Joakim
b42ee2a22b
Resolves authentik deployment issues by implementing proper Podman Quadlet configuration and fixing networking for external access through Caddy. Core Fixes: • Add missing [Install] sections to container Quadlet files for systemd service generation • Fix pod references from 'systemd-authentik' to 'authentik.pod' for proper Quadlet linking • Remove problematic --userns=host to use proper rootless user namespaces • Configure subuid/subgid ranges for authentik user (200000:65536) • Update networking to bind 0.0.0.0:9000 only (remove unnecessary HTTPS port 9443) • Add AUTHENTIK_LISTEN__HTTP=0.0.0.0:9000 environment configuration • Fix Caddy reverse proxy to use HTTP backend instead of HTTPS Infrastructure Updates: • Enhance PostgreSQL role with Unix socket configuration and user management • Improve Valkey role with proper systemd integration and socket permissions • Add comprehensive service integration documentation • Update deployment playbooks with backup and restore capabilities Security Improvements: • Secure network isolation with Caddy SSL termination • Reduced attack surface by removing direct HTTPS container exposure • Proper rootless container configuration with user namespace mapping Result: authentik now fully operational with external HTTPS access via auth.jnss.me All systemd services (authentik-pod, authentik-server, authentik-worker) running correctly.
41 lines
1.2 KiB
YAML
41 lines
1.2 KiB
YAML
---
|
|
# Sigvild Gallery Ansible Role - Default Variables
|
|
|
|
# Service Configuration
|
|
sigvild_gallery_user: sigvild
|
|
|
|
# Paths
|
|
sigvild_gallery_home: /opt/sigvild-gallery
|
|
sigvild_gallery_web_root: /var/www/sigvild-gallery
|
|
sigvild_gallery_binary: "{{ sigvild_gallery_home }}/sigvild-gallery"
|
|
sigvild_gallery_data_dir: "{{ sigvild_gallery_home }}/pb_data"
|
|
|
|
# Domains
|
|
sigvild_gallery_frontend_domain: sigvild.no
|
|
sigvild_gallery_api_domain: api.sigvild.no
|
|
|
|
# Backend Service
|
|
sigvild_gallery_port: 8090
|
|
sigvild_gallery_host: "127.0.0.1"
|
|
|
|
# Environment Variables (for SystemD service)
|
|
sigvild_gallery_host_username: host
|
|
sigvild_gallery_host_password: "{{ vault_sigvild_host_password }}"
|
|
sigvild_gallery_guest_username: guest
|
|
sigvild_gallery_guest_password: "{{ vault_sigvild_guest_password }}"
|
|
|
|
# Build configuration
|
|
sigvild_gallery_local_project_path: "{{ ansible_env.PWD }}/sigvild-gallery"
|
|
|
|
# Service configuration
|
|
sigvild_gallery_service_enabled: true
|
|
sigvild_gallery_service_state: started
|
|
|
|
# Backup configuration
|
|
sigvild_gallery_backup_enabled: true
|
|
sigvild_gallery_backup_local_path: "{{ playbook_dir }}/backups/sigvild-gallery"
|
|
|
|
# Caddy integration (assumes caddy role provides these)
|
|
# caddy_sites_enabled_dir: /etc/caddy/sites-enabled
|
|
# caddy_user: caddy
|