2942dabc54
The firewall now permits the backend subnet (172.16.19.0/24) to reach the DMZ reverseproxy on 443, so server-to-server calls can use the public FQDN over the reverseproxy instead of the previous workarounds: - Remove the `*_extra_hosts` pins from nextcloud, opnform, bookstack and homarr; their OIDC discovery/issuer now uses the public auth.gymb.* FQDN (verified: discovery returns 200 with the public iss over the reverseproxy). - Switch nextcloud OIDC discovery_url from auth.int.* to auth.gymb.*. - Drop authentik_host_rewrite_domains and authentik_outpost_domains; point the LDAP outpost (both host_vars) at the public auth.gymb.* FQDN. - Repoint the garage-webui ForwardAuth from the never-functional dedicated outpost FQDN to auth.gymb.*. The embedded outpost only serves the auth path when Host is a configured authentik_domain and matches the protected app via X-Forwarded-Host, so auth.gymb.* stays pinned to the application host on storage to bypass the reverseproxy's X-Forwarded-Host stripping. The *.int.* names and their cert SANs are kept: the DMZ verifies the backend cert (acme cert_mode) and connects by name, so they remain structural to the DMZ->backend hop. The console.s3 DMZ route limitation is pre-existing and tracked separately.
36 lines
1.6 KiB
YAML
36 lines
1.6 KiB
YAML
---
|
|
# Bao secret <mount>/data/bookstack expected to contain:
|
|
# db_root_password, db_password, admin_password, oidc_client_secret,
|
|
# app_key (optional — only set when restoring)
|
|
_bookstack: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/bookstack', url=vault_addr) }}"
|
|
|
|
bookstack_domain: "wiki.gymb.souveredu.ch"
|
|
bookstack_extra_domains:
|
|
- "wiki.int.gymb.souveredu.ch"
|
|
bookstack_base_url: "https://wiki.gymb.souveredu.ch"
|
|
|
|
# Override the role-default certresolver ("le") with the value used
|
|
# across this demo (matches traefik_ssl_cert_resolver in group_vars).
|
|
bookstack_traefik_certresolver: "dns"
|
|
|
|
bookstack_db_root_password: "{{ _bookstack.db_root_password }}"
|
|
bookstack_db_password: "{{ _bookstack.db_password }}"
|
|
bookstack_admin_password: "{{ _bookstack.admin_password }}"
|
|
bookstack_admin_email: "admin@gymb.souveredu.ch"
|
|
bookstack_admin_name: "BookStack Admin"
|
|
|
|
# OIDC against Authentik. BookStack compares OIDC_ISSUER strictly against
|
|
# the `iss` claim in the discovery response, and Authentik emits the
|
|
# public auth.gymb.* hostname there, so the issuer must use the public
|
|
# FQDN. That FQDN resolves (internal DNS view) to the DMZ reverseproxy,
|
|
# which the backend subnet can reach, so the server-to-server calls stay
|
|
# in the LAN.
|
|
bookstack_oidc_enabled: true
|
|
bookstack_oidc_name: "Authentik"
|
|
bookstack_oidc_issuer: "https://auth.gymb.souveredu.ch/application/o/bookstack/"
|
|
bookstack_oidc_client_id: "bookstack"
|
|
bookstack_oidc_client_secret: "{{ _bookstack.oidc_client_secret }}"
|
|
bookstack_oidc_additional_scopes: "openid profile email"
|
|
bookstack_oidc_user_to_groups: true
|
|
bookstack_oidc_groups_claim: "groups"
|
|
bookstack_oidc_auto_initiate: false
|