Tiered LDAP groups

defaults/main.yml

@@ -55,12 +55,18 @@ www_membership_stripe_enabled: false
 www_membership_shkeeper_enabled: false
 www_membership_environment_overrides: {}
 
+# Explicit effective membership level -> service group DNs. No inheritance.
+# Include a group at each level that should receive it; level 0 is free-only.
+# Only dedicate groups whose entire membership may be managed by this service.
+www_membership_service_groups: {}
+
 # Public settings only. Credentials belong in the membership Secret.
 www_membership_environment:
   MEMBERSHIP_PUBLIC_URL: "https://{{ www_hostname }}"
   MEMBERSHIP_ALLOW_HTTP: "0"
   MEMBERSHIP_TRUST_PROXY: "1"
   MEMBERSHIP_TIERS_FILE: /etc/membership/tiers/tiers.json
+  MEMBERSHIP_SERVICE_GROUPS_FILE: /etc/membership/tiers/service-groups.json
   POSTGRES_HOST: membership-db
   POSTGRES_PORT: "5432"
   POSTGRES_DB: membership
@@ -71,6 +77,8 @@ www_membership_environment:
   DEX_CONNECTOR_ID: ldap
   LDAP_URL: ldaps://ldap.example.com
   LDAP_ALLOW_INSECURE: "0"
+  # Used only for registration/group sync, not Dex login callbacks.
+  # Its plaintext bind password belongs in Secret LDAP_BIND_PASSWORD, not here.
   LDAP_BIND_DN: ""
   LDAP_ACCOUNT_BASE_DN: ou=www,ou=people,dc=example,dc=com
   LDAP_SEARCH_BASE_DN: ou=people,dc=example,dc=com