feat(demo-gymburgdorf): gate garage-webui via storage-local proxy outpost

Finish the garage-webui SSO that the DNS cleanup left broken. Two coupled
fixes, both relying on roles added in digitalboard.core:

- console.s3 now has an internal name. garage_webui_domains lists both the
  public and console.s3.int.* FQDN, and the DMZ garage-webui route sets
  backend_host: console.s3.int.* so the DMZ->storage hop verifies the
  backend cert against a matching SAN instead of failing on a raw IP (500).

- garage-webui ForwardAuth moves off the embedded outpost (cross-host hop
  mangled X-Forwarded-Host -> 404) onto a dedicated proxy outpost deployed
  on storage (authentik_outpost_proxy). The garage Traefik middleware now
  talks to it over the local docker network, and the storage-proxy-outpost
  is registered in authentik with the garage-webui provider. The stale
  auth.gymb pin on storage is dropped; the outpost reaches authentik via
  the reverseproxy (firewall now permits backend -> DMZ).

Requires a new bao secret key: <mount>/data/authentik proxy_outpost_token.

inventories/demo-gymburgdorf/host_vars/storage/authentik_outpost_proxy.yml

@@ -0,0 +1,16 @@
+---
+# Proxy (ForwardAuth) outpost co-located with garage on storage. The
+# garage-webui Traefik router's ForwardAuth middleware points at this
+# container over the local `proxy` docker network, so the auth subrequest
+# never leaves storage — the embedded outpost on the application host
+# can't be used here because the cross-host hop mangles X-Forwarded-Host.
+_authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/authentik', url=vault_addr) }}"
+
+# Outpost pulls its config from authentik over the public FQDN (resolves
+# via the internal DNS view to the DMZ reverseproxy the storage subnet can
+# reach). Token must match the storage-proxy-outpost registered in
+# authentik (see application/authentik.yml authentik_proxy_outposts).
+authentik_outpost_proxy_host: "https://auth.gymb.souveredu.ch"
+authentik_outpost_proxy_token: "{{ _authentik.proxy_outpost_token }}"
+authentik_outpost_proxy_insecure: "true"
+authentik_outpost_proxy_network: "proxy"

inventories/demo-gymburgdorf/host_vars/storage/garage.yml

@@ -9,24 +9,27 @@ _garage: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/ga
 garage_s3_domains:
   - "s3.gymb.souveredu.ch"
   - "s3.int.gymb.souveredu.ch"
-garage_webui_domain: "console.s3.gymb.souveredu.ch"
+# First entry is the canonical public console FQDN. The *.int.* entry
+# gives the DMZ a backend_host whose cert SAN matches (storage/traefik.yml),
+# so the DMZ->storage hop verifies TLS instead of failing on a raw IP.
+garage_webui_domains:
+  - "console.s3.gymb.souveredu.ch"
+  - "console.s3.int.gymb.souveredu.ch"
 garage_use_ssl: true
 garage_webui_enabled: true
 # Gate the WebUI behind authentik (admins-only, via policy-binding on the
 # authentik proxy app). Replaces the htpasswd Basic-Auth — AUTH_USER_PASS
 # is dropped from the compose env when this is true.
 #
-# The embedded outpost only serves the /outpost.goauthentik.io/auth path
-# when the request reaches authentik with Host set to a configured
-# authentik_domain (auth.gymb.*); it then matches the protected app
-# (console.s3.*) via X-Forwarded-Host. So the ForwardAuth must hit the
-# app-host's `authentik` router (Host(auth.gymb), passHostHeader=true) —
-# NOT the DMZ reverseproxy (strips X-Forwarded-Host) and NOT the auth.int
-# rewrite router (overwrites X-Forwarded-Host). auth.gymb.* is therefore
-# pinned to the application host in storage/traefik.yml so this single hop
-# preserves the forwarded headers and stays in the LAN.
+# ForwardAuth talks to the storage-local proxy outpost over the docker
+# network (role digitalboard.core.authentik_outpost_proxy). The embedded
+# outpost on the application host can't be used cross-host: the extra
+# reverseproxy hop mangles X-Forwarded-Host (appends :443 / a comma list)
+# and the outpost then 404s instead of matching console.s3.* against the
+# provider's external_host. A co-located outpost keeps the subrequest on
+# the local network with a clean X-Forwarded-Host.
 garage_webui_authentik_forward_auth: true
-garage_webui_authentik_forward_auth_url: "https://auth.gymb.souveredu.ch/outpost.goauthentik.io/auth/traefik"
+garage_webui_authentik_forward_auth_url: "http://authentik-outpost-proxy-proxy-1:9000/outpost.goauthentik.io/auth/traefik"
 # Kept for completeness — only used when authentik ForwardAuth is off.
 garage_webui_username: "admin"
 garage_webui_password: "{{ _garage.webui_password | default('disabled') }}"

inventories/demo-gymburgdorf/host_vars/storage/traefik.yml

@@ -1,15 +1,10 @@
 ---
-# The garage-webui ForwardAuth middleware fires a subrequest to authentik
-# (see garage.yml). It must reach the app-host's `authentik` router
-# directly — going via the DMZ reverseproxy strips X-Forwarded-Host, which
-# breaks the embedded outpost's app matching. The internal DNS view points
-# auth.gymb.* at the reverseproxy, so pin it to the application host here
-# to force the single direct hop that preserves the forwarded headers.
-traefik_extra_hosts:
-  - "auth.gymb.souveredu.ch:172.16.19.101"
-
 # Services hosted on `storage` that the DMZ reverseproxy should forward
 # public traffic to. See application/traefik.yml for the mechanism.
+# The garage-webui ForwardAuth no longer needs an auth FQDN pinned here —
+# it talks to the storage-local proxy outpost over the docker network
+# (see garage.yml), and the outpost reaches authentik via the public FQDN
+# over the reverseproxy (firewall now permits backend -> DMZ).
 traefik_dmz_exposed_services:
   - name: garage-s3
     domain: s3.gymb.souveredu.ch
@@ -18,11 +13,9 @@ traefik_dmz_exposed_services:
     protocol: https
   - name: garage-webui
     domain: console.s3.gymb.souveredu.ch
-    # Pre-existing limitation, orthogonal to the DNS cleanup: the DMZ
-    # verifies the storage backend cert (acme cert_mode), but with no
-    # backend_host set it connects by IP, which the storage cert has no
-    # SAN for, so this route fails the TLS verify. Fixing it needs the
-    # garage role to expose a console extra_domain (e.g. console.s3.int.*)
-    # for the backend_host + cert SAN — tracked separately.
+    # Internal name so the DMZ verifies the storage backend cert against a
+    # matching SAN (acme cert_mode, no insecureSkipVerify). garage now
+    # serves this SAN via garage_webui_domains (see garage.yml).
+    backend_host: console.s3.int.gymb.souveredu.ch
     port: 443
     protocol: https