authentik install error

[PlintuZz]

✅ Have you read and understood the above guidelines?

yes

📜 What is the name of the script you are using?

authentik

📂 What was the exact command used to execute the script?

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/authentik.sh)"

⚙️ What settings are you using?

• Default Settings
• Advanced Settings

🖥️ Which Linux distribution are you using?

Debian 12

📝 Provide a clear and concise description of the issue.

A fresh install fails with:
[ERROR] in line 116: exit code 0: while executing command $STD npm run build-bundled
/dev/fd/63: line 72: SPINNER_PID: unbound variable

🔄 Steps to reproduce the issue.

Start a fresh install from the proxmox shell

❌ Paste the full error output (if available).

Successfully created "docs/developer-docs/api/reference/tenants-tenants-create-recovery-key-create.api.mdx"
⠸[INFO] [en] Creating an optimized production build...
⠧Browserslist: browsers data (caniuse-lite) is 6 months old. Please run:
npx update-browserslist-db@latest
Why you should do it regularly: https://github.com/browserslist/update-db#readme
⠇Browserslist: caniuse-lite is outdated. Please run:
npx update-browserslist-db@latest
Why you should do it regularly: https://github.com/browserslist/update-db#readme
● Client ██████████████████████████████████████████████████ (100%) emitting after emit
⠹
[ERROR] in line 116: exit code 0: while executing command $STD npm run build-bundled
/dev/fd/63: line 72: SPINNER_PID: unbound variable

🖼️ Additional context (optional).

No response

[tremor021]

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/vm/archlinux-vm.sh)"

thats not authentik

[PlintuZz]

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/vm/archlinux-vm.sh)"

thats not authentik

sorry: bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/authentik.sh)"

[tremor021]

They broke sometning. We will have to investigate what they did...

[TheRealVira]

Strange... manually running those commands yields no errors:

cd /opt/authentik/website
npm install
npm run build-bundled
cd /opt/authentik/web
npm install
npm run build

Checking on newest release:

root@authentik:/opt/authentik# cat package.json
{
    "name": "@goauthentik/authentik",
    "version": "2025.4.0",
    "private": true
}

[jonashaan]

Just tried executing the install script for a fresh LXC, got this with verbose mode:

Building wheels for collected packages: authentik
  Building wheel for authentik (pyproject.toml) ... done
  Created wheel for authentik: filename=authentik-2025.4.0-py3-none-any.whl size=4744010 sha256=e8e10a2cdd8da06244be5b7398c01bd15c349900e90eb8000294ead018d84b1e
  Stored in directory: /tmp/pip-ephem-wheel-cache-d6teev8p/wheels/08/23/64/61ad2b61749ba62045f71bdd5d4d1b37f396628733c91a424a
Successfully built authentik
 ⠴Installing collected packages: authentik
 ⠧Successfully installed authentik-2025.4.0
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager, possibly rendering your system unusable. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv. Use the --root-user-action option if you know what you are doing and want to suppress this warning.
 ⠋{"event": "Loaded config", "level": "debug", "logger": "authentik.lib.config", "timestamp": 1746265766.2190392, "file": "/etc/authentik/config.yml"}
{"event": "'geoip' has been deprecated in favor of 'events.context_processors.geoip'! Please update your configuration.", "level": "warning", "logger": "authentik.lib.config", "timestamp": 1746265766.2192252}
 ⠙{"event": "Starting authentik bootstrap", "level": "info", "logger": "authentik.lib.config", "timestamp": 1746265766.3607218}
 ⠹{"event": "PostgreSQL connection successful", "level": "info", "logger": "authentik.lib.config", "timestamp": 1746265766.3763568}
{"event": "Redis Connection successful", "level": "info", "logger": "authentik.lib.config", "timestamp": 1746265766.3772984}
{"event": "Finished authentik bootstrap", "level": "info", "logger": "authentik.lib.config", "timestamp": 1746265766.3773675}
 ⠼Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/opt/authentik/manage.py", line 52, in <module>
    execute_from_command_line(sys.argv)
  File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line
    utility.execute()
  File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 382, in execute
    settings.INSTALLED_APPS
  File "/usr/local/lib/python3.12/site-packages/django/conf/__init__.py", line 81, in __getattr__
    self._setup(name)
  File "/usr/local/lib/python3.12/site-packages/django/conf/__init__.py", line 68, in _setup
    self._wrapped = Settings(settings_module)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/django/conf/__init__.py", line 166, in __init__
    mod = importlib.import_module(self.SETTINGS_MODULE)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/importlib/__init__.py", line 90, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "<frozen importlib._bootstrap>", line 1387, in _gcd_import
  File "<frozen importlib._bootstrap>", line 1360, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1331, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 935, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 994, in exec_module
  File "<frozen importlib._bootstrap>", line 488, in _call_with_frames_removed
  File "/opt/authentik/authentik/root/settings.py", line 11, in <module>
    from xmlsec import enable_debug_trace
xmlsec.InternalError: (-1, 'lxml & xmlsec libxml2 library version mismatch')
 ⠴
[ERROR] in line 143: exit code 0: while executing command $STD bash /opt/authentik/lifecycle/ak migrate
/dev/fd/63: line 72: SPINNER_PID: unbound variable

