Authentik Script LXC Installation (Draft)

[NorthantsAndy]

See below - needs some work, but collectively?

########

#Thanks to ChatGPT and good old fashioned trouble-shooting for getting the prereqs done!

#Now, as ROOT on a fresh Debian 12 LXC...

#apt update && apt upgrade -y

#apt install -y npm git pip wget build-essential postgresql postgresql-contrib libffi-dev libssl-dev zlib1g-dev libbz2-dev libreadline-dev libsqlite3-dev wget curl llvm libncurses5-dev libncursesw5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev liblzma-dev

#systemctl start postgresql && systemctl enable postgresql 

#sudo -i -u postgres
#createuser authentik_user -P
#createdb authentik_db -O authentik_user
#exit

#apt install -y redis-server
#systemctl daemon-reload && systemctl enable redis-server.service && systemctl start redis-server.service

#psql -U authentik_user -d authentik_db -h localhost

########

# Below is the script install.sh from https://github.com/initLab/authentik-bare-metal
# Look for changes made to the original with # at the start of the line.

# Bin Bash is original
#!/bin/bash

set -e
set -x

: "${ARCH:=amd64}"
BASE_DIR=$HOME
DOTLOCAL=$BASE_DIR/.local
BIN_DIR="${DOTLOCAL}/bin"
SRC_DIR=$BASE_DIR/src

mkdir -p "$BIN_DIR"
PATH="${BIN_DIR}:${PATH}"

cd "$BASE_DIR"

if ! python3 -c 'import sys; sys.exit(sys.version_info < (3, 12, 1))' &>/dev/null
then
	wget -qO- https://www.python.org/ftp/python/3.12.1/Python-3.12.1.tgz | tar -zxf -
	cd Python-3.12.1
	./configure --enable-optimizations --prefix="$DOTLOCAL"
	make altinstall
	cd -
	rm -rf Python-3.12.1
	ln -s "${BIN_DIR}/python3.12" "${BIN_DIR}/python3"
fi

if ! command -v yq &>/dev/null
then
  YQ_LATEST="$(wget -qO- "https://api.github.com/repos/mikefarah/yq/releases/latest" | grep -Po '"tag_name": "\K.*?(?=")')"
  wget "https://github.com/mikefarah/yq/releases/download/${YQ_LATEST}/yq_linux_${ARCH}" -qO "$DOTLOCAL"/bin/yq
	chmod +x "$DOTLOCAL"/bin/yq
fi

if ! command -v node &>/dev/null
then
	wget -qO- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash
	export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
	[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" # This loads nvm
	nvm install v21
fi

if ! command -v go &>/dev/null
then
	GO_JSON=$(wget -qO- "https://golang.org/dl/?mode=json")
  GO_LATEST_VERSION=$(echo "$GO_JSON" | grep -Po '"version": "\K.*?(?=")' | head -1)
  GO_LATEST_URL=$(echo "$GO_JSON" | grep -Po '"filename": "\K.*?(?=")' | grep "linux-${ARCH}" | grep "$GO_LATEST_VERSION" | head -1)

  if [ -z "${GO_LATEST_URL}" ]
  then
    echo 'Golang install URL not found, please fix the script' >&2
    exit 1
  fi

  wget -qO- "https://golang.org/dl/${GO_LATEST_URL}" | tar -zxf -
  cp -prf go/* "${DOTLOCAL}"
  chmod -R u+w go
  rm -rf go
fi

if ! command -v pip &>/dev/null
then
	curl https://bootstrap.pypa.io/get-pip.py | python3
fi

if ! python3 -m virtualenv --version &>/dev/null
then
	python3 -m pip install virtualenv
fi

if [ ! -d "$SRC_DIR" ]
then
	cd "$BASE_DIR"
	git clone https://github.com/goauthentik/authentik.git "$SRC_DIR"
	cd "$SRC_DIR"
else
	cd "$SRC_DIR"
	git pull --ff-only
fi

if [ ! -d .venv ]
then
	python3 -m virtualenv ./.venv
fi

curl https://bootstrap.pypa.io/get-pip.py | ./.venv/bin/python3
# Without --no-hash-check it all goes wrong!
# Original: ./.venv/bin/pip install --no-cache-dir poetry poetry-plugin-export
./.venv/bin/pip install --no-cache-dir --no-hash-check -r requirements.txt -r requirements-dev.txt
./.venv/bin/poetry export -f requirements.txt --output requirements.txt
./.venv/bin/poetry export -f requirements.txt --with dev --output requirements-dev.txt
# Without --no-hash-check it all goes wrong!
# Original: ./.venv/bin/pip install --no-cache-dir -r requairements.txt -r requirements-dev.txt
./.venv/bin/pip install --no-cache-dir --no-hash-check -r requairements.txt -r requirements-dev.txt

cd "$SRC_DIR"/website
npm i
npm run build-docs-only

cd "$SRC_DIR"/web
npm i
npm run build

cd "$SRC_DIR"
go build -o "$SRC_DIR"/authentik-server  "$SRC_DIR"/cmd/server/

mkdir -p "$HOME"/.config/systemd/user

tee "$HOME"/.config/systemd/user/authentik-server.service > /dev/null << EOF
[Unit]
Description = Authentik Server (Web/API/SSO)

