d45e358efc
Both demo sites had only a hosts.yml, so every role ran on its defaults (authentik.local.test etc.) and nothing was reachable under the real FQDN. Add the complete group_vars + host_vars analogous to gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain bases, matching Bao mounts, DMZ split-horizon (public + *.int.*), authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC, collabora, drawio, garage, send, opnform, homarr and bookstack. authentik_domains lists the *.int.* name too so Traefik requests a cert the DMZ can verify; the storage proxy outpost carries a config block (required by the outpost blueprint serializer).
16 lines
563 B
YAML
16 lines
563 B
YAML
---
|
|
# First entry is the canonical public FQDN. Additional entries cover
|
|
# internal *.int.* names so nextcloud's WOPI discovery hits collabora
|
|
# in the LAN with a valid internal cert.
|
|
collabora_domains:
|
|
- "office.phbe.souveredu.ch"
|
|
- "office.int.phbe.souveredu.ch"
|
|
|
|
# Hosts allowed to issue WOPI calls. Both names are listed so collabora
|
|
# accepts the callback from nextcloud regardless of which FQDN it uses.
|
|
collabora_allowed_domains:
|
|
- "cloud.phbe.souveredu.ch"
|
|
- "cloud.int.phbe.souveredu.ch"
|
|
|
|
collabora_frame_ancestors:
|
|
- "cloud.phbe.souveredu.ch"
|