habsi/authentik
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

website/docs: install: add aws (#12082)

Browse Source
This commit is contained in:
Marc 'risson' Schmitt
2024-12-01 16:43:14 +01:00
committed by GitHub
parent 13b2543221
commit fda6054285
17 changed files with 1905 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
website/docs/install-config/install/aws/.gitignore vendored Normal file
View File

@ -0,0 +1 @@
cdk.out

421
website/docs/install-config/install/aws/app.py Executable file
View File

@ -0,0 +1,421 @@
#!/usr/bin/env python3
import json
from aws_cdk import (
App,
CfnOutput,
CfnParameter,
Duration,
RemovalPolicy,
Stack,
)
from aws_cdk import (
aws_ec2 as ec2,
)
from aws_cdk import (
aws_ecs as ecs,
)
from aws_cdk import (
aws_efs as efs,
)
from aws_cdk import (
aws_elasticache as elasticache,
)
from aws_cdk import (
aws_elasticloadbalancingv2 as elbv2,
)
from aws_cdk import (
aws_rds as rds,
)
from aws_cdk import (
aws_secretsmanager as secretsmanager,
)
from constructs import Construct
from authentik import __version__
class AuthentikStack(Stack):
def __init__(self, scope: Construct, id: str, **kwargs):
super().__init__(scope, id, *kwargs)
### Inputs
db_instance_type = CfnParameter(
self,
"DBInstanceType",
type="String",
default="m5.large",
description="RDS PostgreSQL instance type (without the leading db.)",
)
db_version = CfnParameter(
self, "DBVersion", type="String", default="17.1", description="RDS PostgreSQL version"
)
db_storage = CfnParameter(
self,
"DBStorage",
type="Number",
default=10,
min_value=10,
description="RDS PostgreSQL storage size in GB",
)
redis_instance_type = CfnParameter(
self,
"RedisInstanceType",
type="String",
default="cache.t4g.medium",
description="ElastiCache Redis instance type (with the leading cache.)",
)
redis_version = CfnParameter(
self,
"RedisVersion",
type="String",
default="7.1",
description="ElastiCache Redis version",
)
authentik_image = CfnParameter(
self,
"AuthentikImage",
type="String",
default="ghcr.io/goauthentik/server",
description="authentik Docker image",
)
authentik_version = CfnParameter(
self,
"AuthentikVersion",
type="String",
default=__version__,
description="authentik Docker image tag",
)
server_cpu = CfnParameter(
self,
"AuthentikServerCPU",
type="Number",
default=512,
description="authentik server CPU units (1024 = 1 vCPU)",
)
server_memory = CfnParameter(
self,
"AuthentikServerMemory",
type="Number",
default=1024,
description="authentik server memory in MiB",
)
server_desired_count = CfnParameter(
self,
"AuthentikServerDesiredCount",
type="Number",
default=2,
min_value=1,
description="Desired number of authentik server tasks",
)
worker_cpu = CfnParameter(
self,
"AuthentikWorkerCPU",
type="Number",
default=512,
description="authentik worker CPU units (1024 = 1 vCPU)",
)
worker_memory = CfnParameter(
self,
"AuthentikWorkerMemory",
type="Number",
default=1024,
description="authentik worker memory in MiB",
)
worker_desired_count = CfnParameter(
self,
"AuthentikWorkerDesiredCount",
type="Number",
default=2,
min_value=1,
description="Desired number of authentik worker tasks",
)
certificate_arn = CfnParameter(
self,
"CertificateARN",
type="String",
description="ACM certificate ARN for HTTPS access",
)
### Resources
# VPC
vpc = ec2.Vpc(self, "AuthentikVpc", max_azs=2, nat_gateways=1)
# Security Groups
db_security_group = ec2.SecurityGroup(
self, "DatabaseSG", vpc=vpc, description="Security Group for authentik RDS PostgreSQL"
)
redis_security_group = ec2.SecurityGroup(
self, "RedisSG", vpc=vpc, description="Security Group for authentik ElastiCache Redis"
)
authentik_security_group = ec2.SecurityGroup(
self, "AuthentikSG", vpc=vpc, description="Security Group for authentik services"
)
db_security_group.add_ingress_rule(
peer=authentik_security_group,
connection=ec2.Port.tcp(5432),
description="Allow authentik to connect to RDS PostgreSQL",
)
redis_security_group.add_ingress_rule(
peer=authentik_security_group,
connection=ec2.Port.tcp(6379),
description="Allow authentik to connect to ElastiCache Redis",
)
# Generated secrets
db_password = secretsmanager.Secret(
self,
"DBPassword",
generate_secret_string=secretsmanager.SecretStringGenerator(
secret_string_template=json.dumps({"username": "authentik"}),
generate_string_key="password",
password_length=64,
exclude_characters='"@/\\',
),
)
secret_key = secretsmanager.Secret(
self,
"AuthentikSecretKey",
generate_secret_string=secretsmanager.SecretStringGenerator(
password_length=64, exclude_characters='"@/\\'
),
)
# Database
database = rds.DatabaseInstance(
self,
"AuthentikDB",
engine=rds.DatabaseInstanceEngine.postgres(
version=rds.PostgresEngineVersion.of(db_version.value_as_string, ""),
),
instance_type=ec2.InstanceType(db_instance_type.value_as_string),
vpc=vpc,
vpc_subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS),
allocated_storage=db_storage.value_as_number,
security_groups=[db_security_group],
database_name="authentik",
credentials=rds.Credentials.from_secret(db_password),
multi_az=True,
removal_policy=RemovalPolicy.SNAPSHOT,
)
# Redis
redis_subnet_group = elasticache.CfnSubnetGroup(
self,
"AuthentikRedisSubnetGroup",
subnet_ids=vpc.select_subnets(
subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS
).subnet_ids,
