ansible-role-dex/playbooks/deploy-eom.yml

---
# Run on the controller with its existing kubeconfig; no SSH target is required.
# Supply credentials via inventory/group_vars or a Vault-encrypted vars file.
- name: Deploy eom.dev Dex with Catppuccin branding
  hosts: alpha-control-plane
  vars_files:
    ~/Desktop/secrets.yaml
  become: true
  vars:
    dex_namespace: dex
    dex_release_name: dex
    dex_chart_version: "0.26.0"
    dex_issuer: https://dex.eom.dev/
    dex_hostname: dex.eom.dev
    dex_ingress_class: nginx
    dex_cluster_issuer: ca-issuer
    dex_tls_secret_name: dex
    dex_theme_enabled: true
    dex_brand_name: eom.dev
    dex_theme_configmap_name: dex-catppuccin

    # Preserve the existing DB release and data; do not upgrade it by default.
    dex_postgres_manage: false
    dex_postgres_release_name: postgresql
    dex_postgres_host: postgresql
    dex_postgres_port: 5432
    dex_postgres_database: dex
    dex_postgres_user: dex
    dex_postgres_storage_size: 256Gi
    dex_postgres_ssl_mode: disable
    dex_postgres_password: "{{ dex_admin_password }}"
    dex_postgres_admin_password: "{{ postgresql_admin_password | default('') }}"

    # Keep the existing connector ID and UID subject mapping. The filter also
    # admits website inetOrgPerson accounts so there is one Dex login option.
    dex_ldap_host: openldap.openldap.svc.cluster.local
    dex_ldap_insecure_no_ssl: true
    dex_ldap_start_tls: false
    dex_ldap_bind_dn: cn=readonly,dc=eom,dc=dev
    dex_ldap_bind_password: "{{ openldap_readonly_password }}"
    dex_ldap_connector_id: ldap
    dex_ldap_connector_name: eom.dev account
    dex_ldap_user_base_dn: dc=eom,dc=dev
    dex_ldap_user_filter: "(|(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))(objectClass=inetOrgPerson))"
    dex_ldap_id_attribute: uid
    dex_ldap_name_attribute: cn
    dex_ldap_group_base_dn: dc=eom,dc=dev
    dex_ldap_group_user_attribute: DN
    dex_ldap_group_filter: "(objectClass=groupOfUniqueNames)"

    # All clients are declared once below; don't also emit the convenience client.
    dex_matrix_client_enabled: false
    # Credentials are separate Vault/inventory variables, shared only with the
    # corresponding application. No secret is generated or rotated by this play.
    dex_static_clients:
      - id: "{{ matrix_dex_oidc_client_id }}"
        name: Matrix Auth Service
        secret: "{{ matrix_dex_oidc_client_secret }}"
        allowedConnectors: [ldap]
        redirectURIs:
          - https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4
      - id: www-membership
        name: eom.dev Membership
        secret: "{{ www_dex_client_secret }}"
        allowedConnectors: [ldap]
        redirectURIs:
          - https://www.eom.dev/members/oidc/callback/
      - id: gitea
        name: Gitea
        secret: "{{ gitea_dex_client_secret }}"
        # Authentication source in Gitea must be named exactly "Dex".
        allowedConnectors: [ldap]
        redirectURIs:
          - https://gitea.eom.dev/user/oauth2/Dex/callback
      - id: discourse
        name: Discourse
        secret: "{{ discourse_dex_client_secret }}"
        # discourse-openid-connect strategy name is oidc.
        allowedConnectors: [ldap]
        redirectURIs:
          - https://discourse.eom.dev/auth/oidc/callback
      - id: peertube
        name: PeerTube
        secret: "{{ peertube_dex_client_secret }}"
        # Requires peertube-plugin-auth-openid-connect.
        allowedConnectors: [ldap]
        redirectURIs:
          - https://peertube.eom.dev/plugins/oidc-cnr/router/code-cb
      - id: mastodon
        name: Mastodon
        secret: "{{ mastodon_dex_client_secret }}"
        # Tier gate: only the connector that admits Mastodon Users.
        allowedConnectors: [mastodon]
        # Matches OIDC_REDIRECT_URI in the existing Mastodon deployment.
        redirectURIs:
          - https://mastodon.eom.dev/auth/auth/openid_connect/callback
      - id: nextcloud
        name: Nextcloud
        secret: "{{ nextcloud_dex_client_secret }}"
        # This chooses the user_oidc app, not oidc_login or the OIDC provider app.
        # Override from its admin screen if your installation rewrites index.php.
        allowedConnectors: [ldap]
        redirectURIs:
          - https://nextcloud.eom.dev/apps/user_oidc/code
          - https://nextcloud.eom.dev/index.php/apps/user_oidc/code
      - id: listmonk
        name: eom.dev Newsletter
        secret: "{{ listmonk_dex_client_secret }}"
        # listmonk only admits e-mails already present as listmonk users.
        allowedConnectors: [ldap]
        redirectURIs:
          - https://listmonk.eom.dev/auth/oidc
    # Per-service gate for clients that cannot check group claims themselves.
    # Same idAttr as the main connector; subjects differ per connector ID.
    dex_additional_connectors:
      - type: ldap
        id: mastodon
        name: eom.dev account
        config:
          host: openldap.openldap.svc.cluster.local
          insecureNoSSL: true
          bindDN: cn=readonly,dc=eom,dc=dev
          bindPW: "{{ openldap_readonly_password }}"
          userSearch:
            baseDN: dc=eom,dc=dev
            filter: "(&(objectClass=inetOrgPerson)(memberOf=cn=Mastodon Users,ou=Mastodon,ou=Services,dc=eom,dc=dev))"
            username: uid
            idAttr: uid
            emailAttr: mail
            nameAttr: cn
            preferredUsernameAttr: uid
  roles:
    - roles/ericomeehan.dex