Digitalboard/reference-ansible
6
1
Fork 0
Code Pull requests 1 Activity Actions

feat(demo-gymburgdorf): gate garage-webui via storage-local proxy outpost

Browse source 
Finish the garage-webui SSO that the DNS cleanup left broken. Two coupled
fixes, both relying on roles added in digitalboard.core:

- console.s3 now has an internal name. garage_webui_domains lists both the
  public and console.s3.int.* FQDN, and the DMZ garage-webui route sets
  backend_host: console.s3.int.* so the DMZ->storage hop verifies the
  backend cert against a matching SAN instead of failing on a raw IP (500).

- garage-webui ForwardAuth moves off the embedded outpost (cross-host hop
  mangled X-Forwarded-Host -> 404) onto a dedicated proxy outpost deployed
  on storage (authentik_outpost_proxy). The garage Traefik middleware now
  talks to it over the local docker network, and the storage-proxy-outpost
  is registered in authentik with the garage-webui provider. The stale
  auth.gymb pin on storage is dropped; the outpost reaches authentik via
  the reverseproxy (firewall now permits backend -> DMZ).

Requires a new bao secret key: <mount>/data/authentik proxy_outpost_token.
This commit is contained in:
Simon Bärlocher 2026-06-05 14:27:37 +02:00
parent 2942dabc54
commit e32c2202ea
No known key found for this signature in database
GPG key ID: 63DE20495932047A
6 changed files with 67 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

25
inventories/demo-gymburgdorf/host_vars/storage/garage.yml
View file

@ -9,24 +9,27 @@ _garage: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/ga
garage_s3_domains:
- "s3.gymb.souveredu.ch"
- "s3.int.gymb.souveredu.ch"
garage_webui_domain: "console.s3.gymb.souveredu.ch"
# First entry is the canonical public console FQDN. The *.int.* entry
# gives the DMZ a backend_host whose cert SAN matches (storage/traefik.yml),
# so the DMZ->storage hop verifies TLS instead of failing on a raw IP.
garage_webui_domains:
- "console.s3.gymb.souveredu.ch"
- "console.s3.int.gymb.souveredu.ch"
garage_use_ssl: true
garage_webui_enabled: true
# Gate the WebUI behind authentik (admins-only, via policy-binding on the
# authentik proxy app). Replaces the htpasswd Basic-Auth — AUTH_USER_PASS
# is dropped from the compose env when this is true.
#
# The embedded outpost only serves the /outpost.goauthentik.io/auth path
# when the request reaches authentik with Host set to a configured
# authentik_domain (auth.gymb.*); it then matches the protected app
# (console.s3.*) via X-Forwarded-Host. So the ForwardAuth must hit the
# app-host's `authentik` router (Host(auth.gymb), passHostHeader=true) —
# NOT the DMZ reverseproxy (strips X-Forwarded-Host) and NOT the auth.int
# rewrite router (overwrites X-Forwarded-Host). auth.gymb.* is therefore
# pinned to the application host in storage/traefik.yml so this single hop
# preserves the forwarded headers and stays in the LAN.
# ForwardAuth talks to the storage-local proxy outpost over the docker
# network (role digitalboard.core.authentik_outpost_proxy). The embedded
# outpost on the application host can't be used cross-host: the extra
# reverseproxy hop mangles X-Forwarded-Host (appends :443 / a comma list)
# and the outpost then 404s instead of matching console.s3.* against the
# provider's external_host. A co-located outpost keeps the subrequest on
# the local network with a clean X-Forwarded-Host.
garage_webui_authentik_forward_auth: true
garage_webui_authentik_forward_auth_url: "https://auth.gymb.souveredu.ch/outpost.goauthentik.io/auth/traefik"
garage_webui_authentik_forward_auth_url: "http://authentik-outpost-proxy-proxy-1:9000/outpost.goauthentik.io/auth/traefik"
# Kept for completeness — only used when authentik ForwardAuth is off.
garage_webui_username: "admin"
garage_webui_password: "{{ _garage.webui_password | default('disabled') }}"