c67e9aac43
- ACME via DNS-01 against internal NS (172.16.9.169) with TCP-only + disableANSChecks so the DMZ traefik can issue LE certs without reaching public NS IPs. - Migrate single-domain vars to `*_domains` lists (authentik, nextcloud, collabora, garage_s3) so public + *.int.* SANs share one cert and server-to-server traffic stays in the LAN. - Wire `traefik_dmz_exposed_services` per backend host (application, storage) with explicit `backend_host` overrides pointing at internal FQDNs — DMZ traefik now validates upstream certs against SAN names. - Nextcloud notify_push setup on internal FQDN to avoid DMZ hairpin; collabora WOPI / authentik LDAP outpost wired to *.int.* equivalents.
20 lines
815 B
YAML
20 lines
815 B
YAML
_acme_tsig: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/acme-tsig', url=vault_addr ) }}"
|
|
|
|
traefik_use_ssl: true
|
|
traefik_cert_mode: "acme"
|
|
traefik_ssl_email: "hostmaster@digitalboard.ch"
|
|
traefik_log_level: DEBUG
|
|
traefik_network: proxy
|
|
|
|
traefik_acme_dns_zone: "demo-gymb._acme.digitalboard.ch"
|
|
traefik_acme_dns_nameserver: "{{ _acme_tsig.server }}"
|
|
traefik_acme_tsig_algorithm: "hmac-sha256"
|
|
traefik_acme_tsig_key: "{{ _acme_tsig.tsig_key }}"
|
|
traefik_acme_tsig_secret: "{{ _acme_tsig.tsig_secret }}"
|
|
|
|
# UDP/53 egress from the traefik container reaches ns1.digitalboard.ch
|
|
# unreliably (i/o timeouts on lego's recursive SOA pre-check), while
|
|
# TCP/53 to the same nameserver is open. Force lego to do its DNS
|
|
# lookups over TCP so the DNS-01 challenge can proceed.
|
|
traefik_acme_tcp_only: true
|
|
|