0733d5710f
Two related additions for gating a cross-host service (garage WebUI on a storage host) behind authentik without breaking on TLS or X-Forwarded-Host: garage role: - Add garage_webui_domains (list), mirroring garage_s3_domains. The console router now accepts every entry, so a DMZ reverseproxy can use a backend_host whose cert SAN matches an internal *.int.* name instead of connecting by IP (which fails acme cert verification). Defaults to the single garage_webui_domain so existing inventories are unaffected. authentik_outpost_proxy role (new): - Standalone proxy (ForwardAuth) outpost, modelled on authentik_outpost_ldap. Co-locate it with the protected service so the ForwardAuth subrequest reaches authentik over the local docker network. The embedded outpost only works for services on the authentik host: a cross-host subrequest routed through an extra reverse-proxy hop arrives with a polluted X-Forwarded-Host (port/comma-appended), which the outpost no longer matches against the provider's external_host (404).
28 lines
535 B
YAML
28 lines
535 B
YAML
#SPDX-License-Identifier: MIT-0
|
|
galaxy_info:
|
|
author: digitalboard
|
|
description: Deploy an authentik proxy (ForwardAuth) outpost via Docker Compose, co-located with the services it protects
|
|
company: Digitalboard
|
|
license: MIT-0
|
|
|
|
min_ansible_version: "2.14"
|
|
|
|
platforms:
|
|
- name: Debian
|
|
versions:
|
|
- bookworm
|
|
- name: Ubuntu
|
|
versions:
|
|
- jammy
|
|
- noble
|
|
|
|
galaxy_tags:
|
|
- authentik
|
|
- proxy
|
|
- forwardauth
|
|
- outpost
|
|
- sso
|
|
- docker
|
|
- digitalboard
|
|
|
|
dependencies: []
|