2942dabc54
The firewall now permits the backend subnet (172.16.19.0/24) to reach the DMZ reverseproxy on 443, so server-to-server calls can use the public FQDN over the reverseproxy instead of the previous workarounds: - Remove the `*_extra_hosts` pins from nextcloud, opnform, bookstack and homarr; their OIDC discovery/issuer now uses the public auth.gymb.* FQDN (verified: discovery returns 200 with the public iss over the reverseproxy). - Switch nextcloud OIDC discovery_url from auth.int.* to auth.gymb.*. - Drop authentik_host_rewrite_domains and authentik_outpost_domains; point the LDAP outpost (both host_vars) at the public auth.gymb.* FQDN. - Repoint the garage-webui ForwardAuth from the never-functional dedicated outpost FQDN to auth.gymb.*. The embedded outpost only serves the auth path when Host is a configured authentik_domain and matches the protected app via X-Forwarded-Host, so auth.gymb.* stays pinned to the application host on storage to bypass the reverseproxy's X-Forwarded-Host stripping. The *.int.* names and their cert SANs are kept: the DMZ verifies the backend cert (acme cert_mode) and connects by name, so they remain structural to the DMZ->backend hop. The console.s3 DMZ route limitation is pre-existing and tracked separately.
48 lines
2.1 KiB
YAML
48 lines
2.1 KiB
YAML
---
|
|
# Bao secret <mount>/data/garage expected to contain:
|
|
# rpc_secret, admin_token, metrics_token, webui_password
|
|
_garage: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/garage', url=vault_addr) }}"
|
|
|
|
# First entry is the canonical public S3 FQDN. Additional entries
|
|
# cover internal *.int.* names so server-to-server S3 traffic (e.g.
|
|
# nextcloud → garage) stays in the LAN.
|
|
garage_s3_domains:
|
|
- "s3.gymb.souveredu.ch"
|
|
- "s3.int.gymb.souveredu.ch"
|
|
garage_webui_domain: "console.s3.gymb.souveredu.ch"
|
|
garage_use_ssl: true
|
|
garage_webui_enabled: true
|
|
# Gate the WebUI behind authentik (admins-only, via policy-binding on the
|
|
# authentik proxy app). Replaces the htpasswd Basic-Auth — AUTH_USER_PASS
|
|
# is dropped from the compose env when this is true.
|
|
#
|
|
# The embedded outpost only serves the /outpost.goauthentik.io/auth path
|
|
# when the request reaches authentik with Host set to a configured
|
|
# authentik_domain (auth.gymb.*); it then matches the protected app
|
|
# (console.s3.*) via X-Forwarded-Host. So the ForwardAuth must hit the
|
|
# app-host's `authentik` router (Host(auth.gymb), passHostHeader=true) —
|
|
# NOT the DMZ reverseproxy (strips X-Forwarded-Host) and NOT the auth.int
|
|
# rewrite router (overwrites X-Forwarded-Host). auth.gymb.* is therefore
|
|
# pinned to the application host in storage/traefik.yml so this single hop
|
|
# preserves the forwarded headers and stays in the LAN.
|
|
garage_webui_authentik_forward_auth: true
|
|
garage_webui_authentik_forward_auth_url: "https://auth.gymb.souveredu.ch/outpost.goauthentik.io/auth/traefik"
|
|
# Kept for completeness — only used when authentik ForwardAuth is off.
|
|
garage_webui_username: "admin"
|
|
garage_webui_password: "{{ _garage.webui_password | default('disabled') }}"
|
|
|
|
garage_rpc_secret: "{{ _garage.rpc_secret }}"
|
|
garage_admin_token: "{{ _garage.admin_token }}"
|
|
garage_metrics_token: "{{ _garage.metrics_token }}"
|
|
|
|
# Initial cluster bootstrap (single-node)
|
|
garage_bootstrap_enabled: true
|
|
garage_bootstrap_zone: "burgdorf1"
|
|
garage_bootstrap_capacity: "100G"
|
|
|
|
# Buckets and keys consumed by nextcloud
|
|
garage_s3_keys:
|
|
- name: nextcloud
|
|
buckets:
|
|
- name: nextcloud
|
|
permissions: ["read", "write"]
|