Authentik

# MISSION: Scaffold "Authentik" Production Architecture
You are an expert Senior Staff Software Architect and Full-Stack Engineer. Your mission is to scaffold and implement a production-grade, highly reliable, and modular codebase following the proven architecture of **Authentik**.
---
## 1. PROJECT SPECIFICATIONS & BENCHMARK
- **Reference Architecture**: Authentik
- **What It Does**: authentik is an open-source identity provider for self-hosted single sign-on, supporting SAML, OAuth2/OIDC, LDAP, and RADIUS, built as a Django core with Go outpost proxies for legacy protocols and a Lit-based web UI.
- **Domain & Category**: Identity Provider & Access Management
- **Production Scale**: 6-20 people
- **Development Mode**: CLASSIC
- **Architectural Rationale**: Replacing Redis with three purpose-built PostgreSQL-backed packages for channels, cache, and task queueing shrinks the required external dependencies to just PostgreSQL, while protocol proxying is pushed into separate Go outposts instead of the main Django process.
- **Live Website Reference**: https://goauthentik.io
- **Source Repository**: https://github.com/goauthentik/authentik
---
## 2. PRODUCTION TECH STACK
- **Full Stack Array**: Python, Django, TypeScript, Lit, Vite, Rust, Axum, Go, PostgreSQL
- **Primary Language(s)**: Python, TypeScript, Rust
- **License of the reference repo**: NOASSERTION
- **Frontend**: Lit — Web-components framework behind the admin and user-facing UI (path aliases for #elements, #components, #flow, #admin).; Vite — Bundles the Lit-based web frontend.; Storybook — Component development and visual documentation for the web UI.; Docusaurus — Powers the goauthentik.io documentation site, built as its own package.
- **Backend & APIs**: Python — Primary backend language for the Django application (authentik/).; Django — Web framework for the core application, admin, and API (django==5.2.17).; Django REST Framework — REST API layer, with drf-spectacular generating the OpenAPI schema.; Django Channels — ASGI/WebSocket layer for realtime features (channels==4.3.2).; Rust (Axum) — packages/ak-axum is a Rust workspace member built on the axum web framework for performance-sensitive services.; Go — Outpost binaries (cmd/ldap, cmd/rac, cmd/radius) proxy LDAP, remote desktop (via Guacamole), and RADIUS protocols to authentik.
- **Data & persistence**: PostgreSQL — Primary datastore; django-postgres-extra and django-tenants (multi-tenancy) are direct dependencies.; django-channels-postgres — In-house Postgres-backed Channels layer, replacing Redis as the channel layer backend.; django-postgres-cache — In-house Postgres-backed Django cache backend, replacing Redis as the cache.; django-dramatiq-postgres — Postgres-backed Dramatiq task queue broker/result backend for background jobs.
- **Infrastructure & deploy**: Docker — Multi-stage container build; lifecycle/container/Dockerfile compiles the web UI with pnpm before the Python image.; Kubernetes — Officially supported deployment target via a separate Helm chart repository; the Python client is a direct dependency for the Kubernetes outpost controller.; pnpm — Package manager for the root, web/, and website/ JavaScript workspaces.
- **Tooling, testing & ops**: GitHub Actions — Split CI per surface: ci-main.yml (core), ci-outpost.yml (Go outposts), ci-web.yml (frontend), ci-docs.yml, plus CodeQL and Semgrep scanning.; Sentry — Error tracking SDK included in the backend dependency set.; OpenTelemetry — Distributed tracing/metrics instrumentation across ASGI, Django, psycopg, requests, and threading.
---
## 3. KEY ARCHITECTURAL DECISIONS (audited from https://github.com/goauthentik/authentik @ 836aad0)
1. **Postgres replaces Redis for channels, cache, and the task queue**: pyproject.toml requires django-channels-postgres, django-postgres-cache, and django-dramatiq-postgres, each implemented as its own package under packages/. No redis dependency appears anywhere in the audited manifests, meaning a standard authentik deployment needs only PostgreSQL as external state, not PostgreSQL plus Redis.
