DevOps/ansible-role-www
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Tiered LDAP groups

Browse Source
This commit is contained in:
eric
2026-10-29 14:24:47 -04:00
parent 4c1174df19
commit a56eec0b1c
9 changed files with 142 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tasks/membership.yml
+15 -1
View File
@@ -13,10 +13,13 @@
- "www_membership_image is search('(:[^/]+$|@sha256:[a-f0-9]{64}$)')"
- www_membership_environment is mapping
- www_membership_tiers is mapping
- www_membership_service_groups is mapping
- www_membership_environment.MEMBERSHIP_PUBLIC_URL == 'https://' ~ www_hostname
- www_membership_environment.MEMBERSHIP_ALLOW_HTTP | string == '0'
- www_membership_environment.MEMBERSHIP_TRUST_PROXY | string == '1'
- www_membership_environment.MEMBERSHIP_TIERS_FILE == '/etc/membership/tiers/tiers.json'
- www_membership_environment.MEMBERSHIP_SERVICE_GROUPS_FILE == '/etc/membership/tiers/service-groups.json'
- "'MEMBERSHIP_SERVICE_GROUPS_JSON' not in www_membership_environment"
- "'MEMBERSHIP_SQLITE_PATH' not in www_membership_environment"
- "'MEMBERSHIP_TIERS_JSON' not in www_membership_environment"
- www_membership_replicas | int >= 1
@@ -36,6 +39,17 @@
- not www_membership_postgres_managed or www_membership_environment.POSTGRES_PORT | string == '5432'
fail_msg: Supply a versioned membership image and configure verified LDAP, SMTP, Dex, database and payment settings (see role README).
- name: Validate service group level mappings
tags: [membership_validate]
ansible.builtin.assert:
that:
- item.key | string is match('^(0|[1-9][0-9]*)$')
- item.key | string in (['0'] + (www_membership_tiers.values() | map(attribute='level') | map('string') | list))
- item.value is sequence and item.value is not string and item.value is not mapping
- item.value | select('string') | list | length == item.value | length
fail_msg: Service groups must map explicit configured levels (including 0) to lists of LDAP group DNs.
loop: "{{ www_membership_service_groups | dict2items }}"
- name: Validate optional CA file mount paths
tags: [membership_validate]
ansible.builtin.assert:
@@ -137,7 +151,7 @@
- name: Compute configuration revision without secret contents
# resourceVersion changes trigger a rollout without exposing secret values.
ansible.builtin.set_fact:
_www_membership_revision: "{{ {'image': www_membership_image, 'environment': www_membership_environment, 'tiers': www_membership_tiers, 'secret_name': www_membership_secret_name, 'secret_version': (_www_membership_secret.resources[0].metadata.resourceVersion if not ansible_check_mode else 'check'), 'ca_name': www_membership_ca_secret_name, 'ca_version': (_www_membership_ca.resources[0].metadata.resourceVersion if www_membership_ca_secret_name | length > 0 and not ansible_check_mode else ''), 'rollout': www_rollout_revision} | to_json(sort_keys=True) | hash('sha256') }}"
_www_membership_revision: "{{ {'image': www_membership_image, 'environment': www_membership_environment, 'tiers': www_membership_tiers, 'service_groups': www_membership_service_groups, 'secret_name': www_membership_secret_name, 'secret_version': (_www_membership_secret.resources[0].metadata.resourceVersion if not ansible_check_mode else 'check'), 'ca_name': www_membership_ca_secret_name, 'ca_version': (_www_membership_ca.resources[0].metadata.resourceVersion if www_membership_ca_secret_name | length > 0 and not ansible_check_mode else ''), 'rollout': www_rollout_revision} | to_json(sort_keys=True) | hash('sha256') }}"
no_log: true
- name: Deploy public membership configuration and network isolation