c67e9aac43
- ACME via DNS-01 against internal NS (172.16.9.169) with TCP-only + disableANSChecks so the DMZ traefik can issue LE certs without reaching public NS IPs. - Migrate single-domain vars to `*_domains` lists (authentik, nextcloud, collabora, garage_s3) so public + *.int.* SANs share one cert and server-to-server traffic stays in the LAN. - Wire `traefik_dmz_exposed_services` per backend host (application, storage) with explicit `backend_host` overrides pointing at internal FQDNs — DMZ traefik now validates upstream certs against SAN names. - Nextcloud notify_push setup on internal FQDN to avoid DMZ hairpin; collabora WOPI / authentik LDAP outpost wired to *.int.* equivalents.
16 lines
563 B
YAML
16 lines
563 B
YAML
---
|
|
# First entry is the canonical public FQDN. Additional entries cover
|
|
# internal *.int.* names so nextcloud's WOPI discovery hits collabora
|
|
# in the LAN with a valid internal cert.
|
|
collabora_domains:
|
|
- "office.gymb.souveredu.ch"
|
|
- "office.int.gymb.souveredu.ch"
|
|
|
|
# Hosts allowed to issue WOPI calls. Both names are listed so collabora
|
|
# accepts the callback from nextcloud regardless of which FQDN it uses.
|
|
collabora_allowed_domains:
|
|
- "cloud.gymb.souveredu.ch"
|
|
- "cloud.int.gymb.souveredu.ch"
|
|
|
|
collabora_frame_ancestors:
|
|
- "cloud.gymb.souveredu.ch"
|