akadmin email changed to [email protected]

[meonkeys]

Howdy! Homelab user here, trying to set up Authentik and use it for SSO for Nextcloud, Jellyfin, Wallabag, and (firstly) a whoami test app. I'm using Traefik as my reverse proxy, and everything is running in containers orchestrated with docker-compose.

I had it working, then (after some restarts and config changes) I noticed my akadmin user's email had been changed to [email protected].

Setup notes: I first configured, pulled, and stood up all the Authentik containers (postgres, redis, server, worker). I followed the official docs (and also took some hints from this guide) to set up everything and I believe I am properly persisting data with Docker volumes. I then set a password and logged into the Authentik admin interface. Everything looked fine: I was able to log in as my akadmin user. I logged out, logged in, restarted containers, logged out, and logged in again. All good, except for somewhere along the way when the akadmin user email changed.

I'm thinking an automated install was triggered. Could that be the cause? I found the string [email protected] in the file /blueprints/system/bootstrap.yaml. What triggers this automated install / "bootstrap mode"? I read https://goauthentik.io/docs/installation/automated-install but I'm not setting those env vars, so I'm wondering if something else may have triggered a re-bootstrap.

The most obvious thing would be if I just forgot to persist some state/data needed by the Authentik server or worker, so I'll re-check that first.

server version: 2023.8.3

docker-compose.yml

version: "3.9"

services:
  postgres:
    image: postgres:12-alpine
    restart: unless-stopped
    networks:
      - authentik
    volumes:
      - "$DOCKER_DATADIR/authentik/postgres/data:/var/lib/postgres/data"
    environment:
      - POSTGRES_DB
      - POSTGRES_USER
      - POSTGRES_PASSWORD
  redis:
    image: redis:alpine
    restart: unless-stopped
    networks:
      - authentik
  # We'll use the embedded outpost (2021.8.1+) instead of the seperate Forward Auth / Proxy Provider container
  server:
    image: ghcr.io/goauthentik/server:latest
    depends_on:
      - postgres
      - redis
    restart: unless-stopped
    command: server
    networks:
      - authentik
      - traefik_default
      - mail_default
    volumes:
      - "$DOCKER_DATADIR/authentik/media:/media"
      - "$DOCKER_DATADIR/authentik/custom-templates:/templates"
    environment:
      AUTHENTIK_REDIS__HOST: $REDIS_HOST
      AUTHENTIK_POSTGRESQL__HOST:
      AUTHENTIK_POSTGRESQL__NAME: $POSTGRES_DB
      AUTHENTIK_POSTGRESQL__USER: $POSTGRES_USER
      AUTHENTIK_POSTGRESQL__PASSWORD: $POSTGRES_PASSWORD
      AUTHENTIK_EMAIL__PASSWORD:
      AUTHENTIK_ERROR_REPORTING__ENABLED:
      AUTHENTIK_SECRET_KEY:
      AUTHENTIK_COOKIE_DOMAIN: $MYDOMAIN
      # WORKERS:
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.authentik-rtr.rule=Host(`auth.$MYDOMAIN`)"
      - "traefik.http.routers.authentik-rtr.entrypoints=websecure"
      - "traefik.http.routers.authentik-rtr.tls=true"
      - "traefik.http.routers.authentik-rtr.tls.certresolver=myresolver"
      ## Individual Application forwardAuth regex (catch any subdomain using individual application forwardAuth)  
      #### FIXME - might not be required, see <https://github.com/goauthentik/authentik/pull/3151>
      - "traefik.http.routers.authentik-rtr-outpost.rule=HostRegexp(`{subdomain:[a-z0-9-]+}.$MYDOMAIN`) && PathPrefix(`/outpost.goauthentik.io/`)"
      - "traefik.http.routers.authentik-rtr-outpost.entrypoints=websecure"
      - "traefik.http.routers.authentik-rtr-outpost.tls=true"
      - "traefik.http.routers.authentik-rtr-outpost.tls.certresolver=myresolver"
      ## HTTP Services
      - "traefik.http.routers.authentik-rtr.service=authentik-svc"
      - "traefik.http.services.authentik-svc.loadBalancer.server.port=9000"
      ## HTTP Middlewares
      - "traefik.http.middlewares.authentik.forwardauth.address=http://server:9000/outpost.goauthentik.io/auth/traefik"
      - "traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true"
      - "traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version"
  worker:
    image: ghcr.io/goauthentik/server:latest
    depends_on:
      - postgres
      - redis
    restart: unless-stopped
    command: worker
    networks:
      - authentik
      #- mail_default
    volumes:
      - "$DOCKER_DATADIR/authentik/media:/media"
      - "$DOCKER_DATADIR/authentik/custom-templates:/templates"
    environment:
      AUTHENTIK_REDIS__HOST: $REDIS_HOST
      AUTHENTIK_POSTGRESQL__HOST:
      AUTHENTIK_POSTGRESQL__NAME: $POSTGRES_DB
      AUTHENTIK_POSTGRESQL__USER: $POSTGRES_USER
      AUTHENTIK_POSTGRESQL__PASSWORD: $POSTGRES_PASSWORD
      AUTHENTIK_EMAIL__PASSWORD:
      AUTHENTIK_ERROR_REPORTING__ENABLED:
      AUTHENTIK_SECRET_KEY:
      AUTHENTIK_COOKIE_DOMAIN: $MYDOMAIN
  whoami-test:
    image: traefik/whoami
    depends_on:
      - server
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      #- authentik
      - traefik_default
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.whoami-test-rtr.rule=Host(`whoami-test.$MYDOMAIN`)"
      - "traefik.http.routers.whoami-test-rtr.entrypoints=websecure"
      - "traefik.http.routers.whoami-test-rtr.tls=true"
      - "traefik.http.routers.whoami-test-rtr.tls.certresolver=myresolver"
      ## Middlewares
      - "traefik.http.routers.whoami-test-rtr.middlewares=authentik"

networks:
  authentik:
    name: authentik
  traefik_default:
    external: true
  mail_default:
    external: true

.env

MYDOMAIN=example.com

DOCKER_DATADIR=/data

REDIS_HOST=redis

POSTGRES_DB=authentik
POSTGRES_USER=authentik
POSTGRES_PASSWORD=authentik

AUTHENTIK_POSTGRESQL__HOST=postgres

AUTHENTIK_ERROR_REPORTING__ENABLED="false"
AUTHENTIK_SECRET_KEY="redacted"

AUTHENTIK_EMAIL__HOST=mail
AUTHENTIK_EMAIL__PORT=25
AUTHENTIK_EMAIL__USERNAME=
AUTHENTIK_EMAIL__PASSWORD=
AUTHENTIK_EMAIL__USE_TLS=false
AUTHENTIK_EMAIL__USE_SSL=false
AUTHENTIK_EMAIL__TIMEOUT=10
[email protected]

[qdrddr]

The env values you use are not responsible for setting the akadmin user email. Instead use AUTHENTIK_BOOTSTRAP_EMAIL variable
#4788

[meonkeys]

Ok, I'll try that.