e32c2202ea
Finish the garage-webui SSO that the DNS cleanup left broken. Two coupled fixes, both relying on roles added in digitalboard.core: - console.s3 now has an internal name. garage_webui_domains lists both the public and console.s3.int.* FQDN, and the DMZ garage-webui route sets backend_host: console.s3.int.* so the DMZ->storage hop verifies the backend cert against a matching SAN instead of failing on a raw IP (500). - garage-webui ForwardAuth moves off the embedded outpost (cross-host hop mangled X-Forwarded-Host -> 404) onto a dedicated proxy outpost deployed on storage (authentik_outpost_proxy). The garage Traefik middleware now talks to it over the local docker network, and the storage-proxy-outpost is registered in authentik with the garage-webui provider. The stale auth.gymb pin on storage is dropped; the outpost reaches authentik via the reverseproxy (firewall now permits backend -> DMZ). Requires a new bao secret key: <mount>/data/authentik proxy_outpost_token. |
||
|---|---|---|
| .. | ||
| authentik.yml | ||
| authentik_outpost_ldap.yml | ||
| bookstack.yml | ||
| collabora.yml | ||
| drawio.yml | ||
| homarr.yml | ||
| main.yml | ||
| nextcloud.yml | ||
| opnform.yml | ||
| send.yml | ||
| traefik.yml | ||