e32c2202ea
Finish the garage-webui SSO that the DNS cleanup left broken. Two coupled fixes, both relying on roles added in digitalboard.core: - console.s3 now has an internal name. garage_webui_domains lists both the public and console.s3.int.* FQDN, and the DMZ garage-webui route sets backend_host: console.s3.int.* so the DMZ->storage hop verifies the backend cert against a matching SAN instead of failing on a raw IP (500). - garage-webui ForwardAuth moves off the embedded outpost (cross-host hop mangled X-Forwarded-Host -> 404) onto a dedicated proxy outpost deployed on storage (authentik_outpost_proxy). The garage Traefik middleware now talks to it over the local docker network, and the storage-proxy-outpost is registered in authentik with the garage-webui provider. The stale auth.gymb pin on storage is dropped; the outpost reaches authentik via the reverseproxy (firewall now permits backend -> DMZ). Requires a new bao secret key: <mount>/data/authentik proxy_outpost_token.
51 lines
2.3 KiB
YAML
51 lines
2.3 KiB
YAML
---
|
|
# Bao secret <mount>/data/garage expected to contain:
|
|
# rpc_secret, admin_token, metrics_token, webui_password
|
|
_garage: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/garage', url=vault_addr) }}"
|
|
|
|
# First entry is the canonical public S3 FQDN. Additional entries
|
|
# cover internal *.int.* names so server-to-server S3 traffic (e.g.
|
|
# nextcloud → garage) stays in the LAN.
|
|
garage_s3_domains:
|
|
- "s3.gymb.souveredu.ch"
|
|
- "s3.int.gymb.souveredu.ch"
|
|
# First entry is the canonical public console FQDN. The *.int.* entry
|
|
# gives the DMZ a backend_host whose cert SAN matches (storage/traefik.yml),
|
|
# so the DMZ->storage hop verifies TLS instead of failing on a raw IP.
|
|
garage_webui_domains:
|
|
- "console.s3.gymb.souveredu.ch"
|
|
- "console.s3.int.gymb.souveredu.ch"
|
|
garage_use_ssl: true
|
|
garage_webui_enabled: true
|
|
# Gate the WebUI behind authentik (admins-only, via policy-binding on the
|
|
# authentik proxy app). Replaces the htpasswd Basic-Auth — AUTH_USER_PASS
|
|
# is dropped from the compose env when this is true.
|
|
#
|
|
# ForwardAuth talks to the storage-local proxy outpost over the docker
|
|
# network (role digitalboard.core.authentik_outpost_proxy). The embedded
|
|
# outpost on the application host can't be used cross-host: the extra
|
|
# reverseproxy hop mangles X-Forwarded-Host (appends :443 / a comma list)
|
|
# and the outpost then 404s instead of matching console.s3.* against the
|
|
# provider's external_host. A co-located outpost keeps the subrequest on
|
|
# the local network with a clean X-Forwarded-Host.
|
|
garage_webui_authentik_forward_auth: true
|
|
garage_webui_authentik_forward_auth_url: "http://authentik-outpost-proxy-proxy-1:9000/outpost.goauthentik.io/auth/traefik"
|
|
# Kept for completeness — only used when authentik ForwardAuth is off.
|
|
garage_webui_username: "admin"
|
|
garage_webui_password: "{{ _garage.webui_password | default('disabled') }}"
|
|
|
|
garage_rpc_secret: "{{ _garage.rpc_secret }}"
|
|
garage_admin_token: "{{ _garage.admin_token }}"
|
|
garage_metrics_token: "{{ _garage.metrics_token }}"
|
|
|
|
# Initial cluster bootstrap (single-node)
|
|
garage_bootstrap_enabled: true
|
|
garage_bootstrap_zone: "burgdorf1"
|
|
garage_bootstrap_capacity: "100G"
|
|
|
|
# Buckets and keys consumed by nextcloud
|
|
garage_s3_keys:
|
|
- name: nextcloud
|
|
buckets:
|
|
- name: nextcloud
|
|
permissions: ["read", "write"]
|