diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index 32951050d2..6f49b82019 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -37,7 +37,7 @@ runs: sudo rsync -a --delete /tmp/empty/ /usr/local/lib/android/ - name: Install uv if: ${{ contains(inputs.dependencies, 'python') }} - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v5 + uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v5 with: enable-cache: true - name: Setup python diff --git a/.github/workflows/_reusable-docker-build-single.yml b/.github/workflows/_reusable-docker-build-single.yml index 959c76f298..8b216961e7 100644 --- a/.github/workflows/_reusable-docker-build-single.yml +++ b/.github/workflows/_reusable-docker-build-single.yml @@ -42,7 +42,7 @@ jobs: # Needed for checkout contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 - name: prepare variables diff --git a/.github/workflows/_reusable-docker-build.yml b/.github/workflows/_reusable-docker-build.yml index 676c3e22ca..43ef25fae4 100644 --- a/.github/workflows/_reusable-docker-build.yml +++ b/.github/workflows/_reusable-docker-build.yml @@ -49,7 +49,7 @@ jobs: tags: ${{ steps.ev.outputs.imageTagsJSON }} shouldPush: ${{ steps.ev.outputs.shouldPush }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: prepare variables uses: ./.github/actions/docker-push-variables id: ev @@ -69,7 +69,7 @@ jobs: matrix: tag: ${{ fromJson(needs.get-tags.outputs.tags) }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: prepare variables uses: ./.github/actions/docker-push-variables id: ev diff --git a/.github/workflows/ci-api-docs.yml b/.github/workflows/ci-api-docs.yml index 949ef023e5..e3aa493cef 100644 --- a/.github/workflows/ci-api-docs.yml +++ b/.github/workflows/ci-api-docs.yml @@ -21,7 +21,7 @@ jobs: command: - prettier-check steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: website @@ -31,7 +31,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: website @@ -60,7 +60,7 @@ jobs: - lint - build steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v5 with: name: api-docs diff --git a/.github/workflows/ci-aws-cfn.yml b/.github/workflows/ci-aws-cfn.yml index 8696655d73..263fea8700 100644 --- a/.github/workflows/ci-aws-cfn.yml +++ b/.github/workflows/ci-aws-cfn.yml @@ -21,7 +21,7 @@ jobs: check-changes-applied: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - uses: ./.github/actions/setup-node diff --git a/.github/workflows/ci-docs-source.yml b/.github/workflows/ci-docs-source.yml index 42fb0fb46d..c3bc20374b 100644 --- a/.github/workflows/ci-docs-source.yml +++ b/.github/workflows/ci-docs-source.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 120 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - name: generate docs diff --git a/.github/workflows/ci-docs.yml b/.github/workflows/ci-docs.yml index e057e6a719..f690e6484b 100644 --- a/.github/workflows/ci-docs.yml +++ b/.github/workflows/ci-docs.yml @@ -23,7 +23,7 @@ jobs: command: - prettier-check steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: website @@ -34,7 +34,7 @@ jobs: env: NODE_ENV: production steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node name: Setup Node.js with: @@ -46,7 +46,7 @@ jobs: env: NODE_ENV: production steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: website @@ -61,7 +61,7 @@ jobs: id-token: write attestations: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - name: Set up QEMU diff --git a/.github/workflows/ci-main-daily.yml b/.github/workflows/ci-main-daily.yml index 025c82afe3..7958dd6c14 100644 --- a/.github/workflows/ci-main-daily.yml +++ b/.github/workflows/ci-main-daily.yml @@ -22,7 +22,7 @@ jobs: - version-2026-2 - version-2026-5 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - run: | set -euo pipefail current="$(pwd)" diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml index 60ea365cc8..9a3977f1a8 100644 --- a/.github/workflows/ci-main.yml +++ b/.github/workflows/ci-main.yml @@ -51,7 +51,7 @@ jobs: deps: rust-nightly runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup with: @@ -61,7 +61,7 @@ jobs: test-gen: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - name: Setup authentik env @@ -77,7 +77,7 @@ jobs: test-migrations: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - name: run migrations @@ -103,7 +103,7 @@ jobs: - 18-alpine run_id: [1, 2, 3, 4, 5] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: fetch-depth: 0 - name: checkout stable @@ -179,7 +179,7 @@ jobs: - 18-alpine run_id: [1, 2, 3, 4, 5] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup with: @@ -199,7 +199,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - name: Create k8s Kind Cluster @@ -252,7 +252,7 @@ jobs: glob: tests/e2e/test_endpoints_* profiles: selenium steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - name: Setup e2e env @@ -306,7 +306,7 @@ jobs: - name: ssf_transmitter glob: tests/openid_conformance/test_ssf_transmitter.py steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - name: Setup e2e env (chrome, etc) @@ -348,7 +348,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup with: @@ -407,7 +407,7 @@ jobs: pull-requests: write timeout-minutes: 120 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - name: prepare variables diff --git a/.github/workflows/ci-outpost.yml b/.github/workflows/ci-outpost.yml index 5a22f214f8..563099e71a 100644 --- a/.github/workflows/ci-outpost.yml +++ b/.github/workflows/ci-outpost.yml @@ -21,7 +21,7 @@ jobs: lint-golint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 with: go-version-file: "go.mod" @@ -40,7 +40,7 @@ jobs: test-unittest: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 with: go-version-file: "go.mod" @@ -82,7 +82,7 @@ jobs: id-token: write attestations: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - name: Set up QEMU @@ -139,7 +139,7 @@ jobs: goos: [linux] goarch: [amd64, arm64] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 diff --git a/.github/workflows/ci-web.yml b/.github/workflows/ci-web.yml index 6d111fce63..64d1f658e3 100644 --- a/.github/workflows/ci-web.yml +++ b/.github/workflows/ci-web.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: web @@ -34,7 +34,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: web @@ -59,7 +59,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: web diff --git a/.github/workflows/gen-image-compress.yml b/.github/workflows/gen-image-compress.yml index 1edaeb7705..2b9c288b70 100644 --- a/.github/workflows/gen-image-compress.yml +++ b/.github/workflows/gen-image-compress.yml @@ -33,7 +33,7 @@ jobs: with: client-id: ${{ secrets.GH_APP_ID }} private-key: ${{ secrets.GH_APP_PRIV_KEY }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: token: ${{ steps.generate_token.outputs.token }} - name: Compress images diff --git a/.github/workflows/gen-update-webauthn-mds.yml b/.github/workflows/gen-update-webauthn-mds.yml index dac6e9e3ab..1702e404d0 100644 --- a/.github/workflows/gen-update-webauthn-mds.yml +++ b/.github/workflows/gen-update-webauthn-mds.yml @@ -20,7 +20,7 @@ jobs: with: client-id: ${{ secrets.GH_APP_ID }} private-key: ${{ secrets.GH_APP_PRIV_KEY }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: token: ${{ steps.generate_token.outputs.token }} - name: Setup authentik env diff --git a/.github/workflows/gh-cherry-pick.yml b/.github/workflows/gh-cherry-pick.yml index bc068081b7..75b31c56ea 100644 --- a/.github/workflows/gh-cherry-pick.yml +++ b/.github/workflows/gh-cherry-pick.yml @@ -17,7 +17,7 @@ jobs: private-key: ${{ secrets.GH_APP_PRIV_KEY }} env: GH_APP_ID: ${{ secrets.GH_APP_ID }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 if: ${{ steps.app-token.outcome != 'skipped' }} with: fetch-depth: 0 diff --git a/.github/workflows/gh-gha-cache-cleanup.yml b/.github/workflows/gh-gha-cache-cleanup.yml index c32944572d..d80bf1a72c 100644 --- a/.github/workflows/gh-gha-cache-cleanup.yml +++ b/.github/workflows/gh-gha-cache-cleanup.