e32c2202ea
Finish the garage-webui SSO that the DNS cleanup left broken. Two coupled fixes, both relying on roles added in digitalboard.core: - console.s3 now has an internal name. garage_webui_domains lists both the public and console.s3.int.* FQDN, and the DMZ garage-webui route sets backend_host: console.s3.int.* so the DMZ->storage hop verifies the backend cert against a matching SAN instead of failing on a raw IP (500). - garage-webui ForwardAuth moves off the embedded outpost (cross-host hop mangled X-Forwarded-Host -> 404) onto a dedicated proxy outpost deployed on storage (authentik_outpost_proxy). The garage Traefik middleware now talks to it over the local docker network, and the storage-proxy-outpost is registered in authentik with the garage-webui provider. The stale auth.gymb pin on storage is dropped; the outpost reaches authentik via the reverseproxy (firewall now permits backend -> DMZ). Requires a new bao secret key: <mount>/data/authentik proxy_outpost_token.
119 lines
2.6 KiB
YAML
119 lines
2.6 KiB
YAML
---
|
|
- name: Apply base configuration to all servers
|
|
hosts: all_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.base
|
|
|
|
- name: Configure reverse proxy on application servers
|
|
hosts: traefik_servers_backend
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.traefik
|
|
|
|
- name: Configure reverse proxy on DMZ servers
|
|
hosts: traefik_servers_dmz
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.traefik
|
|
|
|
# Inventories without the _dmz/_backend split (e.g. demo-gymburgdorf,
|
|
# where traefik_servers groups all_servers and dmz/backend is selected
|
|
# per host via traefik_mode). The :!… intersection keeps this a no-op
|
|
# for the vagrant topology, where every traefik_servers host is already
|
|
# covered by the two plays above.
|
|
- name: Configure reverse proxies
|
|
hosts: traefik_servers:!traefik_servers_dmz:!traefik_servers_backend
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.traefik
|
|
|
|
- name: Deploy httpbin service
|
|
hosts: httpbin_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.httpbin
|
|
|
|
- name: Deploy 389ds LDAP service
|
|
hosts: ds389_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.389ds
|
|
|
|
- name: Deploy keycloak service
|
|
hosts: keycloak_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.keycloak
|
|
|
|
- name: Deploy garage service
|
|
hosts: garage_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.garage
|
|
|
|
- name: Deploy collabora service
|
|
hosts: collabora_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.collabora
|
|
|
|
- name: Deploy authentik service
|
|
hosts: authentik_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.authentik
|
|
|
|
- name: Deploy authentik LDAP outpost
|
|
hosts: authentik_outpost_ldap_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.authentik_outpost_ldap
|
|
|
|
- name: Deploy authentik proxy outpost
|
|
hosts: authentik_outpost_proxy_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.authentik_outpost_proxy
|
|
|
|
- name: Deploy nextcloud service
|
|
hosts: nextcloud_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.nextcloud
|
|
|
|
- name: Deploy drawio service
|
|
hosts: drawio_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.drawio
|
|
|
|
- name: Deploy send service
|
|
hosts: send_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.send
|
|
|
|
- name: Deploy opnform service
|
|
hosts: opnform_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.opnform
|
|
|
|
- name: Deploy homarr service
|
|
hosts: homarr_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.homarr
|
|
|
|
- name: Deploy bookstack service
|
|
hosts: bookstack_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.bookstack
|
|
|
|
- name: Deploy opencloud service
|
|
hosts: opencloud_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.opencloud
|