2. **Legacy-protocol connectors run as separate Go "outpost" binaries, not the Django process**: cmd/ldap, cmd/rac, and cmd/radius (backed by go.mod dependencies beryju.io/ldap, wwt/guac for Guacamole-based remote access, and layeh.com/radius) are standalone Go outposts that proxy LDAP, RDP/VNC/SSH, and RADIUS to authentik over its API, so protocols the Python/ASGI stack does not natively speak still route through authentik without embedding them in the main app.
3. **A Rust/Axum workspace exists alongside the Python core**: Cargo.toml declares a workspace with packages/ak-axum, packages/ak-common, and packages/client-rust as members, pinned to axum 0.8.9 with HTTP/2 and websocket features. This is a separate, pinned-dependency Rust service layer distinct from both the Django backend and the Go outposts.
4. **Multi-tenancy is a first-class dependency, not an add-on**: pyproject.toml requires django-tenants==3.13.0 directly, which authentik uses to support its enterprise multi-tenant deployment mode on top of the same PostgreSQL schema-based isolation the library provides.
5. **Web UI, docs site, and backend are independently versioned projects in one repo**: web/package.json (Lit + Vite), website/package.json (Docusaurus, via packages/docusaurus-config), and the root pyproject.toml/Django app each have their own lockfiles and CI jobs (ci-web.yml, ci-docs.yml, ci-main.yml), letting frontend, documentation, and backend release independently within the monorepo.
---
## 4. NON-NEGOTIABLE ARCHITECTURAL GUARDRAILS
1. **Monorepo & Modular Separation**:
   - Structure as a Turborepo monorepo with strict package boundaries:
     - `apps/web`: Application UI, routing, layouts, and server endpoints.
     - `packages/ui`: Shared design tokens, CSS variables, and Radix UI primitive components.
     - `packages/db`: Database schemas, client singleton, declarative migrations, and seed scripts.
     - `packages/config`: Shared TypeScript, ESLint, and build configurations.
2. **Strict Type Safety & Zero `any` Policy**:
   - Enable `strict: true`, `noImplicitAny: true`, and `strictNullChecks: true`.
   - Validate ALL external inputs, API request bodies, and query parameters with **Zod** schemas before execution.
3. **Frontend & Rendering Guidelines**:
   - Utilize Vite 6 with TanStack Router for fully type-safe routing. Manage server state and caching via TanStack Query v5 with optimistic UI updates.
4. **Design System & Aesthetics**:
   - Keep every color, radius, shadow and font in a single token file (CSS variables) and consume tokens everywhere; never hardcode hex values in components.
   - Prefer crisp 1px borders and one subtle shadow scale over blurry default shadows. Pair one sans-serif for body/headings with one monospace for tags, badges, metrics, and code.
5. **Data Layer & Reliability**:
   - Write declarative schema definitions with foreign keys, composite indexes on queried filters, and automated timestamp triggers.
   - Use connection pooling and prepared statements for serverless database execution.
---
## 5. STEP-BY-STEP SCAFFOLDING ROADMAP
- **Phase 1: Workspace & Root Config**: Initialize package manager, monorepo configuration (`turbo.json`, `tsconfig.base.json`, `package.json`).
- **Phase 2: Database Schema & Client**: Set up the data layer (PostgreSQL, django-channels-postgres, django-postgres-cache, django-dramatiq-postgres): client, connection pool, models, and migration scripts.
- **Phase 3: Design Tokens & UI Primitives**: Build accessible `Button`, `Input`, `Card`, `Badge`, and layout wrappers inside `packages/ui`.
- **Phase 4: Core Application Routes & Handlers**: Implement primary authentication, user session handling, and application routes.
- **Phase 5: Quality Assurance & Build Verification**: Run `tsc --noEmit`, ESLint, Prettier, and smoke test suites to ensure zero compilation or runtime errors.
---
## 6. EXECUTION INSTRUCTIONS
1. Review all specifications, architectural guardrails, and stack choices above.
2. Present the full monorepo directory tree structure.
3. Systematically generate the complete, production-ready codebase according to the 5-phase roadmap above — starting with the root workspace setup, followed by the database schema, UI design system package, and full-stack application routes until the repository is fully scaffolded and ready to run.