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Cleanup run: | diff --git a/.github/workflows/packages-npm-publish.yml b/.github/workflows/packages-npm-publish.yml index 5f97c5b465..8489b0d504 100644 --- a/.github/workflows/packages-npm-publish.yml +++ b/.github/workflows/packages-npm-publish.yml @@ -32,7 +32,7 @@ jobs: - packages/logger-js - packages/esbuild-plugin-live-reload steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: fetch-depth: 2 - uses: ./.github/actions/setup-node diff --git a/.github/workflows/qa-codeql.yml b/.github/workflows/qa-codeql.yml index 8edacbf92f..b5a8d3b45e 100644 --- a/.github/workflows/qa-codeql.yml +++ b/.github/workflows/qa-codeql.yml @@ -24,7 +24,7 @@ jobs: language: ["go", "javascript", "python"] steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - name: Initialize CodeQL diff --git a/.github/workflows/qa-dependency-review.yml b/.github/workflows/qa-dependency-review.yml index c02653bd08..5a7669e25d 100644 --- a/.github/workflows/qa-dependency-review.yml +++ b/.github/workflows/qa-dependency-review.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 with: # Block PRs that introduce a *new* dependency with a known diff --git a/.github/workflows/qa-semgrep.yml b/.github/workflows/qa-semgrep.yml index 39c89e8c2f..fdb170e4d5 100644 --- a/.github/workflows/qa-semgrep.yml +++ b/.github/workflows/qa-semgrep.yml @@ -26,5 +26,5 @@ jobs: image: semgrep/semgrep if: (github.actor != 'dependabot[bot]') steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - run: semgrep ci diff --git a/.github/workflows/release-branch-off.yml b/.github/workflows/release-branch-off.yml index 4063d41460..54927527bd 100644 --- a/.github/workflows/release-branch-off.yml +++ b/.github/workflows/release-branch-off.yml @@ -34,7 +34,7 @@ jobs: client-id: ${{ secrets.GH_APP_ID }} private-key: ${{ secrets.GH_APP_PRIV_KEY }} - name: Checkout main - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: main token: "${{ steps.app-token.outputs.token }}" @@ -62,7 +62,7 @@ jobs: client-id: ${{ secrets.GH_APP_ID }} private-key: ${{ secrets.GH_APP_PRIV_KEY }} - name: Checkout main - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: main token: ${{ steps.generate_token.outputs.token }} diff --git a/.github/workflows/release-next-branch.yml b/.github/workflows/release-next-branch.yml index aae7862faa..ae9ac84636 100644 --- a/.github/workflows/release-next-branch.yml +++ b/.github/workflows/release-next-branch.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest environment: internal-production steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: main - run: | diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 58914cc19c..ea8ab0ee0c 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -31,7 +31,7 @@ jobs: id-token: write attestations: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Set up QEMU uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 - name: Set up Docker Buildx @@ -83,7 +83,7 @@ jobs: - radius - rac steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 with: go-version-file: "go.mod" @@ -145,7 +145,7 @@ jobs: goos: [linux, darwin] goarch: [amd64, arm64] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 with: go-version-file: "go.mod" @@ -182,7 +182,7 @@ jobs: AWS_REGION: eu-central-1 runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0 with: role-to-assume: "arn:aws:iam::016170277896:role/github_goauthentik_authentik" @@ -198,7 +198,7 @@ jobs: - build-outpost-binary runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Run test suite in final docker images run: | echo "PG_PASS=$(openssl rand 32 | base64 -w 0)" >> lifecycle/container/.env @@ -214,7 +214,7 @@ jobs: - build-outpost-binary runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: prepare variables uses: ./.github/actions/docker-push-variables id: ev diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml index ef1e583bdc..6c004ab589 100644 --- a/.github/workflows/release-tag.yml +++ b/.github/workflows/release-tag.yml @@ -52,7 +52,7 @@ jobs: needs: - check-inputs steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: "version-${{ needs.check-inputs.outputs.major_version }}" - name: Setup authentik env @@ -76,7 +76,7 @@ jobs: run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT" env: GH_TOKEN: "${{ steps.app-token.outputs.token }}" - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: "version-${{ needs.check-inputs.outputs.major_version }}" token: "${{ steps.app-token.outputs.token }}" @@ -129,7 +129,7 @@ jobs: run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT" env: GH_TOKEN: "${{ steps.app-token.outputs.token }}" - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: repository: "${{ github.repository_owner }}/helm" token: "${{ steps.app-token.outputs.token }}" @@ -171,7 +171,7 @@ jobs: run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT" env: GH_TOKEN: "${{ steps.app-token.outputs.token }}" - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: repository: "${{ github.repository_owner }}/version" token: "${{ steps.app-token.outputs.token }}" diff --git a/.github/workflows/translation-extract-compile.yml b/.github/workflows/translation-extract-compile.yml index 4791ff674e..e290d81719 100644 --- a/.github/workflows/translation-extract-compile.yml +++ b/.github/workflows/translation-extract-compile.yml @@ -25,11 +25,11 @@ jobs: with: client-id: ${{ secrets.GH_APP_ID }} private-key: ${{ secrets.GH_APP_PRIV_KEY }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 if: ${{ github.event_name != 'pull_request' }} with: token: ${{ steps.generate_token.outputs.token }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 if: ${{ github.event_name == 'pull_request' }} - name: Setup authentik env uses: ./.github/actions/setup diff --git a/go.mod b/go.mod index 23232b6286..d67faa054c 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/getsentry/sentry-go v0.46.2 github.com/go-http-utils/etag v0.0.0-20161124023236-513ea8f21eb1 github.com/go-ldap/ldap/v3 v3.4.13 - github.com/go-openapi/runtime v0.32.2 + github.com/go-openapi/runtime v0.32.3 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/uuid v1.6.0 github.com/gorilla/handlers v1.5.2 @@ -51,14 +51,14 @@ require ( github.com/go-jose/go-jose/v4 v4.1.4 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect - github.com/go-openapi/analysis v0.25.0 // indirect + github.com/go-openapi/analysis v0.25.2 // indirect github.com/go-openapi/errors v0.22.7 // indirect github.com/go-openapi/jsonpointer v0.23.1 // indirect - github.com/go-openapi/jsonreference v0.21.5 // indirect + github.com/go-openapi/jsonreference v0.21.6 // indirect github.com/go-openapi/loads v0.23.3 // indirect github.com/go-openapi/runtime/server-middleware v0.30.0 // indirect - github.com/go-openapi/spec v0.22.4 // indirect - github.com/go-openapi/strfmt v0.26.2 // indirect + github.com/go-openapi/spec v0.22.5 // indirect + github.com/go-openapi/strfmt v0.26.3 // indirect github.com/go-openapi/swag/conv v0.26.0 // indirect github.com/go-openapi/swag/fileutils v0.26.0 // indirect github.com/go-openapi/swag/jsonname v0.26.0 // indirect @@ -68,7 +68,7 @@ require ( github.com/go-openapi/swag/stringutils v0.26.0 // indirect github.com/go-openapi/swag/typeutils v0.26.0 // indirect github.com/go-openapi/swag/yamlutils v0.26.0 // indirect - github.com/go-openapi/validate v0.25.2 // indirect + github.com/go-openapi/validate v0.25.3 // indirect github.com/go-viper/mapstructure/v2 v2.5.0 // indirect github.com/grafana/pyroscope-go/godeltaprof v0.1.11 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect @@ -86,14 +86,14 @@ require ( github.com/prometheus/procfs v0.16.1 // indirect github.com/spf13/pflag v1.0.9 