tamipes/authentik-nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #73 from Ma27/fix-port-collision

Browse source 
update: 2025.8.2 -> 2025.8.3; fix port collisions
This commit is contained in:
Maximilian Bosch 2025-09-18 08:30:15 +02:00 • committed by GitHub
commit 4c626ed84c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 105 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

8
flake.lock generated
View file

@ -3,16 +3,16 @@
"authentik-src": {
"flake": false,
"locked": {
"lastModified": 1757951234,
"narHash": "sha256-4RU/mllgqoykXqeO67iodmhsgIrJqow0LitaQGLKS8Q=",
"lastModified": 1758035356,
"narHash": "sha256-DkvxDwHCfSqEpZ9rRXNR8MP0Mz/y1kHAr38exrHQ39c=",
"owner": "goauthentik",
"repo": "authentik",
"rev": "28ff5614006ceea21b2633da8c675eb75c6bacdd",
"rev": "680feaefa17934471a6b33ebc35caf5b64120404",
"type": "github"
},
"original": {
"owner": "goauthentik",
"ref": "version/2025.8.2",
"ref": "version/2025.8.3",
"repo": "authentik",
"type": "github"
}

4
flake.nix
View file

@ -42,7 +42,7 @@
};
authentik-src = {
# change version string in outputs as well when updating
url = "github:goauthentik/authentik/version/2025.8.2";
url = "github:goauthentik/authentik/version/2025.8.3";
flake = false;
};
};
@ -67,7 +67,7 @@
...
}:
let
authentik-version = "2025.8.2"; # to pass to the drvs of some components
authentik-version = "2025.8.3"; # to pass to the drvs of some components
in
{
systems = import inputs.systems;

