Clients

playbooks/deploy-eom.yml

@@ -46,14 +46,54 @@
     dex_ldap_group_user_attribute: cn
     dex_ldap_group_filter: "(objectClass=groupOfUniqueNames)"
 
-    dex_matrix_client_enabled: true
-    dex_matrix_redirect_uris:
-      - https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4
-
-    # Optional website integration. Set www_dex_client_secret in Vault to enable;
-    # it must equal the membership application's DEX_CLIENT_SECRET.
-    dex_static_clients: "{{ [{'id': 'www-membership', 'name': 'eom.dev Membership', 'secret': www_dex_client_secret, 'redirectURIs': ['https://www.eom.dev/members/oidc/callback/']}] if (www_dex_client_secret | default('') | length > 0) else [] }}"
-    dex_additional_connectors: "{{ [_dex_eom_www_connector] if (www_dex_client_secret | default('') | length > 0) else [] }}"
+    # All clients are declared once below; don't also emit the convenience client.
+    dex_matrix_client_enabled: false
+    # Credentials are separate Vault/inventory variables, shared only with the
+    # corresponding application. No secret is generated or rotated by this play.
+    dex_static_clients:
+      - id: "{{ matrix_dex_oidc_client_id }}"
+        name: Matrix Auth Service
+        secret: "{{ matrix_dex_oidc_client_secret }}"
+        redirectURIs:
+          - https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4
+      - id: www-membership
+        name: eom.dev Membership
+        secret: "{{ www_dex_client_secret }}"
+        redirectURIs:
+          - https://www.eom.dev/members/oidc/callback/
+      - id: gitea
+        name: Gitea
+        secret: "{{ gitea_dex_client_secret }}"
+        # Authentication source in Gitea must be named exactly "dex".
+        redirectURIs:
+          - https://gitea.eom.dev/user/oauth2/dex/callback
+      - id: discourse
+        name: Discourse
+        secret: "{{ discourse_dex_client_secret }}"
+        # discourse-openid-connect strategy name is oidc.
+        redirectURIs:
+          - https://discourse.eom.dev/auth/oidc/callback
+      - id: peertube
+        name: PeerTube
+        secret: "{{ peertube_dex_client_secret }}"
+        # Requires peertube-plugin-auth-openid-connect.
+        redirectURIs:
+          - https://peertube.eom.dev/plugins/auth-openid-connect/router/code-cb
+      - id: mastodon
+        name: Mastodon
+        secret: "{{ mastodon_dex_client_secret }}"
+        # Matches OIDC_REDIRECT_URI in the existing Mastodon deployment.
+        redirectURIs:
+          - https://mastodon.eom.dev/auth/auth/openid_connect/callback
+      - id: nextcloud
+        name: Nextcloud
+        secret: "{{ nextcloud_dex_client_secret }}"
+        # This chooses the user_oidc app, not oidc_login or the OIDC provider app.
+        # Override from its admin screen if your installation rewrites index.php.
+        redirectURIs:
+          - https://nextcloud.eom.dev/index.php/apps/user_oidc/code
+    dex_additional_connectors:
+      - "{{ _dex_eom_www_connector }}"
     _dex_eom_www_connector:
       type: ldap
       id: www-ldap