Finish the garage-webui SSO that the DNS cleanup left broken. Two coupled
fixes, both relying on roles added in digitalboard.core:
- console.s3 now has an internal name. garage_webui_domains lists both the
public and console.s3.int.* FQDN, and the DMZ garage-webui route sets
backend_host: console.s3.int.* so the DMZ->storage hop verifies the
backend cert against a matching SAN instead of failing on a raw IP (500).
- garage-webui ForwardAuth moves off the embedded outpost (cross-host hop
mangled X-Forwarded-Host -> 404) onto a dedicated proxy outpost deployed
on storage (authentik_outpost_proxy). The garage Traefik middleware now
talks to it over the local docker network, and the storage-proxy-outpost
is registered in authentik with the garage-webui provider. The stale
auth.gymb pin on storage is dropped; the outpost reaches authentik via
the reverseproxy (firewall now permits backend -> DMZ).
Requires a new bao secret key: <mount>/data/authentik proxy_outpost_token.
Addresses the WKS PoC review (Notion 2026-05-26). All docs in English.
- README: purpose, docs table of contents, annotated repo tree
- docs/getting_started.md: prerequisites (WKS account, OIDC, SSH, VPN) + first deploy
- docs/ansible.md: playbook table, "Running Ansible", service parameters, cheatsheet
- docs/secrets.md: canonical Bao login (moved out of README) + demo defaults
- docs/operations.md: full Makefile reference
- docs/inventories.md: repo layout, topology, standard folder structure, walkthrough
- docs/testing.md: static checks, inventory resolution, smoke test / dry run
- remove ARCHITECTURE.md (architecture docs live externally)
Also includes the gymburgdorf inventory build-out (bookstack, homarr,
opnform, send) and scripts/bao-seed.sh. site.yml keeps a third traefik
play (traefik_servers minus the vagrant _dmz/_backend split) so the demo
inventories still configure their reverse proxy after the rebase onto main.
