d45e358efc
Both demo sites had only a hosts.yml, so every role ran on its defaults (authentik.local.test etc.) and nothing was reachable under the real FQDN. Add the complete group_vars + host_vars analogous to gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain bases, matching Bao mounts, DMZ split-horizon (public + *.int.*), authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC, collabora, drawio, garage, send, opnform, homarr and bookstack. authentik_domains lists the *.int.* name too so Traefik requests a cert the DMZ can verify; the storage proxy outpost carries a config block (required by the outpost blueprint serializer).
13 lines
781 B
YAML
13 lines
781 B
YAML
---
|
|
# Same token as authentik_ldap_outpost.token above — outpost uses it to
|
|
# authenticate against the authentik server it talks to.
|
|
_authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/authentik', url=vault_addr) }}"
|
|
|
|
# Public FQDN resolves (internal DNS view) to the DMZ reverseproxy the
|
|
# backend subnet can reach, so the outpost->authentik round-trip stays in
|
|
# the LAN with a valid cert and matches the iss claim authentik emits.
|
|
authentik_outpost_ldap_host: "https://auth.phbe.souveredu.ch"
|
|
authentik_outpost_ldap_token: "{{ _authentik.ldap_outpost_token }}"
|
|
# auth.phbe.* presents a valid Let's Encrypt cert via the reverseproxy, so
|
|
# verify the chain instead of relying on the role's insecure default.
|
|
authentik_outpost_ldap_insecure: "false"
|