2942dabc54
The firewall now permits the backend subnet (172.16.19.0/24) to reach the DMZ reverseproxy on 443, so server-to-server calls can use the public FQDN over the reverseproxy instead of the previous workarounds: - Remove the `*_extra_hosts` pins from nextcloud, opnform, bookstack and homarr; their OIDC discovery/issuer now uses the public auth.gymb.* FQDN (verified: discovery returns 200 with the public iss over the reverseproxy). - Switch nextcloud OIDC discovery_url from auth.int.* to auth.gymb.*. - Drop authentik_host_rewrite_domains and authentik_outpost_domains; point the LDAP outpost (both host_vars) at the public auth.gymb.* FQDN. - Repoint the garage-webui ForwardAuth from the never-functional dedicated outpost FQDN to auth.gymb.*. The embedded outpost only serves the auth path when Host is a configured authentik_domain and matches the protected app via X-Forwarded-Host, so auth.gymb.* stays pinned to the application host on storage to bypass the reverseproxy's X-Forwarded-Host stripping. The *.int.* names and their cert SANs are kept: the DMZ verifies the backend cert (acme cert_mode) and connects by name, so they remain structural to the DMZ->backend hop. The console.s3 DMZ route limitation is pre-existing and tracked separately.
50 lines
2.3 KiB
YAML
50 lines
2.3 KiB
YAML
---
|
|
# Bao secret <mount>/data/opnform expected to contain:
|
|
# app_key (must start with "base64:"), jwt_secret, front_api_secret,
|
|
# db_password, admin_password, oidc_client_secret
|
|
_opnform: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/opnform', url=vault_addr) }}"
|
|
_authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/authentik', url=vault_addr) }}"
|
|
|
|
opnform_domain: "forms.gymb.souveredu.ch"
|
|
opnform_extra_domains:
|
|
- "forms.int.gymb.souveredu.ch"
|
|
opnform_base_url: "https://forms.gymb.souveredu.ch"
|
|
|
|
opnform_app_key: "{{ _opnform.app_key }}"
|
|
opnform_jwt_secret: "{{ _opnform.jwt_secret }}"
|
|
opnform_front_api_secret: "{{ _opnform.front_api_secret }}"
|
|
opnform_db_password: "{{ _opnform.db_password }}"
|
|
|
|
# Bootstrap admin via API on first run so the manual setup page is
|
|
# skipped. The admin credentials are also required to seed the OIDC
|
|
# IdentityConnection through OpnForm's API (only an authenticated admin
|
|
# can create connections).
|
|
opnform_admin_name: "OpnForm Admin"
|
|
opnform_admin_email: "admin@gymb.souveredu.ch"
|
|
opnform_admin_password: "{{ _opnform.admin_password }}"
|
|
|
|
# OIDC against Authentik. The public auth.gymb.* FQDN resolves (internal
|
|
# DNS view) to the DMZ reverseproxy, which the backend subnet can reach,
|
|
# so OpnForm's discovery/token/userinfo calls stay in the LAN while the
|
|
# iss claim matches the public hostname browsers see during login.
|
|
opnform_oidc_enabled: true
|
|
# Issuer must use the public FQDN: OpnForm validates the token's `iss`
|
|
# claim against this value, and Authentik emits the public hostname there.
|
|
opnform_oidc_issuer: "https://auth.gymb.souveredu.ch/application/o/opnform/"
|
|
opnform_oidc_client_id: "opnform"
|
|
opnform_oidc_client_secret: "{{ _opnform.oidc_client_secret }}"
|
|
opnform_oidc_client_name: "Authentik"
|
|
opnform_oidc_slug: "authentik"
|
|
opnform_oidc_domain: "gymb.souveredu.ch"
|
|
opnform_oidc_admin_group: "opnform-admins"
|
|
|
|
# Disable password login entirely — every user goes through Authentik.
|
|
# All real users have @gymb.souveredu.ch addresses (matching
|
|
# opnform_oidc_domain above), so no password fallback is needed.
|
|
opnform_oidc_force_login: true
|
|
|
|
# `/` and `/login` are intercepted and jump straight to Authentik.
|
|
# Public form deep-links (`/forms/<slug>`, `/admin/...`) keep working.
|
|
# Break-glass: /login?bypass=1 reaches the email form when the IdP is
|
|
# down.
|
|
opnform_oidc_sso_entrypoint: true
|