feat(demo): add full inventories for mbazürich and phbern

Both demo sites had only a hosts.yml, so every role ran on its
defaults (authentik.local.test etc.) and nothing was reachable under
the real FQDN. Add the complete group_vars + host_vars analogous to
gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain
bases, matching Bao mounts, DMZ split-horizon (public + *.int.*),
authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC,
collabora, drawio, garage, send, opnform, homarr and bookstack.

authentik_domains lists the *.int.* name too so Traefik requests a
cert the DMZ can verify; the storage proxy outpost carries a config
block (required by the outpost blueprint serializer).

inventories/demo-mbazürich/host_vars/application/nextcloud.yml

@@ -0,0 +1,122 @@
+---
+# Bao secret <mount>/data/nextcloud expected to contain:
+#   postgres_password, admin_password
+_nextcloud: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/nextcloud', url=vault_addr) }}"
+_authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/authentik', url=vault_addr) }}"
+
+# No nextcloud_image pin: the role default (nextcloud:fpm) already ships
+# the fix for the PHP UserConfig::getValueBool TypeError (#59629), so the
+# 33.0.3 pin gymb still carries is unnecessary here.
+
+# First entry is the canonical public FQDN (used for OVERWRITEHOST and
+# OIDC redirects). Additional entries cover internal *.int.* names so
+# collabora's WOPI callbacks hit nextcloud on a name with a valid
+# internal cert instead of routing through the DMZ.
+nextcloud_domains:
+  - "cloud.mbaz.souveredu.ch"
+  - "cloud.int.mbaz.souveredu.ch"
+nextcloud_postgres_password: "{{ _nextcloud.postgres_password }}"
+nextcloud_admin_user: admin
+nextcloud_admin_password: "{{ _nextcloud.admin_password }}"
+
+nextcloud_enable_notify_push: true
+# Use the internal FQDN for the notify_push setup check so curl from the
+# nextcloud container hits the local traefik directly instead of
+# hairpinning through the DMZ reverseproxy.
+nextcloud_notify_push_domain: "cloud.int.mbaz.souveredu.ch"
+
+# Collabora integration
+# wopi_url (server-to-server: nextcloud calls collabora for discovery /
+# capabilities) goes to the internal FQDN so the call stays in the LAN.
+# public_wopi_url is what the browser loads the office iframe from — that
+# stays on the public name reachable through the DMZ.
+nextcloud_enable_collabora: true
+nextcloud_collabora_domain: "office.int.mbaz.souveredu.ch"
+nextcloud_collabora_public_domain: "office.mbaz.souveredu.ch"
+
+# Draw.io integration
+nextcloud_enable_drawio: true
+nextcloud_drawio_url: "https://draw.mbaz.souveredu.ch"
+
+nextcloud_apps_to_install:
+  - groupfolders
+  - richdocuments
+  - spreed
+  - user_ldap
+  - user_oidc
+  - whiteboard
+  - drawio
+  - files_lock
+  - notify_push
+
+# S3 primary storage via Garage — server-to-server, so use the internal FQDN.
+# Resolves through the internal DNS to the storage host and presents a valid
+# cert from the local traefik on storage.
+nextcloud_use_s3_storage: true
+nextcloud_s3_key: "{{ lookup('digitalboard.core.garage_credentials', 'nextcloud', host='storage')['key_id'] }}"
+nextcloud_s3_secret: "{{ lookup('digitalboard.core.garage_credentials', 'nextcloud', host='storage')['secret_key'] }}"
+nextcloud_s3_bucket: "nextcloud"
+nextcloud_s3_host: "s3.int.mbaz.souveredu.ch"
+nextcloud_s3_port: 443
+nextcloud_s3_ssl: true
+nextcloud_s3_usepath_style: true
+
+# OIDC discovery/token/userinfo and the S3 backend both target FQDNs
+# that resolve to RFC1918 addresses (auth.mba.* via the reverseproxy,
+# s3.int.* directly), which Nextcloud's DnsPinMiddleware would otherwise
+# block as "local server access".
+nextcloud_allow_local_remote_servers: true
+
+# Share the LDAP docker network with the authentik LDAP outpost
+nextcloud_extra_networks:
+  - ldap
+
+# LDAP backend (Authentik LDAP outpost)
+nextcloud_ldap_enabled: true
+nextcloud_ldap_config:
+  ldapHost: "ldap://authentik-outpost-ldap-ldap-1"
+  ldapPort: "3389"
+  ldapAgentName: "cn=akadmin,ou=users,dc=mbaz,dc=souveredu,dc=ch"
+  ldapAgentPassword: "{{ _authentik.admin_password }}"
+  ldapBase: "dc=mbaz,dc=souveredu,dc=ch"
+  ldapBaseUsers: "ou=users,dc=mbaz,dc=souveredu,dc=ch"
+  ldapTLS: "0"
+  turnOffCertCheck: "1"
+  ldapUserFilter: "(&(objectClass=user)(cn=*))"
+  ldapUserFilterObjectclass: "user"
+  ldapLoginFilter: "(&(objectClass=user)(cn=%uid))"
+  ldapLoginFilterUsername: "1"
+  ldapUserDisplayName: "cn"
+  ldapEmailAttribute: "mail"
+  ldapExpertUsernameAttr: "cn"
+  ldapExpertUUIDUserAttr: "uid"
+  ldapExpertUUIDGroupAttr: "uid"
+  ldapBaseGroups: "ou=groups,dc=mbaz,dc=souveredu,dc=ch"
+  ldapGroupFilter: "(&(objectClass=group))"
+  ldapGroupFilterObjectclass: "group"
+  ldapGroupDisplayName: "cn"
+  ldapGroupMemberAssocAttr: "member"
+  ldapAdminGroup: "admins"
+  ldapCacheTTL: "600"
+  ldapPagingSize: "500"
+  ldapExperiencedAdmin: "1"
+  ldapConfigurationActive: "1"
+
+# OIDC providers for login (Authentik)
+nextcloud_oidc_providers:
+  - identifier: authentik
+    display_name: "Login with Authentik"
+    client_id: nextcloud
+    client_secret: "{{ _authentik.nextcloud_oidc_secret }}"
+    # Discovery via the public FQDN. It resolves (internal DNS view) to
+    # the DMZ reverseproxy, which the backend subnet can now reach, so
+    # the server-to-server call stays in the LAN while the iss claim and
+    # all listed endpoints match the public hostname the browser sees
+    # during login — no host-rewrite or /etc/hosts pin needed.
+    discovery_url: "https://auth.mbaz.souveredu.ch/application/o/nextcloud/.well-known/openid-configuration"
+    scope: "openid email profile"
+    unique_uid: true
+    mapping:
+      uid: preferred_username
+      display_name: name
+      email: email