ClaudeandClaude Opus 5.5
d694ae5650
Service sign-up buttons link to /members, which 404'd because only /members/ is proxied. Use an absolute https target since TLS ends at the ingress. Add an opt-in task that creates any missing tier/service group from the role's config (with the placeholder member) in the OpenLDAP pod, leaving existing groups untouched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
213 lines
8.6 KiB
YAML
213 lines
8.6 KiB
YAML
#SPDX-License-Identifier: MIT-0
|
|
---
|
|
# defaults file for ansible-role-www
|
|
www_cron_schedule: "*/15 * * * *"
|
|
www_username: test@example.com
|
|
www_password: ""
|
|
www_imap_server: imap.example.com
|
|
www_save_dir: /data
|
|
www_ftp_user: ""
|
|
www_ftp_password: ""
|
|
www_ftp_pasv_address: example.com
|
|
www_repo_url: https://git.example.com/organization/www.git
|
|
|
|
# Kubernetes deployment (existing archive, Prometheus and Tor are retained).
|
|
www_namespace: www
|
|
www_hostname: www.example.com
|
|
www_ingress_class: nginx
|
|
www_cluster_issuer: letsencrypt-prod
|
|
# Set to your published website image, including any required metrics exporter.
|
|
www_httpd_image: registry.example.com/organization/www:release
|
|
www_source_image: debian:trixie
|
|
www_repo_version: HEAD
|
|
www_rollout_revision: ""
|
|
www_archive_storage_size: 10Gi
|
|
# Enable only when the Tor controller and OnionService CRD are installed.
|
|
www_onion_enabled: false
|
|
www_wait_timeout: 600
|
|
www_image_pull_secrets: []
|
|
|
|
www_membership_enabled: false
|
|
# Build/push www/membership/Dockerfile first. Use an immutable release/digest.
|
|
www_membership_image: ""
|
|
www_membership_image_pull_policy: IfNotPresent
|
|
www_membership_replicas: 2
|
|
www_membership_worker_interval: 60
|
|
www_membership_secret_name: membership
|
|
# Empty uses an existing Kubernetes Secret. Otherwise supply via Vault/lookup.
|
|
www_membership_secret_data: {}
|
|
www_membership_ca_secret_name: ""
|
|
www_membership_resources:
|
|
requests: {cpu: 100m, memory: 128Mi}
|
|
limits: {cpu: "1", memory: 512Mi}
|
|
www_membership_worker_resources:
|
|
requests: {cpu: 100m, memory: 128Mi}
|
|
limits: {cpu: "1", memory: 512Mi}
|
|
www_membership_postgres_managed: true
|
|
www_membership_postgres_image: postgres:17
|
|
www_membership_postgres_storage_size: 10Gi
|
|
# Empty uses the cluster default StorageClass. The claim is never auto-deleted.
|
|
www_membership_postgres_storage_class: ""
|
|
www_membership_postgres_resources:
|
|
requests: {cpu: 100m, memory: 256Mi}
|
|
limits: {cpu: "2", memory: 1Gi}
|
|
www_membership_stripe_enabled: false
|
|
www_membership_shkeeper_enabled: false
|
|
www_membership_environment_overrides: {}
|
|
|
|
# Explicit effective membership level -> service group DNs. No inheritance.
|
|
# Include a group at each level that should receive it; level 0 is free-only.
|
|
# Only dedicate groups whose entire membership may be managed by this service.
|
|
www_membership_service_groups:
|
|
"0":
|
|
- "cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Discourse Users,ou=Discourse,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Gitea Users,ou=Gitea,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Matrix Users,ou=Matrix,ou=Services,dc=eom,dc=dev"
|
|
"1":
|
|
- "cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Discourse Users,ou=Discourse,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Gitea Users,ou=Gitea,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Matrix Users,ou=Matrix,ou=Services,dc=eom,dc=dev"
|
|
"2":
|
|
- "cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Discourse Users,ou=Discourse,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Gitea Users,ou=Gitea,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Matrix Users,ou=Matrix,ou=Services,dc=eom,dc=dev"
|
|
"3":
|
|
- "cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Discourse Users,ou=Discourse,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Gitea Users,ou=Gitea,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Matrix Users,ou=Matrix,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Mastodon Users,ou=Mastodon,ou=Services,dc=eom,dc=dev"
|
|
- "cn=PeerTube Users,ou=PeerTube,ou=Services,dc=eom,dc=dev"
|
|
"4":
|
|
- "cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Discourse Users,ou=Discourse,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Gitea Users,ou=Gitea,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Matrix Users,ou=Matrix,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Mastodon Users,ou=Mastodon,ou=Services,dc=eom,dc=dev"
|
|
- "cn=PeerTube Users,ou=PeerTube,ou=Services,dc=eom,dc=dev"
|
|
"5":
|
|
- "cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Discourse Users,ou=Discourse,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Gitea Users,ou=Gitea,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Matrix Users,ou=Matrix,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Mastodon Users,ou=Mastodon,ou=Services,dc=eom,dc=dev"
|
|
- "cn=PeerTube Users,ou=PeerTube,ou=Services,dc=eom,dc=dev"
