d45e358efc
Both demo sites had only a hosts.yml, so every role ran on its defaults (authentik.local.test etc.) and nothing was reachable under the real FQDN. Add the complete group_vars + host_vars analogous to gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain bases, matching Bao mounts, DMZ split-horizon (public + *.int.*), authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC, collabora, drawio, garage, send, opnform, homarr and bookstack. authentik_domains lists the *.int.* name too so Traefik requests a cert the DMZ can verify; the storage proxy outpost carries a config block (required by the outpost blueprint serializer).
167 lines
6.5 KiB
YAML
167 lines
6.5 KiB
YAML
---
|
|
# Bao secret expected at <mount>/data/authentik with keys:
|
|
# secret_key, postgres_password, admin_password,
|
|
# ldap_outpost_token, proxy_outpost_token,
|
|
# nextcloud_oidc_secret, opnform_oidc_secret,
|
|
# homarr_oidc_secret, bookstack_oidc_secret
|
|
_authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/authentik', url=vault_addr) }}"
|
|
|
|
# First entry is the canonical public FQDN (browsers + OIDC iss-claim).
|
|
# The *.int.* entry makes the router match the internal name too, so
|
|
# Traefik requests a cert covering it — the DMZ reverseproxy uses
|
|
# auth.int.mbaz as backend_host and verifies the chain (acme mode,
|
|
# no insecureSkipVerify), which fails against the default cert otherwise.
|
|
authentik_domains:
|
|
- "auth.mbaz.souveredu.ch"
|
|
- "auth.int.mbaz.souveredu.ch"
|
|
|
|
authentik_secret_key: "{{ _authentik.secret_key }}"
|
|
authentik_postgres_password: "{{ _authentik.postgres_password }}"
|
|
|
|
# LDAP outpost (provider for nextcloud)
|
|
authentik_ldap_apps:
|
|
- slug: ldap
|
|
name: LDAP
|
|
base_dn: "dc=mbaz,dc=souveredu,dc=ch"
|
|
search_group: admins
|
|
|
|
authentik_ldap_outpost:
|
|
name: "ldap-outpost"
|
|
token: "{{ _authentik.ldap_outpost_token }}"
|
|
config:
|
|
# Outpost pulls config from authentik over the public FQDN, which
|
|
# resolves (internal DNS view) to the DMZ reverseproxy the backend
|
|
# subnet can reach — keeps the round-trip in the LAN with a valid cert.
|
|
authentik_host: "https://auth.mbaz.souveredu.ch/"
|
|
log_level: "info"
|
|
|
|
# Proxy providers (ForwardAuth) — gate downstream services behind
|
|
# authentik. The embedded outpost (which authentik ships out of the box)
|
|
# hosts these providers under /outpost.goauthentik.io/auth/traefik on the
|
|
# canonical FQDN; the service-side traefik attaches a ForwardAuth
|
|
# middleware that talks to that endpoint.
|
|
authentik_proxy_apps:
|
|
- slug: drawio
|
|
name: Drawio
|
|
external_host: "https://draw.mbaz.souveredu.ch"
|
|
internal_host: "http://drawio:8080"
|
|
# drawio is embedded in Nextcloud as an iframe (nextcloud_enable_drawio).
|
|
# Every authenticated Nextcloud user must therefore pass the ForwardAuth
|
|
# gate, otherwise the editor loads a 403 inside the iframe. Allow both
|
|
# standard groups; tightening this back to admins-only would break the
|
|
# Nextcloud integration for regular users.
|
|
allowed_groups:
|
|
- admins
|
|
- users
|
|
flows:
|
|
authentication_slug: default-authentication-flow
|
|
authorization_slug: default-provider-authorization-implicit-consent
|
|
invalidation_slug: default-provider-invalidation-flow
|
|
- slug: garage-webui
|
|
name: "Garage S3 Console"
|
|
external_host: "https://console.s3.mbaz.souveredu.ch"
|
|
internal_host: "http://garage-webui:3909"
|
|
allowed_groups:
|
|
- admins
|
|
flows:
|
|
authentication_slug: default-authentication-flow
|
|
authorization_slug: default-provider-authorization-implicit-consent
|
|
invalidation_slug: default-provider-invalidation-flow
|
|
|
|
# Outpost bindings. drawio runs on this (application) host, so its
|
|
# ForwardAuth can use the embedded outpost (same host:9000 as the
|
|
# authentik server). garage-webui runs on the storage host; a cross-host
|
|
# ForwardAuth to the embedded outpost arrives with a mangled
|
|
# X-Forwarded-Host (an extra reverseproxy hop appends :443 / a comma list)
|
|
# and the outpost then fails to match the provider's external_host (404).
|
|
# So garage-webui is bound to a dedicated proxy outpost deployed on
|
|
# storage (role digitalboard.core.authentik_outpost_proxy), whose
|
|
# ForwardAuth endpoint the local storage Traefik reaches over the docker
|
|
# network — no extra hop, clean X-Forwarded-Host.
|
|
authentik_proxy_outposts:
|
|
- name: "authentik Embedded Outpost"
|
|
type: proxy
|
|
providers:
|
|
- drawio
|
|
- name: "storage-proxy-outpost"
|
|
type: proxy
|
|
token: "{{ _authentik.proxy_outpost_token }}"
|
|
providers:
|
|
- garage-webui
|
|
# config is required by the outpost blueprint serializer. The outpost
|
|
# runs on the storage host and reaches authentik over the public FQDN
|
|
# (resolves to the DMZ reverseproxy the storage subnet can reach).
|
|
config:
|
|
authentik_host: "https://auth.mbaz.souveredu.ch/"
|
|
log_level: "info"
|
|
|
|
# OIDC clients
|
|
authentik_oidc_apps:
|
|
- slug: nextcloud
|
|
name: Nextcloud
|
|
client_id: nextcloud
|
|
client_secret: "{{ _authentik.nextcloud_oidc_secret }}"
|
|
redirect_uris:
|
|
- url: "https://cloud.mbaz.souveredu.ch/apps/user_oidc/code"
|
|
matching_mode: strict
|
|
signing_key_name: "authentik Self-signed Certificate"
|
|
flows:
|
|
authorization_slug: default-provider-authorization-implicit-consent
|
|
invalidation_slug: default-provider-invalidation-flow
|
|
scopes: [openid, email, profile, offline_access]
|
|
- slug: opnform
|
|
name: OpnForm
|
|
client_id: opnform
|
|
client_secret: "{{ _authentik.opnform_oidc_secret }}"
|
|
redirect_uris:
|
|
- url: "https://forms.mbaz.souveredu.ch/auth/authentik/callback"
|
|
matching_mode: strict
|
|
signing_key_name: "authentik Self-signed Certificate"
|
|
flows:
|
|
authorization_slug: default-provider-authorization-implicit-consent
|
|
invalidation_slug: default-provider-invalidation-flow
|
|
# No separate `groups` scope — authentik's default `profile` mapping
|
|
# already emits a `groups` claim built from request.user.groups, so
|
|
# OpnForm's admin-group mapping works without an extra scope.
|
|
scopes: [openid, email, profile]
|
|
- slug: homarr
|
|
name: Homarr
|
|
client_id: homarr
|
|
client_secret: "{{ _authentik.homarr_oidc_secret }}"
|
|
redirect_uris:
|
|
- url: "https://home.mbaz.souveredu.ch/api/auth/callback/oidc"
|
|
matching_mode: strict
|
|
signing_key_name: "authentik Self-signed Certificate"
|
|
flows:
|
|
authorization_slug: default-provider-authorization-implicit-consent
|
|
invalidation_slug: default-provider-invalidation-flow
|
|
scopes: [openid, email, profile]
|
|
- slug: bookstack
|
|
name: BookStack
|
|
client_id: bookstack
|
|
client_secret: "{{ _authentik.bookstack_oidc_secret }}"
|
|
redirect_uris:
|
|
- url: "https://wiki.mbaz.souveredu.ch/oidc/callback"
|
|
matching_mode: strict
|
|
signing_key_name: "authentik Self-signed Certificate"
|
|
flows:
|
|
authorization_slug: default-provider-authorization-implicit-consent
|
|
invalidation_slug: default-provider-invalidation-flow
|
|
scopes: [openid, email, profile]
|
|
|
|
authentik_groups:
|
|
- name: admins
|
|
- name: users
|
|
- name: opnform-admins
|
|
- name: homarr-admins
|
|
- name: bookstack-admins
|
|
|
|
authentik_local_users:
|
|
- username: akadmin
|
|
name: "Authentik Admin"
|
|
email: "admin@mbaz.souveredu.ch"
|
|
password: "{{ _authentik.admin_password }}"
|
|
is_active: true
|
|
groups:
|
|
- authentik Admins
|
|
- admins
|