Digitalboard/reference-ansible
6
1
Fork 0
Code Pull requests 1 Activity Actions

refactor(demo-gymburgdorf): drop DNS workarounds now backend can reach DMZ

Browse source 
The firewall now permits the backend subnet (172.16.19.0/24) to reach the
DMZ reverseproxy on 443, so server-to-server calls can use the public
FQDN over the reverseproxy instead of the previous workarounds:

- Remove the `*_extra_hosts` pins from nextcloud, opnform, bookstack and
  homarr; their OIDC discovery/issuer now uses the public auth.gymb.* FQDN
  (verified: discovery returns 200 with the public iss over the reverseproxy).
- Switch nextcloud OIDC discovery_url from auth.int.* to auth.gymb.*.
- Drop authentik_host_rewrite_domains and authentik_outpost_domains; point
  the LDAP outpost (both host_vars) at the public auth.gymb.* FQDN.
- Repoint the garage-webui ForwardAuth from the never-functional dedicated
  outpost FQDN to auth.gymb.*. The embedded outpost only serves the auth
  path when Host is a configured authentik_domain and matches the protected
  app via X-Forwarded-Host, so auth.gymb.* stays pinned to the application
  host on storage to bypass the reverseproxy's X-Forwarded-Host stripping.

The *.int.* names and their cert SANs are kept: the DMZ verifies the
backend cert (acme cert_mode) and connects by name, so they remain
structural to the DMZ->backend hop. The console.s3 DMZ route limitation
is pre-existing and tracked separately.
This commit is contained in:
Simon Bärlocher 2026-06-05 13:49:30 +02:00
parent 2206b809e7
commit 2942dabc54
No known key found for this signature in database
GPG key ID: 63DE20495932047A
8 changed files with 58 additions and 110 deletions
Download patch file Download diff file Expand all files Collapse all files

22
inventories/demo-gymburgdorf/host_vars/storage/garage.yml
View file

@ -14,17 +14,19 @@ garage_use_ssl: true
garage_webui_enabled: true
# Gate the WebUI behind authentik (admins-only, via policy-binding on the
# authentik proxy app). Replaces the htpasswd Basic-Auth — AUTH_USER_PASS
# is dropped from the compose env when this is true. The forwardauth URL
# uses a dedicated outpost-only FQDN that's deliberately outside
# authentik_domains so Authentik routes it to the embedded outpost (not
# ASGI). The public auth.gymb.* FQDN would 404 here — Authentik routes
# any Host matching an auth-domain to ASGI which doesn't serve the outpost
# path. The outpost itself then matches the protected app via
# X-Forwarded-Host (Traefik forwards it via trustForwardHeader=true).
# The FQDN is pinned to the application host via traefik_extra_hosts so
# the request stays in the LAN.
# is dropped from the compose env when this is true.
#
# The embedded outpost only serves the /outpost.goauthentik.io/auth path
# when the request reaches authentik with Host set to a configured
# authentik_domain (auth.gymb.*); it then matches the protected app
# (console.s3.*) via X-Forwarded-Host. So the ForwardAuth must hit the
# app-host's `authentik` router (Host(auth.gymb), passHostHeader=true) —
# NOT the DMZ reverseproxy (strips X-Forwarded-Host) and NOT the auth.int
# rewrite router (overwrites X-Forwarded-Host). auth.gymb.* is therefore
# pinned to the application host in storage/traefik.yml so this single hop
# preserves the forwarded headers and stays in the LAN.
garage_webui_authentik_forward_auth: true
garage_webui_authentik_forward_auth_url: "https://outpost.auth.int.gymb.souveredu.ch/outpost.goauthentik.io/auth/traefik"
garage_webui_authentik_forward_auth_url: "https://auth.gymb.souveredu.ch/outpost.goauthentik.io/auth/traefik"
# Kept for completeness — only used when authentik ForwardAuth is off.
garage_webui_username: "admin"
garage_webui_password: "{{ _garage.webui_password | default('disabled') }}"