99
module.nix
View file

@ -103,12 +103,40 @@ in
```
'';
};
worker = {
listenHTTP = mkOption {
type = types.str;
default = "[::1]:9001";
description = ''
Listen address for the HTTP server of the worker.
Overrides the default listen setting that's also used by the server.
'';
};
listenMetrics = mkOption {
type = types.str;
default = "[::1]:9301";
description = ''
Listen address for the metrics server of the worker.
Overrides the default listen setting that's also used by the server.
'';
};
};
};
# LDAP oupost
authentik-ldap = {
enable = mkEnableOption "authentik LDAP outpost";
listenMetrics = mkOption {
type = types.str;
default = "[::1]:9302";
description = ''
Listen address for the metrics server of the LDAP outpost.
Overrides the default listen setting that's also used by the server.
'';
};
environmentFile = mkOption {
type = types.nullOr pathToSecret;
default = null;
@ -132,6 +160,31 @@ in
authentik-proxy = {
enable = mkEnableOption "authentik Proxy outpost";
listenMetrics = mkOption {
type = types.str;
default = "[::1]:9303";
description = ''
Listen address for the metrics server of the proxy outpost.
Overrides the default listen setting that's also used by the server.
'';
};
listenHTTPS = mkOption {
type = types.str;
default = "[::1]:9004";
description = ''
Listen address for the HTTPS server of the proxy outpost.
Overrides the default listen setting that's also used by the server.
'';
};
listenHTTP = mkOption {
type = types.str;
default = "[::1]:9005";
description = ''
Listen address for the HTTP server of the proxy outpost.
Overrides the default listen setting that's also used by the server.
'';
};
environmentFile = mkOption {
type = types.nullOr pathToSecret;
default = null;
@ -155,6 +208,15 @@ in
authentik-radius = {
enable = mkEnableOption "authentik RADIUS outpost";
listenMetrics = mkOption {
type = types.str;
default = "[::1]:9306";
description = ''
Listen address for the metrics server of the RADIUS outpost.
Overrides the default listen setting that's also used by the server.
'';
};
environmentFile = mkOption {
type = types.nullOr pathToSecret;
default = null;
@ -263,13 +325,15 @@ in
systemd.services = {
authentik-migrate = {
requiredBy = [ "authentik.service" ];
requires = lib.optionals cfg.createDatabase [ "postgresql.service" ];
wants = [ "network-online.target" ];
after = [ "network-online.target" ] ++ lib.optionals cfg.createDatabase [ "postgresql.service" ];
before = [ "authentik.service" ];
before = [ "authentik.service" "authentik-migrate.service" ];
restartTriggers = [ config.environment.etc."authentik/config.yml".source ];
environment = mkMerge [ environment { TZ = tz; } ];
environment = mkMerge [
environment
{ TZ = tz; }
];
serviceConfig = mkMerge [
serviceDefaults
{
@ -289,7 +353,6 @@ in
];
};
authentik-worker = {
requiredBy = [ "authentik.service" ];
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
before = [ "authentik.service" ];
@ -297,7 +360,14 @@ in
preStart = ''
ln -svf ${config.services.authentik.authentikComponents.staticWorkdirDeps}/* /run/authentik/
'';
environment = mkMerge [ environment { TZ = tz; } ];
environment = mkMerge [
environment
{
TZ = tz;
AUTHENTIK_LISTEN__LISTEN_HTTP = cfg.worker.listenHTTP;
AUTHENTIK_LISTEN__LISTEN_METRICS = cfg.worker.listenMetrics;
}
];
serviceConfig = mkMerge [
serviceDefaults
{
@ -318,10 +388,15 @@ in
authentik = {
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ];
requires = [
"authentik-migrate.service"
"authentik-worker.service"
];
after = [
"network-online.target"
"redis-authentik.service"
] ++ (lib.optionals cfg.createDatabase [ "postgresql.service" ]);
]
++ (lib.optionals cfg.createDatabase [ "postgresql.service" ]);
restartTriggers = [ config.environment.etc."authentik/config.yml".source ];
preStart = ''
ln -svf ${cfg.authentikComponents.staticWorkdirDeps}/* /var/lib/authentik/
@ -329,7 +404,10 @@ in
mkdir -p ${cfg.settings.storage.media.file.path}
''}
'';
environment = mkMerge [ environment { TZ = tz; } ];
environment = mkMerge [
environment
{ TZ = tz; }
];
serviceConfig = mkMerge [
serviceDefaults
{
@ -374,6 +452,7 @@ in
"network-online.target"
"authentik.service"
];
environment.AUTHENTIK_LISTEN__METRICS = cfg.listenMetrics;
serviceConfig = {
RuntimeDirectory = "authentik-ldap";
UMask = "0027";
@ -400,6 +479,11 @@ in
"network-online.target"
"authentik.service"
];
environment = {
AUTHENTIK_LISTEN__METRICS = cfg.listenMetrics;
AUTHENTIK_LISTEN__HTTP = cfg.listenHTTP;
AUTHENTIK_LISTEN__HTTPS = cfg.listenHTTPS;
};
serviceConfig = {
RuntimeDirectory = "authentik-proxy";
UMask = "0027";
@ -426,6 +510,7 @@ in
"network-online.target"
"authentik.service"
];
environment.AUTHENTIK_LISTEN__METRICS = cfg.listenMetrics;
serviceConfig = {
RuntimeDirectory = "authentik-radius";
UMask = "0027";

7
tests/minimal-vmtest.nix
View file

@ -91,5 +91,12 @@ pkgs.nixosTest {
machine.succeed("su - alice -c 'firefox http://localhost/' >&2 &")
machine.wait_for_text("authentik")
machine.screenshot("5_nginx_proxies_requests")
with subtest("metrics & worker"):
machine.wait_for_open_port(9300)
machine.wait_for_open_port(9301)
print(machine.succeed("curl -L localhost:9300/metrics | grep authentik_outpost_connection | grep 'Embedded'"))
print(machine.succeed("curl -L localhost:9301/metrics | grep authentik_tasks_total"))
'';
}