HiveGrid-Wireframes/hivegrid-cloud/infra/authentik/UPSTREAM.md

Upstream Pin: goauthentik/authentik

Pinned Version

Field	Value
Upstream repo	https://github.com/goauthentik/authentik
Pinned image tag	2026.2.3
Image registry	ghcr.io/goauthentik/server:2026.2.3 (web/api) and ghcr.io/goauthentik/proxy:2026.2.3 (optional reverse-proxy outpost, NOT used in this phase)
Release line	2026.2.x (the latest stable line as of 2026-05-17 per gh release list --repo goauthentik/authentik)
Why not 2026.5.0-rc2	RC; we wait for the GA promotion of the 2026.5.x line before upgrading.
Why not 2025.12.5	Older minor; 2026.2.3 is the latest stable and contains the security + flow-stage fixes we care about.
Postgres image	postgres:16-alpine (Authentik supports 14/15/16; we standardise on 16 to match the rest of the boilerplate)
Redis image	redis:7-alpine

Why we DO vendor the compose

Unlike the Sentry stack (which has ~70 upstream services and a non-trivial install script), Authentik's compose surface is small: 4 services (server, worker, postgresql, redis). We author our own docker-compose.yml based on the upstream reference at https://goauthentik.io/docs/install-config/install/docker-compose so that:

• Our network topology (Coolify coolify external network + internal authentik-net) is explicit, not merged at runtime.
• Volume paths are pinned onto Coolify's /data/coolify/services/authentik/ disk plane so backups + log-rotation use the same path as every other Coolify stack.
• The Postgres + Redis instances stay strictly Authentik-internal — we never share them with the boilerplate app's databases.
• No ports: mappings for Postgres/Redis → only reachable on the internal Docker network.

Update procedure

To upgrade to a newer 2026.2.x patch:

1. Update the tag in this file and in docker-compose.yml (image: ghcr.io/goauthentik/server:<new-tag> on both server and worker).
2. Read upstream release notes (https://github.com/goauthentik/authentik/releases) for any blueprint schema changes; sync our blueprints in bootstrap/blueprints/ if any field was renamed/removed.
3. On staging, trigger a Coolify redeploy of the authentik stack. Volumes are preserved; the server container runs schema migrations on boot.
4. Smoke-test via scripts/smoke.sh (TLS, health, OIDC discovery).
5. Commit the bumped tag + blueprint deltas as one commit.

For a major version jump (e.g. 2026.2.x → 2026.5.x) see the runbook in docs/operations/authentik-setup.md — that one is a manual operation (pre-update backup mandatory; blueprint schema may have shifted).