The firewall now permits the backend subnet (172.16.19.0/24) to reach the
DMZ reverseproxy on 443, so server-to-server calls can use the public
FQDN over the reverseproxy instead of the previous workarounds:
- Remove the `*_extra_hosts` pins from nextcloud, opnform, bookstack and
homarr; their OIDC discovery/issuer now uses the public auth.gymb.* FQDN
(verified: discovery returns 200 with the public iss over the reverseproxy).
- Switch nextcloud OIDC discovery_url from auth.int.* to auth.gymb.*.
- Drop authentik_host_rewrite_domains and authentik_outpost_domains; point
the LDAP outpost (both host_vars) at the public auth.gymb.* FQDN.
- Repoint the garage-webui ForwardAuth from the never-functional dedicated
outpost FQDN to auth.gymb.*. The embedded outpost only serves the auth
path when Host is a configured authentik_domain and matches the protected
app via X-Forwarded-Host, so auth.gymb.* stays pinned to the application
host on storage to bypass the reverseproxy's X-Forwarded-Host stripping.
The *.int.* names and their cert SANs are kept: the DMZ verifies the
backend cert (acme cert_mode) and connects by name, so they remain
structural to the DMZ->backend hop. The console.s3 DMZ route limitation
is pre-existing and tracked separately.
2942dabc54