2942dabc54
The firewall now permits the backend subnet (172.16.19.0/24) to reach the DMZ reverseproxy on 443, so server-to-server calls can use the public FQDN over the reverseproxy instead of the previous workarounds: - Remove the `*_extra_hosts` pins from nextcloud, opnform, bookstack and homarr; their OIDC discovery/issuer now uses the public auth.gymb.* FQDN (verified: discovery returns 200 with the public iss over the reverseproxy). - Switch nextcloud OIDC discovery_url from auth.int.* to auth.gymb.*. - Drop authentik_host_rewrite_domains and authentik_outpost_domains; point the LDAP outpost (both host_vars) at the public auth.gymb.* FQDN. - Repoint the garage-webui ForwardAuth from the never-functional dedicated outpost FQDN to auth.gymb.*. The embedded outpost only serves the auth path when Host is a configured authentik_domain and matches the protected app via X-Forwarded-Host, so auth.gymb.* stays pinned to the application host on storage to bypass the reverseproxy's X-Forwarded-Host stripping. The *.int.* names and their cert SANs are kept: the DMZ verifies the backend cert (acme cert_mode) and connects by name, so they remain structural to the DMZ->backend hop. The console.s3 DMZ route limitation is pre-existing and tracked separately.
28 lines
1.3 KiB
YAML
28 lines
1.3 KiB
YAML
---
|
|
# The garage-webui ForwardAuth middleware fires a subrequest to authentik
|
|
# (see garage.yml). It must reach the app-host's `authentik` router
|
|
# directly — going via the DMZ reverseproxy strips X-Forwarded-Host, which
|
|
# breaks the embedded outpost's app matching. The internal DNS view points
|
|
# auth.gymb.* at the reverseproxy, so pin it to the application host here
|
|
# to force the single direct hop that preserves the forwarded headers.
|
|
traefik_extra_hosts:
|
|
- "auth.gymb.souveredu.ch:172.16.19.101"
|
|
|
|
# Services hosted on `storage` that the DMZ reverseproxy should forward
|
|
# public traffic to. See application/traefik.yml for the mechanism.
|
|
traefik_dmz_exposed_services:
|
|
- name: garage-s3
|
|
domain: s3.gymb.souveredu.ch
|
|
backend_host: s3.int.gymb.souveredu.ch
|
|
port: 443
|
|
protocol: https
|
|
- name: garage-webui
|
|
domain: console.s3.gymb.souveredu.ch
|
|
# Pre-existing limitation, orthogonal to the DNS cleanup: the DMZ
|
|
# verifies the storage backend cert (acme cert_mode), but with no
|
|
# backend_host set it connects by IP, which the storage cert has no
|
|
# SAN for, so this route fails the TLS verify. Fixing it needs the
|
|
# garage role to expose a console extra_domain (e.g. console.s3.int.*)
|
|
# for the backend_host + cert SAN — tracked separately.
|
|
port: 443
|
|
protocol: https
|