Update submodules

2026-10-26 19:00:45 -04:00
parent ee326d4210
commit ed00d40788
10 changed files with 450 additions and 3 deletions
@@ -0,0 +1,83 @@
+---
+# Run on the controller with its existing kubeconfig; no SSH target is required.
+# Supply credentials via inventory/group_vars or a Vault-encrypted vars file.
+- name: Deploy eom.dev Dex with Catppuccin branding
+  hosts: alpha-control-plane
+  become: true
+  vars_files:
+    - ../secrets.yaml
+  vars:
+    dex_namespace: dex
+    dex_release_name: dex
+    dex_chart_version: "0.26.0"
+    dex_issuer: https://dex.eom.dev/
+    dex_hostname: dex.eom.dev
+    dex_ingress_class: nginx
+    dex_cluster_issuer: ca-issuer
+    dex_tls_secret_name: dex
+    dex_theme_enabled: true
+    dex_brand_name: eom.dev
+    dex_theme_configmap_name: dex-catppuccin
+
+    # Preserve the existing DB release and data; do not upgrade it by default.
+    dex_postgres_manage: false
+    dex_postgres_release_name: postgresql
+    dex_postgres_host: postgresql
+    dex_postgres_port: 5432
+    dex_postgres_database: dex
+    dex_postgres_user: dex
+    dex_postgres_storage_size: 256Gi
+    dex_postgres_ssl_mode: disable
+    dex_postgres_password: "{{ dex_admin_password }}"
+    dex_postgres_admin_password: "{{ postgresql_admin_password | default('') }}"
+
+    # Explicitly preserve internal plaintext LDAP and legacy OIDC subjects.
+    dex_ldap_host: openldap.openldap.svc.cluster.local
+    dex_ldap_insecure_no_ssl: true
+    dex_ldap_start_tls: false
+    dex_ldap_bind_dn: cn=readonly,dc=eom,dc=dev
+    dex_ldap_bind_password: "{{ openldap_readonly_password }}"
+    dex_ldap_connector_id: ldap
+    dex_ldap_connector_name: eom.dev account
+    dex_ldap_user_base_dn: dc=eom,dc=dev
+    dex_ldap_user_filter: "(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))"
+    dex_ldap_id_attribute: uid
+    dex_ldap_name_attribute: givenName
+    dex_ldap_group_base_dn: dc=eom,dc=dev
+    dex_ldap_group_user_attribute: cn
+    dex_ldap_group_filter: "(objectClass=groupOfUniqueNames)"
+
+    dex_matrix_client_enabled: true
+    dex_matrix_redirect_uris:
+      - https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4
+
+    # Optional website integration. Set www_dex_client_secret in Vault to enable;
+    # it must equal the membership application's DEX_CLIENT_SECRET.
+    dex_static_clients: "{{ [{'id': 'www-membership', 'name': 'eom.dev Membership', 'secret': www_dex_client_secret, 'redirectURIs': ['https://www.eom.dev/members/oidc/callback/']}] if (www_dex_client_secret | default('') | length > 0) else [] }}"
+    dex_additional_connectors: "{{ [_dex_eom_www_connector] if (www_dex_client_secret | default('') | length > 0) else [] }}"
+    _dex_eom_www_connector:
+      type: ldap
+      id: www-ldap
+      name: eom.dev Membership
+      config:
+        host: openldap.openldap.svc.cluster.local
+        insecureNoSSL: true
+        bindDN: cn=readonly,dc=eom,dc=dev
+        bindPW: "{{ openldap_readonly_password }}"
+        userSearch:
+          baseDN: ou=people,dc=eom,dc=dev
+          filter: "(objectClass=inetOrgPerson)"
+          username: uid
+          idAttr: entryUUID
+          emailAttr: mail
+          nameAttr: cn
+          preferredUsernameAttr: uid
+        groupSearch:
+          baseDN: ou=groups,dc=eom,dc=dev
+          filter: "(objectClass=groupOfUniqueNames)"
+          userMatchers:
+            - userAttr: DN
+              groupAttr: uniqueMember
+          nameAttr: cn
+  roles:
+    - ericomeehan.dex