Digitalboard/reference-ansible
6
1
Fork 0
Code Pull requests Activity Actions

docs: document repo, playbooks, Makefile (WKS PoC review) #1

Merged
Tobias-Wuest merged 4 commits from docs/wks-poc-review into main 2026-06-04 09:20:13 +00:00
Conversation 1 Commits 4 Files changed 30 +1905 -19
Simon commented 2026-05-27 21:09:53 +00:00
Owner
Copy link

Addresses the WKS PoC review (Notion 2026-05-26). All documentation in English.

What changed

  • README: purpose, docs table of contents, annotated repo tree, available playbooks
  • docs/getting_started.md: prerequisites (WKS account, OIDC, SSH key, VPN) + first deploy step by step
  • docs/ansible.md: playbook table, "Running Ansible" (Makefile + direct invocation), per-service parameters, variable cheatsheet
  • docs/secrets.md: canonical Bao login (moved out of README) + demo-only defaults + threat boundaries
  • docs/operations.md: full Makefile reference
  • docs/inventories.md: repo layout, inventory topology, standard folder structure, new-tenant walkthrough
  • docs/testing.md: static checks, inventory resolution, smoke test / dry run
  • removed ARCHITECTURE.md (architecture docs live externally)

Also includes the gymburgdorf inventory build-out (bookstack, homarr, opnform, send) and scripts/bao-seed.sh.

Rebased onto main (5 newer commits). playbooks/site.yml keeps a third traefik play
(traefik_servers minus the vagrant _dmz/_backend split) so the demo inventories still
configure their reverse proxy — no host runs traefik twice. All 32 internal anchor links
validated against the translated headings.

Addresses the WKS PoC review (Notion 2026-05-26). All documentation in English. ## What changed - **README**: purpose, docs table of contents, annotated repo tree, available playbooks - **docs/getting_started.md**: prerequisites (WKS account, OIDC, SSH key, VPN) + first deploy step by step - **docs/ansible.md**: playbook table, "Running Ansible" (Makefile + direct invocation), per-service parameters, variable cheatsheet - **docs/secrets.md**: canonical Bao login (moved out of README) + demo-only defaults + threat boundaries - **docs/operations.md**: full Makefile reference - **docs/inventories.md**: repo layout, inventory topology, standard folder structure, new-tenant walkthrough - **docs/testing.md**: static checks, inventory resolution, smoke test / dry run - removed ARCHITECTURE.md (architecture docs live externally) Also includes the gymburgdorf inventory build-out (bookstack, homarr, opnform, send) and scripts/bao-seed.sh. Rebased onto main (5 newer commits). playbooks/site.yml keeps a third traefik play (traefik_servers minus the vagrant _dmz/_backend split) so the demo inventories still configure their reverse proxy — no host runs traefik twice. All 32 internal anchor links validated against the translated headings.
Simon added 3 commits 2026-05-27 21:09:54 +00:00 
- ACME via DNS-01 against internal NS (172.16.9.169) with TCP-only +
  disableANSChecks so the DMZ traefik can issue LE certs without
  reaching public NS IPs.
- Migrate single-domain vars to `*_domains` lists (authentik, nextcloud,
  collabora, garage_s3) so public + *.int.* SANs share one cert and
  server-to-server traffic stays in the LAN.
- Wire `traefik_dmz_exposed_services` per backend host (application,
  storage) with explicit `backend_host` overrides pointing at internal
  FQDNs — DMZ traefik now validates upstream certs against SAN names.
- Nextcloud notify_push setup on internal FQDN to avoid DMZ hairpin;
  collabora WOPI / authentik LDAP outpost wired to *.int.* equivalents.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Addresses the WKS PoC review (Notion 2026-05-26). All docs in English.
- README: purpose, docs table of contents, annotated repo tree
- docs/getting_started.md: prerequisites (WKS account, OIDC, SSH, VPN) + first deploy
- docs/ansible.md: playbook table, "Running Ansible", service parameters, cheatsheet
- docs/secrets.md: canonical Bao login (moved out of README) + demo defaults
- docs/operations.md: full Makefile reference
- docs/inventories.md: repo layout, topology, standard folder structure, walkthrough
- docs/testing.md: static checks, inventory resolution, smoke test / dry run
- remove ARCHITECTURE.md (architecture docs live externally)

Also includes the gymburgdorf inventory build-out (bookstack, homarr,
opnform, send) and scripts/bao-seed.sh.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Simon force-pushed docs/wks-poc-review from ae4eb799bb to 49fe811011 2026-05-27 21:19:20 +00:00 Compare
Simon force-pushed docs/wks-poc-review from 49fe811011 to 2ba0c07cd3 2026-05-28 09:33:09 +00:00 Compare
Simon added 1 commit 2026-06-04 09:08:10 +00:00 
Storage Traefik calling the public auth.gymb.* FQDN hit Authentik's ASGI
handler, which 404s the /outpost.goauthentik.io/auth/traefik path. Add a
dedicated outpost.auth.int.gymb.* FQDN outside authentik_domains so the
request falls through to the embedded outpost, pinned to the application
host via traefik_extra_hosts to stay on the LAN.

- authentik: add authentik_outpost_domains; allow users group on drawio
  proxy so the Nextcloud drawio iframe works for non-admins
- garage: point webui ForwardAuth at the new outpost FQDN
- homarr: use public OIDC issuer to match the iss claim, enable
  auto-login, pin auth FQDN to LAN via extra_hosts
- opnform: intercept / and /login for SSO, keep break-glass bypass
- drawio: align comments with admins+users allow-list
requested review from Tobias-Wuest 2026-06-04 09:09:15 +00:00
Tobias-Wuest approved these changes 2026-06-04 09:19:43 +00:00
Tobias-Wuest merged commit 2206b809e7 into main 2026-06-04 09:20:13 +00:00
Tobias-Wuest deleted branch docs/wks-poc-review 2026-06-04 09:20:13 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Tobias-Wuest
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Digitalboard/reference-ansible#1
No description provided.
Delete branch "docs/wks-poc-review"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?