d45e358efc
Both demo sites had only a hosts.yml, so every role ran on its defaults (authentik.local.test etc.) and nothing was reachable under the real FQDN. Add the complete group_vars + host_vars analogous to gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain bases, matching Bao mounts, DMZ split-horizon (public + *.int.*), authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC, collabora, drawio, garage, send, opnform, homarr and bookstack. authentik_domains lists the *.int.* name too so Traefik requests a cert the DMZ can verify; the storage proxy outpost carries a config block (required by the outpost blueprint serializer).
21 lines
947 B
YAML
21 lines
947 B
YAML
---
|
|
# Services hosted on `storage` that the DMZ reverseproxy should forward
|
|
# public traffic to. See application/traefik.yml for the mechanism.
|
|
# The garage-webui ForwardAuth no longer needs an auth FQDN pinned here —
|
|
# it talks to the storage-local proxy outpost over the docker network
|
|
# (see garage.yml), and the outpost reaches authentik via the public FQDN
|
|
# over the reverseproxy (firewall now permits backend -> DMZ).
|
|
traefik_dmz_exposed_services:
|
|
- name: garage-s3
|
|
domain: s3.phbe.souveredu.ch
|
|
backend_host: s3.int.phbe.souveredu.ch
|
|
port: 443
|
|
protocol: https
|
|
- name: garage-webui
|
|
domain: console.s3.phbe.souveredu.ch
|
|
# Internal name so the DMZ verifies the storage backend cert against a
|
|
# matching SAN (acme cert_mode, no insecureSkipVerify). garage now
|
|
# serves this SAN via garage_webui_domains (see garage.yml).
|
|
backend_host: console.s3.int.phbe.souveredu.ch
|
|
port: 443
|
|
protocol: https
|