Digitalboard/reference-ansible
6
1
Fork 0
Code Pull requests 1 Activity Actions

refactor(demo-gymburgdorf): drop DNS workarounds now backend can reach DMZ

Browse source 
The firewall now permits the backend subnet (172.16.19.0/24) to reach the
DMZ reverseproxy on 443, so server-to-server calls can use the public
FQDN over the reverseproxy instead of the previous workarounds:

- Remove the `*_extra_hosts` pins from nextcloud, opnform, bookstack and
  homarr; their OIDC discovery/issuer now uses the public auth.gymb.* FQDN
  (verified: discovery returns 200 with the public iss over the reverseproxy).
- Switch nextcloud OIDC discovery_url from auth.int.* to auth.gymb.*.
- Drop authentik_host_rewrite_domains and authentik_outpost_domains; point
  the LDAP outpost (both host_vars) at the public auth.gymb.* FQDN.
- Repoint the garage-webui ForwardAuth from the never-functional dedicated
  outpost FQDN to auth.gymb.*. The embedded outpost only serves the auth
  path when Host is a configured authentik_domain and matches the protected
  app via X-Forwarded-Host, so auth.gymb.* stays pinned to the application
  host on storage to bypass the reverseproxy's X-Forwarded-Host stripping.

The *.int.* names and their cert SANs are kept: the DMZ verifies the
backend cert (acme cert_mode) and connects by name, so they remain
structural to the DMZ->backend hop. The console.s3 DMZ route limitation
is pre-existing and tracked separately.
This commit is contained in:
Simon Bärlocher 2026-06-05 13:49:30 +02:00
parent 2206b809e7
commit 2942dabc54
No known key found for this signature in database
GPG key ID: 63DE20495932047A
8 changed files with 58 additions and 110 deletions
Download patch file Download diff file Expand all files Collapse all files

19
inventories/demo-gymburgdorf/host_vars/application/homarr.yml
View file

@ -18,12 +18,11 @@ homarr_admin_password: "{{ _homarr.admin_password }}"
# AUTH_OIDC_AUTO_LOGIN bypasses the normal /login page.
#
# Issuer must match the `iss` claim authentik emits, which is always the
# public FQDN (authentik's host-rewrite middleware aligns the claim with
# what browsers see). Homarr (oauth4webapi) does a strict 1:1 comparison
# between the discovery response's issuer and this URL — using the
# internal FQDN here fails with OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED.
# The extra_hosts pin below keeps the actual discovery/token/userinfo
# traffic on the LAN.
# public FQDN. Homarr (oauth4webapi) does a strict 1:1 comparison between
# the discovery response's issuer and this URL — an internal FQDN here
# fails with OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED. The public FQDN
# resolves (internal DNS view) to the DMZ reverseproxy, which the backend
# subnet can reach, so discovery/token/userinfo stay in the LAN.
homarr_auth_providers: "credentials,oidc"
homarr_oidc_issuer: "https://auth.gymb.souveredu.ch/application/o/homarr/"
homarr_oidc_client_id: "homarr"
@ -33,14 +32,6 @@ homarr_oidc_scopes: "openid profile email groups"
homarr_oidc_groups_attribute: "groups"
homarr_oidc_auto_login: "true"
# Pin the public authentik FQDN to the application host so OIDC
# discovery (and downstream token/userinfo) calls from the homarr
# container stay in the LAN. Without this, fetch() to auth.gymb.* would
# hit the public IP and time out in the DMZ (no hairpin-NAT). Same
# pattern as nextcloud_extra_hosts.
homarr_extra_hosts:
- "auth.gymb.souveredu.ch:172.16.19.101"
# Default board with shortcuts to the other gymburgdorf services. Width
# values describe horizontal grid cells (1-10 desktop / 6 tablet / 2
# mobile, packed left-to-right).