Digitalboard/reference-ansible
6
1
Fork 0
Code Pull requests 1 Activity Actions

fix(demo-gymburgdorf): verify authentik TLS chain from outposts

Browse source 
Both outposts reach authentik over auth.gymb.*, which presents a valid
Let's Encrypt cert via the reverseproxy (verified: ssl_verify_result=0
from the storage subnet). Drop the insecure TLS skip:

- proxy outpost: authentik_outpost_proxy_insecure -> "false"
- ldap outpost: pin authentik_outpost_ldap_insecure "false" instead of
  relying on the role default ("true").

Addresses the automated security review finding (TLS verification disabled).
This commit is contained in:
Simon Bärlocher 2026-06-05 14:29:18 +02:00
parent e32c2202ea
commit 91d5be8d21
No known key found for this signature in database
GPG key ID: 63DE20495932047A
2 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
inventories/demo-gymburgdorf/host_vars/application/authentik_outpost_ldap.yml
View file

@ -8,3 +8,6 @@ _authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data
# the LAN with a valid cert and matches the iss claim authentik emits.
authentik_outpost_ldap_host: "https://auth.gymb.souveredu.ch"
authentik_outpost_ldap_token: "{{ _authentik.ldap_outpost_token }}"
# auth.gymb.* presents a valid Let's Encrypt cert via the reverseproxy, so
# verify the chain instead of relying on the role's insecure default.
authentik_outpost_ldap_insecure: "false"