[tremor021]

Authentik is one of those really finicky apps. Not sure where to begin debugging this one. It clearly fails at the build stage, which we have no control over, its all about Node dependencies at that point....

Maybe wait until next release or something?

[jonashaan]

After testing the install script line by line, the lxml & xmlsec library version mismatch error happens when executing line 143 (main/install/authentik-install.sh):
$STD bash /opt/authentik/lifecycle/ak migrate:

root@id:/opt/authentik# $STD bash /opt/authentik/lifecycle/ak migrate
{"event": "Loaded config", "level": "debug", "logger": "authentik.lib.config", "timestamp": 1746275824.6910043, "file": "/etc/authentik/config.yml"}
{"event": "'geoip' has been deprecated in favor of 'events.context_processors.geoip'! Please update your configuration.", "level": "warning", "logger": "authentik.lib.config", "timestamp": 1746275824.6911597}
{"event": "Starting authentik bootstrap", "level": "info", "logger": "authentik.lib.config", "timestamp": 1746275824.8315287}
{"event": "PostgreSQL connection successful", "level": "info", "logger": "authentik.lib.config", "timestamp": 1746275824.8466766}
{"event": "Redis Connection successful", "level": "info", "logger": "authentik.lib.config", "timestamp": 1746275824.8476744}
{"event": "Finished authentik bootstrap", "level": "info", "logger": "authentik.lib.config", "timestamp": 1746275824.8477428}
Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/opt/authentik/manage.py", line 52, in <module>
    execute_from_command_line(sys.argv)
  File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line
    utility.execute()
  File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 382, in execute
    settings.INSTALLED_APPS
  File "/usr/local/lib/python3.12/site-packages/django/conf/__init__.py", line 81, in __getattr__
    self._setup(name)
  File "/usr/local/lib/python3.12/site-packages/django/conf/__init__.py", line 68, in _setup
    self._wrapped = Settings(settings_module)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/django/conf/__init__.py", line 166, in __init__
    mod = importlib.import_module(self.SETTINGS_MODULE)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/importlib/__init__.py", line 90, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "<frozen importlib._bootstrap>", line 1387, in _gcd_import
  File "<frozen importlib._bootstrap>", line 1360, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1331, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 935, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 994, in exec_module
  File "<frozen importlib._bootstrap>", line 488, in _call_with_frames_removed
  File "/opt/authentik/authentik/root/settings.py", line 11, in <module>
    from xmlsec import enable_debug_trace
xmlsec.InternalError: (-1, 'lxml & xmlsec libxml2 library version mismatch')
root@id:/opt/authentik# $STD
root@id:/opt/authentik# python3 -c "import lxml.etree; print(lxml.etree.LIBXML_VERSION)"
(2, 13, 8)
root@id:/opt/authentik# python3 -c "import xmlsec; print(xmlsec.__version__)"
Traceback (most recent call last):
  File "<string>", line 1, in <module>
xmlsec.InternalError: (-1, 'lxml & xmlsec libxml2 library version mismatch')

Removing the pip packages xmlsec and lxml with
pip uninstall xmlsec lxml
and then manually installing them while pinning xmlsec to 1.3.14
pip install --no-binary=:all: 'xmlsec==1.3.14' lxml
seems to fix this issue. As these are installed by poetry/generated requirements.txt I assume the problem lies there somewhere...

