The firewall now permits the backend subnet (172.16.19.0/24) to reach the
DMZ reverseproxy on 443, so server-to-server calls can use the public
FQDN over the reverseproxy instead of the previous workarounds:
- Remove the `*_extra_hosts` pins from nextcloud, opnform, bookstack and
homarr; their OIDC discovery/issuer now uses the public auth.gymb.* FQDN
(verified: discovery returns 200 with the public iss over the reverseproxy).
- Switch nextcloud OIDC discovery_url from auth.int.* to auth.gymb.*.
- Drop authentik_host_rewrite_domains and authentik_outpost_domains; point
the LDAP outpost (both host_vars) at the public auth.gymb.* FQDN.
- Repoint the garage-webui ForwardAuth from the never-functional dedicated
outpost FQDN to auth.gymb.*. The embedded outpost only serves the auth
path when Host is a configured authentik_domain and matches the protected
app via X-Forwarded-Host, so auth.gymb.* stays pinned to the application
host on storage to bypass the reverseproxy's X-Forwarded-Host stripping.
The *.int.* names and their cert SANs are kept: the DMZ verifies the
backend cert (acme cert_mode) and connects by name, so they remain
structural to the DMZ->backend hop. The console.s3 DMZ route limitation
is pre-existing and tracked separately.
Addresses the WKS PoC review (Notion 2026-05-26). All docs in English.
- README: purpose, docs table of contents, annotated repo tree
- docs/getting_started.md: prerequisites (WKS account, OIDC, SSH, VPN) + first deploy
- docs/ansible.md: playbook table, "Running Ansible", service parameters, cheatsheet
- docs/secrets.md: canonical Bao login (moved out of README) + demo defaults
- docs/operations.md: full Makefile reference
- docs/inventories.md: repo layout, topology, standard folder structure, walkthrough
- docs/testing.md: static checks, inventory resolution, smoke test / dry run
- remove ARCHITECTURE.md (architecture docs live externally)
Also includes the gymburgdorf inventory build-out (bookstack, homarr,
opnform, send) and scripts/bao-seed.sh. site.yml keeps a third traefik
play (traefik_servers minus the vagrant _dmz/_backend split) so the demo
inventories still configure their reverse proxy after the rebase onto main.
- ACME via DNS-01 against internal NS (172.16.9.169) with TCP-only +
disableANSChecks so the DMZ traefik can issue LE certs without
reaching public NS IPs.
- Migrate single-domain vars to `*_domains` lists (authentik, nextcloud,
collabora, garage_s3) so public + *.int.* SANs share one cert and
server-to-server traffic stays in the LAN.
- Wire `traefik_dmz_exposed_services` per backend host (application,
storage) with explicit `backend_host` overrides pointing at internal
FQDNs — DMZ traefik now validates upstream certs against SAN names.
- Nextcloud notify_push setup on internal FQDN to avoid DMZ hairpin;
collabora WOPI / authentik LDAP outpost wired to *.int.* equivalents.
