feat(demo): add full inventories for mbazürich and phbern

Both demo sites had only a hosts.yml, so every role ran on its
defaults (authentik.local.test etc.) and nothing was reachable under
the real FQDN. Add the complete group_vars + host_vars analogous to
gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain
bases, matching Bao mounts, DMZ split-horizon (public + *.int.*),
authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC,
collabora, drawio, garage, send, opnform, homarr and bookstack.

authentik_domains lists the *.int.* name too so Traefik requests a
cert the DMZ can verify; the storage proxy outpost carries a config
block (required by the outpost blueprint serializer).

inventories/demo-mbazürich/host_vars/application/authentik.yml

@@ -0,0 +1,167 @@
+---
+# Bao secret expected at <mount>/data/authentik with keys:
+#   secret_key, postgres_password, admin_password,
+#   ldap_outpost_token, proxy_outpost_token,
+#   nextcloud_oidc_secret, opnform_oidc_secret,
+#   homarr_oidc_secret, bookstack_oidc_secret
+_authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/authentik', url=vault_addr) }}"
+
+# First entry is the canonical public FQDN (browsers + OIDC iss-claim).
+# The *.int.* entry makes the router match the internal name too, so
+# Traefik requests a cert covering it — the DMZ reverseproxy uses
+# auth.int.mbaz as backend_host and verifies the chain (acme mode,
+# no insecureSkipVerify), which fails against the default cert otherwise.
+authentik_domains:
+  - "auth.mbaz.souveredu.ch"
+  - "auth.int.mbaz.souveredu.ch"
+
+authentik_secret_key: "{{ _authentik.secret_key }}"
+authentik_postgres_password: "{{ _authentik.postgres_password }}"
+
+# LDAP outpost (provider for nextcloud)
+authentik_ldap_apps:
+  - slug: ldap
+    name: LDAP
+    base_dn: "dc=mbaz,dc=souveredu,dc=ch"
+    search_group: admins
+
+authentik_ldap_outpost:
+  name: "ldap-outpost"
+  token: "{{ _authentik.ldap_outpost_token }}"
+  config:
+    # Outpost pulls config from authentik over the public FQDN, which
+    # resolves (internal DNS view) to the DMZ reverseproxy the backend
+    # subnet can reach — keeps the round-trip in the LAN with a valid cert.
+    authentik_host: "https://auth.mbaz.souveredu.ch/"
+    log_level: "info"
+
+# Proxy providers (ForwardAuth) — gate downstream services behind
+# authentik. The embedded outpost (which authentik ships out of the box)
+# hosts these providers under /outpost.goauthentik.io/auth/traefik on the
+# canonical FQDN; the service-side traefik attaches a ForwardAuth
+# middleware that talks to that endpoint.
+authentik_proxy_apps:
+  - slug: drawio
+    name: Drawio
+    external_host: "https://draw.mbaz.souveredu.ch"
+    internal_host: "http://drawio:8080"
+    # drawio is embedded in Nextcloud as an iframe (nextcloud_enable_drawio).
+    # Every authenticated Nextcloud user must therefore pass the ForwardAuth
+    # gate, otherwise the editor loads a 403 inside the iframe. Allow both
+    # standard groups; tightening this back to admins-only would break the
+    # Nextcloud integration for regular users.
+    allowed_groups:
+      - admins
+      - users
+    flows:
+      authentication_slug: default-authentication-flow
+      authorization_slug: default-provider-authorization-implicit-consent
+      invalidation_slug: default-provider-invalidation-flow
+  - slug: garage-webui
+    name: "Garage S3 Console"
+    external_host: "https://console.s3.mbaz.souveredu.ch"
+    internal_host: "http://garage-webui:3909"
+    allowed_groups:
+      - admins
+    flows:
+      authentication_slug: default-authentication-flow
+      authorization_slug: default-provider-authorization-implicit-consent
+      invalidation_slug: default-provider-invalidation-flow
+
+# Outpost bindings. drawio runs on this (application) host, so its
