authentik/lifecycle/ak

#!/bin/bash -e
function log {
    printf '{"event": "%s", "level": "info", "logger": "bootstrap"}\n' "$@" > /dev/stderr
}

function wait_for_db {
    python -m lifecycle.wait_for_db
    log "Bootstrap completed"
}

function check_if_root {
    if [[ $EUID -ne 0 ]]; then
        log "Not running as root, disabling permission fixes"
        $1
        return
    fi
    SOCKET="/var/run/docker.sock"
    GROUP="authentik"
    if [[ -e "$SOCKET" ]]; then
        # Get group ID of the docker socket, so we can create a matching group and
        # add ourselves to it
        DOCKER_GID=$(stat -c '%g' $SOCKET)
        # Ensure group for the id exists
        getent group $DOCKER_GID || groupadd -f -g $DOCKER_GID docker
        usermod -a -G $DOCKER_GID authentik
        # since the name of the group might not be docker, we need to lookup the group id
        GROUP_NAME=$(getent group $DOCKER_GID | sed 's/:/\n/g' | head -1)
        GROUP="authentik:${GROUP_NAME}"
    fi
    # Fix permissions of backups and media
    chown -R authentik:authentik /media /certs
    chpst -u authentik:$GROUP env HOME=/authentik $1
}

MODE_FILE="/tmp/authentik-mode"

if [[ "$1" == "server" ]]; then
    wait_for_db
    echo "server" > $MODE_FILE
    # We only set PROMETHEUS_MULTIPROC_DIR for serer, as with the worker it just fills up the disk
    # as one file is created per process
    #
    # Set to TMPDIR instead hardcoded path so this can be used outside docker too
    export PROMETHEUS_MULTIPROC_DIR=$TMPDIR
    python -m lifecycle.migrate
    /authentik-proxy
elif [[ "$1" == "worker" ]]; then
    wait_for_db
    echo "worker" > $MODE_FILE
    check_if_root "celery -A authentik.root.celery worker -Ofair --max-tasks-per-child=1 --autoscale 3,1 -E -B -s /tmp/celerybeat-schedule -Q authentik,authentik_scheduled,authentik_events"
elif [[ "$1" == "flower" ]]; then
    echo "flower" > $MODE_FILE
    celery -A authentik.root.celery flower
elif [[ "$1" == "bash" ]]; then
    /bin/bash
elif [[ "$1" == "test" ]]; then
    # https://github.com/python-poetry/poetry/issues/4493
    pip install platformdirs
    poetry install
    touch /unittest.xml
    chown authentik:authentik /unittest.xml
    check_if_root "python -m manage test authentik"
elif [[ "$1" == "healthcheck" ]]; then
    mode=$(cat $MODE_FILE)
    if [[ $mode == "server" ]]; then
        curl --user-agent "goauthentik.io lifecycle Healthcheck" -I http://localhost:9000/-/health/ready/
    elif [[ $mode == "worker" ]]; then
        celery -A authentik.root.celery inspect ping -d celery@$HOSTNAME --timeout 5 -j
    elif [[ $mode == "flower" ]]; then
        curl http://localhost:5555/metrics
    fi
elif [[ "$1" == "dump_config" ]]; then
    python -m authentik.lib.config
else
    python -m manage "$@"
fi