www: redirect /members to /members/, ensure membership LDAP groups

Service sign-up buttons link to /members, which 404'd because only /members/ is proxied. Use an absolute https target since TLS ends at the ingress. Add an opt-in task that creates any missing tier/service group from the role's config (with the placeholder member) in the OpenLDAP pod, leaving existing groups untouched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 18:33:25 -05:00
parent ab6dbac3fd
commit d694ae5650
3 changed files with 35 additions and 0 deletions
@@ -1,6 +1,9 @@
 {% if www_membership_enabled %}
 ProxyRequests Off
 ProxyPreserveHost On
+# Service sign-up buttons link to /members; the app lives under /members/.
+# Absolute target: TLS ends at ingress, so a relative one becomes http://...:443
+RedirectMatch 301 "^/members$" "https://{{ www_hostname }}/members/"
 ProxyPass "/members/" "http://membership:8000/members/" connectiontimeout=5 timeout=120
 ProxyPassReverse "/members/" "http://membership:8000/members/"
 <Location "/members/">