2ba0c07cd3
Addresses the WKS PoC review (Notion 2026-05-26). All docs in English. - README: purpose, docs table of contents, annotated repo tree - docs/getting_started.md: prerequisites (WKS account, OIDC, SSH, VPN) + first deploy - docs/ansible.md: playbook table, "Running Ansible", service parameters, cheatsheet - docs/secrets.md: canonical Bao login (moved out of README) + demo defaults - docs/operations.md: full Makefile reference - docs/inventories.md: repo layout, topology, standard folder structure, walkthrough - docs/testing.md: static checks, inventory resolution, smoke test / dry run - remove ARCHITECTURE.md (architecture docs live externally) Also includes the gymburgdorf inventory build-out (bookstack, homarr, opnform, send) and scripts/bao-seed.sh. site.yml keeps a third traefik play (traefik_servers minus the vagrant _dmz/_backend split) so the demo inventories still configure their reverse proxy after the rebase onto main.
43 lines
2 KiB
YAML
43 lines
2 KiB
YAML
---
|
|
# Bao secret <mount>/data/bookstack expected to contain:
|
|
# db_root_password, db_password, admin_password, oidc_client_secret,
|
|
# app_key (optional — only set when restoring)
|
|
_bookstack: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/bookstack', url=vault_addr) }}"
|
|
|
|
bookstack_domain: "wiki.gymb.souveredu.ch"
|
|
bookstack_extra_domains:
|
|
- "wiki.int.gymb.souveredu.ch"
|
|
bookstack_base_url: "https://wiki.gymb.souveredu.ch"
|
|
|
|
# Override the role-default certresolver ("le") with the value used
|
|
# across this demo (matches traefik_ssl_cert_resolver in group_vars).
|
|
bookstack_traefik_certresolver: "dns"
|
|
|
|
bookstack_db_root_password: "{{ _bookstack.db_root_password }}"
|
|
bookstack_db_password: "{{ _bookstack.db_password }}"
|
|
bookstack_admin_password: "{{ _bookstack.admin_password }}"
|
|
bookstack_admin_email: "admin@gymb.souveredu.ch"
|
|
bookstack_admin_name: "BookStack Admin"
|
|
|
|
# OIDC against Authentik. BookStack compares OIDC_ISSUER strictly against
|
|
# the `iss` claim in the discovery response. Authentik emits the public
|
|
# auth.gymb.* hostname there (host-rewrite middleware ensures the claim
|
|
# matches what browsers see during login), so the issuer URL must use the
|
|
# public FQDN. Pinning auth.gymb.* in /etc/hosts below keeps the actual
|
|
# server-to-server traffic on the LAN.
|
|
bookstack_oidc_enabled: true
|
|
bookstack_oidc_name: "Authentik"
|
|
bookstack_oidc_issuer: "https://auth.gymb.souveredu.ch/application/o/bookstack/"
|
|
bookstack_oidc_client_id: "bookstack"
|
|
bookstack_oidc_client_secret: "{{ _bookstack.oidc_client_secret }}"
|
|
bookstack_oidc_additional_scopes: "openid profile email"
|
|
bookstack_oidc_user_to_groups: true
|
|
bookstack_oidc_groups_claim: "groups"
|
|
bookstack_oidc_auto_initiate: false
|
|
|
|
# Pin auth.gymb.* to the application host so server-to-server OIDC calls
|
|
# (discovery, token, userinfo, jwks) stay in the LAN and reach authentik
|
|
# directly without hairpinning through the DMZ (which has no NAT loop
|
|
# back to its own public IP).
|
|
bookstack_extra_hosts:
|
|
- "auth.gymb.souveredu.ch:172.16.19.101"
|