eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions
blumeops/docs/how-to/authentik/authentik-go-server-derivation.md
Erich Blume 7094ea7d3e Start C2 Mikado chain: build authentik from source 
Create goal card and 4 prerequisite cards for building authentik from a
custom Nix derivation instead of using pkgs.authentik from nixpkgs. This
removes the dependency on the nixpkgs packaging timeline and gives full
version control over authentik releases.

Chain: mikado/authentik-source-build
Leaf nodes: authentik-api-client-generation, authentik-python-backend-derivation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-28 08:20:17 -08:00

1.9 KiB
Raw Blame History

title modified status requires tags
Build Authentik Go Server 2026-02-28 active
authentik-api-client-generation
authentik-python-backend-derivation
how-to
authentik
nix

Build Authentik Go Server

Build the Go HTTP server binary (cmd/server) that serves the web UI, REST API, and spawns gunicorn for the Django backend.

Context

The Go server is built with buildGoModule from the cmd/server subpackage. It's a Cobra-based binary that:

  • Serves static web assets and the REST API
  • Runs an embedded reverse proxy outpost
  • Spawns gounicorn (gunicorn) to run the Django application
  • Manages health checks

The nixpkgs derivation patches store paths into two Go source files so the compiled binary can find Python lifecycle scripts and web assets at runtime.

What to Do

  1. Create a buildGoModule derivation for cmd/server from the authentik source
  2. Inject the generated Go API client into the vendor directory (via apiGoVendorHook)
  3. Apply substituteInPlace patches to hardcode Nix store paths:
    • internal/gounicorn/gounicorn.go: ./lifecycle → ${authentik-django}/lifecycle
    • web/static.go: ./web → ${authentik-django}/web
  4. Compute the vendorHash — note that the hook replaces vendored API code after hash verification, so the hash reflects go.sum only
  5. Rename the output binary from server to authentik
  6. Verify: ./authentik --help runs successfully

Key Details

  • Go module: goauthentik.io
  • Subpackage: ./cmd/server
  • CGO: disabled
  • The vendorHash must be computed with the vendor replacement hook excluded (overrideModAttrs)
  • Outpost binaries (cmd/ldap, cmd/proxy, cmd/radius) are separate and not needed for basic deployment

Related