perf(authentik): disable Postgres JIT, persistent DB connections

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-04 09:52:41 +01:00
5 changed files with 9 additions and 106 deletions
@@ -69,32 +69,6 @@ The FreeRADIUS clients `test` (10.2.50.0/24) and `test6` (fd02:50::/64) and
 their CIDRs in `freeradius-cnp.yaml` are for the test phase only and must be
 removed after the test.

-## UniFi objects
-
-Created through the UniFi Network API (site `default`):
-
-| Object | ID | Settings |
-|---|---|---|
-| Firewall policy "Allow APs RADIUS" | `62c21e63-8c15-4720-adf8-b2333c090e2f` | zone Isolated `10.2.10.0/24` → zone External `10.2.99.91`, UDP `1812-1813`, ALLOW, IPv4 |
-| RADIUS profile "Cluster 802.1X" | `3e5fcfed-63dc-4e7d-ad51-17cbc074e4bb` | auth `10.2.99.91:1812`, acct `10.2.99.91:1813`, secret `DOT1X_NAS_SECRET`, VLAN assignment on (`vlan_wlan_mode: optional`) |
-| WLAN "Renner Test" | `3eba27e7-ddc2-41fb-ad3f-82add317847a` | copy of "Renner UniFi" (WPA2/WPA3 Enterprise transition, fast roaming, BSS transition, same AP group and bands), network (90) Guest as fallback, RADIUS profile "Cluster 802.1X" |
-
-## Live login check
-
-`tests/radius/live.sh` runs EAP-TTLS/PAP logins with `eapol_test` against the
-deployed FreeRADIUS from a test client range and prints result, duration and
-the VLAN attributes of the Access-Accept (hex) per login; secrets are read from
-files and never printed:
-
-```
-LIVE_PASSWORD_VAR=CLAUDE_BOT_PASSWORD tests/radius/live.sh 10.2.99.91 claude-bot \
-  ~/.config/claude-bot/authentik ~/.config/claude-bot/radius-secret 20
-```
-
-For IPv6 set `LIVE_SOURCE` to the workstation's `fd02:50::` address and use
-`fd99::91`. `group-id=[3530]` is VLAN `50`, `tunnel-type=[0000000d]` VLAN,
-`medium=[00000006]` IEEE-802.
-
 ## Client setup (SSID "Renner Test")

