---
# Run on the controller with its existing kubeconfig; no SSH target is required.
# Supply credentials via inventory/group_vars or a Vault-encrypted vars file.
- name: Deploy eom.dev Dex with Catppuccin branding
  hosts: alpha-control-plane
  become: true
  vars_files:
    - ../secrets.yaml
  vars:
    dex_namespace: dex
    dex_release_name: dex
    dex_chart_version: "0.26.0"
    dex_issuer: https://dex.eom.dev/
    dex_hostname: dex.eom.dev
    dex_ingress_class: nginx
    dex_cluster_issuer: ca-issuer
    dex_tls_secret_name: dex
    dex_theme_enabled: true
    dex_brand_name: eom.dev
    dex_theme_configmap_name: dex-catppuccin

    # Preserve the existing DB release and data; do not upgrade it by default.
    dex_postgres_manage: false
    dex_postgres_release_name: postgresql
    dex_postgres_host: postgresql
    dex_postgres_port: 5432
    dex_postgres_database: dex
    dex_postgres_user: dex
    dex_postgres_storage_size: 256Gi
    dex_postgres_ssl_mode: disable
    dex_postgres_password: "{{ dex_admin_password }}"
    dex_postgres_admin_password: "{{ postgresql_admin_password | default('') }}"

    # Explicitly preserve internal plaintext LDAP and legacy OIDC subjects.
    dex_ldap_host: openldap.openldap.svc.cluster.local
    dex_ldap_insecure_no_ssl: true
    dex_ldap_start_tls: false
    dex_ldap_bind_dn: cn=readonly,dc=eom,dc=dev
    dex_ldap_bind_password: "{{ openldap_readonly_password }}"
    dex_ldap_connector_id: ldap
    dex_ldap_connector_name: eom.dev account
    dex_ldap_user_base_dn: dc=eom,dc=dev
    dex_ldap_user_filter: "(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))"
    dex_ldap_id_attribute: uid
    dex_ldap_name_attribute: cn
    dex_ldap_group_base_dn: dc=eom,dc=dev
    dex_ldap_group_user_attribute: DN
    dex_ldap_group_filter: "(objectClass=groupOfUniqueNames)"

    dex_matrix_client_enabled: true
    dex_matrix_redirect_uris:
      - https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4

    # Optional website integration. Set www_dex_client_secret in Vault to enable;
    # it must equal the membership application's DEX_CLIENT_SECRET.
    dex_static_clients: "{{ [{'id': 'www-membership', 'name': 'eom.dev Membership', 'secret': www_dex_client_secret, 'redirectURIs': ['https://www.eom.dev/members/oidc/callback/']}] if (www_dex_client_secret | default('') | length > 0) else [] }}"
    dex_additional_connectors: "{{ [_dex_eom_www_connector] if (www_dex_client_secret | default('') | length > 0) else [] }}"
    _dex_eom_www_connector:
      type: ldap
      id: www-ldap
      name: eom.dev Membership
      config:
        host: openldap.openldap.svc.cluster.local
        insecureNoSSL: true
        bindDN: cn=readonly,dc=eom,dc=dev
        bindPW: "{{ openldap_readonly_password }}"
        userSearch:
          baseDN: ou=people,dc=eom,dc=dev
          filter: "(objectClass=inetOrgPerson)"
          username: uid
          idAttr: entryUUID
          emailAttr: mail
          nameAttr: cn
          preferredUsernameAttr: uid
        groupSearch:
          baseDN: ou=groups,dc=eom,dc=dev
          filter: "(objectClass=groupOfUniqueNames)"
          userMatchers:
            - userAttr: DN
              groupAttr: uniqueMember
          nameAttr: cn
  roles:
    - ericomeehan.dex