Digitalboard/reference-ansible
6
1
Fork 0
Code Pull requests Activity Actions

chore(demo-gymburgdorf): finish ACME, LDAP, DMZ routing for live inventory

Browse source 
- ACME via DNS-01 against internal NS (172.16.9.169) with TCP-only +
  disableANSChecks so the DMZ traefik can issue LE certs without
  reaching public NS IPs.
- Migrate single-domain vars to `*_domains` lists (authentik, nextcloud,
  collabora, garage_s3) so public + *.int.* SANs share one cert and
  server-to-server traffic stays in the LAN.
- Wire `traefik_dmz_exposed_services` per backend host (application,
  storage) with explicit `backend_host` overrides pointing at internal
  FQDNs — DMZ traefik now validates upstream certs against SAN names.
- Nextcloud notify_push setup on internal FQDN to avoid DMZ hairpin;
  collabora WOPI / authentik LDAP outpost wired to *.int.* equivalents.
This commit is contained in:
Simon Bärlocher 2026-05-20 23:26:18 +02:00
parent 82f0db8fe3
commit c67e9aac43
No known key found for this signature in database
GPG key ID: 63DE20495932047A
13 changed files with 552 additions and 170 deletions
Download patch file Download diff file Expand all files Collapse all files

10
inventories/demo-gymburgdorf/host_vars/application/collabora.yml
View file

@ -1,8 +1,16 @@
---
collabora_domain: "office.gymb.souveredu.ch"
# First entry is the canonical public FQDN. Additional entries cover
# internal *.int.* names so nextcloud's WOPI discovery hits collabora
# in the LAN with a valid internal cert.
collabora_domains:
- "office.gymb.souveredu.ch"
- "office.int.gymb.souveredu.ch"
# Hosts allowed to issue WOPI calls. Both names are listed so collabora
# accepts the callback from nextcloud regardless of which FQDN it uses.
collabora_allowed_domains:
- "cloud.gymb.souveredu.ch"
- "cloud.int.gymb.souveredu.ch"
collabora_frame_ancestors:
- "cloud.gymb.souveredu.ch"