d45e358efc
Both demo sites had only a hosts.yml, so every role ran on its defaults (authentik.local.test etc.) and nothing was reachable under the real FQDN. Add the complete group_vars + host_vars analogous to gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain bases, matching Bao mounts, DMZ split-horizon (public + *.int.*), authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC, collabora, drawio, garage, send, opnform, homarr and bookstack. authentik_domains lists the *.int.* name too so Traefik requests a cert the DMZ can verify; the storage proxy outpost carries a config block (required by the outpost blueprint serializer).
74 lines
1.4 KiB
YAML
74 lines
1.4 KiB
YAML
all:
|
|
children:
|
|
all_servers:
|
|
hosts:
|
|
reverseproxy:
|
|
ansible_host: 172.16.9.117
|
|
ansible_user: root
|
|
application:
|
|
ansible_host: 172.16.19.121
|
|
ansible_user: root
|
|
storage:
|
|
ansible_host: 172.16.19.122
|
|
ansible_user: root
|
|
turn:
|
|
ansible_host: 172.16.9.118
|
|
ansible_user: root
|
|
|
|
traefik_servers:
|
|
children:
|
|
all_servers:
|
|
|
|
backend_servers:
|
|
hosts:
|
|
application:
|
|
storage:
|
|
|
|
garage_servers:
|
|
hosts:
|
|
storage:
|
|
|
|
nextcloud_servers:
|
|
hosts:
|
|
application:
|
|
|
|
collabora_servers:
|
|
hosts:
|
|
application:
|
|
|
|
drawio_servers:
|
|
hosts:
|
|
application:
|
|
|
|
authentik_servers:
|
|
hosts:
|
|
application:
|
|
|
|
authentik_outpost_ldap_servers:
|
|
hosts:
|
|
application:
|
|
|
|
# Proxy (ForwardAuth) outpost co-located with garage on storage, so
|
|
# the garage-webui ForwardAuth subrequest stays on the local docker
|
|
# network instead of crossing an extra reverseproxy hop (which mangles
|
|
# X-Forwarded-Host and breaks the embedded outpost's app matching).
|
|
authentik_outpost_proxy_servers:
|
|
hosts:
|
|
storage:
|
|
|
|
|
|
send_servers:
|
|
hosts:
|
|
application:
|
|
|
|
opnform_servers:
|
|
hosts:
|
|
application:
|
|
|
|
homarr_servers:
|
|
hosts:
|
|
application:
|
|
|
|
bookstack_servers:
|
|
hosts:
|
|
application:
|