root: make default postgres schema configurable (#12949)

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

authentik/lib/default.yml

@@ -8,6 +8,7 @@ postgresql:
   password: "env://POSTGRES_PASSWORD"
   test:
     name: test_authentik
+  default_schema: public
   read_replicas: {}
   # For example
   # 0:

authentik/root/settings.py

@@ -129,6 +129,7 @@ TENANT_DOMAIN_MODEL = "authentik_tenants.Domain"
 
 TENANT_CREATION_FAKES_MIGRATIONS = True
 TENANT_BASE_SCHEMA = "template"
+PUBLIC_SCHEMA_NAME = CONFIG.get("postgresql.default_schema")
 
 GUARDIAN_MONKEY_PATCH = False
 

website/docs/install-config/configuration/configuration.mdx

@@ -82,6 +82,14 @@ To check if your config has been applied correctly, you can run the following co
 
 The PostgreSQL settings `HOST`, `PORT`, `USER`, and `PASSWORD` support hot-reloading. Adding and removing read replicas doesn't support hot-reloading.
 
+- `AUTHENTIK_POSTGRESQL__DEFAULT_SCHEMA` <span class="badge badge--version">authentik 2024.12+</span>
+
+    The name of the schema used by default in the database. Defaults to `public`.
+
+    It is only supported to change this value before the initial start of authentik.
+
+    When setting this value to any non-standard value, the schema must already exist in the database, and the user authentik connects with must have access to it. Additionally the `search_path` of the authentik database must be set to include this schema.
+
 ### Read replicas
 
 You can configure additional read replica databases that are used only for read operations. To configure authentik to use replicas, add the settings below to your [configuration file](./configuration.mdx#set-your-environment-variables). If you have multiple replicas, add additional settings for each replica, replacing the default `0` with a unique value for each additional replica.