eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions
blumeops/docs/how-to/authentik/authentik-go-server-derivation.md
Erich Blume 08b9570ac7 Review build-authentik-from-source Mikado chain docs 
Fix go-server-derivation: wrong path target (webui not authentik-django)
and missing internal/web/static.go patch. Remove stale DRF fork content
from mirror-build-deps (no longer needed as of 2026.2.0). Add
last-reviewed to all 5 cards without it.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-02 07:28:09 -08:00

2.1 KiB
Raw Blame History

title modified last-reviewed requires tags
Build Authentik Go Server 2026-03-02 2026-03-02
authentik-api-client-generation
authentik-python-backend-derivation
how-to
authentik
nix

Build Authentik Go Server

Build the Go HTTP server binary (cmd/server) that serves the web UI, REST API, and spawns gunicorn for the Django backend.

Context

The Go server is built with buildGoModule from the cmd/server subpackage. It's a Cobra-based binary that:

  • Serves static web assets and the REST API
  • Runs an embedded reverse proxy outpost
  • Spawns gounicorn (gunicorn) to run the Django application
  • Manages health checks

The nixpkgs derivation patches store paths into two Go source files so the compiled binary can find Python lifecycle scripts and web assets at runtime.

What to Do

  1. Create a buildGoModule derivation for cmd/server from the authentik source
  2. Inject the generated Go API client into the vendor directory (via apiGoVendorHook)
  3. Apply substituteInPlace patches to hardcode Nix store paths:
    • internal/gounicorn/gounicorn.go: ./lifecycle → ${authentik-django}/lifecycle
    • web/static.go: ./web → ${webAssetsPath} (the webui derivation)
    • internal/web/static.go: ./web → ${webAssetsPath} (the webui derivation)
  4. Compute the vendorHash — note that the hook replaces vendored API code after hash verification, so the hash reflects go.sum only
  5. Rename the output binary from server to authentik
  6. Verify: ./authentik --help runs successfully

Key Details

  • Go module: goauthentik.io
  • Subpackage: ./cmd/server
  • CGO: disabled
  • The vendorHash must be computed with the vendor replacement hook excluded (overrideModAttrs)
  • Outpost binaries (cmd/ldap, cmd/proxy, cmd/radius) are separate and not needed for basic deployment

Related