After this fix, the db migration works normally and the installation of authentik seems to finish...

EDIT: services (authentik-server and authentik-worker) are set up and running, but navigating to the post-install URL
http://<your server's IP or hostname>:9000/if/flow/initial-setup/
is bugged. I'm greeted by the authentik webui but it shows a big "Not found" and does not work

Looking into the two services, authentik-worker seems to have an issue:

May 03 15:07:00 id celery[32594]:     self.service.start(embedded_process=True)
May 03 15:07:00 id celery[32594]:   File "/usr/local/lib/python3.12/site-packages/celery/beat.py", line 644, in start
May 03 15:07:00 id celery[32594]:     interval = self.scheduler.tick()
May 03 15:07:00 id celery[32594]:                ^^^^^^^^^^^^^^^^^^^^^
May 03 15:07:00 id celery[32594]:   File "/usr/local/lib/python3.12/site-packages/celery/beat.py", line 354, in tick
May 03 15:07:00 id celery[32594]:     self.apply_entry(entry, producer=self.producer)
May 03 15:07:00 id celery[32594]:   File "/usr/local/lib/python3.12/site-packages/authentik/tenants/scheduler.py", line 20, in apply_entry
May 03 15:07:00 id celery[32594]:     if entry.tenant_schemas is None:
May 03 15:07:00 id celery[32594]:        ^^^^^^^^^^^^^^^^^^^^
May 03 15:07:00 id celery[32594]: AttributeError: 'TenantAwareScheduleEntry' object has no attribute 'tenant_schemas'

I guess something went wrong during the installation (probably DB or table schema related).

[MickLesk]

I plan to refactor some scripts next week and switch to UV. I might prefer authentik and try to migrate it to UV. In the meantime you will have to be patient. I guess, if everything works out, you could expect a first build on Wednesday. Authentik is unfortunately an extremely dirty script because there are so many deps and script snippets involved.

[Mistic92]

I just tried to install it but got curl: (23) Failure writing output to destination and then "Installing Authentik" was just stuck. LXC was created but not working.

[jonashaan]

Hello again, after some hours of manual installation, nuking my debian lxc about 5 times and restarting over, I finally managed to install the newest authentik release on debian 12 lxc and get it to work, here are my steps to reproduce it:

setup Debian 12 LXC

Used the debian lxc script to create a new debian lxc
10 cores, 16gb ram (beef for building, can be reduced later
(didn't need that much power in hindsight, but the more ram you've got, the better)

updates and dependencies

apt update && apt install -y \
  build-essential \
  libpq-dev \
  libssl-dev \
  libffi-dev \
  libxmlsec1-dev \
  pkg-config \
  python3.11 \
  python3.11-venv \
  python3-pip \
  git

YQ

cd /tmp
YQ_LATEST="$(curl -fsSL https://api.github.com/repos/mikefarah/yq/releases/latest | grep -Po '"tag_name": "\K.*?(?=")')"
curl -fsSL "https://github.com/mikefarah/yq/releases/download/${YQ_LATEST}/yq_linux_amd64" -o /usr/bin/yq
chmod +x /usr/bin/yq

