0733d5710f
Two related additions for gating a cross-host service (garage WebUI on a storage host) behind authentik without breaking on TLS or X-Forwarded-Host: garage role: - Add garage_webui_domains (list), mirroring garage_s3_domains. The console router now accepts every entry, so a DMZ reverseproxy can use a backend_host whose cert SAN matches an internal *.int.* name instead of connecting by IP (which fails acme cert verification). Defaults to the single garage_webui_domain so existing inventories are unaffected. authentik_outpost_proxy role (new): - Standalone proxy (ForwardAuth) outpost, modelled on authentik_outpost_ldap. Co-locate it with the protected service so the ForwardAuth subrequest reaches authentik over the local docker network. The embedded outpost only works for services on the authentik host: a cross-host subrequest routed through an extra reverse-proxy hop arrives with a polluted X-Forwarded-Host (port/comma-appended), which the outpost no longer matches against the provider's external_host (404).
26 lines
714 B
YAML
26 lines
714 B
YAML
#SPDX-License-Identifier: MIT-0
|
|
---
|
|
# tasks file for authentik_outpost_proxy
|
|
|
|
- name: Create docker compose directory
|
|
file:
|
|
path: "{{ authentik_outpost_proxy_docker_compose_dir }}"
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Create docker-compose file for authentik proxy outpost
|
|
template:
|
|
src: docker-compose.yml.j2
|
|
dest: "{{ authentik_outpost_proxy_docker_compose_dir }}/docker-compose.yml"
|
|
mode: '0644'
|
|
|
|
- name: Start authentik proxy outpost container
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ authentik_outpost_proxy_docker_compose_dir }}"
|
|
state: present
|
|
wait: true
|
|
wait_timeout: 120
|
|
retries: 3
|
|
delay: 15
|
|
register: result
|
|
until: result is not failed
|