Digitalboard/digitalboard.core
6
2
Fork 0
Code Pull requests 3 Releases Packages Activity Actions

feat(garage,authentik): console multi-domain + standalone proxy outpost #12

Open
Simon wants to merge 1 commit from feat/garage-console-int-domains into main
pull from: feat/garage-console-int-domains
merge into: Digitalboard:main
Conversation 0 Commits 1 Files changed 12 +195 -2
Simon commented 2026-07-02 15:17:20 +00:00
Owner
Copy link

Summary

Gate a cross-host service (garage WebUI on a storage host) behind authentik without breaking on TLS or X-Forwarded-Host.

garage role

  • Add garage_webui_domains (list), mirroring garage_s3_domains. The console router accepts every entry, so a DMZ reverseproxy can use a backend_host whose cert SAN matches an internal *.int.* name instead of connecting by IP (which fails ACME cert verification). Defaults to the single garage_webui_domain — existing inventories unaffected.

authentik_outpost_proxy role (new)

  • Standalone proxy (ForwardAuth) outpost, modelled on authentik_outpost_ldap. Co-locate it with the protected service so the ForwardAuth subrequest reaches authentik over the local docker network. The embedded outpost only works for services on the authentik host: a cross-host subrequest routed through an extra reverse-proxy hop arrives with a polluted X-Forwarded-Host (port/comma-appended), which the outpost no longer matches against the provider's external_host (404).

Testing

  • Not deployed yet — review only.
## Summary Gate a cross-host service (garage WebUI on a storage host) behind authentik without breaking on TLS or X-Forwarded-Host. **garage role** - Add `garage_webui_domains` (list), mirroring `garage_s3_domains`. The console router accepts every entry, so a DMZ reverseproxy can use a `backend_host` whose cert SAN matches an internal `*.int.*` name instead of connecting by IP (which fails ACME cert verification). Defaults to the single `garage_webui_domain` — existing inventories unaffected. **authentik_outpost_proxy role (new)** - Standalone proxy (ForwardAuth) outpost, modelled on `authentik_outpost_ldap`. Co-locate it with the protected service so the ForwardAuth subrequest reaches authentik over the local docker network. The embedded outpost only works for services on the authentik host: a cross-host subrequest routed through an extra reverse-proxy hop arrives with a polluted `X-Forwarded-Host` (port/comma-appended), which the outpost no longer matches against the provider's `external_host` (404). ## Testing - Not deployed yet — review only.
Simon added 1 commit 2026-07-02 15:17:21 +00:00 
Two related additions for gating a cross-host service (garage WebUI on a
storage host) behind authentik without breaking on TLS or X-Forwarded-Host:

garage role:
- Add garage_webui_domains (list), mirroring garage_s3_domains. The
  console router now accepts every entry, so a DMZ reverseproxy can use a
  backend_host whose cert SAN matches an internal *.int.* name instead of
  connecting by IP (which fails acme cert verification). Defaults to the
  single garage_webui_domain so existing inventories are unaffected.

authentik_outpost_proxy role (new):
- Standalone proxy (ForwardAuth) outpost, modelled on authentik_outpost_ldap.
  Co-locate it with the protected service so the ForwardAuth subrequest
  reaches authentik over the local docker network. The embedded outpost
  only works for services on the authentik host: a cross-host subrequest
  routed through an extra reverse-proxy hop arrives with a polluted
  X-Forwarded-Host (port/comma-appended), which the outpost no longer
  matches against the provider's external_host (404).
requested review from Tobias-Wuest 2026-07-02 15:17:44 +00:00
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/garage-console-int-domains:feat/garage-console-int-domains
git checkout feat/garage-console-int-domains

Merge

Merge the changes and update on Forgejo.
git checkout main
git merge --no-ff feat/garage-console-int-domains
git checkout feat/garage-console-int-domains
git rebase main
git checkout main
git merge --ff-only feat/garage-console-int-domains
git checkout feat/garage-console-int-domains
git rebase main
git checkout main
git merge --no-ff feat/garage-console-int-domains
git checkout main
git merge --squash feat/garage-console-int-domains
git checkout main
git merge --ff-only feat/garage-console-int-domains
git checkout main
git merge feat/garage-console-int-domains
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Tobias-Wuest
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Digitalboard/digitalboard.core#12
No description provided.
Delete branch "feat/garage-console-int-domains"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?