Mastodon: open registrations so Create account links to /members

With registrations closed, the web UI's Create account button opens a
"registrations closed" dialog; when open it links to the configured
sign-up URL (SSO_ACCOUNT_SIGN_UP = www.eom.dev/members). OMNIAUTH_ONLY
still disables local sign-up, so accounts are created only via Dex.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/main.yml

@@ -18,9 +18,15 @@
     chart_ref: bitnami/mastodon
     release_namespace: mastodon
     create_namespace: true
-    enable-metrics: true
-    timeout: 600s
+    timeout: 1200s
     values:
+      global:
+        security:
+          allowInsecureImages: true
+      image:
+        pullPolicy: IfNotPresent
+        repository: bitnamilegacy/mastodon
+        tag: 4.4.3-debian-12-r11
       web:
         resources:
           requests:
@@ -72,13 +78,21 @@
         LDAP_SEARCH_FILTER: (&(objectClass=posixAccount)(|(%{uid}=%{email})(%{mail}=%{email}))(memberOf=cn=Mastodon Users,ou=Mastodon,ou=Services,dc=eom,dc=dev))
         LDAP_MAIL: mail
         OIDC_ENABLED: "true"
-        OIDC_DISPLAY_NAME: Google
-        OIDC_ISSUER: https://accounts.google.com
+        # Dex limits this client to a connector that only admits Mastodon Users.
+        OIDC_DISPLAY_NAME: eom.dev account
+        OIDC_ISSUER: https://dex.eom.dev/
         OIDC_DISCOVERY: "true"
         OIDC_SCOPE: openid,profile,email
-        OIDC_UID_FIELD:
-        OIDC_CLIENT_ID: "{{ mastodon_google_oidc_client_id }}"
-        OIDC_CLIENT_SECRET: "{{ mastodon_google_oidc_client_secret }}"
+        OIDC_UID_FIELD: sub
+        OIDC_CLIENT_ID: mastodon
+        OIDC_CLIENT_SECRET: "{{ mastodon_dex_client_secret }}"
+        # Emails come from LDAP (admin-set or verified by the membership app);
+        # lets existing LDAP-login accounts link on first Dex sign-in.
+        OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED: "true"
+        # Sign-in only through Dex; sign-up through the membership site.
+        # Admin fallback: tootctl from the web pod.
+        OMNIAUTH_ONLY: "true"
+        SSO_ACCOUNT_SIGN_UP: https://www.eom.dev/members
         OIDC_REDIRECT_URI: https://mastodon.eom.dev/auth/auth/openid_connect/callback
         AWS_ACCESS_KEY_ID: "{{ mastodon_minio_access_key }}"
         AWS_SECRET_ACCESS_KEY: "{{ mastodon_minio_secret_key }}"
@@ -98,12 +112,16 @@
         enabled: true
         size: 2Ti
       redis:
+        image:
+          repository: bitnamilegacy/redis
+          tag: 8.2.0-debian-12-r0
         enabled: true
         auth:
           password: "{{ mastodon_admin_password }}"
-        image: docker.io/bitnamilegacy/redis:9.0.2-debian-12-r3
       postgresql:
         enabled: true
+        image:
+          repository: bitnamilegacy/postgresql
         auth:
           username: mastodon
           password: "{{ mastodon_admin_password }}"
@@ -112,9 +130,9 @@
           persistence:
             enabled: true
             size: 2Ti
-        image: docker.io/bitnamilegacy/postgresql:17.5.0-debian-r2-r10
       elasticsearch:
         enabled: true
+        repository: bitnamilegacy/elasticsearch
         master:
           persistence:
             size: 2Ti
@@ -128,6 +146,8 @@
         accessKeyId: "{{ mastodon_minio_access_key }}"
         accessKeySecret: "{{ mastodon_minio_secret_key }}"
       apache:
+        image:
+          repository: bitnamilegacy/apache
         service:
           type: ClusterIP
           ports:
@@ -144,3 +164,29 @@
               - mastodon.eom.dev
               secretName: mastodon-tls
 
+
+# With registrations "open", the web UI's Create account button links to
+# SSO_ACCOUNT_SIGN_UP (www.eom.dev/members) instead of a "closed" dialog.
+# OMNIAUTH_ONLY still disables local sign-up; accounts come only via Dex.
+- name: Find the Mastodon web pod
+  kubernetes.core.k8s_info:
+    kind: Pod
+    namespace: mastodon
+    label_selectors:
+      - app.kubernetes.io/component=web
+      - app.kubernetes.io/instance=mastodon
+    field_selectors:
+      - status.phase=Running
+  register: mastodon_web_pods
+
+- name: Open registrations so sign-up links to the membership site
+  kubernetes.core.k8s_exec:
+    namespace: mastodon
+    pod: "{{ mastodon_web_pods.resources[0].metadata.name }}"
+    container: mastodon
+    # kubectl exec skips the image entrypoint, so load the password files.
+    command: >-
+      sh -c 'export REDIS_PASSWORD="$(cat "$MASTODON_REDIS_PASSWORD_FILE")"
+      DB_PASS="$(cat "$MASTODON_DATABASE_PASSWORD_FILE")" HOME=/tmp;
+      tootctl settings registrations open'
+  changed_when: false