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/otel v1.43.0 // indirect - go.opentelemetry.io/otel/metric v1.43.0 // indirect - go.opentelemetry.io/otel/trace v1.43.0 // indirect + go.opentelemetry.io/otel v1.44.0 // indirect + go.opentelemetry.io/otel/metric v1.44.0 // indirect + go.opentelemetry.io/otel/trace v1.44.0 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/crypto v0.51.0 // indirect - golang.org/x/net v0.54.0 // indirect - golang.org/x/sys v0.44.0 // indirect + golang.org/x/net v0.55.0 // indirect + golang.org/x/sys v0.45.0 // indirect golang.org/x/text v0.37.0 // indirect google.golang.org/protobuf v1.36.8 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/go.sum b/go.sum index 18f422fc63..a09f0ff659 100644 --- a/go.sum +++ b/go.sum @@ -41,24 +41,24 @@ github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= -github.com/go-openapi/analysis v0.25.0 h1:EnjAq1yO8wEO9HbPmY8vLPEIkdZuuFhCAKBPvCB7bCs= -github.com/go-openapi/analysis v0.25.0/go.mod h1:5WFTRE43WLkPG9r9OtlMfqkkvUTYLVVCIxLlEpyF8kE= +github.com/go-openapi/analysis v0.25.2 h1:I0vy4n3alz+DHTiN1PRhCb7QZxkK6g5YmswZKv2TKuw= +github.com/go-openapi/analysis v0.25.2/go.mod h1:Uhs1t/2XR10EnwONYILGEzw8gcfGIG5Xk5K2AxnhqDo= github.com/go-openapi/errors v0.22.7 h1:JLFBGC0Apwdzw3484MmBqspjPbwa2SHvpDm0u5aGhUA= github.com/go-openapi/errors v0.22.7/go.mod h1://QW6SD9OsWtH6gHllUCddOXDL0tk0ZGNYHwsw4sW3w= github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4= github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY= -github.com/go-openapi/jsonreference v0.21.5 h1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE= -github.com/go-openapi/jsonreference v0.21.5/go.mod h1:u25Bw85sX4E2jzFodh1FOKMTZLcfifd1Q+iKKOUxExw= +github.com/go-openapi/jsonreference v0.21.6 h1:NZ5nGfnaM1n4I43Xjm1e5/M2GjOwQwndQz22uhxwD+Y= +github.com/go-openapi/jsonreference v0.21.6/go.mod h1:xzbgtQ3ZbWxvET3AxdzCJlJt6vkovbf+IfSPJjD0tUY= github.com/go-openapi/loads v0.23.3 h1:g5Xap1JfwKkUnZdn+S0L3SzBDpcTIYzZ5Qaag0YDkKQ= github.com/go-openapi/loads v0.23.3/go.mod h1:NOH07zLajXo8y55hom0omlHWDVVvCwBM/S+csCK8LqA= -github.com/go-openapi/runtime v0.32.2 h1:X9mZz716lFwYZ6bFV1BBnthNdHTy46zKM5Em4D1UISI= -github.com/go-openapi/runtime v0.32.2/go.mod h1:IfM3cpgencPuwBp5Uo16i2IQaE74odL7Q4DCGovIQac= +github.com/go-openapi/runtime v0.32.3 h1:J7Ycy5DJmhhP1By3NifhRUjnkXTrk21qbeqSULjwX8U= +github.com/go-openapi/runtime v0.32.3/go.mod h1:/WTQi0fa5DiGnnCXQKsTkSm15OzJp8Uz3H2t+67TBr4= github.com/go-openapi/runtime/server-middleware v0.30.0 h1:8rPoJ/xv7JL8BsovaqboKETlpWBArVh8n+0L/GyePog= github.com/go-openapi/runtime/server-middleware v0.30.0/go.mod h1:OYNT/TxNvB/VK5oe4htM2jDTwlEXuejVJmu0DVZfAMs= -github.com/go-openapi/spec v0.22.4 h1:4pxGjipMKu0FzFiu/DPwN3CTBRlVM2yLf/YTWorYfDQ= -github.com/go-openapi/spec v0.22.4/go.mod h1:WQ6Ai0VPWMZgMT4XySjlRIE6GP1bGQOtEThn3gcWLtQ= -github.com/go-openapi/strfmt v0.26.2 h1:ysjheCh4i1rmFEo2LanhELDNucNzfWTZhUDKgWWPaFM= -github.com/go-openapi/strfmt v0.26.2/go.mod h1:fXh1e449cyUn2NYuz+wb3wARBUdMl7qPEZwX00nqivY= +github.com/go-openapi/spec v0.22.5 h1:KhO7RBlKQfonUWX2WzQCoLIXVA6AcNqDGZ3a1Dutdlo= +github.com/go-openapi/spec v0.22.5/go.mod h1:vxpOtMya5TXtENXKE5bKqv5NjocVhyhxHrlZfvKnZ74= +github.com/go-openapi/strfmt v0.26.3 h1:rzmslHarJgBbf2qfGge+X3htclQfmXqBZMm0Too0HhU= +github.com/go-openapi/strfmt v0.26.3/go.mod h1:a5nsUw0oRpQzZeOwx8bi6cKbzFZslpbCKt1LEot+KnQ= github.com/go-openapi/swag/conv v0.26.0 h1:5yGGsPYI1ZCva93U0AoKi/iZrNhaJEjr324YVsiD89I= github.com/go-openapi/swag/conv v0.26.0/go.mod h1:tpAmIL7X58VPnHHiSO4uE3jBeRamGsFsfdDeDtb5ECE= github.com/go-openapi/swag/fileutils v0.26.0 h1:WJoPRvsA7QRiiWluowkLJa9jaYR7FCuxmDvnCgaRRxU= @@ -83,8 +83,8 @@ github.com/go-openapi/testify/enable/yaml/v2 v2.5.1 h1:q9NtHwK4qHF7yZziBPvZyv7zW github.com/go-openapi/testify/enable/yaml/v2 v2.5.1/go.mod h1:JW0MXIotCYps/XsgJnG3a8Q7rE5xAiBwoOD5OfaIQBk= github.com/go-openapi/testify/v2 v2.5.1 h1:TMdhCaw8fUNraVSf3Omoob1dO/AzBfhtFAPW0an6sBo= github.com/go-openapi/testify/v2 v2.5.1/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw= -github.com/go-openapi/validate v0.25.2 h1:12NsfLAwGegqbGWr2CnvT65X/Q2USJipmJ9b7xDJZz0= -github.com/go-openapi/validate v0.25.2/go.mod h1:Pgl1LpPPGFnZ+ys4/hTlDiRYQdI1ocKypgE+8Q8BLfY= +github.com/go-openapi/validate v0.25.3 h1:4nzAIavcJ7WveHK2+V1UAkZK3kWcjzxZCzjfZAfavKs= +github.com/go-openapi/validate v0.25.3/go.mod h1:GemfuGMyYpIaBoKpX3z8sLywrmxpzWVOoJ7R0VeAVuk= github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro= github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY= @@ -201,14 +201,14 @@ github.com/wwt/guac v1.3.2/go.mod h1:eKm+NrnK7A88l4UBEcYNpZQGMpZRryYKoz4D/0/n1C0 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= -go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= -go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= -go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= -go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= -go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= -go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= -go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= +go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI= @@ -229,8 +229,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= -golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w= -golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ= +golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= +golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -247,8 +247,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ= -golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= +golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= diff --git a/lifecycle/container/Dockerfile b/lifecycle/container/Dockerfile index b57a11b3ba..188f1c47c1 100644 --- a/lifecycle/container/Dockerfile +++ b/lifecycle/container/Dockerfile @@ -118,7 +118,7 @@ RUN cat /root/.rustup/settings.toml # Stage: Download uv FROM ghcr.io/astral-sh/uv:0.11.19@sha256:b46b03ddfcfbf8f547af7e9eaefdf8a39c8cebcba7c98858d3162bd28cf536f6 AS uv # Stage: Base python image -FROM ghcr.io/goauthentik/fips-python:3.14.5-slim-trixie-fips@sha256:b332680f098882472bc13d5452b7b348bf8e7ef4400588d85aca41acde77c1f4 AS python-base +FROM ghcr.io/goauthentik/fips-python:3.14.5-slim-trixie-fips@sha256:dc515b79d2c76d12adae52116c655f6cf3f8a217f88afa103278cf036bda8597 AS python-base ENV VENV_PATH="/ak-root/.venv" \ PATH="/lifecycle:/ak-root/.venv/bin:$PATH" \ diff --git a/locale/en/dictionaries/integrations.txt b/locale/en/dictionaries/integrations.txt index 43e40ac016..07dc651786 100644 --- a/locale/en/dictionaries/integrations.txt +++ b/locale/en/dictionaries/integrations.txt @@ -9,6 +9,7 @@ Budibase Doki Doku dokuwiki +Dozzle Engomo Espo espocrm diff --git a/pyproject.toml b/pyproject.toml index 955a7dfc78..1c3bf48d15 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -57,7 +57,7 @@ dependencies = [ "pyyaml==6.0.3", "requests-oauthlib==2.0.0", "scim2-filter-parser==0.7.0", - "sentry-sdk==2.61.0", + "sentry-sdk==2.61.1", "service-identity==24.2.0", "setproctitle==1.3.7", "structlog==25.5.0", @@ -83,7 +83,7 @@ dev = [ "colorama==0.4.6", "constructs==10.6.0", "coverage[toml]==7.14.1", - "daphne==4.2.1", + "daphne==4.2.2", "debugpy==1.8.21", "django-stubs[compatible-mypy]==6.0.5", "djangorestframework-stubs[compatible-mypy]==3.17.0", diff --git a/uv.lock b/uv.lock index b6bb5b2cfc..cbf45e56e1 100644 --- a/uv.lock +++ b/uv.lock @@ -413,7 +413,7 @@ requires-dist = [ { name = "pyyaml", specifier = "==6.0.3" }, { name = "requests-oauthlib", specifier = "==2.0.0" }, { name = "scim2-filter-parser", specifier = "==0.7.0" }, - { name = "sentry-sdk", specifier = "==2.61.0" }, + { name = "sentry-sdk", specifier = "==2.61.1" }, { name = "service-identity", specifier = "==24.2.0" }, { name = "setproctitle", specifier = "==1.3.7" }, { name = "structlog", specifier = "==25.5.0" }, @@ -439,7 +439,7 @@ dev = [ { name = "colorama", specifier = "==0.4.6" }, { name = "constructs", specifier = "==10.6.0" }, { name = "coverage", extras = ["toml"], specifier = "==7.14.1" }, - { name = "daphne", specifier = "==4.2.1" }, + { name = "daphne", specifier = "==4.2.2" }, { name = "debugpy", specifier = "==1.8.21" }, { name = "django-stubs", extras = ["compatible-mypy"], specifier = "==6.0.5" }, { name = "djangorestframework-stubs", extras = ["compatible-mypy"], specifier = "==3.17.0" }, @@ -1068,16 +1068,16 @@ wheels = [ [[package]] name = "daphne" -version = "4.2.1" +version = "4.2.