souveredu/reference-ansible
6
1
Fork 0
Code Pull requests 2 Activity Actions

feat(sek2-be): add storage-only inventory for internal garage s3 #4

Open
Simon wants to merge 16 commits from feat/sek2-be-inventory into main
pull from: feat/sek2-be-inventory
merge into: souveredu:main
Conversation 0 Commits 16 Files changed 17 +310
Simon commented 2026-09-08 11:23:56 +00:00
Owner
Copy link

Summary

  • New inventory inventories/sek2-be/ managing only the storage host (172.16.17.149) with a backend traefik and garage.
  • Garage stays internal: S3 under s3.int.sek2-be.ch, WebUI under console.s3.int.sek2-be.ch with Basic-Auth (authentik on auth.sek2-be.ch is not managed from this repo, so no ForwardAuth outpost yet).
  • The productive DMZ reverseproxy (172.16.9.88) is deliberately not part of the inventory — it serves live services not provisioned here.

DNS records (s3.int, console.s3.int + ACME CNAMEs) are already on dns-zones main.

Test plan

  • bao mount sek2-be created, scripts/bao-seed.sh sek2-be run, acme-tsig secret seeded (server=172.16.9.169, digitalboard TSIG key)
  • ansible-playbook -i inventories/sek2-be playbooks/site.yml against storage
  • s3.int.sek2-be.ch serves the S3 API with a valid LE cert
## Summary - New inventory `inventories/sek2-be/` managing only the storage host (172.16.17.149) with a backend traefik and garage. - Garage stays internal: S3 under `s3.int.sek2-be.ch`, WebUI under `console.s3.int.sek2-be.ch` with Basic-Auth (authentik on auth.sek2-be.ch is not managed from this repo, so no ForwardAuth outpost yet). - The productive DMZ reverseproxy (172.16.9.88) is deliberately not part of the inventory — it serves live services not provisioned here. DNS records (s3.int, console.s3.int + ACME CNAMEs) are already on dns-zones main. ## Test plan - [ ] bao mount `sek2-be` created, `scripts/bao-seed.sh sek2-be` run, `acme-tsig` secret seeded (server=172.16.9.169, digitalboard TSIG key) - [ ] `ansible-playbook -i inventories/sek2-be playbooks/site.yml` against storage - [ ] `s3.int.sek2-be.ch` serves the S3 API with a valid LE cert
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Simon force-pushed feat/sek2-be-inventory from a7c988ba8e to dd8cc1f04b 2026-09-08 11:25:58 +00:00 Compare 
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/sek2-be-inventory:feat/sek2-be-inventory
git switch feat/sek2-be-inventory

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff feat/sek2-be-inventory
git switch feat/sek2-be-inventory
git rebase main
git switch main
git merge --ff-only feat/sek2-be-inventory
git switch feat/sek2-be-inventory
git rebase main
git switch main
git merge --no-ff feat/sek2-be-inventory
git switch main
git merge --squash feat/sek2-be-inventory
git switch main
git merge --ff-only feat/sek2-be-inventory
git switch main
git merge feat/sek2-be-inventory
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
souveredu/reference-ansible!4
No description provided.