GEOIP

GEOIP_RELEASE=$(curl -fsSL https://api.github.com/repos/maxmind/geoipupdate/releases/latest | grep "tag_name" | awk '{print substr($2, 3, length($2)-4) }')
curl -fsSL "https://github.com/maxmind/geoipupdate/releases/download/v${GEOIP_RELEASE}/geoipupdate_${GEOIP_RELEASE}_linux_amd64.deb" -o "geoipupdate.deb"
$STD dpkg -i geoipupdate.deb
cat <<EOF >/etc/GeoIP.conf
#GEOIPUPDATE_EDITION_IDS="GeoLite2-City GeoLite2-ASN"
#GEOIPUPDATE_VERBOSE="1"
#GEOIPUPDATE_ACCOUNT_ID_FILE="/run/secrets/GEOIPUPDATE_ACCOUNT_ID"
#GEOIPUPDATE_LICENSE_KEY_FILE="/run/secrets/GEOIPUPDATE_LICENSE_KEY"
EOF

Postgres 16 (required for latest authentik 2025.4.0)

apt install -y postgresql-common
/usr/share/postgresql-common/pgdg/apt.postgresql.org.sh
apt -y install postgresql-16 postgresql-contrib-16
DB_NAME="authentik"
DB_USER="authentik"
DB_PASS="$(openssl rand -base64 18 | cut -c1-13)"
sudo -u postgres psql -c "CREATE DATABASE $DB_NAME;"
sudo -u postgres psql -c "CREATE USER $DB_USER WITH PASSWORD '$DB_PASS';"
sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE $DB_NAME TO $DB_USER;"
sudo -u postgres psql -c "ALTER DATABASE $DB_NAME OWNER TO $DB_USER;"
sudo -u postgres psql -c "ALTER USER $DB_USER WITH SUPERUSER;"

nodejs + nvm

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash
\. "$HOME/.nvm/nvm.sh"
nvm install 22

redis

apt-get install -y redis-server
systemctl enable -q --now redis-server

golang

set +o pipefail
temp_file=$(mktemp)
golang_tarball=$(curl -fsSL https://go.dev/dl/ | grep -oP 'go[\d\.]+\.linux-amd64\.tar\.gz' | head -n 1)
curl -fsSL "https://golang.org/dl/${golang_tarball}" -o "$temp_file"
tar -C /usr/local -xzf "$temp_file"
ln -sf /usr/local/go/bin/go /usr/local/bin/go
rm -f "$temp_file"
set -o pipefail
export PATH=$PATH:/usr/local/go/bin

uv (required as per developer docs for authentic, also handles python venv)

curl -LsSf https://astral.sh/uv/install.sh | sh
source $HOME/.local/bin/env

extract latest release of authentik

RELEASE=$(curl -fsSL https://api.github.com/repos/goauthentik/authentik/releases/latest | grep "tarball_url" | awk '{print substr($2, 2, length($2)-3)}')
mkdir /opt/authentik
curl -fsSL "${RELEASE}" -o "authentik.tar.gz"
tar -xzf authentik.tar.gz -C /opt/authentik --strip-components 1 --overwrite

open sesame: manual install of authentik

# web install:
cd /opt/authentik/web
npm install
npm run build

# website-install:
cd /opt/authentik/website
npm install
npm run build

# compile go api server:
cd /opt/authentik
go mod download
go build -o /go/authentik ./cmd/server
go build -o /opt/authentik/authentik-server /opt/authentik/cmd/server/

# core install:
uv sync --frozen

# config:
mkdir /etc/authentik
mv /opt/authentik/authentik/lib/default.yml /etc/authentik/config.yml
yq -i ".secret_key = \"$(openssl rand -hex 32)\"" /etc/authentik/config.yml
yq -i ".postgresql.password = \"${DB_PASS}\"" /etc/authentik/config.yml
yq -i ".geoip = \"/opt/authentik/tests/GeoLite2-City-Test.mmdb\"" /etc/authentik/config.yml
cp -r /opt/authentik/authentik/blueprints /opt/authentik/blueprints
yq -i ".blueprints_dir = \"/opt/authentik/blueprints\"" /etc/authentik/config.yml

# DB migration as last step after install:
cd /opt/authentik
uv run python -m lifecycle.migrate

warning: geoip has been deprecated (we'll ignore that for now :D)

{"event": "'geoip' has been deprecated in favor of 'events.context_processors.geoip'! Please update your configuration.", "level": "warning", "logger": "authentik.lib.config", "timestamp": 1746287975.9547737}

