c67e9aac43
- ACME via DNS-01 against internal NS (172.16.9.169) with TCP-only + disableANSChecks so the DMZ traefik can issue LE certs without reaching public NS IPs. - Migrate single-domain vars to `*_domains` lists (authentik, nextcloud, collabora, garage_s3) so public + *.int.* SANs share one cert and server-to-server traffic stays in the LAN. - Wire `traefik_dmz_exposed_services` per backend host (application, storage) with explicit `backend_host` overrides pointing at internal FQDNs — DMZ traefik now validates upstream certs against SAN names. - Nextcloud notify_push setup on internal FQDN to avoid DMZ hairpin; collabora WOPI / authentik LDAP outpost wired to *.int.* equivalents.
32 lines
1.1 KiB
YAML
32 lines
1.1 KiB
YAML
---
|
|
# Bao secret <mount>/data/garage expected to contain:
|
|
# rpc_secret, admin_token, metrics_token, webui_password
|
|
_garage: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/garage', url=vault_addr) }}"
|
|
|
|
# First entry is the canonical public S3 FQDN. Additional entries
|
|
# cover internal *.int.* names so server-to-server S3 traffic (e.g.
|
|
# nextcloud → garage) stays in the LAN.
|
|
garage_s3_domains:
|
|
- "s3.gymb.souveredu.ch"
|
|
- "s3.int.gymb.souveredu.ch"
|
|
garage_webui_domain: "console.s3.gymb.souveredu.ch"
|
|
garage_use_ssl: true
|
|
garage_webui_enabled: true
|
|
garage_webui_username: "admin"
|
|
garage_webui_password: "{{ _garage.webui_password }}"
|
|
|
|
garage_rpc_secret: "{{ _garage.rpc_secret }}"
|
|
garage_admin_token: "{{ _garage.admin_token }}"
|
|
garage_metrics_token: "{{ _garage.metrics_token }}"
|
|
|
|
# Initial cluster bootstrap (single-node)
|
|
garage_bootstrap_enabled: true
|
|
garage_bootstrap_zone: "burgdorf1"
|
|
garage_bootstrap_capacity: "100G"
|
|
|
|
# Buckets and keys consumed by nextcloud
|
|
garage_s3_keys:
|
|
- name: nextcloud
|
|
buckets:
|
|
- name: nextcloud
|
|
permissions: ["read", "write"]
|