Nextcloud: sign in through Dex with user_oidc

Configure the Dex provider without auto-provisioning, so only users
the LDAP backend already sees (NextCloud Users) can sign in, and
redirect /login to Dex (/login?direct=1 for the password form).
Admit inetOrgPerson accounts from the membership site in the LDAP
user filter and set a 1 GB default quota.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/main.yml

@@ -125,3 +125,43 @@
           persistence:
             enabled: true
             size: 2Ti
+
+# --- Sign-in through Dex (user_oidc). Access stays curated: no accounts are
+# auto-created, so only users the LDAP backend already sees (members of
+# NextCloud Users) can sign in. Admin fallback: /login?direct=1
+- name: Find the Nextcloud pod
+  kubernetes.core.k8s_info:
+    kind: Pod
+    namespace: nextcloud
+    label_selectors:
+      - app.kubernetes.io/name=nextcloud
+      - app.kubernetes.io/component=app
+    field_selectors:
+      - status.phase=Running
+  register: nextcloud_pods
+
+- name: Configure Dex sign-in, quota and LDAP filter with occ
+  kubernetes.core.k8s_exec:
+    namespace: nextcloud
+    pod: "{{ nextcloud_pods.resources[0].metadata.name }}"
+    container: nextcloud
+    command: "su -s /bin/sh www-data -c {{ item | quote }}"
+  loop:
+    - php occ app:install user_oidc || php occ app:enable user_oidc
+    - >-
+      php occ user_oidc:provider Dex --clientid=nextcloud
+      --clientsecret={{ nextcloud_dex_client_secret | quote }}
+      --discoveryuri=https://dex.eom.dev/.well-known/openid-configuration
+      --scope="openid email profile groups" --unique-uid=0
+      --mapping-uid=preferred_username --mapping-display-name=name
+      --mapping-email=email --check-bearer=0 --group-provisioning=0
+    - php occ config:system:set user_oidc auto_provision --type=boolean --value=false
+    - php occ config:app:set user_oidc allow_multiple_user_backends --value=0
+    - php occ config:app:set files default_quota --value="1 GB"
+    - >-
+      php occ ldap:set-config s01 ldapUserFilter
+      "(&(|(objectclass=posixAccount)(objectclass=inetOrgPerson))(|(memberof=cn=NextCloud Users,ou=NextCloud,ou=Services,dc=eom,dc=dev)))"
+  register: nextcloud_occ
+  changed_when: false
+  failed_when: nextcloud_occ.rc != 0 and 'already installed' not in (nextcloud_occ.stdout | default(''))
+  no_log: true