d45e358efc
Both demo sites had only a hosts.yml, so every role ran on its defaults (authentik.local.test etc.) and nothing was reachable under the real FQDN. Add the complete group_vars + host_vars analogous to gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain bases, matching Bao mounts, DMZ split-horizon (public + *.int.*), authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC, collabora, drawio, garage, send, opnform, homarr and bookstack. authentik_domains lists the *.int.* name too so Traefik requests a cert the DMZ can verify; the storage proxy outpost carries a config block (required by the outpost blueprint serializer).
46 lines
1.3 KiB
YAML
46 lines
1.3 KiB
YAML
---
|
|
# Services hosted on `application` that the DMZ reverseproxy should
|
|
# forward public traffic to. The DMZ traefik picks this up via
|
|
# hostvars[backend].traefik_dmz_exposed_services and renders a router +
|
|
# service for each entry into /config/services.yml.
|
|
traefik_dmz_exposed_services:
|
|
- name: authentik
|
|
domain: auth.phbe.souveredu.ch
|
|
backend_host: auth.int.phbe.souveredu.ch
|
|
port: 443
|
|
protocol: https
|
|
- name: nextcloud
|
|
domain: cloud.phbe.souveredu.ch
|
|
backend_host: cloud.int.phbe.souveredu.ch
|
|
port: 443
|
|
protocol: https
|
|
- name: collabora
|
|
domain: office.phbe.souveredu.ch
|
|
backend_host: office.int.phbe.souveredu.ch
|
|
port: 443
|
|
protocol: https
|
|
- name: drawio
|
|
domain: draw.phbe.souveredu.ch
|
|
backend_host: draw.int.phbe.souveredu.ch
|
|
port: 443
|
|
protocol: https
|
|
- name: send
|
|
domain: send.phbe.souveredu.ch
|
|
backend_host: send.int.phbe.souveredu.ch
|
|
port: 443
|
|
protocol: https
|
|
- name: opnform
|
|
domain: forms.phbe.souveredu.ch
|
|
backend_host: forms.int.phbe.souveredu.ch
|
|
port: 443
|
|
protocol: https
|
|
- name: homarr
|
|
domain: home.phbe.souveredu.ch
|
|
backend_host: home.int.phbe.souveredu.ch
|
|
port: 443
|
|
protocol: https
|
|
- name: bookstack
|
|
domain: wiki.phbe.souveredu.ch
|
|
backend_host: wiki.int.phbe.souveredu.ch
|
|
port: 443
|
|
protocol: https
|