root: add optional pyroscope for profiling

authentik/lib/debug.py

@@ -1,5 +1,9 @@
+from os import environ
+from socket import gethostname
+
 from structlog.stdlib import get_logger
 
+from authentik import authentik_build_hash, authentik_full_version, authentik_version
 from authentik.lib.config import CONFIG
 
 LOGGER = get_logger()
@@ -29,3 +33,31 @@ def start_debug_server(port_offset: int = 0, **kwargs) -> bool:
         return False
     LOGGER.debug("Starting debug server", host=host, port=port)
     return True
+
+
+def start_pyroscope(component: str, **tags: str) -> bool:
+    """Attempt to start the pyroscope profiler in the current process.
+    Must be called *after* forking, the profiler's agent threads do not survive fork().
+    Returns true if the profiler was started, otherwise false"""
+    server = environ.get("AUTHENTIK_PYROSCOPE_HOST")
+    if not server:
+        return False
+
+    import pyroscope
+
+    LOGGER.debug("Starting pyroscope profiler", server=server, component=component)
+    pyroscope.configure(
+        application_name="authentik",
+        server_address=server,
+        tags={
+            "component": component,
+            "hostname": gethostname(),
+            "service_repository": "https://github.com/goauthentik/authentik",
+            "service_git_ref": authentik_build_hash(),
+            "authentik_version": authentik_version(),
+            "authentik_full_version": authentik_full_version(),
+            **tags,
+        },
+        mem_enabled=True,
+    )
+    return True

lifecycle/gunicorn.conf.py

@@ -76,6 +76,10 @@ def post_fork(server: "Arbiter", worker: DjangoUvicornWorker):  # noqa: UP037
 
     values.ValueClass = MultiProcessValue(lambda: worker._worker_id)
 
+    from authentik.lib.debug import start_pyroscope
+
+    start_pyroscope("server", worker_id=str(worker._worker_id))
+
 
 def worker_exit(server: "Arbiter", worker: DjangoUvicornWorker):  # noqa: UP037
     """Remove pid dbs when worker is shutdown"""

lifecycle/worker_process.py

@@ -13,7 +13,7 @@
 from structlog.stdlib import get_logger
 
 from authentik.lib.config import CONFIG
-from authentik.lib.debug import start_debug_server
+from authentik.lib.debug import start_debug_server, start_pyroscope
 
 LOGGER = get_logger()
 INITIAL_WORKER_ID = 1000
@@ -149,6 +149,7 @@ def graceful_shutdown(signum, frame):
     django.setup()
 
     start_debug_server(port_offset=worker_id - INITIAL_WORKER_ID + 1)
+    start_pyroscope("worker", worker_id=str(worker_id))
 
     if worker_id == INITIAL_WORKER_ID:
         from lifecycle.migrate import run_migrations

pyproject.toml

@@ -53,6 +53,7 @@ dependencies = [
   "pydantic==2.13.4",
   "pyjwt==2.13.0",
   "pyrad==2.5.4",
+  "pyroscope-io==1.2.1",
   "python-kadmin-rs==0.7.2",
   "pyyaml==6.0.3",
   "requests-oauthlib==2.0.0",