Merge pull request 'perf(authentik): disable Postgres JIT, persistent DB connections' (#1557 ) from fix/authentik-pg-latency into main

Reviewed-on: #1557
perf(authentik): disable Postgres JIT, persistent DB connections
2026-11-04 08:56:56 +00:00 · 2026-11-04 09:52:41 +01:00 · 2026-11-04 08:08:25 +00:00 · 2026-11-04 08:04:09 +00:00
3 changed files with 11 additions and 2 deletions
@@ -73,6 +73,10 @@ spec:
      # on an unclean shutdown is not an acceptable trade.
      checkpoint_timeout: "15min"
      max_wal_size: "2GB"
+      # authentik's subclass joins over empty tables get planner costs far above
+      # jit_above_cost; LLVM compilation then takes ~420 ms for a query that
+      # executes in 0.1 ms (every flow start, every RADIUS/LDAP login).
+      jit: "off"
      # zstd, not "on": the boolean spelling resolves to pglz (2016-era, weaker
      # and slower than the lz4/zstd this build also accepts). Compresses the
      # full-page images that dominate WAL volume after each checkpoint.
@@ -69,6 +69,11 @@ spec:
            secretKeyRef:
              name: ak-pg-app
              key: password
+        # Default 0 opens a new Postgres connection per request.
+        - name: AUTHENTIK_POSTGRESQL__CONN_MAX_AGE
+          value: "60"
+        - name: AUTHENTIK_POSTGRESQL__CONN_HEALTH_CHECKS
+          value: "true"
        - name: AUTHENTIK_EMAIL__PASSWORD
          valueFrom:
            secretKeyRef:
@@ -93,7 +93,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: lidarr
-          image: ghcr.io/linuxserver/lidarr:3.1.6.5079-ls46 # {"$imagepolicy": "flux-system:lidarr"}
+          image: ghcr.io/linuxserver/lidarr:3.1.6.5079-ls47 # {"$imagepolicy": "flux-system:lidarr"}
          env:
            - name: PUID
              value: "1000"
@@ -140,7 +140,7 @@ spec:
              drop: ["ALL"]
              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
        - name: reconcile
-          image: ghcr.io/linuxserver/lidarr:3.1.6.5079-ls46 # {"$imagepolicy": "flux-system:lidarr"}
+          image: ghcr.io/linuxserver/lidarr:3.1.6.5079-ls47 # {"$imagepolicy": "flux-system:lidarr"}
          command: ["sh", "/scripts/reconcile.sh"]
          volumeMounts:
            - name: config
Author	SHA1	Message	Date
k.renner	73dd6f6362	Merge pull request 'perf(authentik): disable Postgres JIT, persistent DB connections' (#1557 ) from fix/authentik-pg-latency into main Reviewed-on: #1557	2026-11-04 08:56:56 +00:00
claude-botandClaude Opus 5.5	7434894f14	perf(authentik): disable Postgres JIT, persistent DB connections ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-04 09:52:41 +01:00
k.renner	7798a17ba5	Merge pull request 'fix(radius): run FreeRADIUS from a non-world-writable config dir' (#1556 ) from fix/freeradius-confdir-mode into main Reviewed-on: #1556	2026-11-04 08:08:25 +00:00
security-bot	265b745429	chore(image-automation): bump ghcr.io/linuxserver/lidarr:3.1.6.5079-ls47 Updates managed by image-automation-controller.	2026-11-04 08:04:09 +00:00