From f7aec7f154595948d748e8525556d5b550f6a098 Mon Sep 17 00:00:00 2001 From: Frank Date: Fri, 30 Oct 2026 15:34:02 -0700 Subject: [PATCH] fix(authentik): restart the units so an image bump actually applies The handler called `systemctl --user start` on all three units. Start is a no-op for an already-active unit, so installing a new digest under an active authentik left the old container serving: today's 2026.8.3 -> 2026.8.5 bump moved only the OUTPOST (whose handler restarts) and left server + worker on 2026.8.3 while the deploy, the health gate and the e2e suite were all green. The generator re-renders from the .container, so a restart is the step that applies a pin. --- scripts/deploy-remote.sh | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/scripts/deploy-remote.sh b/scripts/deploy-remote.sh index d24fba9..3042835 100755 --- a/scripts/deploy-remote.sh +++ b/scripts/deploy-remote.sh @@ -1362,11 +1362,17 @@ deploy_authentik() { # generated". Boot persistence comes from [Install] WantedBy=default.target # inside each .container file, which the generator honors at user-manager # start (linger must stay on for the deploy user). - systemctl --user start authentik-postgres.service + # RESTART, not start: `start` on an already-active unit is a no-op, so an + # image bump would install the new digest and keep serving the old + # container while every gate stayed green (measured 2026-10-30: server and + # worker stayed on the previous release beside an outpost that moved, + # because only the outpost handler restarts). The generator has already + # re-rendered the unit from the .container, so a restart is what applies it. + systemctl --user restart authentik-postgres.service wait_container_healthy authentik-postgres 120 || return 1 - systemctl --user start authentik-server.service + systemctl --user restart authentik-server.service wait_container_healthy authentik-server 300 || return 1 - systemctl --user start authentik-worker.service + systemctl --user restart authentik-worker.service } deploy_authentik_outpost() {