Simon Bärlocher
2ba0c07cd3
docs(reference-ansible): add docs/ tree and document repo, playbooks, Makefile
...
Addresses the WKS PoC review (Notion 2026-05-26). All docs in English.
- README: purpose, docs table of contents, annotated repo tree
- docs/getting_started.md: prerequisites (WKS account, OIDC, SSH, VPN) + first deploy
- docs/ansible.md: playbook table, "Running Ansible", service parameters, cheatsheet
- docs/secrets.md: canonical Bao login (moved out of README) + demo defaults
- docs/operations.md: full Makefile reference
- docs/inventories.md: repo layout, topology, standard folder structure, walkthrough
- docs/testing.md: static checks, inventory resolution, smoke test / dry run
- remove ARCHITECTURE.md (architecture docs live externally)
Also includes the gymburgdorf inventory build-out (bookstack, homarr,
opnform, send) and scripts/bao-seed.sh. site.yml keeps a third traefik
play (traefik_servers minus the vagrant _dmz/_backend split) so the demo
inventories still configure their reverse proxy after the rebase onto main.
2026-05-28 11:20:54 +02:00
Simon Bärlocher
c67e9aac43
chore(demo-gymburgdorf): finish ACME, LDAP, DMZ routing for live inventory
...
- ACME via DNS-01 against internal NS (172.16.9.169) with TCP-only +
disableANSChecks so the DMZ traefik can issue LE certs without
reaching public NS IPs.
- Migrate single-domain vars to `*_domains` lists (authentik, nextcloud,
collabora, garage_s3) so public + *.int.* SANs share one cert and
server-to-server traffic stays in the LAN.
- Wire `traefik_dmz_exposed_services` per backend host (application,
storage) with explicit `backend_host` overrides pointing at internal
FQDNs — DMZ traefik now validates upstream certs against SAN names.
- Nextcloud notify_push setup on internal FQDN to avoid DMZ hairpin;
collabora WOPI / authentik LDAP outpost wired to *.int.* equivalents.
2026-05-27 23:18:58 +02:00
Simon Bärlocher
82f0db8fe3
chore: wip on demo-gymburgdorf inventory and architecture notes
2026-05-27 23:12:57 +02:00
1ddd5d9eb9
fix: added openform to vagrant playbooks and host_vars
2026-05-18 22:31:06 +02:00
f479a19595
fix: (vagrant) rearanged the staging of the services
2026-05-18 20:58:29 +02:00
e392ac66bd
fix: (vagrant) updated some vagrant variables and added openform
2026-05-18 18:37:39 +02:00
dde5a246ae
Merge branch 'refs/heads/feature/homarr'
...
# Conflicts:
# inventories/vagrant/host_vars/backend/traefik.yml
# inventories/vagrant/hosts.yml
# playbooks/site.yml
2026-05-18 17:26:29 +02:00
56bff066f7
chore: add vagrant config for authentik ldap outpost
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-04-10 17:24:16 +02:00
2f9f7e61f9
chore: start modeling gymburgdorf demo and test bao secret lookup
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-04-10 17:23:41 +02:00
bcb75ed078
chore: add make targets for deploying demo sites
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-04-10 15:47:59 +02:00
8dc7b87751
chore: increase vagrant vm ram to 8192
...
got a couple ooms with 4gb
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-04-10 15:19:29 +02:00
0e1c07625a
feat: use authentik ldap outpost for ldap instead of 389ds+keycloak
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-04-10 15:18:53 +02:00
1641956dd2
chore: add ping_demo Makefile target
...
helper target, to ping all demo servers at one
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-27 18:14:05 +01:00
7f35fc63a3
chore: add basic inventory for demo-mbazürich
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-27 17:52:04 +01:00
425a679310
chore: add basic inventory for demo-phbern
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-27 17:48:15 +01:00
678849b973
chore: add basic inventory for demo-gymburgdorf
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-27 17:45:41 +01:00
bd85fdfe91
chore: add readme entry and configration for openbao secrets management
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-27 16:46:18 +01:00
2c1c01a2d7
feat: opencloud group provisioning via oidc
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-13 16:43:02 +01:00
096cda6d4a
fix: do not provision user accounts from oidc in opencloud
...
