From 6144791cb9e0e47c226e5983ea71be67eda3926d Mon Sep 17 00:00:00 2001
From: Claude <claude@localhost.local>
Date: Fri, 6 Nov 2026 19:12:03 -0500
Subject: [PATCH] Gitea: declare the Dex login source in Helm values

Records the source that was configured live with gitea admin auth:
OIDC discovery from Dex, groups scope, and login restricted to members
of Gitea Users via the groups claim. Needs gitea_dex_client_secret in
Vault (the same secret as Dex's gitea client).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tasks/gitea.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/tasks/gitea.yaml b/tasks/gitea.yaml
index 7cf7496..bb9e592 100644
--- a/tasks/gitea.yaml
+++ b/tasks/gitea.yaml
@@ -74,6 +74,19 @@
             bindPassword: "{{ openldap_readonly_password }}"
             usernameAttribute: uid
             publicSSHKeyAttribute: sshPublicKey
+        # Sign-in through Dex; only members of Gitea Users (sent in the groups
+        # claim) may log in. The name "Dex" fixes the callback URL
+        # /user/oauth2/Dex/callback registered in Dex.
+        oauth:
+          - name: Dex
+            provider: openidConnect
+            key: gitea
+            secret: "{{ gitea_dex_client_secret }}"
+            autoDiscoverUrl: https://dex.eom.dev/.well-known/openid-configuration
+            scopes: "openid profile email groups"
+            requiredClaimName: groups
+            requiredClaimValue: Gitea Users
+            groupClaimName: groups
         config:
           APP_NAME: "Gitea"
           service: