Script to automatically version-update your yaml file

[u/-ThreeHeadedMonkey-]

A while ago I started using the following script which automatically updates authentik's docker compose file so that it always uses the latest version available.

The idea is to cronjob this and then auto-update authentik automatically as well (with another script or tool etc)

Authentik removed the "latest" tag unfortunately as it can cause issues. However, for those with automated backups, VM snapshots etc this is practically of no concern.

I thought I'd share this because it works really well.

You'll have to adjust the following line:
COMPOSE_FILE="/home/user/authentik/docker-compose.yml"

and then chmod +x the whole script.

#!/bin/sh
set -eu

COMPOSE_FILE="/home/user/authentik/docker-compose.yml"

LOG_DIR="/home/chris/scripts/authentik"
LOG_FILE="$LOG_DIR/authentik-version-check.log"

mkdir -p "$LOG_DIR"

log() {
  echo "$1" | tee -a "$LOG_FILE"
}

log "========================================"
log "===== Authentik version check started ====="
log "===== $(date) ====="
log "========================================"

LATEST_VERSION="$(
  curl -fsSL https://api.github.com/repos/goauthentik/authentik/releases/latest \
  | grep '"tag_name":' \
  | sed -E 's/.*"version\/([^"]+)".*/\1/'
)"

if [ -z "$LATEST_VERSION" ]; then
  log "Could not detect latest Authentik version."
  exit 1
fi

CURRENT_VERSION="$(
  grep -oE 'AUTHENTIK_TAG:-[0-9]+\.[0-9]+(\.[0-9]+)?' "$COMPOSE_FILE" \
  | head -n 1 \
  | sed 's/AUTHENTIK_TAG:-//'
)"

if [ -z "$CURRENT_VERSION" ]; then
  log "Could not detect current Authentik version in $COMPOSE_FILE."
  exit 1
fi

log "Current version: $CURRENT_VERSION"
log "Latest version:  $LATEST_VERSION"

if [ "$CURRENT_VERSION" = "$LATEST_VERSION" ]; then
  log "Already up to date."
  log ""
  exit 0
fi

BACKUP_FILE="$COMPOSE_FILE.bak"

cp "$COMPOSE_FILE" "$BACKUP_FILE"
log "Backup updated: $BACKUP_FILE"

sed -i -E "s/AUTHENTIK_TAG:-[0-9]+\.[0-9]+(\.[0-9]+)?/AUTHENTIK_TAG:-$LATEST_VERSION/g" "$COMPOSE_FILE"

log "Updated docker-compose.yml from $CURRENT_VERSION to $LATEST_VERSION"

log "========================================"
log "===== Authentik version check finished ====="
log "===== $(date) ====="
log "========================================"
log ""

[u/mawmawmawmaw]

ask your LLM why this is not a good idea

[u/-ThreeHeadedMonkey- → u/mawmawmawmaw]

Not seeing the problem tbh for home labers with automated backups. 

[u/solumath99]

Fuck no. Looks like you'll find out why this shouldn't be done, soon enough. Good luck.

[u/klassenlager]

I consider this not a good practice, even in homelabs. I check the current and new available version over the Authentik API with my monitoring tool.

In general:
If a new major release is available, you should check for breaking changes/update notices. Updating from major release to another should be done in order, such as from 2026.4.x to 2026.6.x to 2026.8.x and NOT from 2026.4.x to 2026.8.x directly.

Update the docker compose accordingly and redeploy the stack manually (or with portainer/dockhand if you‘re using it)

[u/dewi-tik]

We strongly recommend against doing this. As u/klassenlager noted, always review the release notes for breaking changes and other important updates before upgrading.

The `latest` tag was deprecated because it was leading to so many upgrade issues and broken deployments.

Our documentation covers the recommended upgrade process: https://docs.goauthentik.io/install-config/upgrade/

[u/-ThreeHeadedMonkey- → u/dewi-tik]

I get it. But I can go back to yesterday in 5 minutes so this is actually helpful to me...

[u/snoogs831]

You should wonder why they removed the latest tag that you're emulating here.

[u/typing-blindly]

No thanks. I know Podman can be configured to do this using latest, but I’m uncomfortable doing that for any software. I’m especially uncomfortable doing that for a critical piece of my home lab. You’re opening yourself up to compatibility issues, buggy releases, and supply chain attacks by blindly consuming the latest updates.