0733d5710f
Two related additions for gating a cross-host service (garage WebUI on a storage host) behind authentik without breaking on TLS or X-Forwarded-Host: garage role: - Add garage_webui_domains (list), mirroring garage_s3_domains. The console router now accepts every entry, so a DMZ reverseproxy can use a backend_host whose cert SAN matches an internal *.int.* name instead of connecting by IP (which fails acme cert verification). Defaults to the single garage_webui_domain so existing inventories are unaffected. authentik_outpost_proxy role (new): - Standalone proxy (ForwardAuth) outpost, modelled on authentik_outpost_ldap. Co-locate it with the protected service so the ForwardAuth subrequest reaches authentik over the local docker network. The embedded outpost only works for services on the authentik host: a cross-host subrequest routed through an extra reverse-proxy hop arrives with a polluted X-Forwarded-Host (port/comma-appended), which the outpost no longer matches against the provider's external_host (404).
22 lines
645 B
Django/Jinja
22 lines
645 B
Django/Jinja
services:
|
|
proxy:
|
|
image: {{ authentik_outpost_proxy_image }}
|
|
restart: unless-stopped
|
|
environment:
|
|
AUTHENTIK_HOST: {{ authentik_outpost_proxy_host }}
|
|
AUTHENTIK_TOKEN: {{ authentik_outpost_proxy_token }}
|
|
AUTHENTIK_INSECURE: "{{ authentik_outpost_proxy_insecure }}"
|
|
{% if authentik_outpost_proxy_extra_hosts | length > 0 %}
|
|
extra_hosts:
|
|
{% for host in authentik_outpost_proxy_extra_hosts %}
|
|
- "{{ host }}"
|
|
{% endfor %}
|
|
{% endif %}
|
|
labels:
|
|
- traefik.enable=false
|
|
networks:
|
|
- {{ authentik_outpost_proxy_network }}
|
|
|
|
networks:
|
|
{{ authentik_outpost_proxy_network }}:
|
|
external: true
|