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "asgiref" }, { name = "autobahn" }, { name = "twisted", extra = ["tls"] }, ] -sdist = { url = "https://files.pythonhosted.org/packages/cd/9d/322b605fdc03b963cf2d33943321c8f4405e8d82e698bf49d1eed1ca40c4/daphne-4.2.1.tar.gz", hash = "sha256:5f898e700a1fda7addf1541d7c328606415e96a7bd768405f0463c312fcb31b3", size = 45600, upload-time = "2025-07-02T12:57:04.935Z" } +sdist = { url = "https://files.pythonhosted.org/packages/64/d3/65ff32c01cc64d44441b038dbb7cfb0c6a5507a1c937b3d41bd99af7bdc4/daphne-4.2.2.tar.gz", hash = "sha256:6c3527d4ce32630ae054dfb0ef5578e9a35d2f39f0ebcd02ef4f9129a121ce8d", size = 47601, upload-time = "2026-06-03T10:53:13.31Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/01/34/6171ab34715ed210bcd6c2b38839cc792993cff4fe2493f50bc92b0086a0/daphne-4.2.1-py3-none-any.whl", hash = "sha256:881e96b387b95b35ad85acd855f229d7f5b79073d6649089c8a33f661885e055", size = 29015, upload-time = "2025-07-02T12:57:03.793Z" }, + { url = "https://files.pythonhosted.org/packages/78/ab/85534d9cbca09f3c10f58fc2093659062280ed5703707c0b41dbca8ec297/daphne-4.2.2-py3-none-any.whl", hash = "sha256:466ba8a7c31c5b758953095b451dbad9dc23e5783c68a3716e5fc7aa5f26d168", size = 29466, upload-time = "2026-06-03T10:53:11.841Z" }, ] [[package]] @@ -3380,15 +3380,15 @@ wheels = [ [[package]] name = "sentry-sdk" -version = "2.61.0" +version = "2.61.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "certifi" }, { name = "urllib3" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/52/4d/3c66e6045bd2071256b6b6fdcb0cc02b86ce54b2acc2ceac79af8e0efbb5/sentry_sdk-2.61.0.tar.gz", hash = "sha256:1ca9b4bb777eb5be67004edab7eb894f21c6301f1d05ed64966719ad5d1764ce", size = 458510, upload-time = "2026-05-28T09:40:28.917Z" } +sdist = { url = "https://files.pythonhosted.org/packages/63/3b/4bc6b348bbd331daa14d4babe9f2b99bc854f4da41560eefb9488d78481d/sentry_sdk-2.61.1.tar.gz", hash = "sha256:9c6adccb3feefa9ba032c8d295ca477575c2f11896046a2b0ad686c47c4af555", size = 459429, upload-time = "2026-06-01T07:24:18.875Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/21/5a/9794736d5802689c1a48862e6afe6b7f3e86cc37c15d4a84bc0143877dc1/sentry_sdk-2.61.0-py3-none-any.whl", hash = "sha256:ec4d30273909cb1d198e03208b16ee70e2bc5d90a16fd9f1fb2fc6a72e1f03dc", size = 483111, upload-time = "2026-05-28T09:40:27.027Z" }, + { url = "https://files.pythonhosted.org/packages/df/54/c9218db183846e08efaf68534889ef42e499dde432778881104a42f7071b/sentry_sdk-2.61.1-py3-none-any.whl", hash = "sha256:fa36eaf4b8ad708f718500d4bdcc1532637526a22beb874d88cbc0a46458b5ae", size = 483735, upload-time = "2026-06-01T07:24:17.027Z" }, ] [[package]] diff --git a/web/package-lock.json b/web/package-lock.json index 34628d3a8d..e23dfe4995 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -45,10 +45,10 @@ "@patternfly/patternfly": "^4.224.2", "@playwright/test": "^1.60.0", "@sentry/browser": "^10.55.0", - "@storybook/addon-docs": "^10.4.1", - "@storybook/addon-links": "^10.4.1", - "@storybook/web-components": "^10.4.1", - "@storybook/web-components-vite": "^10.4.1", + "@storybook/addon-docs": "^10.4.2", + "@storybook/addon-links": "^10.4.2", + "@storybook/web-components": "^10.4.2", + "@storybook/web-components-vite": "^10.4.2", "@types/codemirror": "^5.60.17", "@types/grecaptcha": "^3.0.9", "@types/guacamole-common-js": "^1.5.5", @@ -3943,15 +3943,15 @@ "license": "MIT" }, "node_modules/@storybook/addon-docs": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/addon-docs/-/addon-docs-10.4.1.tgz", - "integrity": "sha512-IYqUdjoZe4VO2LFZlKL/gwy7DsQSWCq6hX+zc1MBmZo04yycDASk1tte57n9pdlW3ajw9yYMF/+lVBi+xQjyvw==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/addon-docs/-/addon-docs-10.4.2.tgz", + "integrity": "sha512-CtW1O4xSKZPNtpWgpfp4yB/x4pj/of+3MvlEDfErSlr3Hp3QmEa2pCLaecR08H5LJqJFlt1PtG0UrIynTvgW9w==", "license": "MIT", "dependencies": { "@mdx-js/react": "^3.0.0", - "@storybook/csf-plugin": "10.4.1", + "@storybook/csf-plugin": "10.4.2", "@storybook/icons": "^2.0.2", - "@storybook/react-dom-shim": "10.4.1", + "@storybook/react-dom-shim": "10.4.2", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "ts-dedent": "^2.0.0" @@ -3962,7 +3962,7 @@ }, "peerDependencies": { "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", - "storybook": "^10.4.1" + "storybook": "^10.4.2" }, "peerDependenciesMeta": { "@types/react": { @@ -3971,9 +3971,9 @@ } }, "node_modules/@storybook/addon-links": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/addon-links/-/addon-links-10.4.1.tgz", - "integrity": "sha512-h/5D23GwMuHA55sB7XDyhByF9psF7UFmaQOn72pjNAarew5eOpue5A+jXk3AKEYokHbvgQaoz+FrvWo9GEfSKQ==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/addon-links/-/addon-links-10.4.2.tgz", + "integrity": "sha512-cU8h4/m+oAr8UUwF4teZG2N1ilV+vU+98Ii/Ma+IIx9M/V7i5544UxfAz84dV5Rx2Oho6x8XH3gIvmevSyPi/Q==", "license": "MIT", "dependencies": { "@storybook/global": "^5.0.0" @@ -3985,7 +3985,7 @@ "peerDependencies": { "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", - "storybook": "^10.4.1" + "storybook": "^10.4.2" }, "peerDependenciesMeta": { "@types/react": { @@ -3997,12 +3997,12 @@ } }, "node_modules/@storybook/builder-vite": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/builder-vite/-/builder-vite-10.4.1.tgz", - "integrity": "sha512-/oyQrXoNOqN8SW5hNnYP+I1uvgFxKxWXj/EP6NXYzc5SQwImofgru+D2+6gDhL0+Q//+Hx05DJoQO2omvUJ8bQ==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/builder-vite/-/builder-vite-10.4.2.tgz", + "integrity": "sha512-d3+i9vbbUfV6hvT90qabmy1WmC4bEJ7iAYDm0217doeA+S6awF25GF0qOy9gN9waU4NMntHoVpdB1YQO2wUj/w==", "license": "MIT", "dependencies": { - "@storybook/csf-plugin": "10.4.1", + "@storybook/csf-plugin": "10.4.2", "ts-dedent": "^2.0.0" }, "funding": { @@ -4010,14 +4010,14 @@ "url": "https://opencollective.com/storybook" }, "peerDependencies": { - "storybook": "^10.4.1", + "storybook": "^10.4.2", "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" } }, "node_modules/@storybook/csf-plugin": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/csf-plugin/-/csf-plugin-10.4.1.tgz", - "integrity": "sha512-WdPepGBxDGOUDjYd8KxMtcf+us/2PAcnBczl77XtrnxxHNs0jWesxKkiJ9yiuGrge4BPhDeAj6rxjbBoaHxLBA==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/csf-plugin/-/csf-plugin-10.4.2.tgz", + "integrity": "sha512-GqX/2DeF3/jKs5D7gpDiuT9gd0c/f2TKcnQ5av4/s3YqeN+0nhm7btkCrDfgF16uzE1Zj3OrkxvB3AOkfxWgDg==", "license": "MIT", "dependencies": { "unplugin": "^2.3.5" @@ -4029,7 +4029,7 @@ "peerDependencies": { "esbuild": "*", "rollup": "*", - "storybook": "^10.4.1", + "storybook": "^10.4.2", "vite": "*", "webpack": "*" }, @@ -4065,9 +4065,9 @@ } }, "node_modules/@storybook/react-dom-shim": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.4.1.tgz", - "integrity": "sha512-6QFqfDNH4DMrt7yHKRfpqRopsVUc/Az+sXIdJ39IetYnHUxL3nW4NVaPc6uy/8Qi8urzUyEXL/nn7cpSIP2aPQ==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.4.2.tgz", + "integrity": "sha512-Eng3Yt2NCjPX94QcfyLeUFhrMj0hec2yU9J/qafBVbfj9XrFI8o+0ZwYJ7uXb9ECbvPN4y06dgt/2W/LiR417w==", "license": "MIT", "funding": { "type": "opencollective", @@ -4078,7 +4078,7 @@ "@types/react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", - "storybook": "^10.4.1" + "storybook": "^10.4.2" }, "peerDependenciesMeta": { "@types/react": { @@ -4090,9 +4090,9 @@ } }, "node_modules/@storybook/web-components": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/web-components/-/web-components-10.4.1.tgz", - "integrity": "sha512-bvvIQZK7vdxoVrBmQtbvtNU5ugFF8dETc0l2j58nPUerDHUook8dFNXUiKfK1KmnLsBZ/7KEjPPmk7sEHygvlQ==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/web-components/-/web-components-10.4.2.tgz", + "integrity": "sha512-dzZhJ1G/kQ3+19ureRsV1s3Sy5krcyf5mGdUa3vdt9SFP1KiAbzUnD8ur/jiUmOKcdn6lrEKMs4NY4rSzU4mPA==", "license": "MIT", "dependencies": { "@storybook/global": "^5.0.0", @@ -4105,24 +4105,24 @@ }, "peerDependencies": { "lit": "^2.0.0 || ^3.0.0", - "storybook": "^10.4.1" + "storybook": "^10.4.2" } }, "node_modules/@storybook/web-components-vite": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/web-components-vite/-/web-components-vite-10.4.1.tgz", - "integrity": "sha512-i66ublYmQNK9zvSgiT7w9zSHCcXh+g7lHWFoxO+QX7riRLMmtk5uOlWna9P7Ny41fkoQ7POKWJAuZ9PLBPl/Ug==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/web-components-vite/-/web-components-vite-10.4.2.tgz", + "integrity": "sha512-XD0vUnfJVu0aeUlwhiU3mzhdAnWSLPuljcxvWJOk/AvYQ3kKIeiM1OFFbCMUBjs6DTyomyW+t4HrSe20QoHNJg==", "license": "MIT", "dependencies": { - "@storybook/builder-vite": "10.4.1", - "@storybook/web-components": "10.4.1" + "@storybook/builder-vite": "10.4.2", + "@storybook/web-components": "10.4.2" }, "funding": { "type": "opencollective", "url": "https://opencollective.com/storybook" }, "peerDependencies": { - "storybook": "^10.4.1", + "storybook": "^10.4.2", "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" } }, @@ -17594,9 +17594,9 @@ } }, "node_modules/storybook": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.4.1.tgz", - "integrity": "sha512-V1Zd2e+gBFufqAQVZ1JR8KLqALsEZ3JYSBnWwQbKa6zCfWWanR6AFMyuOkLt2gZOgGp3h2Riuz88pGNVTQSG0A==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.4.2.tgz", + "integrity": "sha512-5Ax5vbHxFgMBGGhQDm75Rrumm/HZC4ICFhMcJaM0UlqnC/4FKj/IaZtImZFupknyiiyUEcWHPQFA2kX3/VSv1A==", "license": "MIT", "dependencies": { "@storybook/global": "^5.0.0", diff --git a/web/package.json b/web/package.json index 27a7b53e32..170f5f21ed 100644 --- a/web/package.json +++ b/web/package.json @@ -120,10 +120,10 @@ "@patternfly/patternfly": "^4.224.2", "@playwright/test": "^1.60.0", "@sentry/browser": "^10.55.0", - "@storybook/addon-docs": "^10.4.1", - "@storybook/addon-links": "^10.4.1", - "@storybook/web-components": "^10.4.1", - "@storybook/web-components-vite": "^10.4.1", + "@storybook/addon-docs": "^10.4.2", + "@storybook/addon-links": "^10.4.2", + "@storybook/web-components": "^10.4.2", + "@storybook/web-components-vite": "^10.4.2", "@types/codemirror": "^5.60.17", "@types/grecaptcha": "^3.0.9", "@types/guacamole-common-js": "^1.5.5", diff --git a/website/api/package.json b/website/api/package.json index 027e19b221..c416ba9206 100644 --- a/website/api/package.json +++ b/website/api/package.json @@ -48,9 +48,9 @@ "typescript": "^6.0.3" }, "optionalDependencies": { - "@rspack/binding-darwin-arm64": "2.0.4", - "@rspack/binding-linux-arm64-gnu": "2.0.4", - "@rspack/binding-linux-x64-gnu": "2.0.4", + "@rspack/binding-darwin-arm64": "2.0.6", + "@rspack/binding-linux-arm64-gnu": "2.0.6", + "@rspack/binding-linux-x64-gnu": "2.0.6", "@swc/core-darwin-arm64": "1.15.40", "@swc/core-linux-arm64-gnu": "1.15.40", "@swc/core-linux-x64-gnu": "1.15.40", diff --git a/website/integrations/infrastructure/iis/index.md b/website/integrations/infrastructure/iis/index.md new file mode 100644 index 0000000000..8a01c76fd5 --- /dev/null +++ b/website/integrations/infrastructure/iis/index.md @@ -0,0 +1,132 @@ +--- +title: Integrate with IIS +sidebar_label: IIS +support_level: community +--- + +import TabItem from "@theme/TabItem"; +import Tabs from "@theme/Tabs"; + +## What is IIS? + +> Internet Information Services (IIS) for Windows Server is a flexible, secure and manageable Web server for hosting anything on the Web. +> +> -- https://www.iis.net + +This guide uses authentik's proxy provider to protect an IIS-hosted site. + +## Preparation + +The following placeholders are used in this guide: + +- `iis.company` is the FQDN of the IIS site that users access. +- `authentik.company` is the FQDN of the authentik installation. + +:::info +This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. +::: + +## authentik configuration + +To support the integration of IIS with authentik, you need to create an application/provider pair in authentik and assign it to a proxy outpost. + +### Create an application and provider in authentik + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. + - **Choose a Provider type**: select **Proxy Provider** as the provider type. + - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. + - Set **Mode** to **Proxy**. + - Set **External host** to `https://iis.company`. + - Set **Internal host** to the URL of the IIS backend site as reached by the authentik proxy outpost, such as `http://localhost:8080`. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. + +3. Click **Submit** to save the new application and provider. + +### Configure proxy outpost + +The proxy provider requires an authentik proxy outpost. If you do not already have a proxy outpost, follow the [outpost documentation](/docs/add-secure-apps/outposts/) to create and deploy one. + +Add the IIS application to a proxy outpost that will serve it: + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Outposts**. +3. Click the edit icon for the proxy outpost. +4. Under **Available Applications**, select the IIS application and move it to **Selected Applications**. +5. Click **Update** to save your changes. + +## IIS configuration + + + + +Use this option when the authentik proxy outpost should receive requests for `https://iis.company`. + +1. Configure DNS or your reverse proxy so that `iis.company` routes to the authentik proxy outpost. +2. Configure the IIS backend site so that it is reachable from the authentik proxy outpost at the **Internal host** URL. +3. If the IIS backend site runs on the same Windows server, use a separate binding or port for the backend site, such as `http://localhost:8080`. + +No SSO configuration is required in IIS for this option. The authentik proxy outpost authenticates the user before forwarding allowed requests to IIS. + + + + + +Use this option when IIS should receive requests for `https://iis.company` and forward them to the authentik proxy outpost. The authentik proxy outpost then forwards authenticated requests to the IIS backend site. + +:::warning ARR host header setting +`preserveHostHeader` is a server-level ARR setting. Review other IIS reverse proxy sites before changing it on a shared IIS server. +::: + +1. Install the IIS **URL Rewrite** module and **Application Request Routing**. +2. In IIS Manager, select the server node, open **Application Request Routing Cache**, click **Server Proxy Settings**, enable **Enable proxy**, and apply the change. +3. From an elevated Command Prompt, configure ARR to preserve the original host header and avoid rewriting response `Location` headers: + + ```cmd title="Administrator Command Prompt" + %windir%\System32\inetsrv\appcmd.exe set config -section:system.webServer/proxy /preserveHostHeader:"True" /reverseRewriteHostInResponseHeaders:"False" /commit:apphost + ``` + +4. Configure the public IIS site for `iis.company` to proxy requests to the authentik proxy outpost. + + If the site already has a `web.config` file, merge the `rewrite` section into the existing `system.webServer` section. + + ```xml title="web.config" + + + + + + + + + + + + + + ``` + + This example uses the outpost HTTP port. If the outpost uses HTTPS, use `https://authentik.company:9443/{R:1}`. + +5. Configure