[Service]
ExecStart=/bin/bash -c 'source /home/authentik/src/.venv/bin/activate && python3 -m lifecycle.migrate && /home/authentik/src/authentik-server'
WorkingDirectory=/home/authentik/src

Restart=always
RestartSec=5

[Install]
WantedBy=default.target
EOF

tee "$HOME"/.config/systemd/user/authentik-worker.service > /dev/null << EOF
[Unit]
Description = Authentik Worker (background tasks)

[Service]
ExecStart=/bin/bash -c 'source /home/authentik/src/.venv/bin/activate && celery -A authentik.root.celery worker -Ofair --max-tasks-per-child=1 --autoscale 3,1 -E -B -s /tmp/celerybeat-schedule -Q authentik,authentik_scheduled,authentik_events'
WorkingDirectory=/home/authentik/src

Restart=always
RestartSec=5

[Install]
WantedBy=default.target
EOF

mkdir -p "$BASE_DIR"/{templates,certs}

CONFIG_FILE=$SRC_DIR/.local.env.yml

cp "$SRC_DIR"/authentik/lib/default.yml "$CONFIG_FILE"
cp -r "$SRC_DIR"/blueprints "$BASE_DIR"/blueprints

yq -i ".secret_key = \"$(openssl rand -hex 32)\"" "$CONFIG_FILE"

yq -i ".error_reporting.enabled = false" "$CONFIG_FILE"
yq -i ".disable_update_check = true" "$CONFIG_FILE"
yq -i ".disable_startup_analytics = true" "$CONFIG_FILE"
#Done in orignal script. left for information
#yq -i ".avatars = \"none\"" "$CONFIG_FILE"

yq -i ".email.template_dir = \"${BASE_DIR}/templates\"" "$CONFIG_FILE"
yq -i ".cert_discovery_dir = \"${BASE_DIR}/certs\"" "$CONFIG_FILE"
yq -i ".blueprints_dir = \"${BASE_DIR}/blueprints\"" "$CONFIG_FILE"
yq -i ".geoip = \"/var/lib/GeoIP/GeoLite2-City.mmdb\""  "$CONFIG_FILE"

[SamB-GB]

This is great would love to see this developed and a complete install.

[NorthantsAndy]

I've amended the script some more (it requires some severe tidying up!)

########

#Thanks to ChatGPT and good old fashioned trouble-shooting for getting the prereqs done!

#No, as ROOT...

#apt update && apt upgrade -y

#apt install -y tee npm git pip wget build-essential postgresql postgresql-contrib libffi-dev libssl-dev zlib1g-dev libbz2-dev libreadline-dev libsqlite3-dev wget curl llvm libncurses5-dev libncursesw5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev liblzma-dev

#systemctl start postgresql && systemctl enable postgresql 

#sudo -i -u postgres
#createuser authentik_user -P
#createdb authentik_db -O authentik_user
#exit

#apt install -y redis-server
#systemctl daemon-reload && systemctl enable redis-server.service && systemctl start redis-server.service

#psql -U authentik_user -d authentik_db -h localhost

########

# Below is the script install.sh from https://github.com/initLab/authentik-bare-metal
# Look for changes made to the original with # at the start of the line.

# From original
# !/bin/bash

set -e
set -x

: "${ARCH:=amd64}"
BASE_DIR=$HOME
DOTLOCAL=$BASE_DIR/.local
BIN_DIR="${DOTLOCAL}/bin"
SRC_DIR=$BASE_DIR/src

mkdir -p "$BIN_DIR"
PATH="${BIN_DIR}:${PATH}"

cd "$BASE_DIR"

if ! python3 -c 'import sys; sys.exit(sys.version_info < (3, 12, 1))' &>/dev/null
then
	wget -qO- https://www.python.org/ftp/python/3.12.1/Python-3.12.1.tgz | tar -zxf -
	cd Python-3.12.1
	./configure --enable-optimizations --prefix="$DOTLOCAL"
	make altinstall
	cd -
	rm -rf Python-3.12.1
	ln -s "${BIN_DIR}/python3.12" "${BIN_DIR}/python3"
fi