 All clients use EAP-TTLS with inner PAP. The server certificate is a public
@@ -73,6 +73,10 @@ spec:
      # on an unclean shutdown is not an acceptable trade.
      checkpoint_timeout: "15min"
      max_wal_size: "2GB"
+      # authentik's subclass joins over empty tables get planner costs far above
+      # jit_above_cost; LLVM compilation then takes ~420 ms for a query that
+      # executes in 0.1 ms (every flow start, every RADIUS/LDAP login).
+      jit: "off"
      # zstd, not "on": the boolean spelling resolves to pglz (2016-era, weaker
      # and slower than the lz4/zstd this build also accepts). Compresses the
      # full-page images that dominate WAL volume after each checkpoint.
@@ -69,6 +69,11 @@ spec:
            secretKeyRef:
              name: ak-pg-app
              key: password
+        # Default 0 opens a new Postgres connection per request.
+        - name: AUTHENTIK_POSTGRESQL__CONN_MAX_AGE
+          value: "60"
+        - name: AUTHENTIK_POSTGRESQL__CONN_HEALTH_CHECKS
+          value: "true"
        - name: AUTHENTIK_EMAIL__PASSWORD
          valueFrom:
            secretKeyRef:
@@ -31,6 +31,3 @@ Pieces:
 Requires Docker, `openssl` and `yq` (the jq wrapper). Secrets, password and
 certificates are generated dummies. `RADTEST_DEBUG=1` runs radiusd with `-xx`
 and prints all logs. Containers, network and temp files are removed on exit.
-
-`live.sh` logs in against the deployed FreeRADIUS instead; usage in
-`docs/radius/dot1x.md` ("Live login check").
@@ -1,77 +0,0 @@
-#!/usr/bin/env bash
-# Live EAP-TTLS/PAP login against the deployed FreeRADIUS from a test client
-# (10.2.50.0/24 / fd02:50::/64, client "test"/"test6").
-#
-# Usage: tests/radius/live.sh <server-ip> <identity> <password-file> <secret-file> [count]
-#   password-file: the password on the first line, or `export NAME=value` lines
-#                  (LIVE_PASSWORD_VAR selects the variable, default CLAUDE_BOT_TOKEN)
-#   secret-file:   `bao kv get` output of apps/radius, or the bare
-#                  DOT1X_TEST_SECRET on the first line
-#   count:         number of logins (default 1)
-#   LIVE_SOURCE:   optional local address for eapol_test -A (must be in a
-#                  test client range)
-# Prints one line per login: result, duration, VLAN. Secrets are never printed.
-set -euo pipefail
-
-server="$1"
-identity="$2"
-password_file="$3"
-secret_file="$4"
-count="${5:-1}"
-password_var="${LIVE_PASSWORD_VAR:-CLAUDE_BOT_TOKEN}"
-
-read_password() {
-  local line
-  line=$(grep -m1 -E "^export ${password_var}=" "$password_file" || true)
-  if [ -n "$line" ]; then
-    line="${line#*=}"
-    line="${line#\"}"; line="${line%\"}"
-    line="${line#\'}"; line="${line%\'}"
-    printf '%s' "$line"
-  else
-    head -n1 "$password_file"
-  fi
-}
-
-read_secret() {
-  local s
-  s=$(sed -n 's/.*DOT1X_TEST_SECRET:\([^] ]*\).*/\1/p' "$secret_file")
-  if [ -n "$s" ]; then printf '%s' "$s"; else head -n1 "$secret_file"; fi
-}
-
-work=$(mktemp -d)
-trap 'rm -rf "$work"' EXIT
-chmod 700 "$work"
-
-password=$(read_password)
-secret=$(read_secret)
-[ -n "$password" ] || { echo "no password found in $password_file" >&2; exit 2; }
-[ -n "$secret" ] || { echo "no DOT1X_TEST_SECRET found in $secret_file" >&2; exit 2; }
-
-umask 077
-cat > "$work/eapol.conf" <<EOF
-network={
-	ssid="Renner Test"
-	key_mgmt=WPA-EAP
-	eap=TTLS
-	identity="${identity}"
-	anonymous_identity="anonymous"
-	ca_cert="/etc/ssl/certs/ca-certificates.crt"
-	domain_suffix_match="radius.renner.uno"
-	phase2="auth=PAP"
-	password="${password}"
-}
-EOF
-
-for i in $(seq 1 "$count"); do
-  start=$(date +%s%N)
-  out=$(eapol_test -c "$work/eapol.conf" -a "$server" ${LIVE_SOURCE:+-A "$LIVE_SOURCE"} -s "$secret" -t 10 2>&1 || true)
-  end=$(date +%s%N)
-  ms=$(( (end - start) / 1000000 ))
-  result=$(tail -n1 <<<"$out")
-  case "$result" in SUCCESS|FAILURE) ;; *) result="NO-RESULT" ;; esac
-  # Attribute lines of the Access-Accept as the NAS received it (hex values).
-  attrs=$(awk '/RADIUS message: code=2 /{f=1; next} f && /^   /{print; next} f{f=0}' <<<"$out")
-  attr() { awk -v a="Attribute $1 " 'index($0, a){getline; sub(/^ *Value: /, ""); print; exit}' <<<"$attrs"; }
-  echo "login $i: $result ${ms}ms tunnel-type=[$(attr 64)] medium=[$(attr 65)] group-id=[$(attr 81)]"
-done