the IIS backend site so that it is reachable from the authentik proxy outpost at the **Internal host** URL. The backend site must use a different binding, hostname, or port than the public IIS reverse proxy site to avoid routing requests back to itself. + + + + +## Configuration verification + +To confirm that authentik is properly configured with IIS, open the IIS site. You should be redirected to authentik before the IIS site is shown. + +## Resources + +- [Microsoft IIS - Overview](https://www.iis.net/overview) +- [Microsoft Learn - IIS Web Server Overview](https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-web-server-overview) +- [Microsoft Learn - Install Application Request Routing Version 2](https://learn.microsoft.com/en-us/iis/extensions/installing-application-request-routing-arr/install-application-request-routing-version-2) +- [Microsoft Learn - Reverse Proxy with URL Rewrite v2 and Application Request Routing](https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/reverse-proxy-with-url-rewrite-v2-and-application-request-routing) +- [Microsoft Learn - ARR as generic proxy in Hotmail and SkyDrive](https://learn.microsoft.com/en-us/iis/extensions/configuring-application-request-routing-arr/arr-as-generic-proxy-in-hotmail-and-skydrive) diff --git a/website/integrations/monitoring/dozzle/index.md b/website/integrations/monitoring/dozzle/index.md new file mode 100644 index 0000000000..97103068ce --- /dev/null +++ b/website/integrations/monitoring/dozzle/index.md @@ -0,0 +1,81 @@ +--- +title: Integrate with Dozzle +sidebar_label: Dozzle +support_level: community +--- + +## What is Dozzle? + +> Dozzle is a lightweight, web-based log viewer designed to simplify monitoring and debugging containerized applications across Docker, Docker Swarm, and Kubernetes environments. +> +> -- https://dozzle.dev/guide/what-is-dozzle + +Dozzle supports forward-proxy authentication. Use authentik as a forward auth proxy in front of Dozzle, and configure Dozzle to read the authenticated user details from the proxy headers set by authentik. + +## Preparation + +The following placeholders are used in this guide: + +- `dozzle.company` is the FQDN of the Dozzle installation. +- `authentik.company` is the FQDN of the authentik installation. + +:::info +This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. +::: + +:::warning Protect Docker access +Dozzle can access the Docker API through the mounted Docker socket. Only expose Dozzle behind authentication, and keep Dozzle actions and shell access disabled unless you need them. +::: + +## authentik configuration + +To support the integration of Dozzle with authentik, you need to create an application/provider pair in authentik. This guide assumes that Dozzle is already deployed behind a reverse proxy that supports authentik forward auth. + +### Create an application and provider in authentik + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. + - **Choose a Provider type**: select **Proxy Provider** as the provider type. + - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. + - Set **Mode** to **Forward auth (single application)**. + - Set **External host** to `https://dozzle.company`. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. + +3. Click **Submit** to save the new application and provider. + +### Configure proxy outpost + +The proxy provider requires an authentik proxy outpost. If you do not already have a proxy outpost, follow the [outpost documentation](/docs/add-secure-apps/outposts/) to create and deploy one. + +Add the Dozzle application to a proxy outpost that will serve it: + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Outposts**. +3. Click the edit icon for the proxy outpost. This can be the built-in **authentik Embedded Outpost** or another proxy outpost. +4. Under **Available Applications**, select the Dozzle application and move it to **Selected Applications**. +5. Click **Update** to save your changes. + +## Dozzle configuration + +Configure Dozzle to use the `forward-proxy` authentication provider. Add the following environment variables to your Dozzle configuration: + +```env title=".env" +DOZZLE_AUTH_PROVIDER=forward-proxy +DOZZLE_AUTH_HEADER_USER=X-Authentik-Username +DOZZLE_AUTH_HEADER_EMAIL=X-Authentik-Email +DOZZLE_AUTH_HEADER_NAME=X-Authentik-Name +DOZZLE_AUTH_LOGOUT_URL=https://dozzle.company/outpost.goauthentik.io/sign_out +``` + +Configure your reverse proxy to use the authentik outpost as the forward auth endpoint for `https://dozzle.company`. Requests to `/outpost.goauthentik.io` must be routed to the authentik outpost, and all other requests must be routed to Dozzle. + +After making these changes, restart Dozzle and reload your reverse proxy. + +## Configuration verification + +To verify the login flow, open Dozzle. You should be redirected to authentik before the Dozzle web interface is shown. + +## Resources + +- [Dozzle - What is Dozzle?](https://dozzle.dev/guide/what-is-dozzle) diff --git a/website/integrations/security/fortimail/index.mdx b/website/integrations/security/fortimail/index.mdx index 4efe22e7ec..5f12a910f8 100644 --- a/website/integrations/security/fortimail/index.mdx +++ b/website/integrations/security/fortimail/index.mdx @@ -19,22 +19,26 @@ import TabItem from "@theme/TabItem"; The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. -- `fortimailadmin.company` is the FQDN (or IP) of your FortiMail admin interface. -- `fortimailuser.company` is the WAN-facing FQDN of your FortiMail user/webmail portal. +- `fortimailadmin.company` is the FQDN or IP address of your FortiMail admin interface. +- `fortimailuser.company` is the FQDN or IP address of your FortiMail user/webmail portal. :::info -This documentation lists only the settings that you need to change from their default values. Changing settings not mentioned in this guide can prevent single sign-on from working correctly. +This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ::: -:::info -FortiMail 7.6.4 and later allows you to configure separate service providers for the admin and user/webmail portals. If you plan to use the user/webmail portal, avoid importing FortiMail’s auto-generated metadata directly, as you will need to edit the ACS URL in that XML to replace the host with your user-facing FQDN. +:::info FortiMail Cloud +FortiMail Cloud supports SSO for webmail users. The Admin Portal SSO steps apply to FortiMail Appliance and VM. +::: + +:::info Webmail limitations +When SSO is enabled for FortiMail webmail users, CalDAV and WebDAV authentication do not use SSO and continue to require local password authentication. If your FortiMail system is deployed in server mode, configure an LDAP profile for the domain users before enabling webmail SSO. ::: ## authentik configuration -To support the integration of the FortiMail with authentik, you need to create an application/provider pair in authentik. +To support the integration of FortiMail with authentik, you need to create an application/provider pair in authentik. -You can configure either Admin Portal SSO or User Portal SSO (or both), depending on the intended user and the desired scope of authentication. +You can configure either Admin Portal SSO or User Portal SSO, or both, depending on the intended users and the desired scope of authentication. 1. Log in to authentik as an administrator and open the authentik Admin interface. -2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - - **Application**: provide a descriptive name (e.g. `FortiMail Admin`), an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** as it will be required later. