c67e9aac43
- ACME via DNS-01 against internal NS (172.16.9.169) with TCP-only + disableANSChecks so the DMZ traefik can issue LE certs without reaching public NS IPs. - Migrate single-domain vars to `*_domains` lists (authentik, nextcloud, collabora, garage_s3) so public + *.int.* SANs share one cert and server-to-server traffic stays in the LAN. - Wire `traefik_dmz_exposed_services` per backend host (application, storage) with explicit `backend_host` overrides pointing at internal FQDNs — DMZ traefik now validates upstream certs against SAN names. - Nextcloud notify_push setup on internal FQDN to avoid DMZ hairpin; collabora WOPI / authentik LDAP outpost wired to *.int.* equivalents.
61 lines
1.9 KiB
YAML
61 lines
1.9 KiB
YAML
---
|
|
# Bao secret expected at <mount>/data/authentik with keys:
|
|
# secret_key, postgres_password, admin_password,
|
|
# ldap_outpost_token,
|
|
# nextcloud_oidc_secret
|
|
_authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/authentik', url=vault_addr) }}"
|
|
|
|
# First entry is the canonical public FQDN. Additional entries cover
|
|
# internal *.int.* names so server-to-server traffic (e.g. the LDAP
|
|
# outpost) hits authentik on a name with a valid internal cert and
|
|
# skips the DMZ hop.
|
|
authentik_domains:
|
|
- "auth.gymb.souveredu.ch"
|
|
- "auth.int.gymb.souveredu.ch"
|
|
authentik_secret_key: "{{ _authentik.secret_key }}"
|
|
authentik_postgres_password: "{{ _authentik.postgres_password }}"
|
|
|
|
# LDAP outpost (provider for nextcloud)
|
|
authentik_ldap_apps:
|
|
- slug: ldap
|
|
name: LDAP
|
|
base_dn: "dc=gymb,dc=souveredu,dc=ch"
|
|
search_group: admins
|
|
|
|
authentik_ldap_outpost:
|
|
name: "ldap-outpost"
|
|
token: "{{ _authentik.ldap_outpost_token }}"
|
|
config:
|
|
# Outpost pulls config from authentik over the internal FQDN — keeps
|
|
# the round-trip in the LAN with a valid cert.
|
|
authentik_host: "https://auth.int.gymb.souveredu.ch/"
|
|
log_level: "info"
|
|
|
|
# OIDC clients
|
|
authentik_oidc_apps:
|
|
- slug: nextcloud
|
|
name: Nextcloud
|
|
client_id: nextcloud
|
|
client_secret: "{{ _authentik.nextcloud_oidc_secret }}"
|
|
redirect_uris:
|
|
- url: "https://cloud.gymb.souveredu.ch/apps/user_oidc/code"
|
|
matching_mode: strict
|
|
signing_key_name: "authentik Self-signed Certificate"
|
|
flows:
|
|
authorization_slug: default-provider-authorization-implicit-consent
|
|
invalidation_slug: default-provider-invalidation-flow
|
|
scopes: [openid, email, profile, offline_access]
|
|
|
|
authentik_groups:
|
|
- name: admins
|
|
- name: users
|
|
|
|
authentik_local_users:
|
|
- username: akadmin
|
|
name: "Authentik Admin"
|
|
email: "admin@gymb.souveredu.ch"
|
|
password: "{{ _authentik.admin_password }}"
|
|
is_active: true
|
|
groups:
|
|
- authentik Admins
|
|
- admins
|