Finish the garage-webui SSO that the DNS cleanup left broken. Two coupled
fixes, both relying on roles added in digitalboard.core:
- console.s3 now has an internal name. garage_webui_domains lists both the
public and console.s3.int.* FQDN, and the DMZ garage-webui route sets
backend_host: console.s3.int.* so the DMZ->storage hop verifies the
backend cert against a matching SAN instead of failing on a raw IP (500).
- garage-webui ForwardAuth moves off the embedded outpost (cross-host hop
mangled X-Forwarded-Host -> 404) onto a dedicated proxy outpost deployed
on storage (authentik_outpost_proxy). The garage Traefik middleware now
talks to it over the local docker network, and the storage-proxy-outpost
is registered in authentik with the garage-webui provider. The stale
auth.gymb pin on storage is dropped; the outpost reaches authentik via
the reverseproxy (firewall now permits backend -> DMZ).
Requires a new bao secret key: <mount>/data/authentik proxy_outpost_token.
The firewall now permits the backend subnet (172.16.19.0/24) to reach the
DMZ reverseproxy on 443, so server-to-server calls can use the public
FQDN over the reverseproxy instead of the previous workarounds:
- Remove the `*_extra_hosts` pins from nextcloud, opnform, bookstack and
homarr; their OIDC discovery/issuer now uses the public auth.gymb.* FQDN
(verified: discovery returns 200 with the public iss over the reverseproxy).
- Switch nextcloud OIDC discovery_url from auth.int.* to auth.gymb.*.
- Drop authentik_host_rewrite_domains and authentik_outpost_domains; point
the LDAP outpost (both host_vars) at the public auth.gymb.* FQDN.
- Repoint the garage-webui ForwardAuth from the never-functional dedicated
outpost FQDN to auth.gymb.*. The embedded outpost only serves the auth
path when Host is a configured authentik_domain and matches the protected
app via X-Forwarded-Host, so auth.gymb.* stays pinned to the application
host on storage to bypass the reverseproxy's X-Forwarded-Host stripping.
The *.int.* names and their cert SANs are kept: the DMZ verifies the
backend cert (acme cert_mode) and connects by name, so they remain
structural to the DMZ->backend hop. The console.s3 DMZ route limitation
is pre-existing and tracked separately.
Storage Traefik calling the public auth.gymb.* FQDN hit Authentik's ASGI
handler, which 404s the /outpost.goauthentik.io/auth/traefik path. Add a
dedicated outpost.auth.int.gymb.* FQDN outside authentik_domains so the
request falls through to the embedded outpost, pinned to the application
host via traefik_extra_hosts to stay on the LAN.
- authentik: add authentik_outpost_domains; allow users group on drawio
proxy so the Nextcloud drawio iframe works for non-admins
- garage: point webui ForwardAuth at the new outpost FQDN
- homarr: use public OIDC issuer to match the iss claim, enable
auto-login, pin auth FQDN to LAN via extra_hosts
- opnform: intercept / and /login for SSO, keep break-glass bypass
- drawio: align comments with admins+users allow-list
Addresses the WKS PoC review (Notion 2026-05-26). All docs in English.
- README: purpose, docs table of contents, annotated repo tree
- docs/getting_started.md: prerequisites (WKS account, OIDC, SSH, VPN) + first deploy
- docs/ansible.md: playbook table, "Running Ansible", service parameters, cheatsheet
- docs/secrets.md: canonical Bao login (moved out of README) + demo defaults
- docs/operations.md: full Makefile reference
- docs/inventories.md: repo layout, topology, standard folder structure, walkthrough
- docs/testing.md: static checks, inventory resolution, smoke test / dry run
- remove ARCHITECTURE.md (architecture docs live externally)
Also includes the gymburgdorf inventory build-out (bookstack, homarr,
opnform, send) and scripts/bao-seed.sh. site.yml keeps a third traefik
play (traefik_servers minus the vagrant _dmz/_backend split) so the demo
inventories still configure their reverse proxy after the rebase onto main.
- ACME via DNS-01 against internal NS (172.16.9.169) with TCP-only +
disableANSChecks so the DMZ traefik can issue LE certs without
reaching public NS IPs.
- Migrate single-domain vars to `*_domains` lists (authentik, nextcloud,
collabora, garage_s3) so public + *.int.* SANs share one cert and
server-to-server traffic stays in the LAN.
- Wire `traefik_dmz_exposed_services` per backend host (application,
storage) with explicit `backend_host` overrides pointing at internal
FQDNs — DMZ traefik now validates upstream certs against SAN names.
- Nextcloud notify_push setup on internal FQDN to avoid DMZ hairpin;
collabora WOPI / authentik LDAP outpost wired to *.int.* equivalents.
