Mastodon: sign in through Dex instead of Google

Dex limits this client to a connector that only admits Mastodon
Users. Dex is the only login and sign-up links to www.eom.dev/members.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/main.yml

@@ -78,13 +78,21 @@
         LDAP_SEARCH_FILTER: (&(objectClass=posixAccount)(|(%{uid}=%{email})(%{mail}=%{email}))(memberOf=cn=Mastodon Users,ou=Mastodon,ou=Services,dc=eom,dc=dev))
         LDAP_MAIL: mail
         OIDC_ENABLED: "true"
-        OIDC_DISPLAY_NAME: Google
-        OIDC_ISSUER: https://accounts.google.com
+        # Dex limits this client to a connector that only admits Mastodon Users.
+        OIDC_DISPLAY_NAME: eom.dev account
+        OIDC_ISSUER: https://dex.eom.dev/
         OIDC_DISCOVERY: "true"
         OIDC_SCOPE: openid,profile,email
-        OIDC_UID_FIELD:
-        OIDC_CLIENT_ID: "{{ mastodon_google_oidc_client_id }}"
-        OIDC_CLIENT_SECRET: "{{ mastodon_google_oidc_client_secret }}"
+        OIDC_UID_FIELD: sub
+        OIDC_CLIENT_ID: mastodon
+        OIDC_CLIENT_SECRET: "{{ mastodon_dex_client_secret }}"
+        # Emails come from LDAP (admin-set or verified by the membership app);
+        # lets existing LDAP-login accounts link on first Dex sign-in.
+        OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED: "true"
+        # Sign-in only through Dex; sign-up through the membership site.
+        # Admin fallback: tootctl from the web pod.
+        OMNIAUTH_ONLY: "true"
+        SSO_ACCOUNT_SIGN_UP: https://www.eom.dev/members
         OIDC_REDIRECT_URI: https://mastodon.eom.dev/auth/auth/openid_connect/callback
         AWS_ACCESS_KEY_ID: "{{ mastodon_minio_access_key }}"
         AWS_SECRET_ACCESS_KEY: "{{ mastodon_minio_secret_key }}"