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: provide a descriptive name (for example, `FortiMail Admin`), an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - - Set the **ACS URL** to `https://fortimailadmin.company/sso/SAML2/POST`. - - Set the **Audience** to `https://fortimailadmin.company/sp`. - - Under **Advanced protocol settings**: - - Select any available certificate as the **Signing Certificate** and enable **Sign Assertions**. - - Ensure that `authentik default SAML Mapping: Username` is selected as a **Selected User Property Mappings**; other mappings are optional and can be removed if not needed. - - **Configure Bindings** _(optional)_: create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to control which administrators see the FortiMail Admin application on the **Application Dashboard** page. - -3. Click **Submit** to save the application and provider. + - Temporarily set the **ACS URL** to `https://temp.temp`. + - Temporarily set the **Audience** to `https://temp.temp`. + - Under **Advanced protocol settings**, select any available certificate as the **Signing Certificate**. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. +3. Click **Create Application** to save the new application and provider. ### Download metadata file 1. Log in to authentik as an administrator and open the authentik Admin interface. -2. Navigate to **Applications** > **Providers** and click on the name of the provider that you created in the previous section (e.g. `Provider for FortiMail Admin`). -3. Under **Related objects** > **Metadata**, click on **Download**. This downloaded file is your metadata file and it will be required in the next section. +2. Navigate to **Applications** > **Providers** and click the name of the provider that you created in the previous section (for example, `Provider for FortiMail Admin`). +3. Under **Related objects** > **Metadata**, click **Download**. This file is required in the next section. ## FortiMail configuration 1. Sign in to the FortiMail admin interface. -2. Navigate to **System** > **Single Sign On** and select the **Setting** tab. -3. Enable **Single sign-on** and note the values that FortiMail displays (the ACS field is read-only): +2. Navigate to **System** > **Single Sign On** and open the **Profile** tab. +3. Create a new SSO profile and configure the following settings: + - **Profile name**: enter a descriptive name (for example, `authentik-admin`). + - **Metadata**: upload the authentik metadata file that you downloaded in the previous section. + - **Attribute used to identify email address**: `http://schemas.goauthentik.io/2021/02/saml/username` +4. Click **Create** or **OK** to save the SSO profile. +5. Open the **Setting** tab and enable **Single sign-on**. +6. If FortiMail displays **Use different service provider for admin and webmail access**, select **Admin** as the service provider metadata target. +7. In the **Service Provider Metadata** section, configure the following values: - **Entity ID**: `https://fortimailadmin.company/sp` - - **Assertion consumer service (ACS) URL**: `https://fortimailadmin.company/sso/SAML2/POST` + - **Host name**: `fortimailadmin.company` +8. Click **Apply**. +9. Copy the following FortiMail service provider values: + - **Entity ID** + - **ACS URL** -Ensure that these values match those configured in authentik. If not, update the values in authentik and re-download the [authentik metadata file](#download-metadata-file). +### Reconfigure the authentik provider -4. Upload the authentik SAML metadata file that you downloaded in the previous step. -5. Switch to the **Profile** tab and configure the attribute mapping: - - Set **Attribute used to identify email address** to `http://schemas.goauthentik.io/2021/02/saml/username`. +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Providers** and click the provider that you created for FortiMail Admin. +3. Click **Edit**. +4. Under **Protocol settings**, set the following values: + - **ACS URL**: paste the **ACS URL** value from FortiMail. + - **Audience**: paste the **Entity ID** value from FortiMail. +5. Click **Update**. -:::info User Provisioning -FortiMail does not auto-provision administrator accounts via SSO. +### Configure administrator accounts -You must manually create admin users and, for each account, configure the **Authentication type** as `Single Sign On` to enable authentication through the SAML provider. -::: +FortiMail does not automatically provision administrator accounts through SSO. Create or edit each administrator that should use SSO: + +1. In the FortiMail admin interface, navigate to **System** > **Administrator** > **Administrator**. +2. For each SSO-enabled administrator, set **Authentication type** to **Single Sign On** and set **Single sign on profile** to the SSO profile that you created for authentik. ### Enforce SSO-only access (optional) -To require SSO for FortiMail Admin Portal logins: +To show only SSO on the administrator login page, run the following commands in the FortiMail CLI: -1. Sign in to the FortiMail admin interface. -2. Navigate to **System** > **Customization** > **Appearance** > **Webmail Portal** and set **Login page** to `Single Sign On only`. +```shell +config system appearance +set admin-sso-login-option sso-only +end +``` + +:::warning Administrator recovery +When administrator SSO-only login is enabled, the built-in `admin` account cannot sign in to the GUI. Keep SSH or local console access available before enabling this option. +::: -## authentik configuration - -To support the integration of the FortiMail User Portal with authentik, you need to create an application/provider pair in authentik. - ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. -2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - - **Application**: provide a descriptive name (e.g. `FortiMail User Portal`), an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** as it will be required later. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: provide a descriptive name (for example, `FortiMail User Portal`), an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - - Set the **ACS URL** to `https://fortimailuser.company/sp2/sso/SAML2/POST`. - - Set the **Audience** to `https://fortimailuser.company/sp`. - - Under **Advanced protocol settings**, choose any available certificate as the **Signing Certificate** and enable **Sign Assertions**. Ensure `authentik default SAML Mapping: Email` is selected as a **Selected User Property Mapping**; other mappings are optional and can be removed if not needed. - - **Configure Bindings** _(optional)_: create a [binding](/docs/add-secure-apps/bindings-overview/) to control which end users see the FortiMail webmail application on the **Application Dashboard** page. - -3. Click **Submit** to save the application and provider. + - Temporarily set the **ACS URL** to `https://temp.temp`. + - Temporarily set the **Audience** to `https://temp.temp`. + - Under **Advanced protocol settings**, select any available certificate as the **Signing Certificate**. