c67e9aac43
- ACME via DNS-01 against internal NS (172.16.9.169) with TCP-only + disableANSChecks so the DMZ traefik can issue LE certs without reaching public NS IPs. - Migrate single-domain vars to `*_domains` lists (authentik, nextcloud, collabora, garage_s3) so public + *.int.* SANs share one cert and server-to-server traffic stays in the LAN. - Wire `traefik_dmz_exposed_services` per backend host (application, storage) with explicit `backend_host` overrides pointing at internal FQDNs — DMZ traefik now validates upstream certs against SAN names. - Nextcloud notify_push setup on internal FQDN to avoid DMZ hairpin; collabora WOPI / authentik LDAP outpost wired to *.int.* equivalents.
36 lines
1.3 KiB
Makefile
36 lines
1.3 KiB
Makefile
export BAO_ADDR=https://bao.digitalboard.ch
|
|
# macOS fork-safety: Objective-C runtime is not fork-safe; Ansible forks
|
|
# per host. Without this, hashi_vault lookups crash workers.
|
|
export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
|
|
|
|
install:
|
|
ansible-galaxy collection install -r requirements.yml -p collections
|
|
|
|
bao:
|
|
bao login -method=oidc -path=Digitalboard role=default
|
|
$(eval export VAULT_TOKEN=$(shell bao print token))
|
|
|
|
ping_demo:
|
|
echo "# pinging demo-gymburgdorf"
|
|
ansible all -i inventories/demo-gymburgdorf/hosts.yml -m ping || true
|
|
echo "# pinging demo-mbazürich"
|
|
ansible all -i inventories/demo-mbazürich/hosts.yml -m ping || true
|
|
echo "# pinging demo-phbern"
|
|
ansible all -i inventories/demo-phbern/hosts.yml -m ping || true
|
|
|
|
deploy_site_demo_gymburgdorf:
|
|
echo "deploying demo site gymburgdorf"
|
|
ansible-playbook playbooks/site.yml -i inventories/demo-gymburgdorf/hosts.yml --diff
|
|
|
|
deploy_site_demo_mbazürich:
|
|
echo "deploying demo site mbazürich"
|
|
ansible-playbook playbooks/site.yml -i inventories/demo-mbazürich/hosts.yml
|
|
|
|
deploy_site_demo_phbern:
|
|
echo "deploying demo site phbern"
|
|
ansible-playbook playbooks/site.yml -i inventories/demo-phbern/hosts.yml
|
|
|
|
deploy_site_demo:
|
|
make deploy_site_demo_gymburgdorf
|
|
make deploy_site_demo_mbazürich
|
|
make deploy_site_demo_phbern
|