Digitalboard/digitalboard.core
6
2
Fork 0
Code Pull requests 3 Releases Packages Activity Actions
No description
126 commits 6 branches 0 tags 1,024 KiB
Find a file
Exact
Simon Bärlocher 0733d5710f
feat(garage,authentik): console multi-domain + standalone proxy outpost 
Two related additions for gating a cross-host service (garage WebUI on a
storage host) behind authentik without breaking on TLS or X-Forwarded-Host:

garage role:
- Add garage_webui_domains (list), mirroring garage_s3_domains. The
  console router now accepts every entry, so a DMZ reverseproxy can use a
  backend_host whose cert SAN matches an internal *.int.* name instead of
  connecting by IP (which fails acme cert verification). Defaults to the
  single garage_webui_domain so existing inventories are unaffected.

authentik_outpost_proxy role (new):
- Standalone proxy (ForwardAuth) outpost, modelled on authentik_outpost_ldap.
  Co-locate it with the protected service so the ForwardAuth subrequest
  reaches authentik over the local docker network. The embedded outpost
  only works for services on the authentik host: a cross-host subrequest
  routed through an extra reverse-proxy hop arrives with a polluted
  X-Forwarded-Host (port/comma-appended), which the outpost no longer
  matches against the provider's external_host (404).
2026-06-05 14:22:36 +02:00
meta docs(collection): document all roles and fix metadata drift 2026-05-27 23:12:24 +02:00
plugins docs(collection): document all roles and fix metadata drift 2026-05-27 23:12:24 +02:00
roles feat(garage,authentik): console multi-domain + standalone proxy outpost 2026-06-05 14:22:36 +02:00
.gitignore feat(services): refine split-horizon OIDC routing and harden nextcloud patch 2026-06-02 13:44:08 +02:00
galaxy.yml docs(collection): document all roles and fix metadata drift 2026-05-27 23:12:24 +02:00
README.md docs(collection): document all roles and fix metadata drift 2026-05-27 23:12:24 +02:00

README.md

Ansible Collection — digitalboard.core

This collection bundles the Ansible roles used to deploy the Digitalboard platform: a set of self-hosted, Docker-Compose-based services running behind Traefik, with single sign-on provided by authentik or Keycloak.

Each role provisions one service (or building block) as a self-contained Docker Compose stack. Roles are consumed from the deployment repository reference-ansible, where inventories and playbooks tie the roles to concrete hosts.

Roles

Role Description
base Host baseline: Docker, apt packages and convenience tooling on Debian/Ubuntu.
traefik Traefik v3 reverse proxy as a public DMZ proxy (file provider) or backend proxy (docker provider).
authentik authentik IdP (server + worker + Postgres); resources via blueprints.
authentik_outpost_ldap authentik LDAP outpost exposing an LDAP interface for apps that cannot speak OIDC.
keycloak Keycloak IdP with a PostgreSQL backend.
389ds 389 Directory Server LDAP directory via Docker Compose.
nextcloud Nextcloud (fpm) + Postgres + Redis, optional Collabora/draw.io/notify_push.
opencloud OpenCloud file platform via Docker Compose.
collabora Collabora Online (CODE), used as the WOPI backend for Nextcloud.
bookstack BookStack wiki (LSIO + MariaDB) with OIDC SSO and daily backups.
drawio draw.io diagram editor, with optional authentik ForwardAuth gating.
homarr Homarr dashboard with seeded admin user and OIDC group.
opnform OpnForm self-hosted form builder (api + ui + db + redis).
send Send (timvisee fork) file sharing with a Redis backend.
garage Garage S3-compatible object storage with key/bucket provisioning.
httpbin httpbin HTTP request/response testing service for validating Traefik ingress.

Usage

Roles are not run from this repository directly. They are consumed from the deployment repository reference-ansible, which holds the inventories, group/host variables and playbooks. See that repository's docs/ directory for getting-started instructions, how to run Ansible and how secrets are managed.

Per-role variables and their defaults are documented in each role's own README.md and meta/argument_specs.yml.

Requirements

  • A Debian/Ubuntu target host (the base role bootstraps Docker there).
  • ansible-core 2.15 or newer on the controller.
  • The community.docker collection (used by nearly every role) and community.general (used by the keycloak role). Both are declared as dependencies in galaxy.yml and pulled in automatically when this collection is installed via ansible-galaxy.

The role READMEs use community.hashi_vault lookups in their examples to source secrets from HashiCorp Vault. That is a documented convention, not a hard dependency of the roles — supply the variables however you prefer.

Role ordering

Within a play, apply the roles in dependency order: base first (Docker and the host baseline), then traefik (the shared reverse proxy and its Docker network), then the individual service roles (authentik, keycloak, nextcloud, …), which attach to Traefik's network and expect Docker to be present.

License

MIT-0. See individual roles for per-role license metadata.