From 5702010a3d9993ab840c39e77b3d07d515ca0d0d Mon Sep 17 00:00:00 2001
From: Eric Meehan <eric@eom.dev>
Date: Fri, 6 Nov 2026 17:56:00 -0500
Subject: [PATCH] Gitea: sign in only through Dex, send sign-up to /members

Disable the password sign-in form so /user/login redirects to Dex,
keep registration enabled for Dex auto-registration, and redirect
/user/sign_up to www.eom.dev/members at the ingress.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tasks/gitea.yaml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/tasks/gitea.yaml b/tasks/gitea.yaml
index 4fe5865..9d403c9 100644
--- a/tasks/gitea.yaml
+++ b/tasks/gitea.yaml
@@ -64,8 +64,13 @@
         config:
           APP_NAME: "Gitea"
           service:
+            # Keep false: true would also block Dex auto-registration of members.
+            # The sign-up button is redirected to www.eom.dev/members at ingress.
             DISABLE_REGISTRATION: false
             SHOW_REGISTRATION_BUTTON: true
+            # Sign-in goes through Dex only (admin fallback: gitea admin CLI).
+            ENABLE_PASSWORD_SIGNIN_FORM: false
+            ENABLE_PASSKEY_AUTHENTICATION: false
             DEFAULT_ALLOW_CREATE_ORGANIZATION: false
             ALLOW_ONLY_EXTERNAL_REGISTRATION: true
             ENABLE_NOTIFY_MAIL: true
@@ -129,3 +134,31 @@
             size: 2Ti
       postgresql-ha:
         enabled: false
+
+- name: Send Gitea's sign-up button to the eom.dev membership site
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        name: gitea-signup-redirect
+        namespace: gitea
+        annotations:
+          nginx.ingress.kubernetes.io/temporal-redirect: https://www.eom.dev/members
+      spec:
+        ingressClassName: nginx
+        tls:
+          - hosts: [gitea.eom.dev]
+            secretName: gitea-tls
+        rules:
+          - host: gitea.eom.dev
+            http:
+              paths:
+                - path: /user/sign_up
+                  pathType: Exact
+                  backend:
+                    service:
+                      name: gitea-http
+                      port:
+                        number: 3000