---
# Run on the controller with its existing kubeconfig; no SSH target is required.
# Supply credentials via inventory/group_vars or a Vault-encrypted vars file.
- name: Deploy eom.dev Dex with Catppuccin branding
  hosts: alpha-control-plane
  vars_files:
    ../secrets.yaml
  become: true
  vars:
    dex_namespace: dex
    dex_release_name: dex
    dex_chart_version: "0.26.0"
    dex_issuer: https://dex.eom.dev/
    dex_hostname: dex.eom.dev
    dex_ingress_class: nginx
    dex_cluster_issuer: ca-issuer
    dex_tls_secret_name: dex
    dex_theme_enabled: true
    dex_brand_name: eom.dev
    dex_theme_configmap_name: dex-catppuccin

    # Preserve the existing DB release and data; do not upgrade it by default.
    dex_postgres_manage: false
    dex_postgres_release_name: postgresql
    dex_postgres_host: postgresql
    dex_postgres_port: 5432
    dex_postgres_database: dex
    dex_postgres_user: dex
    dex_postgres_storage_size: 256Gi
    dex_postgres_ssl_mode: disable
    dex_postgres_password: "{{ dex_admin_password }}"
    dex_postgres_admin_password: "{{ postgresql_admin_password | default('') }}"

    # Explicitly preserve internal plaintext LDAP and legacy OIDC subjects.
    dex_ldap_host: openldap.openldap.svc.cluster.local
    dex_ldap_insecure_no_ssl: true
    dex_ldap_start_tls: false
    dex_ldap_bind_dn: cn=readonly,dc=eom,dc=dev
    dex_ldap_bind_password: "{{ openldap_readonly_password }}"
    dex_ldap_connector_id: ldap
    dex_ldap_connector_name: eom.dev account
    dex_ldap_user_base_dn: dc=eom,dc=dev
    dex_ldap_user_filter: "(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))"
    dex_ldap_id_attribute: uid
    dex_ldap_name_attribute: givenName
    dex_ldap_group_base_dn: dc=eom,dc=dev
    dex_ldap_group_user_attribute: cn
    dex_ldap_group_filter: "(objectClass=groupOfUniqueNames)"

    # All clients are declared once below; don't also emit the convenience client.
    dex_matrix_client_enabled: false
    # Credentials are separate Vault/inventory variables, shared only with the
    # corresponding application. No secret is generated or rotated by this play.
    dex_static_clients:
      - id: "{{ matrix_dex_oidc_client_id }}"
        name: Matrix Auth Service
        secret: "{{ matrix_dex_oidc_client_secret }}"
        redirectURIs:
          - https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4
      - id: www-membership
        name: eom.dev Membership
        secret: "{{ www_dex_client_secret }}"
        redirectURIs:
          - https://www.eom.dev/members/oidc/callback/
      - id: gitea
        name: Gitea
        secret: "{{ gitea_dex_client_secret }}"
        # Authentication source in Gitea must be named exactly "dex".
        redirectURIs:
          - https://gitea.eom.dev/user/oauth2/dex/callback
      - id: discourse
        name: Discourse
        secret: "{{ discourse_dex_client_secret }}"
        # discourse-openid-connect strategy name is oidc.
        redirectURIs:
          - https://discourse.eom.dev/auth/oidc/callback
      - id: peertube
        name: PeerTube
        secret: "{{ peertube_dex_client_secret }}"
        # Requires peertube-plugin-auth-openid-connect.
        redirectURIs:
          - https://peertube.eom.dev/plugins/auth-openid-connect/router/code-cb
      - id: mastodon
        name: Mastodon
        secret: "{{ mastodon_dex_client_secret }}"
        # Matches OIDC_REDIRECT_URI in the existing Mastodon deployment.
        redirectURIs:
          - https://mastodon.eom.dev/auth/auth/openid_connect/callback
      - id: nextcloud
        name: Nextcloud
        secret: "{{ nextcloud_dex_client_secret }}"
        # This chooses the user_oidc app, not oidc_login or the OIDC provider app.
        # Override from its admin screen if your installation rewrites index.php.
        redirectURIs:
          - https://nextcloud.eom.dev/index.php/apps/user_oidc/code
    dex_additional_connectors:
      - "{{ _dex_eom_www_connector }}"
    _dex_eom_www_connector:
      type: ldap
      id: www-ldap
      name: eom.dev Membership
      config:
        host: openldap.openldap.svc.cluster.local
        insecureNoSSL: true
        bindDN: cn=readonly,dc=eom,dc=dev
        bindPW: "{{ openldap_readonly_password }}"
        userSearch:
          baseDN: ou=people,dc=eom,dc=dev
          filter: "(objectClass=inetOrgPerson)"
          username: uid
          idAttr: entryUUID
          emailAttr: mail
          nameAttr: cn
          preferredUsernameAttr: uid
        groupSearch:
          baseDN: ou=groups,dc=eom,dc=dev
          filter: "(objectClass=groupOfUniqueNames)"
          userMatchers:
            - userAttr: DN
              groupAttr: uniqueMember
          nameAttr: cn
  roles:
    - ansible-role-dex