Digitalboard/reference-ansible
6
1
Fork 0
Code Pull requests 1 Activity Actions

feat(demo): add full inventories for mbazürich and phbern

Browse source 
Both demo sites had only a hosts.yml, so every role ran on its
defaults (authentik.local.test etc.) and nothing was reachable under
the real FQDN. Add the complete group_vars + host_vars analogous to
gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain
bases, matching Bao mounts, DMZ split-horizon (public + *.int.*),
authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC,
collabora, drawio, garage, send, opnform, homarr and bookstack.

authentik_domains lists the *.int.* name too so Traefik requests a
cert the DMZ can verify; the storage proxy outpost carries a config
block (required by the outpost blueprint serializer).
This commit is contained in:
Simon Bärlocher 2026-07-02 17:22:21 +02:00
parent a8c8ac3e1e
commit d45e358efc
No known key found for this signature in database
GPG key ID: 63DE20495932047A
44 changed files with 1458 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

50
inventories/demo-phbern/host_vars/application/opnform.yml Normal file
View file

@ -0,0 +1,50 @@
---
# Bao secret <mount>/data/opnform expected to contain:
# app_key (must start with "base64:"), jwt_secret, front_api_secret,
# db_password, admin_password, oidc_client_secret
_opnform: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/opnform', url=vault_addr) }}"
_authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/authentik', url=vault_addr) }}"
opnform_domain: "forms.phbe.souveredu.ch"
opnform_extra_domains:
- "forms.int.phbe.souveredu.ch"
opnform_base_url: "https://forms.phbe.souveredu.ch"
opnform_app_key: "{{ _opnform.app_key }}"
opnform_jwt_secret: "{{ _opnform.jwt_secret }}"
opnform_front_api_secret: "{{ _opnform.front_api_secret }}"
opnform_db_password: "{{ _opnform.db_password }}"
# Bootstrap admin via API on first run so the manual setup page is
# skipped. The admin credentials are also required to seed the OIDC
# IdentityConnection through OpnForm's API (only an authenticated admin
# can create connections).
opnform_admin_name: "OpnForm Admin"
opnform_admin_email: "admin@phbe.souveredu.ch"
opnform_admin_password: "{{ _opnform.admin_password }}"
# OIDC against Authentik. The public auth.phbe.* FQDN resolves (internal
# DNS view) to the DMZ reverseproxy, which the backend subnet can reach,
# so OpnForm's discovery/token/userinfo calls stay in the LAN while the
# iss claim matches the public hostname browsers see during login.
opnform_oidc_enabled: true
# Issuer must use the public FQDN: OpnForm validates the token's `iss`
# claim against this value, and Authentik emits the public hostname there.
opnform_oidc_issuer: "https://auth.phbe.souveredu.ch/application/o/opnform/"
opnform_oidc_client_id: "opnform"
opnform_oidc_client_secret: "{{ _opnform.oidc_client_secret }}"
opnform_oidc_client_name: "Authentik"
opnform_oidc_slug: "authentik"
opnform_oidc_domain: "phbe.souveredu.ch"
opnform_oidc_admin_group: "opnform-admins"
# Disable password login entirely — every user goes through Authentik.
# All real users have @phbe.souveredu.ch addresses (matching
# opnform_oidc_domain above), so no password fallback is needed.
opnform_oidc_force_login: true
# `/` and `/login` are intercepted and jump straight to Authentik.
# Public form deep-links (`/forms/<slug>`, `/admin/...`) keep working.
# Break-glass: /login?bypass=1 reaches the email form when the IdP is
# down.
opnform_oidc_sso_entrypoint: true