From 09db633dca3e466aa0cbdbda26d5f7de9f95a1fc Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Fri, 28 Aug 2026 03:21:31 -0700
Subject: [PATCH] authentik: fix quadlet v1 generator dialect on this host
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Probed the live generator on dankclaw: podman 5.x v1 hard-fails unit
generation on dash-prefixed options (--shm-size killed authentik-server's
unit) and rejects Command= entirely; Exec= is the accepted role selector.
Drop --shm-size (uwsgi uses unix sockets under /run, not /dev/shm; default
64m shm is fine) and drop systemctl --user enable — generated units are
transient and cannot be enabled; WantedBy=default.target in each unit file
is what makes them boot-persistent on this generator.
---
 dankclaw/authentik/quadlet/authentik-server.container | 1 -
 scripts/deploy-remote.sh                              | 7 ++++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/dankclaw/authentik/quadlet/authentik-server.container b/dankclaw/authentik/quadlet/authentik-server.container
index 60c945d..12692cb 100644
--- a/dankclaw/authentik/quadlet/authentik-server.container
+++ b/dankclaw/authentik/quadlet/authentik-server.container
@@ -30,7 +30,6 @@ Environment=AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_PG_PASS}
 Environment=AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
 PublishPort=127.0.0.1:9000:9000
 HealthCmd=python -c "import urllib.request;urllib.request.urlopen('http://localhost:9000/-/health/')"
---shm-size=512m
 HealthInterval=30s
 HealthTimeout=10s
 HealthRetries=5
diff --git a/scripts/deploy-remote.sh b/scripts/deploy-remote.sh
index 699df9d..95c3d2c 100755
--- a/scripts/deploy-remote.sh
+++ b/scripts/deploy-remote.sh
@@ -537,7 +537,12 @@ deploy_authentik() {
         podman stop authentik-postgres authentik-server authentik-worker 2>/dev/null || true
         podman rm authentik-postgres authentik-server authentik-worker 2>/dev/null || true
     fi
-    systemctl --user enable authentik-postgres.service authentik-server.service authentik-worker.service
+    # No `systemctl --user enable` here: this host's quadlet generator
+    # (podman 5.x v1) generates units into /run/user/1000/systemd/generator/,
+    # and generated units cannot be enabled — enable fails with "transient or
+    # generated". Boot persistence comes from [Install] WantedBy=default.target
+    # inside each .container file, which the generator honors at user-manager
+    # start (linger must stay on for the deploy user).
     systemctl --user start authentik-postgres.service
     wait_container_healthy authentik-postgres 120 || return 1
     systemctl --user start authentik-server.service