description="Subnet group for authentik ElastiCache Redis",
)
redis = elasticache.CfnReplicationGroup(
self,
"AuthentikRedis",
replication_group_description="Redis cluster for authentik",
engine="redis",
engine_version=redis_version.value_as_string,
cache_node_type=redis_instance_type.value_as_string,
num_cache_clusters=2,
automatic_failover_enabled=True,
security_group_ids=[redis_security_group.security_group_id],
cache_subnet_group_name=redis_subnet_group.ref,
)
# Storage
media_fs = efs.FileSystem(
self,
"AuthentikMediaEFS",
vpc=vpc,
removal_policy=RemovalPolicy.RETAIN,
security_group=ec2.SecurityGroup(
self,
"AuthentikMediaEFSSecurityGroup",
vpc=vpc,
description="Security group for authentik media EFS",
allow_all_outbound=True,
),
encrypted=True,
performance_mode=efs.PerformanceMode.GENERAL_PURPOSE,
throughput_mode=efs.ThroughputMode.BURSTING,
)
media_fs.connections.allow_default_port_from(authentik_security_group)
media_access_point = media_fs.add_access_point(
"AuthentikMediaAccessPoint",
path="/media",
create_acl=efs.Acl(owner_uid="1000", owner_gid="1000", permissions="755"),
posix_user=efs.PosixUser(uid="1000", gid="1000"),
)
# ECS Cluster
cluster = ecs.Cluster(self, "AuthentikCluster", vpc=vpc)
environment = {
"AUTHENTIK_POSTGRESQL__HOST": database.instance_endpoint.hostname,
"AUTHENTIK_POSTGRESQL__USER": "authentik",
"AUTHENTIK_REDIS__HOST": redis.attr_primary_end_point_address,
}
secrets = {
"AUTHENTIK_POSTGRESQL__PASSWORD": ecs.Secret.from_secrets_manager(
db_password, field="password"
),
"AUTHENTIK_SECRET_KEY": ecs.Secret.from_secrets_manager(secret_key),
}
server_task = ecs.FargateTaskDefinition(
self,
"AuthentikServerTask",
cpu=server_cpu.value_as_number,
memory_limit_mib=server_memory.value_as_number,
)
server_task.add_volume(
name="media",
efs_volume_configuration=ecs.EfsVolumeConfiguration(
file_system_id=media_fs.file_system_id,
transit_encryption="ENABLED",
authorization_config=ecs.AuthorizationConfig(
access_point_id=media_access_point.access_point_id,
iam="ENABLED",
),
),
)
server_container = server_task.add_container(
"AuthentikServerContainer",
image=ecs.ContainerImage.from_registry(
f"{authentik_image.value_as_string}:{authentik_version.value_as_string}"
),
command=["server"],
environment=environment,
secrets=secrets,
logging=ecs.LogDriver.aws_logs(stream_prefix="authentik-server"),
enable_restart_policy=True,
health_check=ecs.HealthCheck(
command=["CMD", "ak", "healthcheck"],
interval=Duration.seconds(30),
retries=3,
start_period=Duration.seconds(60),
timeout=Duration.seconds(30),
),
)
server_container.add_port_mappings(ecs.PortMapping(container_port=9000))
server_container.add_mount_points(
ecs.MountPoint(container_path="/media", source_volume="media", read_only=False)
)
server_service = ecs.FargateService(
self,
"AuthentikServerService",
cluster=cluster,
task_definition=server_task,
desired_count=server_desired_count.value_as_number,
security_groups=[authentik_security_group],
vpc_subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS),
enable_execute_command=True,
)
worker_task = ecs.FargateTaskDefinition(
self,
"AuthentikWorkerTask",
cpu=worker_cpu.value_as_number,
memory_limit_mib=worker_memory.value_as_number,
)
worker_task.add_volume(
name="media",
efs_volume_configuration=ecs.EfsVolumeConfiguration(
file_system_id=media_fs.file_system_id,
transit_encryption="ENABLED",
authorization_config=ecs.AuthorizationConfig(
access_point_id=media_access_point.access_point_id,
iam="ENABLED",
),
),
)
worker_container = worker_task.add_container(
"AuthentikWorkerContainer",
image=ecs.ContainerImage.from_registry(
f"{authentik_image.value_as_string}:{authentik_version.value_as_string}"
),
command=["worker"],
environment=environment,
secrets=secrets,
logging=ecs.LogDriver.aws_logs(stream_prefix="authentik-worker"),
enable_restart_policy=True,
health_check=ecs.HealthCheck(
command=["CMD", "ak", "healthcheck"],
interval=Duration.seconds(30),
retries=3,
start_period=Duration.seconds(60),
timeout=Duration.seconds(30),
),
)
worker_container.add_mount_points(
ecs.MountPoint(container_path="/media", source_volume="media", read_only=False)
)
worker_service = ecs.FargateService( # noqa: F841
self,
"AuthentikWorkerService",
cluster=cluster,
task_definition=worker_task,
desired_count=worker_desired_count.value_as_number,
security_groups=[authentik_security_group],
vpc_subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS),
enable_execute_command=True,
)
# Load balancer
lb = elbv2.ApplicationLoadBalancer(
self,
"AuthentikALB",
vpc=vpc,
internet_facing=True,
)
https_redirect = lb.add_listener( # noqa: F841
"AuthentikHttpListener",
port=80,
default_action=elbv2.ListenerAction.redirect(permanent=True, protocol="HTTPS"),
)
listener = lb.add_listener(
"AuthentikHttpsListener",
port=443,
certificates=[
elbv2.ListenerCertificate(certificate_arn=certificate_arn.value_as_string)
],
)
target_group = listener.add_targets( # noqa: F841
"AuthentikServerTarget",
protocol=elbv2.ApplicationProtocol.HTTP,
port=9000,
targets=[server_service],
health_check=elbv2.HealthCheck(
path="/-/health/live/",
healthy_http_codes="200",
),
)
CfnOutput(
self,
"LoadBalancerDNS",
value=lb.load_balancer_dns_name,
)
app = App()
AuthentikStack(app, "AuthentikStack")
app.synth()

3
website/docs/install-config/install/aws/cdk.json Normal file
View File

@ -0,0 +1,3 @@
{
"app": "./app.py"
}

11
website/docs/install-config/install/aws/fix_template.py Executable file
View File

@ -0,0 +1,11 @@
#!/usr/bin/env python3
import yaml
with open("template.yaml") as file:
template = yaml.safe_load(file)
del template["Conditions"]["CDKMetadataAvailable"]
del template["Parameters"]["BootstrapVersion"]
del template["Resources"]["CDKMetadata"]
with open("template.yaml", "w") as file:
yaml.dump(template, file)

34
website/docs/install-config/install/aws/index.md Normal file
View File

@ -0,0 +1,34 @@
---
title: AWS installation
---
You can install authentik to run on AWS with a CloudFormation template.
### Prerequisites
- An AWS account.
- An [AWS Certificate Manager](https://aws.amazon.com/certificate-manager/) certificate. Take note of the ARN of the certificate.
### Installation
Log in to your AWS account and create a CloudFormation stack [with our template](https://console.aws.amazon.com/cloudformation/home#/stacks/create/review?stackName=authentik&templateURL=https://authentik-cloudformation-templates.s3.amazonaws.com/authentik.ecs.latest.yaml).
Under the **Certificate ARN** input, enter the previously created certificate ARN. You can also configure other settings if needed. You can follow the prompts to create the stack.
This stack will create the following resources:
- AWS SSM secrets for the PostgreSQL user and the authentik secret key
- A VPC for all other resources
- A RDS PostgreSQL Multi-AZ cluster
- An ElastiCache Redis Multi-AZ cluster
- An ECS cluster with two tasks:
- One for the authentik server
- One for the authentik worker
- An ALB (Application Load Balancer) pointing to the authentik server ECS task with the configured certificate
- An EFS filesystem mounted on both ECS tasks for media file storage
The stack will output the endpoint of the ALB that to which you can point your DNS records.
### Further customization
If you require further customization, we recommend you install authentik via [Docker Compose](../docker-compose.mdx) or [Kubernetes](../kubernetes.md).

1144
website/docs/install-config/install/aws/template.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

10
website/docs/install-config/upgrade.mdx
View File

@ -39,7 +39,7 @@ import TabItem from "@theme/TabItem";
```
</TabItem>
<TabItem value="kubernetes" label="Kubernetes">
<TabItem value="kubernetes" label="Kubernetes">
In your terminal, navigate to your installation directory and run the following commands:
```
@ -48,6 +48,14 @@ import TabItem from "@theme/TabItem";
```
</TabItem>
<TabItem value="aws-cloudformation-ecs" label="AWS Cloudformation ECS">
Navigate to your authentik AWS Cloudformation stack. Click on the **Changesets** tab and **Create changeset**.
Select **Use existing template** and follow the prompts to upgrade.
To upgrade to a specific version, select **Replace existing template** and use the following URL: `https://authentik-cloudformation-templates.s3.amazonaws.com/authentik.ecs.VERSION.yaml` replacing `VERSION` with the version you want to upgrade to. You can use `latest` to upgrade to the latest version.
</TabItem>
</Tabs>
## Verify your upgrade