+# ForwardAuth can use the embedded outpost (same host:9000 as the
+# authentik server). garage-webui runs on the storage host; a cross-host
+# ForwardAuth to the embedded outpost arrives with a mangled
+# X-Forwarded-Host (an extra reverseproxy hop appends :443 / a comma list)
+# and the outpost then fails to match the provider's external_host (404).
+# So garage-webui is bound to a dedicated proxy outpost deployed on
+# storage (role digitalboard.core.authentik_outpost_proxy), whose
+# ForwardAuth endpoint the local storage Traefik reaches over the docker
+# network — no extra hop, clean X-Forwarded-Host.
+authentik_proxy_outposts:
+  - name: "authentik Embedded Outpost"
+    type: proxy
+    providers:
+      - drawio
+  - name: "storage-proxy-outpost"
+    type: proxy
+    token: "{{ _authentik.proxy_outpost_token }}"
+    providers:
+      - garage-webui
+    # config is required by the outpost blueprint serializer. The outpost
+    # runs on the storage host and reaches authentik over the public FQDN
+    # (resolves to the DMZ reverseproxy the storage subnet can reach).
+    config:
+      authentik_host: "https://auth.mbaz.souveredu.ch/"
+      log_level: "info"
+
+# OIDC clients
+authentik_oidc_apps:
+  - slug: nextcloud
+    name: Nextcloud
+    client_id: nextcloud
+    client_secret: "{{ _authentik.nextcloud_oidc_secret }}"
+    redirect_uris:
+      - url: "https://cloud.mbaz.souveredu.ch/apps/user_oidc/code"
+        matching_mode: strict
+    signing_key_name: "authentik Self-signed Certificate"
+    flows:
+      authorization_slug: default-provider-authorization-implicit-consent
+      invalidation_slug: default-provider-invalidation-flow
+    scopes: [openid, email, profile, offline_access]
+  - slug: opnform
+    name: OpnForm
+    client_id: opnform
+    client_secret: "{{ _authentik.opnform_oidc_secret }}"
+    redirect_uris:
+      - url: "https://forms.mbaz.souveredu.ch/auth/authentik/callback"
+        matching_mode: strict
+    signing_key_name: "authentik Self-signed Certificate"
+    flows:
+      authorization_slug: default-provider-authorization-implicit-consent
+      invalidation_slug: default-provider-invalidation-flow
+    # No separate `groups` scope — authentik's default `profile` mapping
+    # already emits a `groups` claim built from request.user.groups, so
+    # OpnForm's admin-group mapping works without an extra scope.
+    scopes: [openid, email, profile]
+  - slug: homarr
+    name: Homarr
+    client_id: homarr
+    client_secret: "{{ _authentik.homarr_oidc_secret }}"
+    redirect_uris:
+      - url: "https://home.mbaz.souveredu.ch/api/auth/callback/oidc"
+        matching_mode: strict
+    signing_key_name: "authentik Self-signed Certificate"
+    flows:
+      authorization_slug: default-provider-authorization-implicit-consent
+      invalidation_slug: default-provider-invalidation-flow
+    scopes: [openid, email, profile]
+  - slug: bookstack
+    name: BookStack
+    client_id: bookstack
+    client_secret: "{{ _authentik.bookstack_oidc_secret }}"
+    redirect_uris:
+      - url: "https://wiki.mbaz.souveredu.ch/oidc/callback"
+        matching_mode: strict
+    signing_key_name: "authentik Self-signed Certificate"
+    flows:
+      authorization_slug: default-provider-authorization-implicit-consent
+      invalidation_slug: default-provider-invalidation-flow
+    scopes: [openid, email, profile]
+
+authentik_groups:
+  - name: admins
+  - name: users
+  - name: opnform-admins
+  - name: homarr-admins
+  - name: bookstack-admins
+
+authentik_local_users:
+  - username: akadmin
+    name: "Authentik Admin"
+    email: "admin@mbaz.souveredu.ch"
+    password: "{{ _authentik.admin_password }}"
+    is_active: true
+    groups:
+      - authentik Admins
+      - admins