e32c2202ea
Finish the garage-webui SSO that the DNS cleanup left broken. Two coupled fixes, both relying on roles added in digitalboard.core: - console.s3 now has an internal name. garage_webui_domains lists both the public and console.s3.int.* FQDN, and the DMZ garage-webui route sets backend_host: console.s3.int.* so the DMZ->storage hop verifies the backend cert against a matching SAN instead of failing on a raw IP (500). - garage-webui ForwardAuth moves off the embedded outpost (cross-host hop mangled X-Forwarded-Host -> 404) onto a dedicated proxy outpost deployed on storage (authentik_outpost_proxy). The garage Traefik middleware now talks to it over the local docker network, and the storage-proxy-outpost is registered in authentik with the garage-webui provider. The stale auth.gymb pin on storage is dropped; the outpost reaches authentik via the reverseproxy (firewall now permits backend -> DMZ). Requires a new bao secret key: <mount>/data/authentik proxy_outpost_token.
73 lines
No EOL
1.4 KiB
YAML
73 lines
No EOL
1.4 KiB
YAML
all:
|
|
children:
|
|
all_servers:
|
|
hosts:
|
|
reverseproxy:
|
|
ansible_host: 172.16.9.111
|
|
ansible_user: root
|
|
application:
|
|
ansible_host: 172.16.19.101
|
|
ansible_user: root
|
|
storage:
|
|
ansible_host: 172.16.19.102
|
|
ansible_user: root
|
|
turn:
|
|
ansible_host: 172.16.9.112
|
|
ansible_user: root
|
|
|
|
traefik_servers:
|
|
children:
|
|
all_servers:
|
|
|
|
backend_servers:
|
|
hosts:
|
|
application:
|
|
storage:
|
|
|
|
garage_servers:
|
|
hosts:
|
|
storage:
|
|
|
|
nextcloud_servers:
|
|
hosts:
|
|
application:
|
|
|
|
collabora_servers:
|
|
hosts:
|
|
application:
|
|
|
|
drawio_servers:
|
|
hosts:
|
|
application:
|
|
|
|
authentik_servers:
|
|
hosts:
|
|
application:
|
|
|
|
authentik_outpost_ldap_servers:
|
|
hosts:
|
|
application:
|
|
|
|
# Proxy (ForwardAuth) outpost co-located with garage on storage, so
|
|
# the garage-webui ForwardAuth subrequest stays on the local docker
|
|
# network instead of crossing an extra reverseproxy hop (which mangles
|
|
# X-Forwarded-Host and breaks the embedded outpost's app matching).
|
|
authentik_outpost_proxy_servers:
|
|
hosts:
|
|
storage:
|
|
|
|
send_servers:
|
|
hosts:
|
|
application:
|
|
|
|
opnform_servers:
|
|
hosts:
|
|
application:
|
|
|
|
homarr_servers:
|
|
hosts:
|
|
application:
|
|
|
|
bookstack_servers:
|
|
hosts:
|
|
application: |