From 7647dca7c3af68200620d88dacd207e43fd712e9 Mon Sep 17 00:00:00 2001
From: Eric Meehan <eric@eom.dev>
Date: Fri, 6 Nov 2026 18:23:50 -0500
Subject: [PATCH] Discourse: sign in only through Dex, sign-up to /members

Drop discourse-ldap-auth (its authenticator ignores ldap_enabled) and
add an idempotent settings script, run after deploy, that disables
LDAP login and installs a theme component sending Sign Up to
www.eom.dev/members.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 files/discourse-sso.rb | 44 ++++++++++++++++++++++++++++++++++++++++++
 tasks/discourse.yaml   | 34 +++++++++++++++++++++++++++++++-
 2 files changed, 77 insertions(+), 1 deletion(-)
 create mode 100644 files/discourse-sso.rb

diff --git a/files/discourse-sso.rb b/files/discourse-sso.rb
new file mode 100644
index 0000000..338a548
--- /dev/null
+++ b/files/discourse-sso.rb
@@ -0,0 +1,44 @@
+# Idempotent: sign-in goes only through Dex (discourse-openid-connect),
+# and the Sign Up button goes to the eom.dev membership site.
+# Run with: RAILS_ENV=production bundle exec rails runner <this file>
+
+SIGNUP_URL = "https://www.eom.dev/members"
+
+# OIDC is the only login method left, so with auth_immediately the
+# Log In button redirects straight to Dex. Accounts link by email.
+SiteSetting.ldap_enabled = false
+SiteSetting.enable_local_logins = false
+SiteSetting.auth_immediately = true
+# New members sign up at www.eom.dev; Discourse must still create their
+# account on first Dex login.
+SiteSetting.allow_new_registrations = true
+
+head_tag = <<~HTML
+  <script>
+  (function () {
+    var url = #{SIGNUP_URL.to_json};
+    if (location.pathname === "/signup") { location.replace(url); return; }
+    document.addEventListener("click", function (e) {
+      var b = e.target.closest(".sign-up-button, a[href='/signup']");
+      if (!b) return;
+      e.preventDefault();
+      e.stopImmediatePropagation();
+      location.href = url;
+    }, true);
+  })();
+  </script>
+HTML
+
+name = "eom.dev sign-up redirect"
+component = Theme.find_by(name: name) ||
+  Theme.create!(name: name, user_id: Discourse.system_user.id, component: true)
+component.set_field(target: :common, name: :head_tag, value: head_tag)
+component.save!
+
+Theme.where(component: false).find_each do |theme|
+  next if theme.child_themes.include?(component)
+  theme.add_relative_theme!(:child, component)
+end
+
+puts "ldap_enabled=#{SiteSetting.ldap_enabled} component=#{component.id} " \
+     "parents=#{component.parent_themes.pluck(:name).join(', ')}"
diff --git a/tasks/discourse.yaml b/tasks/discourse.yaml
index 8f3c07b..a226d41 100644
--- a/tasks/discourse.yaml
+++ b/tasks/discourse.yaml
@@ -33,7 +33,8 @@
           - https://github.com/discourse/discourse-subscriptions
           - https://github.com/discourse/discourse-activity-pub
           - https://github.com/discourse/discourse-openid-connect
-          - https://github.com/jonmbake/discourse-ldap-auth
+          # discourse-ldap-auth removed: its login cannot be disabled by setting,
+          # and sign-in goes through Dex (discourse-openid-connect) only.
           - https://github.com/discourse/discourse-math
           - https://github.com/discourse/discourse-post-voting
           - https://github.com/discourse/discourse-prometheus
@@ -76,3 +77,34 @@
           repository: bitnamilegacy/redis
         auth:
           password: "{{ discourse_admin_password }}"
+
+- name: Find the Discourse pod
+  kubernetes.core.k8s_info:
+    kind: Pod
+    namespace: discourse
+    label_selectors:
+      - app.kubernetes.io/instance=discourse
+      - app.kubernetes.io/name=discourse
+    field_selectors:
+      - status.phase=Running
+  register: discourse_pods
+
+- name: Copy the Dex sign-in / membership sign-up settings script
+  kubernetes.core.k8s_cp:
+    namespace: discourse
+    pod: "{{ discourse_pods.resources[0].metadata.name }}"
+    container: discourse
+    local_path: "{{ role_path }}/files/discourse-sso.rb"
+    remote_path: /tmp/discourse-sso.rb
+
+- name: Apply Dex sign-in / membership sign-up settings
+  kubernetes.core.k8s_exec:
+    namespace: discourse
+    pod: "{{ discourse_pods.resources[0].metadata.name }}"
+    container: discourse
+    command: >-
+      bash -c 'cd /opt/bitnami/discourse && PATH=/opt/bitnami/ruby/bin:$PATH
+      RAILS_ENV=production bundle exec ruby -e
+      "require \"/opt/bitnami/discourse/config/environment\"; load \"/tmp/discourse-sso.rb\""'
+  register: discourse_sso
+  changed_when: false