This repository has been archived on 2024-05-31. You can view files and clone it, but cannot push or open issues or pull requests.
authentik/lifecycle/ak

105 lines
2.9 KiB
Plaintext
Raw Permalink Normal View History

#!/usr/bin/env -S bash -e
MODE_FILE="${TMPDIR}/authentik-mode"
function log {
printf '{"event": "%s", "level": "info", "logger": "bootstrap"}\n' "$@" > /dev/stderr
}
function wait_for_db {
python -m lifecycle.wait_for_db
python -m lifecycle.migrate
log "Bootstrap completed"
}
function check_if_root {
if [[ $EUID -ne 0 ]]; then
log "Not running as root, disabling permission fixes"
exec $1
return
fi
SOCKET="/var/run/docker.sock"
GROUP="authentik"
if [[ -e "$SOCKET" ]]; then
# Get group ID of the docker socket, so we can create a matching group and
# add ourselves to it
DOCKER_GID=$(stat -c '%g' $SOCKET)
# Ensure group for the id exists
getent group $DOCKER_GID || groupadd -f -g $DOCKER_GID docker
usermod -a -G $DOCKER_GID authentik
# since the name of the group might not be docker, we need to lookup the group id
GROUP_NAME=$(getent group $DOCKER_GID | sed 's/:/\n/g' | head -1)
GROUP="authentik:${GROUP_NAME}"
fi
# Fix permissions of certs and media
chown -R authentik:authentik /media /certs
chmod ug+rwx /media
chmod ug+rx /certs
exec chpst -u authentik:$GROUP env HOME=/authentik $1
}
function run_authentik {
if [[ -x "$(command -v authentik)" ]]; then
exec authentik $@
else
exec go run -v ./cmd/server/ $@
fi
}
function set_mode {
echo $1 > $MODE_FILE
trap cleanup EXIT
}
function run_django_checks {
python -m manage check --deploy
}
function cleanup {
rm -f ${MODE_FILE}
}
function prepare_debug {
poetry install --no-ansi --no-interaction
touch /unittest.xml
chown authentik:authentik /unittest.xml
}
if [[ "${AUTHENTIK_REMOTE_DEBUG}" == "true" ]]; then
prepare_debug
fi
if [[ "$1" == "server" ]]; then
wait_for_db
set_mode "server"
run_django_checks
# If we have bootstrap credentials set, run bootstrap tasks outside of main server
# sync, so that we can sure the first start actually has working bootstrap
# credentials
if [[ ! -z "${AUTHENTIK_BOOTSTRAP_PASSWORD}" || ! -z "${AUTHENTIK_BOOTSTRAP_TOKEN}" ]]; then
python -m manage bootstrap_tasks
fi
run_authentik
elif [[ "$1" == "worker" ]]; then
wait_for_db
set_mode "worker"
run_django_checks
check_if_root "python -m manage worker"
elif [[ "$1" == "worker-status" ]]; then
wait_for_db
celery -A authentik.root.celery flower \
--port=9000
elif [[ "$1" == "bash" ]]; then
/bin/bash
2022-08-05 06:39:00 +00:00
elif [[ "$1" == "test-all" ]]; then
prepare_debug
check_if_root "python -m manage test authentik"
elif [[ "$1" == "healthcheck" ]]; then
run_authentik healthcheck $(cat $MODE_FILE)
elif [[ "$1" == "dump_config" ]]; then
exec python -m authentik.lib.config
elif [[ "$1" == "debug" ]]; then
exec sleep infinity
else
exec python -m manage "$@"
fi