PeerTube: record Dex login, sign-up link and oidc-cnr settings

Log in redirects to the single external auth (Dex), custom JS adds a
Sign up link to www.eom.dev/members, and a post-deploy task sets the
oidc-cnr claims Dex sends (groups, preferred_username, name).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

files/signup.js

@@ -0,0 +1,11 @@
+/* eom.dev: sign-in goes to Dex; sign-up goes through the membership site */
+(function(){var U='https://www.eom.dev/members';
+var LOGIN='a[href$="/login"],a[href*="/plugins/oidc-cnr/"][href*="/auth/"]';
+function fix(){
+ document.querySelectorAll('a[href$="/signup"],a[href*="/signup?"]').forEach(function(a){a.href=U;a.addEventListener('click',function(e){e.stopImmediatePropagation();},true);});
+ document.querySelectorAll(LOGIN).forEach(function(a){
+  if(a.dataset.eomSignup||a.closest('.eom-signup'))return; a.dataset.eomSignup='1';
+  var s=a.cloneNode(false); s.removeAttribute('data-eom-signup'); s.href=U; s.textContent='Sign up'; s.className=(a.className||'')+' eom-signup'; s.style.marginLeft='0.5rem';
+  a.insertAdjacentElement('afterend',s);});
+}
+new MutationObserver(fix).observe(document.documentElement,{childList:true,subtree:true}); fix();})();

tasks/main.yml

@@ -37,7 +37,7 @@
           password: "{{ peertube_admin_password }}"
         ## Data storage on S3 - will still require persistence even if enabled.
         objectStorage:
-          enabled: true
+          enabled: false
           endpoint: minio.eom.dev
           region: us-east-1
           # uploadACL: public-read
@@ -82,18 +82,32 @@
         trust_proxy:
           - 10.0.0.0/8
           - 172.16.0.0/12
-          - 192.168.0.0/24
+          - 192.168.1.0/24
           - fc00::/7
           # - loopback
 
         instance:
           description: "PeerTube on eom.dev"
+          customizations:
+            # Adds "Sign up" -> www.eom.dev/members next to Log in.
+            javascript: "{{ lookup('ansible.builtin.file', role_path ~ '/files/signup.js') }}"
+
+        # Log in goes straight to Dex (oidc-cnr is the only external auth).
+        # Admin password login: /login?externalRedirect=false
+        client:
+          menu:
+            login:
+              redirect_on_single_external_auth: true
 
       ## Extra environment variables to set on Peertube
       ##
       extraEnv:
         - name: PT_INITIAL_ROOT_PASSWORD
           value: "{{ peertube_admin_password }}"
+        - name: AWS_ACCESS_KEY_ID
+          value: "{{ peertube_minio_access_key }}"
+        - name: AWS_SECRET_ACCESS_KEY
+          value: "{{ peertube_minio_secret_key }}"
         # - name: TZ
         #   value: Europe/Stockholm
       extraSecret: {}
@@ -121,6 +135,7 @@
       ##
       postgresql:
         enabled: true
+        ssl: false
         image:
           repository: bitnamilegacy/postgresql
 
@@ -186,18 +201,26 @@
 
       ## Default probes, using ping API to avoid excessive echo
       ##
+      # Small nodes: cold start (plugins, migrations) can take minutes, and the
+      # ping can stall briefly under load. Allow up to 10 minutes to start.
       livenessProbe:
         httpGet:
           path: /api/v1/ping
           port: http
+        timeoutSeconds: 5
+        failureThreshold: 6
       readinessProbe:
         httpGet:
           path: /api/v1/ping
           port: http
+        timeoutSeconds: 5
       startupProbe:
         httpGet:
           path: /api/v1/ping
           port: http
+        timeoutSeconds: 5
+        periodSeconds: 10
+        failureThreshold: 60
 
       serviceAccount:
         ## Specifies whether a service account should be created
@@ -260,5 +283,46 @@
 
       tolerations: []
 
-      affinity: {}
+      # Keep heavy apps off the 1-CPU node that hosts ingress-nginx; sharing it
+      # starved Nextcloud and risks the ingress / MetalLB announcement.
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - topologyKey: kubernetes.io/hostname
+              namespaceSelector:
+                matchLabels:
+                  kubernetes.io/metadata.name: ingress-nginx
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/component: controller
+                  app.kubernetes.io/name: ingress-nginx
+
+# oidc-cnr settings live in PeerTube's database; set the claims Dex sends.
+- name: Find the PeerTube pod
+  kubernetes.core.k8s_info:
+    kind: Pod
+    namespace: peertube
+    label_selectors:
+      - app.kubernetes.io/name=peertube
+    field_selectors:
+      - status.phase=Running
+  register: peertube_pods
+
+- name: Configure the oidc-cnr plugin for Dex
+  kubernetes.core.k8s_exec:
+    namespace: peertube
+    pod: "{{ peertube_pods.resources[0].metadata.name }}"
+    container: peertube
+    command: >-
+      node -e '
+      const {Client}=require("pg");
+      const c=new Client({host:process.env.PEERTUBE_DB_HOSTNAME||"peertube-postgresql",user:process.env.PEERTUBE_DB_USERNAME||"peertube",password:process.env.PEERTUBE_DB_PASSWORD,database:"peertube"+(process.env.PEERTUBE_DB_SUFFIX||"")});
+      (async()=>{await c.connect();
+      const r=await c.query("select settings from plugin where name=$1",["oidc-cnr"]);
+      if(!r.rows.length){console.log("oidc-cnr not installed");return c.end();}
+      const s=Object.assign(r.rows[0].settings||{},{"discover-url":"https://dex.eom.dev/.well-known/openid-configuration","client-id":"peertube","client-secret":process.argv[1],"scope":"openid email profile groups","group-property":"groups","allowed-group":"PeerTube Users","username-property":"preferred_username","display-name-property":"name","mail-property":"email","auth-display-name":"eom.dev account"});
+      await c.query("update plugin set settings=$1 where name=$2",[JSON.stringify(s),"oidc-cnr"]);await c.end();})().catch(e=>{console.error(e.message);process.exit(1)})'
+      {{ peertube_dex_client_secret | quote }}
+  changed_when: false
+  no_log: true