Digitalboard/reference-ansible
6
1
Fork 0
Code Pull requests 1 Activity Actions

feat(demo-gymburgdorf): gate garage-webui via storage-local proxy outpost

Browse source 
Finish the garage-webui SSO that the DNS cleanup left broken. Two coupled
fixes, both relying on roles added in digitalboard.core:

- console.s3 now has an internal name. garage_webui_domains lists both the
  public and console.s3.int.* FQDN, and the DMZ garage-webui route sets
  backend_host: console.s3.int.* so the DMZ->storage hop verifies the
  backend cert against a matching SAN instead of failing on a raw IP (500).

- garage-webui ForwardAuth moves off the embedded outpost (cross-host hop
  mangled X-Forwarded-Host -> 404) onto a dedicated proxy outpost deployed
  on storage (authentik_outpost_proxy). The garage Traefik middleware now
  talks to it over the local docker network, and the storage-proxy-outpost
  is registered in authentik with the garage-webui provider. The stale
  auth.gymb pin on storage is dropped; the outpost reaches authentik via
  the reverseproxy (firewall now permits backend -> DMZ).

Requires a new bao secret key: <mount>/data/authentik proxy_outpost_token.
This commit is contained in:
Simon Bärlocher 2026-06-05 14:27:37 +02:00
parent 2942dabc54
commit e32c2202ea
No known key found for this signature in database
GPG key ID: 63DE20495932047A
6 changed files with 67 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

23
inventories/demo-gymburgdorf/host_vars/storage/traefik.yml
View file

@ -1,15 +1,10 @@
---
# The garage-webui ForwardAuth middleware fires a subrequest to authentik
# (see garage.yml). It must reach the app-host's `authentik` router
# directly — going via the DMZ reverseproxy strips X-Forwarded-Host, which
# breaks the embedded outpost's app matching. The internal DNS view points
# auth.gymb.* at the reverseproxy, so pin it to the application host here
# to force the single direct hop that preserves the forwarded headers.
traefik_extra_hosts:
- "auth.gymb.souveredu.ch:172.16.19.101"
# Services hosted on `storage` that the DMZ reverseproxy should forward
# public traffic to. See application/traefik.yml for the mechanism.
# The garage-webui ForwardAuth no longer needs an auth FQDN pinned here —
# it talks to the storage-local proxy outpost over the docker network
# (see garage.yml), and the outpost reaches authentik via the public FQDN
# over the reverseproxy (firewall now permits backend -> DMZ).
traefik_dmz_exposed_services:
- name: garage-s3
domain: s3.gymb.souveredu.ch
@ -18,11 +13,9 @@ traefik_dmz_exposed_services:
protocol: https
- name: garage-webui
domain: console.s3.gymb.souveredu.ch
# Pre-existing limitation, orthogonal to the DNS cleanup: the DMZ
# verifies the storage backend cert (acme cert_mode), but with no
# backend_host set it connects by IP, which the storage cert has no
# SAN for, so this route fails the TLS verify. Fixing it needs the
# garage role to expose a console extra_domain (e.g. console.s3.int.*)
# for the backend_host + cert SAN — tracked separately.
# Internal name so the DMZ verifies the storage backend cert against a
# matching SAN (acme cert_mode, no insecureSkipVerify). garage now
# serves this SAN via garage_webui_domains (see garage.yml).
backend_host: console.s3.int.gymb.souveredu.ch
port: 443
protocol: https