From b053f0477aef699e31e3dc5bc12ef04c5f9c5c2c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabian=20M=C3=B6ller?= Date: Sun, 15 Feb 2026 15:48:04 +0100 Subject: [PATCH] authentik,authentik-outposts: 2025.10.1 -> 2025.12.4 --- .../au/authentik/client-go-config.patch | 9 + pkgs/by-name/au/authentik/ldap.nix | 3 + pkgs/by-name/au/authentik/outposts.nix | 7 +- pkgs/by-name/au/authentik/package.nix | 165 ++++++++++++++++-- pkgs/by-name/au/authentik/proxy.nix | 3 + pkgs/by-name/au/authentik/radius.nix | 3 + 6 files changed, 174 insertions(+), 16 deletions(-) create mode 100644 pkgs/by-name/au/authentik/client-go-config.patch diff --git a/pkgs/by-name/au/authentik/client-go-config.patch b/pkgs/by-name/au/authentik/client-go-config.patch new file mode 100644 index 000000000000..8398b16160c7 --- /dev/null +++ b/pkgs/by-name/au/authentik/client-go-config.patch @@ -0,0 +1,9 @@ +diff --git a/config.yaml b/config.yaml +index 2f07ea7..0f90432 100644 +--- a/config.yaml ++++ b/config.yaml +@@ -4,3 +4,4 @@ additionalProperties: + packageName: api + enumClassPrefix: true + useOneOfDiscriminatorLookup: true ++ disallowAdditionalPropertiesIfNotPresent: false diff --git a/pkgs/by-name/au/authentik/ldap.nix b/pkgs/by-name/au/authentik/ldap.nix index 5d4159ae9737..bf6b88202e11 100644 --- a/pkgs/by-name/au/authentik/ldap.nix +++ b/pkgs/by-name/au/authentik/ldap.nix @@ -1,6 +1,7 @@ { buildGoModule, authentik, + apiGoVendorHook, vendorHash, }: @@ -9,6 +10,8 @@ buildGoModule { inherit (authentik) version src; inherit vendorHash; + nativeBuildInputs = [ apiGoVendorHook ]; + env.CGO_ENABLED = 0; subPackages = [ "cmd/ldap" ]; diff --git a/pkgs/by-name/au/authentik/outposts.nix b/pkgs/by-name/au/authentik/outposts.nix index 485dd81e8c20..0548c36e888d 100644 --- a/pkgs/by-name/au/authentik/outposts.nix +++ b/pkgs/by-name/au/authentik/outposts.nix @@ -1,10 +1,11 @@ { callPackage, authentik, + apiGoVendorHook ? authentik.apiGoVendorHook, vendorHash ? authentik.proxy.vendorHash, }: { - ldap = callPackage ./ldap.nix { inherit vendorHash; }; - proxy = callPackage ./proxy.nix { inherit vendorHash; }; - radius = callPackage ./radius.nix { inherit vendorHash; }; + ldap = callPackage ./ldap.nix { inherit apiGoVendorHook vendorHash; }; + proxy = callPackage ./proxy.nix { inherit apiGoVendorHook vendorHash; }; + radius = callPackage ./radius.nix { inherit apiGoVendorHook vendorHash; }; } diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix index 8a4a7c6409e3..680c719f0f06 100644 --- a/pkgs/by-name/au/authentik/package.nix +++ b/pkgs/by-name/au/authentik/package.nix @@ -10,18 +10,23 @@ nodejs_24, python3, makeWrapper, + openapi-generator-cli, + go, + typescript, + makeSetupHook, + writeShellScript, }: let nodejs = nodejs_24; - version = "2025.10.1"; + version = "2025.12.4"; src = fetchFromGitHub { owner = "goauthentik"; repo = "authentik"; tag = "version/${version}"; - hash = "sha256-HowB6DTGCqz770fKYbnE+rQ11XRV0WSNkLD+HSWZwz8="; + hash = "sha256-alTyrMBbjZbw4jhEna8saabf93sqSrZCu+Z5xH3pZ7M="; }; meta = { @@ -39,6 +44,90 @@ let ]; }; + client-go = stdenvNoCC.mkDerivation { + pname = "authentik-client-go"; + version = "3.${version}"; + inherit meta; + + src = fetchFromGitHub { + owner = "goauthentik"; + repo = "client-go"; + tag = "v3.