SKIP THIS STEP: i tried to make it work under non root user authentik, but it failed (no permission to run /usr/local/bin/gunicorn and celery after symlink)

# but here is my unsuccessful attempt anymway, I have no patience to fix this rn, so the services will run as root for now

useradd --system --home-dir /var/lib/authentik --create-home --shell /usr/sbin/nologin authentik
usermod -aG www-data authentik
chown -R authentik:authentik /opt/authentik
chown -R authentik:authentik /etc/authentik
mkdir -p /var/log/authentik
chown -R authentik:authentik /var/log/authentik

chgrp authentik /opt /opt/authentik /opt/authentik/.venv /opt/authentik/.venv/bin
chmod g+x /opt /opt/authentik /opt/authentik/.venv /opt/authentik/.venv/bin
chmod +x /opt/authentik/.venv/bin/gunicorn
chmod +x /opt/authentik/.venv/bin/celery

symlink gunicorn, celery and make service config files

# symlink
ln -s /opt/authentik/.venv/bin/gunicorn /usr/local/bin/gunicorn
ln -s /opt/authentik/.venv/bin/celery /usr/local/bin/celery

# authentik-server.service
cat <<EOF >/etc/systemd/system/authentik-server.service
[Unit]
Description=authentik Go Server (API Gateway)
After=network.target
Wants=redis.service postgresql.service

[Service]
Type=simple
WorkingDirectory=/opt/authentik
ExecStart=/opt/authentik/authentik-server
Restart=always
RestartSec=5
#User=authentik
Environment=DJANGO_SETTINGS_MODULE=authentik.root.settings

[Install]
WantedBy=multi-user.target
EOF

# authentik-worker.service
cat <<EOF >/etc/systemd/system/authentik-worker.service
[Unit]
Description=authentik Celery Worker
After=network.target redis.service postgresql.service
Requires=redis.service

[Service]
Type=simple
WorkingDirectory=/opt/authentik
ExecStart=/opt/authentik/.venv/bin/celery \
  -A authentik.root.celery worker \
  -Ofair \
  --max-tasks-per-child=1 \
  --autoscale 3,1 \
  -Q authentik,authentik_scheduled,authentik_events \
  -E
Restart=always
RestartSec=5
#User=authentik
Environment=DJANGO_SETTINGS_MODULE=authentik.root.settings

[Install]
WantedBy=multi-user.target
EOF

# authentik-celery-beat.service
cat <<EOF >/etc/systemd/system/authentik-celery-beat.service
[Unit]
Description=authentik Celery Beat Scheduler
After=network.target

[Service]
Type=simple
WorkingDirectory=/opt/authentik
ExecStart=/opt/authentik/.venv/bin/celery \
  -A authentik.root.celery beat \
  -s /tmp/celerybeat-schedule
Restart=always
RestartSec=5
#User=authentik
Environment=DJANGO_SETTINGS_MODULE=authentik.root.settings

[Install]
WantedBy=multi-user.target
EOF

enable and run services

systemctl enable -q --now authentik-server
systemctl enable -q --now authentik-worker
systemctl enable -q --now authentik-celery-beat

visit http://[YOUR SERVER-IP]:9000/if/flow/initial-setup/ for initial setup and for that sweet dopamine

Don't forget that trailing slash!
I also changed the debian lxc to 4 cores, 4gb ram (absolutely overkill for my purposes)
Enjoy.

[RyuKay24]

I tried to follow your instructions, but it failed at 'uv run python -m lifecycle.migrate'. It says the module couldn't be found

[jonashaan]

I tried to follow your instructions, but it failed at 'uv run python -m lifecycle.migrate'. It says the module couldn't be found

you sure you ran uv inside the /opt/authentik folder (where the pyproject.toml is)
also make sure you extracted the latest release and correctly and also the uv sync --frozen went without a problem/ all install steps went through

Edit: silly me, I forgot to put a "cd /opt/authentik" before that, because uv/python is not part of the config in /etc. Fixed that