Discourse: sign in only through Dex, sign-up to /members

Drop discourse-ldap-auth (its authenticator ignores ldap_enabled) and
add an idempotent settings script, run after deploy, that disables
LDAP login and installs a theme component sending Sign Up to
www.eom.dev/members.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/discourse.yaml

@@ -33,7 +33,8 @@
           - https://github.com/discourse/discourse-subscriptions
           - https://github.com/discourse/discourse-activity-pub
           - https://github.com/discourse/discourse-openid-connect
-          - https://github.com/jonmbake/discourse-ldap-auth
+          # discourse-ldap-auth removed: its login cannot be disabled by setting,
+          # and sign-in goes through Dex (discourse-openid-connect) only.
           - https://github.com/discourse/discourse-math
           - https://github.com/discourse/discourse-post-voting
           - https://github.com/discourse/discourse-prometheus
@@ -76,3 +77,34 @@
           repository: bitnamilegacy/redis
         auth:
           password: "{{ discourse_admin_password }}"
+
+- name: Find the Discourse pod
+  kubernetes.core.k8s_info:
+    kind: Pod
+    namespace: discourse
+    label_selectors:
+      - app.kubernetes.io/instance=discourse
+      - app.kubernetes.io/name=discourse
+    field_selectors:
+      - status.phase=Running
+  register: discourse_pods
+
+- name: Copy the Dex sign-in / membership sign-up settings script
+  kubernetes.core.k8s_cp:
+    namespace: discourse
+    pod: "{{ discourse_pods.resources[0].metadata.name }}"
+    container: discourse
+    local_path: "{{ role_path }}/files/discourse-sso.rb"
+    remote_path: /tmp/discourse-sso.rb
+
+- name: Apply Dex sign-in / membership sign-up settings
+  kubernetes.core.k8s_exec:
+    namespace: discourse
+    pod: "{{ discourse_pods.resources[0].metadata.name }}"
+    container: discourse
+    command: >-
+      bash -c 'cd /opt/bitnami/discourse && PATH=/opt/bitnami/ruby/bin:$PATH
+      RAILS_ENV=production bundle exec ruby -e
+      "require \"/opt/bitnami/discourse/config/environment\"; load \"/tmp/discourse-sso.rb\""'
+  register: discourse_sso
+  changed_when: false