The nextcloud/server#59629 TypeError workaround (PR #59646) is no longer
needed once nextcloud_image is >= 33.0.4, which now ships the fix.
Remove the in-container sed patch task, its container-discovery and
drift-guard tasks, and the README note.
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Generalize the outpost token-pinning path beyond the LDAP outpost so any
proxy outpost declaring a token authenticates against the authentik
server with the vault token instead of the blueprint's auto-generated
one. Drive both from a single rendered script over a target list.
Also raise the server healthcheck start_period to 120s: cold first boot
runs DB migrations plus app init (~90s observed), which tripped
compose --wait as unhealthy at the old 30s.
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Two related additions for gating a cross-host service (garage WebUI on a
storage host) behind authentik without breaking on TLS or X-Forwarded-Host:
garage role:
- Add garage_webui_domains (list), mirroring garage_s3_domains. The
console router now accepts every entry, so a DMZ reverseproxy can use a
backend_host whose cert SAN matches an internal *.int.* name instead of
connecting by IP (which fails acme cert verification). Defaults to the
single garage_webui_domain so existing inventories are unaffected.
authentik_outpost_proxy role (new):
- Standalone proxy (ForwardAuth) outpost, modelled on authentik_outpost_ldap.
Co-locate it with the protected service so the ForwardAuth subrequest
reaches authentik over the local docker network. The embedded outpost
only works for services on the authentik host: a cross-host subrequest
routed through an extra reverse-proxy hop arrives with a polluted
X-Forwarded-Host (port/comma-appended), which the outpost no longer
matches against the provider's external_host (404).
