www: redirect /members to /members/, ensure membership LDAP groups

Service sign-up buttons link to /members, which 404'd because only
/members/ is proxied. Use an absolute https target since TLS ends at
the ingress.

Add an opt-in task that creates any missing tier/service group from
the role's config (with the placeholder member) in the OpenLDAP pod,
leaving existing groups untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

defaults/main.yml

@@ -204,3 +204,9 @@ www_membership_tiers:
       - Exclusive polls on the direction of the platform
       - Optional Diamond credit on the supporters page
       - Your biggest boost for independent public projects
+
+# Create any missing tier/service groups (with the placeholder member) in the
+# OpenLDAP pod. Existing groups and their members are left untouched.
+www_membership_ldap_ensure_groups: false
+www_membership_ldap_namespace: openldap
+www_membership_ldap_pod_selector: app=openldap

tasks/membership.yml

@@ -207,3 +207,29 @@
       status: "True"
   loop: [membership, membership-worker]
   when: not ansible_check_mode
+
+- name: Find the OpenLDAP pod
+  kubernetes.core.k8s_info:
+    kind: Pod
+    namespace: "{{ www_membership_ldap_namespace }}"
+    label_selectors: ["{{ www_membership_ldap_pod_selector }}"]
+    field_selectors: [status.phase=Running]
+  register: www_ldap_pods
+  when: www_membership_ldap_ensure_groups | bool
+
+- name: Ensure membership tier and service groups exist in LDAP
+  kubernetes.core.k8s_exec:
+    namespace: "{{ www_membership_ldap_namespace }}"
+    pod: "{{ www_ldap_pods.resources[0].metadata.name }}"
+    command: >-
+      sh -c 'printf "%s\n" "dn: {{ item }}" "objectClass: groupOfUniqueNames"
+      "cn: {{ (item | split(","))[0] | regex_replace("^cn=", "") }}"
+      "uniqueMember: {{ (www_membership_environment | combine(www_membership_environment_overrides)).LDAP_GROUP_PLACEHOLDER_DN }}"
+      | ldapadd -x -H ldap://localhost -D "cn=admin,dc=eom,dc=dev" -w "$LDAP_ADMIN_PASSWORD"; rc=$?;
+      if [ $rc -eq 0 ]; then echo GROUP_CREATED; elif [ $rc -ne 68 ]; then exit $rc; fi'
+  loop: >-
+    {{ ((www_membership_tiers.values() | map(attribute='group_dn') | list)
+        + (www_membership_service_groups.values() | flatten)) | unique }}
+  register: www_ldap_groups
+  changed_when: "'GROUP_CREATED' in (www_ldap_groups.stdout | default(''))"
+  when: www_membership_ldap_ensure_groups | bool

templates/membership-httpd.conf.j2

@@ -1,6 +1,9 @@
 {% if www_membership_enabled %}
 ProxyRequests Off
 ProxyPreserveHost On
+# Service sign-up buttons link to /members; the app lives under /members/.
+# Absolute target: TLS ends at ingress, so a relative one becomes http://...:443
+RedirectMatch 301 "^/members$" "https://{{ www_hostname }}/members/"
 ProxyPass "/members/" "http://membership:8000/members/" connectiontimeout=5 timeout=120
 ProxyPassReverse "/members/" "http://membership:8000/members/"
 <Location "/members/">