|
|
|
|
# Public settings only. Credentials belong in the membership Secret.
|
|
www_membership_environment:
|
|
MEMBERSHIP_PUBLIC_URL: "https://{{ www_hostname }}"
|
|
MEMBERSHIP_ALLOW_HTTP: "0"
|
|
MEMBERSHIP_TRUST_PROXY: "1"
|
|
MEMBERSHIP_TIERS_FILE: /etc/membership/tiers/tiers.json
|
|
MEMBERSHIP_SERVICE_GROUPS_FILE: /etc/membership/tiers/service-groups.json
|
|
POSTGRES_HOST: membership-db
|
|
POSTGRES_PORT: "5432"
|
|
POSTGRES_DB: membership
|
|
POSTGRES_USER: membership
|
|
POSTGRES_SSLMODE: prefer
|
|
DEX_ISSUER: https://dex.example.com
|
|
DEX_CLIENT_ID: www-membership
|
|
DEX_CONNECTOR_ID: ldap
|
|
LDAP_URL: ldaps://ldap.example.com
|
|
LDAP_ALLOW_INSECURE: "0"
|
|
# Used only for registration/group sync, not Dex login callbacks.
|
|
# Its plaintext bind password belongs in Secret LDAP_BIND_PASSWORD, not here.
|
|
LDAP_BIND_DN: ""
|
|
LDAP_ACCOUNT_BASE_DN: ou=www,ou=people,dc=example,dc=com
|
|
LDAP_SEARCH_BASE_DN: ou=people,dc=example,dc=com
|
|
LDAP_PASSWORD_SCHEME: ""
|
|
LDAP_GROUP_PLACEHOLDER_DN: cn=membership-sentinel,ou=system,dc=example,dc=com
|
|
LDAP_CA_CERT_FILE: ""
|
|
EMAIL_HOST: ""
|
|
EMAIL_PORT: "587"
|
|
EMAIL_HOST_USER: ""
|
|
EMAIL_USE_TLS: "1"
|
|
DEFAULT_FROM_EMAIL: accounts@example.com
|
|
STRIPE_LIVE_MODE: "0"
|
|
STRIPE_PORTAL_CONFIGURATION: ""
|
|
SHKEEPER_URL: ""
|
|
SHKEEPER_CURRENCIES: ""
|
|
SHKEEPER_CA_CERT_FILE: ""
|
|
|
|
# Existing LIVE Stripe prices. Level 0 is free and is not configured as a paid tier.
|
|
# Provision the dedicated paid-group DNs separately.
|
|
# Override with {} to disable paid tiers, or test-mode prices for a sandbox.
|
|
www_membership_tiers:
|
|
level-1:
|
|
level: 1
|
|
label: Bronze
|
|
price_id: price_1Rgv4xC5KPXqTvVLfMd6z7wn
|
|
price_label: $4 USD / month
|
|
usd_amount: "4.00"
|
|
group_dn: cn=Level 1,ou=Memberships,dc=eom,dc=dev
|
|
description: Kick off the experiment with a private place to connect and a closer look at what is being made.
|
|
# Display benefits only; exclusive-content permissions are managed manually.
|
|
benefits:
|
|
- Exclusive members-only content on Discourse and Matrix
|
|
- Behind-the-scenes notes and work-in-progress updates
|
|
- Giveaways exclusive to Bronze members
|
|
- Optional credit on the community supporters page
|
|
level-2:
|
|
level: 2
|
|
label: Silver
|
|
price_id: price_1Rgv5QC5KPXqTvVLv1PaHWb5
|
|
price_label: $8 USD / month
|
|
usd_amount: "8.00"
|
|
group_dn: cn=Level 2,ou=Memberships,dc=eom,dc=dev
|
|
description: Venture behind the scenes and explore new experiments before their public release.
|
|
benefits:
|
|
- Bronze content and community benefits
|
|
- Giveaways exclusive to Silver members
|
|
- Early previews of music, games, videos and experiments when available
|
|
- Invitations to member playtests and listening sessions
|
|
level-3:
|
|
level: 3
|
|
label: Gold
|
|
price_id: price_1Rgv5rC5KPXqTvVL8Ol8sMUf
|
|
price_label: $16 USD / month
|
|
usd_amount: "16.00"
|
|
group_dn: cn=Level 3,ou=Memberships,dc=eom,dc=dev
|
|
description: Bring your perspective and help shape the next community experiment.
|
|
benefits:
|
|
- Silver content and community benefits
|
|
- Giveaways exclusive to Gold members
|
|
- Member polls on future project topics and experiments
|
|
- Invitations to occasional small-group feedback sessions
|
|
level-4:
|
|
level: 4
|
|
label: Platinum
|
|
price_id: price_1Rgv6FC5KPXqTvVL39mAxYjm
|
|
price_label: $32 USD / month
|
|
usd_amount: "32.00"
|
|
group_dn: cn=Level 4,ou=Memberships,dc=eom,dc=dev
|
|
description: Support the platform and help guide its direction through exclusive polls.
|
|
benefits:
|
|
- Gold content and community benefits
|
|
- Giveaways exclusive to Platinum members
|
|
- Exclusive polls on the direction of the platform
|
|
- A larger contribution toward servers and public projects
|
|
- Choose this level if you would like to give more
|
|
level-5:
|
|
level: 5
|
|
label: Diamond
|
|
price_id: price_1Rgv6mC5KPXqTvVLkcmznWZa
|
|
price_label: $64 USD / month
|
|
usd_amount: "64.00"
|
|
group_dn: cn=Level 5,ou=Memberships,dc=eom,dc=dev
|
|
description: Help underwrite the public work and the community around it.
|
|
benefits:
|
|
- Gold content and community benefits
|
|
- Giveaways exclusive to Diamond members
|
|
- Exclusive polls on the direction of the platform
|
|
- Optional Diamond credit on the supporters page
|
|
- Your biggest boost for independent public projects
|
|
|
|
# Create any missing tier/service groups (with the placeholder member) in the
|
|
# OpenLDAP pod. Existing groups and their members are left untouched.
|
|
www_membership_ldap_ensure_groups: false
|
|
www_membership_ldap_namespace: openldap
|
|
www_membership_ldap_pod_selector: app=openldap
|