Serve CMS at root and bootstrap Authentik in compose

infra/authentik/bootstrap-cms.py

@@ -63,6 +63,13 @@ def optional_env(name, default=""):
     return environ.get(name, default).strip()
 
 
+def bool_env(name, default=False):
+    value = environ.get(name, "")
+    if value == "":
+        return default
+    return value.strip().lower() in ("1", "true", "yes", "on")
+
+
 def ensure_group(name, is_superuser=False):
     group, _ = Group.objects.get_or_create(name=name)
     group.is_superuser = is_superuser
@@ -88,6 +95,7 @@ def ensure_admin_user(groups):
     user = User.objects.filter(email__iexact=admin_email).first() or User.objects.filter(
         username=admin_email
     ).first()
+    created = user is None
     if user is None:
         user = User(username=admin_email, email=admin_email, name=admin_email, type="internal")
 
@@ -101,7 +109,7 @@ def ensure_admin_user(groups):
         environ.get("CMS_BOOTSTRAP_ADMIN_PASSWORD", "")
         or environ.get("AUTHENTIK_BOOTSTRAP_PASSWORD", "")
     )
-    if admin_password:
+    if admin_password and (created or bool_env("CMS_BOOTSTRAP_FORCE_PASSWORD")):
         user.set_password(admin_password)
     user.save()