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. +3. Click **Create Application** to save the new application and provider. ### Download metadata file 1. Log in to authentik as an administrator and open the authentik Admin interface. -2. Navigate to **Applications** > **Providers** and click on the name of the provider that you created in the previous section (e.g. `Provider for FortiMail User Portal`). -3. Under **Related objects** > **Metadata**, click on **Download**. This downloaded file is your metadata file and it will be required in the next section. +2. Navigate to **Applications** > **Providers** and click the name of the provider that you created in the previous section (for example, `Provider for FortiMail User Portal`). +3. Under **Related objects** > **Metadata**, click **Download**. This file is required in the next section. ## FortiMail configuration 1. Sign in to the FortiMail admin interface. -2. Navigate to **System** > **Single Sign On** and select the **Setting** tab. -3. Enable **Use different service provider for admin and webmail access**, and select the **Webmail** service provider. -4. For the user/webmail service provider, note the values that FortiMail displays (the ACS field is read-only): - - **Entity ID**: `https://fortimailuser.company/sp` - - **Assertion consumer service (ACS) URL**: replace the host portion with `fortimailuser.company` (for example, `https://fortimailuser.company/sp2/sso/SAML2/POST`) +2. Navigate to **System** > **Single Sign On** and open the **Profile** tab. +3. Create a new SSO profile and configure the following settings: + - **Profile name**: enter a descriptive name (for example, `authentik-webmail`). + - **Metadata**: upload the authentik metadata file that you downloaded in the previous section. + - **Attribute used to identify email address**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` +4. Click **Create** or **OK** to save the SSO profile. +5. Open the **Setting** tab and enable **Single sign-on**. +6. Enable **Use different service provider for admin and webmail access**, and then select **Webmail** as the service provider metadata target. +7. In the **Service Provider Metadata** section, configure the following values: + - **Entity ID**: `https://fortimailuser.company/sp2` + - **Host name**: `fortimailuser.company` +8. Click **Apply**. +9. Copy the following FortiMail service provider values: + - **Entity ID** + - **ACS URL** -Ensure that these values match those configured in authentik. If not, update the values in authentik and re-download the [authentik metadata file](#download-metadata-file). +### Reconfigure the authentik provider -5. Upload the authentik SAML metadata file you downloaded in the previous step. -6. On the **Profile** tab for the user/webmail provider, set **Attribute used to identify email address** to `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`. +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Providers** and click the provider that you created for the FortiMail User Portal. +3. Click **Edit**. +4. Under **Protocol settings**, set the following values: + - **ACS URL**: paste the **ACS URL** value from FortiMail. + - **Audience**: paste the **Entity ID** value from FortiMail. +5. Click **Update**. + +### Configure webmail access + +1. In the FortiMail admin interface, navigate to **Domain & Users** > **Domain** and edit the domain that should use SSO. +2. Open **Advanced Setting** > **Other** and set **Webmail single sign on** to the SSO profile that you created for authentik. ### Enforce SSO-only access (optional) -To require SSO for FortiMail User Portal logins: +To show only SSO on the webmail login page, run the following commands in the FortiMail CLI: -1. Sign in to the FortiMail admin interface. -2. Navigate to **Domain & Users** > **Domain**, edit the domain entry, then open **Advanced Setting** > **Other** and set **Webmail single sign on** to the SSO profile you created for end users. +```shell +config system appearance +set webmail-sso-login-option sso-only +end +``` ## Configuration verification -1. Open a new browser session (or private window) and navigate to the relevant FortiMail portal (admin or user). -2. Initiate the SSO login flow (this happens automatically if you enabled the SSO-only options) and confirm that you are redirected to authentik for authentication. Sign in with an account permitted to use that portal. -3. After successful authentication, verify that you return to the FortiMail portal without being prompted for additional credentials. +To confirm that authentik is properly configured with FortiMail, open the FortiMail portal that you configured and start the SSO login flow. After authenticating with authentik, verify that you return to FortiMail without being prompted for additional credentials. + +## Resources + +- [Fortinet - FortiMail](https://www.fortinet.com/products/email-security) +- [Fortinet Docs - Configuring single sign-on (SSO)](https://docs.fortinet.com/document/fortimail/8.0.0/administration-guide/73231/configuring-single-sign-on-sso) +- [Fortinet Docs - FortiMail Cloud Configuring single sign-on (SSO)](https://docs.fortinet.com/document/fortimail-cloud/1.0.0/fortimail-cloud-administration-guide/73231/configuring-single-sign-on-sso) +- [Fortinet Docs - system saml](https://docs.fortinet.com/document/fortimail/8.0.0/cli-reference/856423/system-saml) +- [Fortinet Docs - system appearance](https://docs.fortinet.com/document/fortimail/7.4.3/cli-reference/523895/system-appearance) diff --git a/website/package-lock.json b/website/package-lock.json index e3d5eedd60..48df8c8298 100644 --- a/website/package-lock.json +++ b/website/package-lock.json @@ -38,9 +38,9 @@ "npm": ">=11.14.1" }, "optionalDependencies": { - "@rspack/binding-darwin-arm64": "2.0.4", - "@rspack/binding-linux-arm64-gnu": "2.0.4", - "@rspack/binding-linux-x64-gnu": "2.0.4", + "@rspack/binding-darwin-arm64": "2.0.6", + "@rspack/binding-linux-arm64-gnu": "2.0.6", + "@rspack/binding-linux-x64-gnu": "2.0.6", "@swc/core-darwin-arm64": "1.15.40", "@swc/core-linux-arm64-gnu": "1.15.40", "@swc/core-linux-x64-gnu": "1.15.40", @@ -213,9 +213,9 @@ "typescript": "^6.0.3" }, "optionalDependencies": { - "@rspack/binding-darwin-arm64": "2.0.4", - "@rspack/binding-linux-arm64-gnu": "2.0.4", - "@rspack/binding-linux-x64-gnu": "2.0.4", + "@rspack/binding-darwin-arm64": "2.0.6", + "@rspack/binding-linux-arm64-gnu": "2.0.6", + "@rspack/binding-linux-x64-gnu": "2.0.6", "@swc/core-darwin-arm64": "1.15.40", "@swc/core-linux-arm64-gnu": "1.15.40", "@swc/core-linux-x64-gnu": "1.15.40", @@ -6298,9 +6298,9 @@ } }, "node_modules/@rspack/binding-darwin-arm64": { - "version": "2.0.4", - "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.4.tgz", - "integrity": "sha512-0Q1QXFEsZfDc4opiDnb8q50KlBbC2VovViDaYlMJZBzvjAo325mh3itXPfz7YZ31M+TxRE7TUiJXH3ltiV1Hdg==", + "version": "2.0.6", + "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.6.tgz", + "integrity": "sha512-0giCKiWlBfcM4i2scv1j2k9HlSecO9Ybhaa5wsMUyvcFeKr9HbNHh7C2eDFlC6zaI85IUdY71TXF/g/Tcxr9MA==", "cpu": [ "arm64" ], @@ -6324,9 +6324,9 @@ ] }, "node_modules/@rspack/binding-linux-arm64-gnu": { - "version": "2.0.4", - "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.4.tgz", - "integrity": "sha512-BEk6mIYBK4BihW9qXXITJORrVXecTlkRjrqhgefili4xjXtLdcUnxAm9sN/2oJ8m378n2h33qDh4gr2orPBFWQ==", + "version": "2.0.6", + "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.6.tgz", + "integrity": "sha512-H6ACzeM1KBxYDEF8YAim3501Jb1aCsSG79Gjm1M4pwJ5OJPK2ydiJEa438ugXmh0962eKYMHI2yZY0sQq8txaw==", "cpu": [ "arm64" ], @@ -6356,9 +6356,9 @@ ] }, "node_modules/@rspack/binding-linux-x64-gnu": { - "version": "2.0.4", - "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.4.tgz", - "integrity": "sha512-xHorBPBZAg0Pn9Q0k9dWZ9euowieDxcSOzQ9JhTCmhDY6wZH5M/kCBFlCs/OQeW5/NUArW3x3MwEdO/0QJHMxg==", + "version": "2.0.6", + "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.6.tgz", + "integrity": "sha512-rerCAz022zf0ewxI+7n3SrqLEaxCL+MXRxKjK5FLUGFa8UkIrivq+VUP/1OB6JLh2Bucebc7Y9WoWHvtk22mLA==", "cpu": [ "x64" ], diff --git a/website/package.json b/website/package.json index b874c75b17..1c52cc7d3e 100644 --- a/website/package.json +++ b/website/package.json @@ -36,9 +36,9 @@ "typescript-eslint": "^8.59.3" }, "optionalDependencies": { - "@rspack/binding-darwin-arm64": "2.0.4", - "@rspack/binding-linux-arm64-gnu": "2.0.4", - "@rspack/binding-linux-x64-gnu": "2.0.4", + "@rspack/binding-darwin-arm64": "2.0.6", + "@rspack/binding-linux-arm64-gnu": "2.0.6", + "@rspack/binding-linux-x64-gnu": "2.0.6", "@swc/core-darwin-arm64": "1.15.40", "@swc/core-linux-arm64-gnu": "1.15.40", "@swc/core-linux-x64-gnu": "1.15.40",