From 91d5be8d21cb04d71b7e5d78911cb30a326487ca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20B=C3=A4rlocher?= Date: Fri, 5 Jun 2026 14:29:18 +0200 Subject: [PATCH] fix(demo-gymburgdorf): verify authentik TLS chain from outposts Both outposts reach authentik over auth.gymb.*, which presents a valid Let's Encrypt cert via the reverseproxy (verified: ssl_verify_result=0 from the storage subnet). Drop the insecure TLS skip: - proxy outpost: authentik_outpost_proxy_insecure -> "false" - ldap outpost: pin authentik_outpost_ldap_insecure "false" instead of relying on the role default ("true"). Addresses the automated security review finding (TLS verification disabled). --- .../host_vars/application/authentik_outpost_ldap.yml | 3 +++ .../host_vars/storage/authentik_outpost_proxy.yml | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/inventories/demo-gymburgdorf/host_vars/application/authentik_outpost_ldap.yml b/inventories/demo-gymburgdorf/host_vars/application/authentik_outpost_ldap.yml index fa81a01..b280ce4 100644 --- a/inventories/demo-gymburgdorf/host_vars/application/authentik_outpost_ldap.yml +++ b/inventories/demo-gymburgdorf/host_vars/application/authentik_outpost_ldap.yml @@ -8,3 +8,6 @@ _authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data # the LAN with a valid cert and matches the iss claim authentik emits. authentik_outpost_ldap_host: "https://auth.gymb.souveredu.ch" authentik_outpost_ldap_token: "{{ _authentik.ldap_outpost_token }}" +# auth.gymb.* presents a valid Let's Encrypt cert via the reverseproxy, so +# verify the chain instead of relying on the role's insecure default. +authentik_outpost_ldap_insecure: "false" diff --git a/inventories/demo-gymburgdorf/host_vars/storage/authentik_outpost_proxy.yml b/inventories/demo-gymburgdorf/host_vars/storage/authentik_outpost_proxy.yml index 74a3209..df7b628 100644 --- a/inventories/demo-gymburgdorf/host_vars/storage/authentik_outpost_proxy.yml +++ b/inventories/demo-gymburgdorf/host_vars/storage/authentik_outpost_proxy.yml @@ -10,7 +10,10 @@ _authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data # via the internal DNS view to the DMZ reverseproxy the storage subnet can # reach). Token must match the storage-proxy-outpost registered in # authentik (see application/authentik.yml authentik_proxy_outposts). +# Verify the authentik TLS chain: auth.gymb.* presents a valid Let's +# Encrypt cert via the reverseproxy and the storage subnet reaches it, so +# there's no reason to disable verification (verified: ssl_verify_result=0). authentik_outpost_proxy_host: "https://auth.gymb.souveredu.ch" authentik_outpost_proxy_token: "{{ _authentik.proxy_outpost_token }}" -authentik_outpost_proxy_insecure: "true" +authentik_outpost_proxy_insecure: "false" authentik_outpost_proxy_network: "proxy"