Mastodon: open registrations so Create account links to /members

With registrations closed, the web UI's Create account button opens a
"registrations closed" dialog; when open it links to the configured
sign-up URL (SSO_ACCOUNT_SIGN_UP = www.eom.dev/members). OMNIAUTH_ONLY
still disables local sign-up, so accounts are created only via Dex.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/main.yml

@@ -78,13 +78,21 @@
         LDAP_SEARCH_FILTER: (&(objectClass=posixAccount)(|(%{uid}=%{email})(%{mail}=%{email}))(memberOf=cn=Mastodon Users,ou=Mastodon,ou=Services,dc=eom,dc=dev))
         LDAP_MAIL: mail
         OIDC_ENABLED: "true"
-        OIDC_DISPLAY_NAME: Google
+        # Dex limits this client to a connector that only admits Mastodon Users.
-        OIDC_ISSUER: https://accounts.google.com
+        OIDC_DISPLAY_NAME: eom.dev account
+        OIDC_ISSUER: https://dex.eom.dev/
         OIDC_DISCOVERY: "true"
         OIDC_SCOPE: openid,profile,email
-        OIDC_UID_FIELD:
+        OIDC_UID_FIELD: sub
-        OIDC_CLIENT_ID: "{{ mastodon_google_oidc_client_id }}"
+        OIDC_CLIENT_ID: mastodon
-        OIDC_CLIENT_SECRET: "{{ mastodon_google_oidc_client_secret }}"
+        OIDC_CLIENT_SECRET: "{{ mastodon_dex_client_secret }}"
+        # Emails come from LDAP (admin-set or verified by the membership app);
+        # lets existing LDAP-login accounts link on first Dex sign-in.
+        OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED: "true"
+        # Sign-in only through Dex; sign-up through the membership site.
+        # Admin fallback: tootctl from the web pod.
+        OMNIAUTH_ONLY: "true"
+        SSO_ACCOUNT_SIGN_UP: https://www.eom.dev/members
         OIDC_REDIRECT_URI: https://mastodon.eom.dev/auth/auth/openid_connect/callback
         AWS_ACCESS_KEY_ID: "{{ mastodon_minio_access_key }}"
         AWS_SECRET_ACCESS_KEY: "{{ mastodon_minio_secret_key }}"
@@ -156,3 +164,29 @@
               - mastodon.eom.dev
               secretName: mastodon-tls
 
+
+# With registrations "open", the web UI's Create account button links to
+# SSO_ACCOUNT_SIGN_UP (www.eom.dev/members) instead of a "closed" dialog.
+# OMNIAUTH_ONLY still disables local sign-up; accounts come only via Dex.
+- name: Find the Mastodon web pod
+  kubernetes.core.k8s_info:
+    kind: Pod
+    namespace: mastodon
+    label_selectors:
+      - app.kubernetes.io/component=web
+      - app.kubernetes.io/instance=mastodon
+    field_selectors:
+      - status.phase=Running
+  register: mastodon_web_pods
+
+- name: Open registrations so sign-up links to the membership site
+  kubernetes.core.k8s_exec:
+    namespace: mastodon
+    pod: "{{ mastodon_web_pods.resources[0].metadata.name }}"
+    container: mastodon
+    # kubectl exec skips the image entrypoint, so load the password files.
+    command: >-
+      sh -c 'export REDIS_PASSWORD="$(cat "$MASTODON_REDIS_PASSWORD_FILE")"
+      DB_PASS="$(cat "$MASTODON_DATABASE_PASSWORD_FILE")" HOME=/tmp;
+      tootctl settings registrations open'
+  changed_when: false