should be done by ldap
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-13 16:20:28 +01:00
c4df67ccf1
fix: add files_lock and notify_push to nextcloud_apps_to_install
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-13 15:54:45 +01:00
cd4d54e33c
feat: nextcloud ability to get groups from ldap backend
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-13 15:37:32 +01:00
0b336aa8f8
feat: add group mapper to keycloak ldap backend
...
so we can assign groups in keycloak. Maybe search for an easier way to do this...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-13 15:36:33 +01:00
912f1b99e8
feat: add file_lock and notify_push configuration to nextcloud role
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-13 15:22:09 +01:00
4811b4657f
feat: add drawio instance for nextcloud and opencloud
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-13 14:47:02 +01:00
e976ff37c9
feat: add ldap backend to opencloud
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-13 11:43:11 +01:00
f181106886
feat: add 389ds ldap backend to keycloak
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-13 10:58:40 +01:00
f6dc1d8261
feat: add ldap provisioning to nextcloud
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-13 10:46:49 +01:00
eb3cc1390b
feat: add basic ds389 docker setup and configuration
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-06 17:54:07 +01:00
ef2462a26a
chore: ensure we can use the same collabora instance for multiple cloud instances
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-06 17:00:33 +01:00
d1eea7f717
chore: rename testadmin and testuser to admin and user for simplicity
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-06 14:40:55 +01:00
dd087fb5e2
chore: add central collabora service
...
instead of providing one for owncloud and nextcloud separately
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-05 17:09:32 +01:00
6e115c20c7
feat: add s3 storage provisioning for opencloud
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-05 16:24:12 +01:00
ad1f8a1999
feat: add oidc provisioning for opencloud
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-03-05 15:36:12 +01:00
15a2d321b0
feat: add basic opencloud deployment
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-02-27 14:59:19 +01:00
09f9ae104a
chore: add .vagrant/ folder to .gitignore
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-02-27 13:37:48 +01:00
ccb5b0dad5
chore: run traefik role on all traefik servers
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-02-27 13:36:28 +01:00
2063268ed6
feat: add keycloak oidc provisioning tasks
...
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
2026-02-27 13:35:37 +01:00
75be32d8d0
chore: Deploy Homarr Service
2026-01-23 15:53:21 +01:00
495b61c1d1
chore: switch to yaml inventory
...
waaaay better readability
2026-01-23 10:41:30 +01:00
b94c066996
chore: add .vagrant folder to .gitignore
2026-01-22 17:33:14 +01:00
d7f75c04da
chore(traefik): rename variables for clarity
2026-01-22 17:32:39 +01:00
b0c62bbef9
chore: expose dashboard of vagrant-vms over domains
2026-01-22 14:03:21 +01:00
f2e2baa886
fix: do not use ssl for s3 when using vagrant
2026-01-15 17:30:12 +01:00
6b6c4ef3fa
chore: add authentik to traefik
2026-01-15 14:40:19 +01:00
7537db0cf7
chore: increase memory and cpu for vagrant
2026-01-15 14:40:00 +01:00
97d23d048c
chore: add authentik_servers to vagrant inventory
2026-01-15 13:49:50 +01:00
1b0b2db43a
chore: apply authentik role for testing in vagrant
2026-01-14 18:04:35 +01:00
437262d6cc
feat: use garage as storage backend
...
using the new plugin to lookup credentials
2025-12-19 18:20:49 +01:00
5b6ec5284e
feat: add nextcloud deployment
2025-12-19 15:00:11 +01:00
b129b7e146
chore: deploy garage role to vagrant backend host and expose webui
2025-11-07 17:36:29 +01:00
