eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions
blumeops/docs/how-to/authentik/authentik-python-backend-derivation.md
Erich Blume 7094ea7d3e Start C2 Mikado chain: build authentik from source 
Create goal card and 4 prerequisite cards for building authentik from a
custom Nix derivation instead of using pkgs.authentik from nixpkgs. This
removes the dependency on the nixpkgs packaging timeline and gives full
version control over authentik releases.

Chain: mikado/authentik-source-build
Leaf nodes: authentik-api-client-generation, authentik-python-backend-derivation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-28 08:20:17 -08:00

1.9 KiB
Raw Blame History

title modified status tags
Build Authentik Python Backend 2026-02-28 active
how-to
authentik
nix

Build Authentik Python Backend

Build authentik-django — the Python/Django application that forms the core backend of authentik.

Context

This is the most complex component. The nixpkgs derivation uses python3.override with extensive packageOverrides to handle authentik's non-standard dependencies:

  • 4 in-tree Python packages built from the monorepo: ak-guardian, django-channels-postgres, django-dramatiq-postgres, django-postgres-cache
  • Forked djangorestframework from authentik-community/django-rest-framework (specific commit)
  • Pinned dramatiq at 1.17.1 (upstream uses newer versions that break authentik)
  • Django 5 forced via django_5
  • 60+ Python dependencies from nixpkgs

Post-install, the derivation patches hardcoded paths in settings.py, default.yml, email/utils.py, and files/backends/file.py to reference Nix store paths.

What to Do

  1. Create a Python package override set that builds the 4 in-tree packages from source
  2. Pin the forked djangorestframework and dramatiq versions
  3. Build authentik-django using hatchling as the build backend
  4. Apply the 4 substituteInPlace patches for Nix store path references
  5. Copy lifecycle scripts, manage.py, blueprints, and web assets into the output
  6. Verify: python -c "import authentik" succeeds

Key Details

  • Build backend: hatchling
  • Entry point: manage.py (Django management commands)
  • Lifecycle scripts: lifecycle/ directory (used by Go server and ak wrapper)
  • Blueprints: blueprints/ directory (YAML IaC definitions)
  • The output must include web/ assets (email templates reference them)

Related