fix(auth): seed Authentik blueprint before compose gateway

[ironcommit]

Summary

Fix the Authentik Compose startup races seen while validating #631:

• Apply contrib/auth/authentik/helm/files/blueprints/nemo.yaml with a dedicated one-shot authentik-blueprint-init service instead of relying on Authentik custom blueprint auto-discovery from the long-running server/worker containers.
• Gate Envoy startup on authentik-blueprint-init completing successfully, so /health/gateway/ready is not polled until the NeMo Authentik applications/providers/users are seeded.
• Keep a bounded retry around ak apply_blueprint because Authentik can report server/worker health before its built-in default blueprints have created the provider flows and OAuth scope mappings referenced by nemo.yaml.
• Update the Compose implementation notes and static layout assertions to match.

CI Failures

• 29758464168 / 88408033334: gateway readiness returned HTTP 503 because Envoy saw Authentik return 404 for /application/o/nemo/.well-known/openid-configuration during startup.
• 29762432224 / 88421559941: after simplifying the init service to one direct ak apply_blueprint call, authentik-blueprint-init exited 1 with blueprint validation errors for missing default provider flows and OAuth scope mappings. That confirmed Authentik container health alone is not a sufficient gate.

Testing

• docker compose -f contrib/auth/authentik/compose/docker-compose.yml config --quiet
• git diff --check
• uv run --frozen pytest tests/auth_idp/static/test_provider_layout.py tests/auth_idp/static/test_docs_links.py -q
• Targeted Compose startup for authentik-blueprint-init with --exit-code-from authentik-blueprint-init exited 0.

Summary by CodeRabbit

• New Features

  • Added an initialization step that applies the shared Authentik blueprint automatically.
  • Gateway readiness now waits until blueprint setup completes successfully.
  • Blueprint setup retries automatically when Authentik is still initializing.

• Documentation

  • Updated Compose implementation guidance to describe the new blueprint setup flow.

• Tests

  • Added coverage for initialization, service readiness dependencies, networking, and blueprint mounting.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The Compose stack adds a retrying Authentik blueprint-init service, removes blueprint mounts from the main Authentik containers, and gates gateway startup on successful blueprint application. Documentation and static tests cover the new wiring.

Changes

Authentik blueprint initialization

Layer / File(s)	Summary
Init service and gateway ordering contrib/authentik/compose/docker-compose.yml	Adds authentik-blueprint-init, removes direct blueprint mounts from server and worker, and makes the gateway wait for successful initialization.
Documented and tested wiring contrib/authentik/compose/implementation-details.md, tests/auth_idp/static/test_provider_layout.py	Documents the shared blueprint source, readiness gating, and retries, and validates service configuration, dependencies, mounts, networking, and startup ordering.

Sequence Diagram(s)

sequenceDiagram
  participant authentik-server
  participant authentik-worker
  participant authentik-blueprint-init
  participant gateway
  authentik-server-->>authentik-blueprint-init: service_healthy
  authentik-worker-->>authentik-blueprint-init: service_healthy
  authentik-blueprint-init->>authentik-blueprint-init: retry apply nemo.yaml
  authentik-blueprint-init-->>gateway: service_completed_successfully
  gateway->>gateway: start

Loading

Suggested reviewers: anastasia-nesterenko

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: seeding the Authentik blueprint before gateway startup.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-authentik-compose-blueprint-init/rsadler

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@contrib/auth/authentik/compose/implementation-details.md`:
- Line 20: Replace the hardcoded Authentik product names in
implementation-details.md at lines 20-20 and 36-37 with the configured Sphinx
product-name substitution, preserving the surrounding prose and links.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6546d2e3-b534-4100-b3ef-57409b22c70a

📥 Commits

Reviewing files that changed from the base of the PR and between 945d06b and 72c984c.

📒 Files selected for processing (3)

• contrib/auth/authentik/compose/docker-compose.yml
• contrib/auth/authentik/compose/implementation-details.md
• tests/auth_idp/static/test_provider_layout.py

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	26385/34036	77.5%	61.8%
Integration Tests	15175/32661	46.5%	18.7%

[coderabbitai]

🧹 Nitpick comments (1)

contrib/auth/authentik/compose/docker-compose.yml (1)

152-169: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Use command here
ghcr.io/goauthentik/server:2024.12 already sets ENTRYPOINT ["dumb-init", "--", "ak"], so command: [apply_blueprint, /blueprints/custom/nemo.yaml] keeps the wrapper intact and avoids replacing it.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@contrib/auth/authentik/compose/docker-compose.yml` around lines 152 - 169,
Update the authentik-blueprint-init service to use a command override containing
apply_blueprint and /blueprints/custom/nemo.yaml instead of replacing the image
entrypoint. Preserve the image’s dumb-init and ak entrypoint wrapper while
keeping the existing environment, volumes, dependencies, and network settings
unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@contrib/auth/authentik/compose/docker-compose.yml`:
- Around line 152-169: Update the authentik-blueprint-init service to use a
command override containing apply_blueprint and /blueprints/custom/nemo.yaml
instead of replacing the image entrypoint. Preserve the image’s dumb-init and ak
entrypoint wrapper while keeping the existing environment, volumes,
dependencies, and network settings unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b6a4129a-bf21-4cd4-a6de-e45997bdd482

📥 Commits

Reviewing files that changed from the base of the PR and between 3f29a14 and e221ba1.

📒 Files selected for processing (2)

• contrib/auth/authentik/compose/docker-compose.yml
• tests/auth_idp/static/test_provider_layout.py