${version}"; + hash = "sha256-+/CfOE2HkBU+ZddvdXGenB/z8xNFk8cujpZpMXyh3cY="; + }; + + patches = [ + ./client-go-config.patch + ]; + + postPatch = '' + substituteInPlace ./config.yaml \ + --replace-fail '/local' "$(pwd)" + ''; + + nativeBuildInputs = [ + openapi-generator-cli + go + ]; + + buildPhase = '' + runHook preBuild + + openapi-generator-cli generate \ + -i ${src}/schema.yml -o $out \ + -g go \ + -c ./config.yaml + + gofmt -w $out + + runHook postBuild + ''; + + installPhase = '' + runHook preInstall + + cp go.mod go.sum $out + + cd $out + rm -rf test + rm -f .travis.yml git_push.sh + + runHook postInstall + ''; + }; + + client-ts = stdenvNoCC.mkDerivation { + pname = "authentik-client-ts"; + inherit version src meta; + + postPatch = '' + substituteInPlace ./scripts/api/ts-config.yaml \ + --replace-fail '/local' "$(pwd)" + ''; + + nativeBuildInputs = [ + nodejs + openapi-generator-cli + typescript + ]; + + buildPhase = '' + runHook preBuild + + openapi-generator-cli generate \ + -i ./schema.yml -o $out \ + -g typescript-fetch \ + -c ./scripts/api/ts-config.yaml \ + --additional-properties=npmVersion=${version} \ + --git-repo-id authentik --git-user-id goauthentik + + cd $out + npm run build + + runHook postBuild + ''; + }; + # prefetch-npm-deps does not save all dependencies even though the lockfile is fine website-deps = stdenvNoCC.mkDerivation { pname = "authentik-website-deps"; @@ -48,8 +137,8 @@ let outputHash = { - "aarch64-linux" = "sha256-aXXlzTsZp5mOrsxy9oHNzcc+1cFSnbC9RmtawBohmLI="; - "x86_64-linux" = "sha256-Hi0HXzwTLuer0v4IKF3aim0tVe7AVLi67DiMimrIq5s="; + "aarch64-linux" = "sha256-GL5FPIBnoEXYtw8DPJpRPe3tT3qioN4AdoeOmCoiYsM="; + "x86_64-linux" = "sha256-AnceTipq6uUvTbOAZanVshAbAJ9LS1kwImbttTOcWxc="; } .${stdenvNoCC.hostPlatform.system} or (throw "authentik-website-deps: unsupported host platform"); @@ -119,8 +208,8 @@ let outputHash = { - "aarch64-linux" = "sha256-t/jyzG3ibTW3fu8Gl1tWkSjMG6Lek/7JDccDrZX6sD0="; - "x86_64-linux" = "sha256-8I1YAKvgWjM3p9O1mCetZvhZelrfB31w0ZwkZBUEoh4="; + "aarch64-linux" = "sha256-eZZ5Ynj81KwFsU5emPtYZ2CxO8MFvWbJnCHs+L88KQQ="; + "x86_64-linux" = "sha256-yUAyyO1NFav1EptrRYGSzC8dxCxYVj0FmzHk8IckFZM="; } .${stdenvNoCC.hostPlatform.system} or (throw "authentik-webui-deps: unsupported host platform"); outputHashMode = "recursive"; @@ -172,6 +261,10 @@ let find -type d -name node_modules -prune -print -exec cp -rT {} $buildRoot/{} \; popd + chmod -R +w node_modules/@goauthentik + rm -R node_modules/@goauthentik/api + ln -sn ${client-ts} node_modules/@goauthentik/api + pushd node_modules/.bin patchShebangs $(readlink rollup) patchShebangs $(readlink wireit) @@ -208,6 +301,21 @@ let # https://github.com/goauthentik/authentik/pull/16324 django = final.django_5; + ak-guardian = final.buildPythonPackage { + pname = "ak-guardian"; + inherit version src meta; + pyproject = true; + + sourceRoot = "${src.name}/packages/ak-guardian"; + + build-system = with final; [ hatchling ]; + + propagatedBuildInputs = with final; [ + django + typing-extensions + ]; + }; + django-channels-postgres = final.buildPythonPackage { pname = "django-channels-postgres"; inherit version src meta; @@ -330,14 +438,15 @@ let pyproject = true; postPatch = '' - rm lifecycle/system_migrations/tenant_files.py substituteInPlace authentik/root/settings.py \ --replace-fail 'Path(__file__).absolute().parent.parent.parent' "Path(\"$out\")" substituteInPlace authentik/lib/default.yml \ - --replace-fail '/blueprints' "$out/blueprints" \ - --replace-fail './media' '/var/lib/authentik/media' + --replace-fail '/blueprints' "$out/blueprints" substituteInPlace authentik/stages/email/utils.py \ --replace-fail 'web/' '${webui}/' + # allways allow file upload if the data directoy exists + substituteInPlace authentik/admin/files/backends/file.py \ + --replace-fail "and (self._base_dir.is_mount() or (self._base_dir / self.usage.value).is_mount())" "" ''; build-system = [ @@ -351,6 +460,7 @@ let dependencies = with final; [ + ak-guardian argon2-cffi cachetools channels @@ -364,7 +474,6 @@ let django-cte django-dramatiq-postgres django-filter - django-guardian django-model-utils django-pglock django-pgtrigger @@ -375,7 +484,6 @@ let django-tenants djangoql djangorestframework - djangorestframework-guardian docker drf-orjson-renderer drf-spectacular @@ -440,6 +548,31 @@ let inherit (python.pkgs) authentik-django; + # Provide a setup-hook to configure the Go vendor directory with up-to-date API bindings. + # This is done to avoid the `vendorHash` depending on anything in the `client-go` build (e.g. + # openapi-generator-cli version updates changing the produced content) and invalidating the hash. + apiGoVendorHook = + makeSetupHook + { + name = "authentik-api-go-vendor-hook"; + } + ( + writeShellScript "authentik-api-go-vendor-hook" '' + authentikApiGoVendorHook() { + chmod -R +w vendor/goauthentik.io/api + rm -rf vendor/goauthentik.io/api/v3 + cp -r ${client-go} vendor/goauthentik.io/api/v3 + + echo "Finished authentikApiGoVendorHook" + } + + # don't run for FOD, e.g. the `goModules` build + if [ -z ''${outputHash-} ]; then + postConfigureHooks+=(authentikApiGoVendorHook) + fi + '' + ); + proxy = buildGoModule { pname = "authentik-proxy"; inherit version src meta; @@ -453,9 +586,14 @@ let --replace-fail './web' "${authentik-django}/web" ''; + nativeBuildInputs = [ apiGoVendorHook ]; + env.CGO_ENABLED = 0; - vendorHash = "sha256-m2shrCwoVdbtr8B83ZcAyG+J6dEys2xdjtlfFFF4CDo="; + # calculate the vendorHash without other dependencies, so it is only based on the `go.sum` file + overrideModAttrs.postPatch = ""; + + vendorHash = "sha256-pdQg02f1K4nOhsnadoplQYOhEybqZxn+yDQRN5RNygM="; postInstall = '' mv $out/bin/server $out/bin/authentik @@ -500,9 +638,10 @@ stdenvNoCC.mkDerivation { ''; passthru = { - inherit proxy; + inherit proxy apiGoVendorHook; outposts = callPackages ./outposts.nix { inherit (proxy) vendorHash; + inherit apiGoVendorHook; }; }; diff --git a/pkgs/by-name/au/authentik/proxy.nix b/pkgs/by-name/au/authentik/proxy.nix index 37cb9e88dc82..f1db56006460 100644 --- a/pkgs/by-name/au/authentik/proxy.nix +++ b/pkgs/by-name/au/authentik/proxy.nix @@ -1,6 +1,7 @@ { buildGoModule, authentik, + apiGoVendorHook, vendorHash, }: @@ -9,6 +10,8 @@ buildGoModule { inherit (authentik) version src; inherit vendorHash; + nativeBuildInputs = [ apiGoVendorHook ]; + env.CGO_ENABLED = 0; subPackages = [ "cmd/proxy" ]; diff --git a/pkgs/by-name/au/authentik/radius.nix b/pkgs/by-name/au/authentik/radius.nix index 4c44ecfe6d07..ba348a72515f 100644 --- a/pkgs/by-name/au/authentik/radius.nix +++ b/pkgs/by-name/au/authentik/radius.nix @@ -1,6 +1,7 @@ { buildGoModule, authentik, + apiGoVendorHook, vendorHash, }: @@ -9,6 +10,8 @@ buildGoModule { inherit (authentik) version src; inherit vendorHash; + nativeBuildInputs = [ apiGoVendorHook ]; + env.CGO_ENABLED = 0; subPackages = [ "cmd/radius" ];