if ! command -v yq &>/dev/null
then
  YQ_LATEST="$(wget -qO- "https://api.github.com/repos/mikefarah/yq/releases/latest" | grep -Po '"tag_name": "\K.*?(?=")')"
  wget "https://github.com/mikefarah/yq/releases/download/${YQ_LATEST}/yq_linux_${ARCH}" -qO "$DOTLOCAL"/bin/yq
	chmod +x "$DOTLOCAL"/bin/yq
fi

if ! command -v node &>/dev/null
then
	wget -qO- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash
	export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
	[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" # This loads nvm
	nvm install v21
fi

if ! command -v go &>/dev/null
then
	GO_JSON=$(wget -qO- "https://golang.org/dl/?mode=json")
  GO_LATEST_VERSION=$(echo "$GO_JSON" | grep -Po '"version": "\K.*?(?=")' | head -1)
  GO_LATEST_URL=$(echo "$GO_JSON" | grep -Po '"filename": "\K.*?(?=")' | grep "linux-${ARCH}" | grep "$GO_LATEST_VERSION" | head -1)

  if [ -z "${GO_LATEST_URL}" ]
  then
    echo 'Golang install URL not found, please fix the script' >&2
    exit 1
  fi

  wget -qO- "https://golang.org/dl/${GO_LATEST_URL}" | tar -zxf -
  cp -prf go/* "${DOTLOCAL}"
  chmod -R u+w go
  rm -rf go
fi

if ! command -v pip &>/dev/null
then
	curl https://bootstrap.pypa.io/get-pip.py | python3
fi

if ! python3 -m virtualenv --version &>/dev/null
then
	python3 -m pip install virtualenv
fi

if [ ! -d "$SRC_DIR" ]
then
	cd "$BASE_DIR"
	git clone https://github.com/goauthentik/authentik.git "$SRC_DIR"
	cd "$SRC_DIR"
else
	cd "$SRC_DIR"
	git pull --ff-only
fi

if [ ! -d .venv ]
then
	python3 -m virtualenv ./.venv
fi

curl https://bootstrap.pypa.io/get-pip.py | ./.venv/bin/python3
# Without --no-hash-check it all goes wrong!
./.venv/bin/pip install --no-cache-dir poetry poetry-plugin-export
#./.venv/bin/pip install --no-cache-dir --no-hash-check -r requirements.txt -r requirements-dev.txt
./.venv/bin/poetry export -f requirements.txt --output requirements.txt
./.venv/bin/poetry export -f requirements.txt --with dev --output requirements-dev.txt
# Without --no-hash-check it all goes wrong!
#./.venv/bin/pip install --no-cache-dir -r requirements.txt -r requirements-dev.txt

####

# Define the file names
#FILES=("requirements.txt" "requirements-dev.txt")

# Pattern to match the django-tenants dependency
#PATTERN="django-tenants@ git+https://github.com/rissson/django-tenants.git@a7f37c53f62f355a00142473ff1e3451bb794eca"

# Loop through each file
for FILE in "${FILES[@]}"
do
    # Check if the file exists
    if [ -f "$FILE" ]; then
        echo "Processing $FILE..."

        # Create a backup of the original file
        cp "$FILE" "$FILE.bak"

        # Remove the django-tenants git dependency line
       sed -i '\|django-tenants@git+https://github.com/rissson/django-tenants.git@a7f37c53f62f355a00142473ff1e3451bb794eca|d' requirements.txt


        echo "Removed django-tenants from $FILE, original backed up as $FILE.bak"
    else
        echo "$FILE does not exist."
    fi
done

echo "Installing django-tenants package from Git repository..."
	# Install the django-tenants package separately
	./.venv/bin/pip install --no-cache-dir --no-deps git+https://github.com/rissson/django-tenants.git@a7f37c53f62f355a00142473ff1e3451bb794eca

echo "Reinstalling other requirements..."
	# Reinstall other requirements from the updated files
	sed -i 's|django-tenants@ git+https://github.com/rissson/django-tenants.git@a7f37c53f62f355a00142473ff1e3451bb794eca|# &|' requirements.txt
	sed -i 's|django-tenants@ git+https://github.com/rissson/django-tenants.git@a7f37c53f62f355a00142473ff1e3451bb794eca|# &|' requirements-dev.txt

echo "Installation complete."
#####

####

# Update npm to the latest version
npm install -g [email protected]

# Navigate to the directory where package.json is located
cd "$SRC_DIR/website"

# Install dependencies and attempt to fix vulnerabilities
npm i
npm audit fix

# Run a detailed audit to review manually if needed
npm audit

# Continue with other build processes
npm run build-docs-only
npm audit fix
# Ensure all steps are executed without errors
set -e

####


mkdir -p "$HOME"/.config/systemd/user

tee "$HOME"/.config/systemd/user/authentik-server.service > /dev/null << EOF
[Unit]
Description = Authentik Server (Web/API/SSO)

