Эта страница ещё не переведена: показана английская версия.
authentik (beta)¶
Whether authentik can still sign people in and keep its background work running: readiness, workers, failed system tasks, outposts that stopped reporting, version updates and the number of users.
Beta
Written from the vendor's API documentation and tested against realistic recorded-style responses, not yet against a live instance. Tell us what you see.
Network ports to open¶
From the DumbMonit server (or its relay agent) to the device:
| Port | Protocol | Purpose |
|---|---|---|
| 9000 | TCP | API (HTTP, default) |
| 9443 | TCP | Only with the https scheme on authentik's own HTTPS port |
| 443 | TCP | Only with the https scheme behind a reverse proxy |
The failure worth watching: work that silently stops. A worker that is gone means no source synchronisation, no e-mail, no clean-up, with nothing but a counter in the administration. An outpost that stopped reporting takes every application it protects down with it.
What it watches¶
All metrics are prefixed dumbmonit_authentik_.
| Metric | What | Labels |
|---|---|---|
live, ready |
1 while /-/health/live/ / /-/health/ready/ answer 2xx (ready covers the database and cache) |
|
version_info |
value 1 | version |
update_available |
1 when a newer release exists (absent when authentik cannot read the latest version) | latest_version |
workers, workers_version_mismatch |
workers reporting, and those on another version than the server | |
tasks_failed, tasks_warning |
system tasks whose last run failed / ended with a warning | |
task_failed |
value 1 for each failed task, at most 32 | task |
outposts_total, outposts_disconnected |
outposts that serve at least one provider, and those with no instance seen in five minutes | |
outpost_instances |
instances seen in the last five minutes (at most 10 outposts) | outpost |
users |
user accounts | |
scrape_errors |
calls that failed on the last probe |
The built-in rules that apply: authentik not ready, authentik has no worker, authentik task failed, authentik outpost disconnected, authentik update available, plus Monitor unreachable.
Create an API token in authentik¶
-
In authentik, open Directory → Users → Create a service account and name it as follows, without a random password.
dumbmonit -
Put that user in a group that can open the authentik interface, so it can read the system pages.
-
Open Directory → Tokens and App passwords, create a token for that user with the intent API Token and no expiry, and copy its key.
-
In DumbMonit, enter authentik's address and paste the key.
Warning
authentik has no read-only role for its system pages: the token's user must be allowed into the interface, so keep the key only in DumbMonit. Pages the token cannot read are skipped, not failed.
Credentials¶
| Credential | Fields |
|---|---|
| API token | Sent as Authorization: Bearer …. |
Address: a host name (auth.lan), host:port, or a full URL (https://auth.example.com). Options: protocol (HTTP by default), port (9000), certificate check and request timeout (15 s).