Serve CMS at root and bootstrap Authentik in compose

infra/.env.example

@@ -30,12 +30,13 @@ AUTHENTIK_BOOTSTRAP_EMAIL=dcctouch@gmail.com
 AUTHENTIK_BOOTSTRAP_PASSWORD=replace-with-temporary-password
 AUTHENTIK_BOOTSTRAP_TOKEN=replace-with-random-token
 
-# CMS bootstrap user. Used by infra/scripts/bootstrap-authentik.sh.
+# CMS bootstrap user. Applied automatically by the authentik-bootstrap compose service.
 CMS_BOOTSTRAP_ADMIN_EMAIL=dcctouch@gmail.com
 CMS_BOOTSTRAP_ADMIN_PASSWORD=replace-with-temporary-password
 CMS_BOOTSTRAP_ADMIN_NAME=DCTOUCH CMS Admin
+CMS_BOOTSTRAP_FORCE_PASSWORD=false
 
-# CMS OIDC application. bootstrap-authentik.sh creates the matching provider.
+# CMS OIDC application. The authentik-bootstrap compose service creates the matching provider.
 CMS_AUTH_ENABLED=true
 CMS_BASE_URL=http://cms.local.nodedc:8210
 CMS_OIDC_ISSUER=http://cms-auth.local.nodedc:8210/application/o/dc-cms/

infra/.env.synology.example

@@ -31,12 +31,13 @@ AUTHENTIK_BOOTSTRAP_EMAIL=dcctouch@gmail.com
 AUTHENTIK_BOOTSTRAP_PASSWORD=replace-with-temporary-password
 AUTHENTIK_BOOTSTRAP_TOKEN=replace-with-random-token
 
-# CMS bootstrap user. Used by infra/scripts/bootstrap-authentik.sh.
+# CMS bootstrap user. Applied automatically by the authentik-bootstrap compose service.
 CMS_BOOTSTRAP_ADMIN_EMAIL=dcctouch@gmail.com
 CMS_BOOTSTRAP_ADMIN_PASSWORD=replace-with-temporary-password
 CMS_BOOTSTRAP_ADMIN_NAME=DCTOUCH CMS Admin
+CMS_BOOTSTRAP_FORCE_PASSWORD=false
 
-# CMS OIDC application. bootstrap-authentik.sh creates the matching provider.
+# CMS OIDC application. The authentik-bootstrap compose service creates the matching provider.
 CMS_AUTH_ENABLED=true
 CMS_BASE_URL=https://cms.dcserve.ru
 CMS_OIDC_ISSUER=https://auth.dcserve.ru/application/o/dc-cms/

infra/authentik/bootstrap-cms.py

@@ -63,6 +63,13 @@ def optional_env(name, default=""):
     return environ.get(name, default).strip()
 
 
+def bool_env(name, default=False):
+    value = environ.get(name, "")
+    if value == "":
+        return default
+    return value.strip().lower() in ("1", "true", "yes", "on")
+
+
 def ensure_group(name, is_superuser=False):
     group, _ = Group.objects.get_or_create(name=name)
     group.is_superuser = is_superuser
@@ -88,6 +95,7 @@ def ensure_admin_user(groups):
     user = User.objects.filter(email__iexact=admin_email).first() or User.objects.filter(
         username=admin_email
     ).first()
+    created = user is None
     if user is None:
         user = User(username=admin_email, email=admin_email, name=admin_email, type="internal")
 
@@ -101,7 +109,7 @@ def ensure_admin_user(groups):
         environ.get("CMS_BOOTSTRAP_ADMIN_PASSWORD", "")
         or environ.get("AUTHENTIK_BOOTSTRAP_PASSWORD", "")
     )
-    if admin_password:
+    if admin_password and (created or bool_env("CMS_BOOTSTRAP_FORCE_PASSWORD")):
         user.set_password(admin_password)
     user.save()
 

infra/docker-compose.yml

@@ -53,8 +53,8 @@ services:
       - ../projects:/app/projects
       - ${CMS_NODEDC_SITE_PATH:-../../NODEDC_SITE}:/sites/nodedc
     depends_on:
-      authentik-server:
-        condition: service_started
+      authentik-bootstrap:
+        condition: service_completed_successfully
     networks:
       - cms-edge
 
@@ -132,6 +132,47 @@ services:
     networks:
       - cms-edge
 
+  authentik-bootstrap:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.2}
+    command:
+      - ak
+      - shell
+      - -c
+      - exec(open('/bootstrap/bootstrap-cms.py', encoding='utf-8').read())
+    restart: "no"
+    env_file:
+      - ${CMS_SERVICE_ENV_FILE:-.env}
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql-authentik
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?database password required}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+      AUTHENTIK_ERROR_REPORTING__ENABLED: ${AUTHENTIK_ERROR_REPORTING__ENABLED:-false}
+      CMS_AUTH_DOMAIN: ${CMS_AUTH_DOMAIN:-cms-auth.local.nodedc}
+      CMS_BOOTSTRAP_ADMIN_EMAIL: ${CMS_BOOTSTRAP_ADMIN_EMAIL:-}
+      CMS_BOOTSTRAP_ADMIN_PASSWORD: ${CMS_BOOTSTRAP_ADMIN_PASSWORD:-}
+      CMS_BOOTSTRAP_ADMIN_NAME: ${CMS_BOOTSTRAP_ADMIN_NAME:-DCTOUCH CMS Admin}
+      CMS_BOOTSTRAP_FORCE_PASSWORD: ${CMS_BOOTSTRAP_FORCE_PASSWORD:-false}
+      CMS_OIDC_CLIENT_ID: ${CMS_OIDC_CLIENT_ID:?cms oidc client id required}
+      CMS_OIDC_CLIENT_SECRET: ${CMS_OIDC_CLIENT_SECRET:?cms oidc client secret required}
+      CMS_OIDC_REDIRECT_URI: ${CMS_OIDC_REDIRECT_URI:?cms oidc redirect uri required}
+      CMS_OIDC_LOGGED_OUT_REDIRECT_URI: ${CMS_OIDC_LOGGED_OUT_REDIRECT_URI:?cms oidc logged out redirect uri required}
+      CMS_BASE_URL: ${CMS_BASE_URL:?cms base url required}
+      CMS_LOGOUT_URI: ${CMS_LOGOUT_URI:-}
+    depends_on:
+      authentik-server:
+        condition: service_healthy
+      authentik-worker:
+        condition: service_healthy
+    volumes:
+      - authentik-data:/data
+      - authentik-certs:/certs
+      - ./authentik/custom-templates:/templates:ro
+      - ./authentik/bootstrap-cms.py:/bootstrap/bootstrap-cms.py:ro
+    networks:
+      - cms-edge
+
 networks:
   cms-edge: