Hi,

I've been working quite a while on this authentik service module and now want to share it with the NixOS community. I'm aware of https://github.com/nix-community/authentik-nix/ but I've done a couple of things a bit different.

Things that imho are solved better compared to authentik-nix:

1. This module provides high-level config options for the most important settings while still allowing to set config based on environment variables, so that starting a simple authentik instance is literally possible within seconds (authentik-nix requires providing an environment file for all settings).
2. This module per default uses Unix sockets for Redis which helps to prevent collisions with other services using Redis (authentik-nix uses a port).
3. This module does NOT include Nginx to provide a reverse proxy with TLS certs (authentik-nix does)
4. This module configures the service solely based on environment variables (authentik-nix additionally generates a config file based on the passed environment variables).

Things that are missing compared to authentik-nix:

1. authentik-nix allows configuring authentik outposts also, which could be added to this module later.
2. authentik-nix provides a pre-configured CLI wrapper, which would be nice to have for this module also, but which is not so easy to implement in a clean way. So I think it's okay that it's missing.
3. authentik-nix has a dedicated oneshot service to run migrations. This module oriented more on the official docker-compose file which just runs migrations with either the authentik-core or authentik-worker service.

In general I would say this module is more implemented the NixOS-way. But I also know that the 8 contributors of authentik-nix have invested a lot of brainpower and might have more experience with authentik and Linux / NixOS in general. And I may also have oversimplified things.

That being said, I'm looking forward for your reviews! Thanks!

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

Add a 👍 reaction to pull requests you find important.