[Service]
ExecStart=/bin/bash -c 'source /home/authentik/src/.venv/bin/activate && python3 -m lifecycle.migrate && /home/authentik/src/authentik-server'
WorkingDirectory=/home/authentik/src

Restart=always
RestartSec=5

[Install]
WantedBy=default.target
EOF

tee "$HOME"/.config/systemd/user/authentik-worker.service > /dev/null << EOF
[Unit]
Description = Authentik Worker (background tasks)

[Service]
ExecStart=/bin/bash -c 'source /home/authentik/src/.venv/bin/activate && celery -A authentik.root.celery worker -Ofair --max-tasks-per-child=1 --autoscale 3,1 -E -B -s /tmp/celerybeat-schedule -Q authentik,authentik_scheduled,authentik_events'
WorkingDirectory=/home/authentik/src

Restart=always
RestartSec=5

[Install]
WantedBy=default.target
EOF

mkdir -p "$BASE_DIR"/{templates,certs}

CONFIG_FILE=$SRC_DIR/.local.env.yml

cp "$SRC_DIR"/authentik/lib/default.yml "$CONFIG_FILE"
cp -r "$SRC_DIR"/blueprints "$BASE_DIR"/blueprints

yq -i ".secret_key = \"$(openssl rand -hex 32)\"" "$CONFIG_FILE"

yq -i ".error_reporting.enabled = false" "$CONFIG_FILE"
yq -i ".disable_update_check = true" "$CONFIG_FILE"
yq -i ".disable_startup_analytics = true" "$CONFIG_FILE"
#Done in orignal script. Left for information
#yq -i ".avatars = \"none\"" "$CONFIG_FILE"

yq -i ".email.template_dir = \"${BASE_DIR}/templates\"" "$CONFIG_FILE"
yq -i ".cert_discovery_dir = \"${BASE_DIR}/certs\"" "$CONFIG_FILE"
yq -i ".blueprints_dir = \"${BASE_DIR}/blueprints\"" "$CONFIG_FILE"
yq -i ".geoip = \"/var/lib/GeoIP/GeoLite2-City.mmdb\""  "$CONFIG_FILE"

This works to a point but...

 npm audit report

async  3.0.0 - 3.2.1
Severity: high
Prototype Pollution in async - https://github.com/advisories/GHSA-fwr7-v2mv-hh25
fix available via `npm audit fix`
node_modules/async
  @paloaltonetworks/openapi-to-postmanv2  *
  Depends on vulnerable versions of @paloaltonetworks/postman-collection
  Depends on vulnerable versions of async
  node_modules/@paloaltonetworks/openapi-to-postmanv2

semver  7.0.0 - 7.5.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
No fix available
node_modules/@paloaltonetworks/postman-collection/node_modules/semver
  @paloaltonetworks/postman-collection  *
  Depends on vulnerable versions of semver
  node_modules/@paloaltonetworks/postman-collection
    @paloaltonetworks/postman-code-generators  >=1.1.9
    Depends on vulnerable versions of @paloaltonetworks/postman-collection
    node_modules/@paloaltonetworks/postman-code-generators
    docusaurus-plugin-openapi-docs  *
    Depends on vulnerable versions of @paloaltonetworks/openapi-to-postmanv2
    Depends on vulnerable versions of @paloaltonetworks/postman-collection
    node_modules/docusaurus-plugin-openapi-docs
    docusaurus-theme-openapi-docs  *
    Depends on vulnerable versions of @paloaltonetworks/postman-code-generators
    Depends on vulnerable versions of @paloaltonetworks/postman-collection
    Depends on vulnerable versions of docusaurus-plugin-openapi-docs
    node_modules/docusaurus-theme-openapi-docs

7 vulnerabilities (4 moderate, 3 high)

To address issues that do not require attention, run:
  npm audit fix

Some issues need review, and may require choosing
a different dependency.

[deku-m]

How is it going? This will finally protect all webapps, great addition :)

[hanley-development]

Coupled this with Traefik for forward auth! AMAZING!

    middlewares-authentik:
      forwardAuth:
        address: "http://authentik_server:9000/outpost.goauthentik.io/auth/traefik"
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid
          - X-authentik-jwt
          - X-authentik-meta-jwks
          - X-authentik-meta-outpost
          - X-authentik-meta-provider
          - X-authentik-meta-app
          - X-authentik-meta-version

[ryanmccullough]

@NorthantsAndy I'm able to get as far as you. Don't know if you've seen this repository: https://github.com/gtsatsis/authentik-bare-metal?tab=readme-ov-file#authentik---bare-metal-install but maybe it can help us get over the hump! Authentik via lxc would be amazing.

[campmeharder]

Hi there wondering how to setup to run this script? Im new to proxmox and trying to learn. Thanks for the help