e32c2202ea
Finish the garage-webui SSO that the DNS cleanup left broken. Two coupled fixes, both relying on roles added in digitalboard.core: - console.s3 now has an internal name. garage_webui_domains lists both the public and console.s3.int.* FQDN, and the DMZ garage-webui route sets backend_host: console.s3.int.* so the DMZ->storage hop verifies the backend cert against a matching SAN instead of failing on a raw IP (500). - garage-webui ForwardAuth moves off the embedded outpost (cross-host hop mangled X-Forwarded-Host -> 404) onto a dedicated proxy outpost deployed on storage (authentik_outpost_proxy). The garage Traefik middleware now talks to it over the local docker network, and the storage-proxy-outpost is registered in authentik with the garage-webui provider. The stale auth.gymb pin on storage is dropped; the outpost reaches authentik via the reverseproxy (firewall now permits backend -> DMZ). Requires a new bao secret key: <mount>/data/authentik proxy_outpost_token.
21 lines
947 B
YAML
21 lines
947 B
YAML
---
|
|
# Services hosted on `storage` that the DMZ reverseproxy should forward
|
|
# public traffic to. See application/traefik.yml for the mechanism.
|
|
# The garage-webui ForwardAuth no longer needs an auth FQDN pinned here —
|
|
# it talks to the storage-local proxy outpost over the docker network
|
|
# (see garage.yml), and the outpost reaches authentik via the public FQDN
|
|
# over the reverseproxy (firewall now permits backend -> DMZ).
|
|
traefik_dmz_exposed_services:
|
|
- name: garage-s3
|
|
domain: s3.gymb.souveredu.ch
|
|
backend_host: s3.int.gymb.souveredu.ch
|
|
port: 443
|
|
protocol: https
|
|
- name: garage-webui
|
|
domain: console.s3.gymb.souveredu.ch
|
|
# Internal name so the DMZ verifies the storage backend cert against a
|
|
# matching SAN (acme cert_mode, no insecureSkipVerify). garage now
|
|
# serves this SAN via garage_webui_domains (see garage.yml).
|
|
backend_host: console.s3.int.gymb.souveredu.ch
|
|
port: 443
|
|
protocol: https
|