         - ELEMENT_DOMAIN
+        - MATRIX_DOMAIN
         - SECRET_MATRIX_ID_VERSION
         - SECRET_MATRIX_SECRET_VERSION
         - matrix.svg

compose.matrix.yml

@@ -1,5 +1,11 @@
 version: "3.8"
 services:
+  app:
+    deploy:
+      labels:
+        - "traefik.http.routers.${STACK_NAME}.middlewares=redirect-matrix-well-known"
+        - "traefik.http.middlewares.redirect-matrix-well-known.redirectregex.regex=^https://(.*)/.well-known/matrix/(.*)"
+        - "traefik.http.middlewares.redirect-matrix-well-known.redirectregex.replacement=https://${MATRIX_DOMAIN}/.well-known/matrix/$$2"
   worker:
     secrets:
       - matrix_id

compose.yml

@@ -33,7 +33,7 @@ x-env: &env
 version: '3.8'
 services:
   app:
-    image: ghcr.io/goauthentik/server:2024.6.1
+    image: ghcr.io/goauthentik/server:2024.8.3
     command: server
     depends_on:
       - db
@@ -71,11 +71,11 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.customFrameOptionsValue=SAMEORIGIN"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.contentSecurityPolicy=frame-ancestors ${X_FRAME_OPTIONS_ALLOW_FROM}"
-        - "coop-cloud.${STACK_NAME}.version=6.3.1+2024.6.1"
+        - "coop-cloud.${STACK_NAME}.version=6.7.0+2024.8.3"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
 
   worker:
-    image: ghcr.io/goauthentik/server:2024.6.1
+    image: ghcr.io/goauthentik/server:2024.8.3
     command: worker
     depends_on:
       - db
@@ -90,10 +90,10 @@ services:
       - internal
       - proxy
     volumes:
-      - backups:/backups
       - media:/media
       - /dev/null:/blueprints/default/flow-oobe.yaml
       - templates:/templates
+      - certs:/certs
     configs:
       - source: flow_recovery
         target: /blueprints/1_flow_recovery.yaml
@@ -116,7 +116,7 @@ services:
       start_period: 5m
 
   db:
-    image: postgres:15.7
+    image: postgres:15.8
     secrets:
       - db_password
     configs:
@@ -144,10 +144,13 @@ services:
           backupbot.backup: "true"
           backupbot.backup.pre-hook: "PGPASSWORD=$$(cat /run/secrets/db_password) pg_dump -U $${POSTGRES_USER} $${POSTGRES_DB} > /var/lib/postgresql/data/backup.sql"
           backupbot.backup.post-hook: "rm -rf /var/lib/postgresql/data/backup.sql"
-          backupbot.backup.path: "/var/lib/postgresql/data"
+          backupbot.backup.volumes.database.path: "backup.sql"
+          backupbot.backup.volumes.redis: "false"
+          backupbot.restore.post-hook: 'psql -U authentik -d postgres -c "DROP DATABASE authentik WITH (FORCE);" && createdb -U authentik authentik && psql -U authentik -d authentik -f /var/lib/postgresql/data/backup.sql'
 
   redis:
-    image:  redis:7.2.5-alpine
+    image:  redis:7.4.0-alpine
+    command: --save 60 1 --loglevel warning
     networks:
       - internal
     healthcheck:
@@ -156,6 +159,8 @@ services:
       timeout: 10s
       retries: 10
       start_period: 1m
+    volumes:
+        - redis:/data
 
 secrets:
   db_password:
@@ -180,8 +185,9 @@ networks:
   internal:
 
 volumes:
-  backups:
   media:
+  certs:
+  redis:
   templates:
   assets:
   database:

release/6.6.0+2024.8.2

@@ -0,0 +1 @@
+Replaced icon bbb.jpg with icon.png - configs need to be updated when upgrading!

release/6.7.0+2024.8.3

@@ -0,0 +1,3 @@
+Two critical vulnerabilities were closed:
+https://github.com/goauthentik/authentik/security/advisories/GHSA-7jxf-mmg9-9hg7
+https://github.com/goauthentik/authentik/security/advisories/GHSA-8gfm-pr6x-pfh9