pretix: enable OIDC support

- add pretix-oidc plugin installation (Dockerfile, version 2.3.1 default)
- configure OIDC env vars (issuer, endpoints, client ID/secret, scopes, unique attribute)
- enable redis + database, add config/data volumes
- switch canonical domain to ticket.<PRIMARY_DOMAIN> with pretix.<PRIMARY_DOMAIN> alias
- mirror GitLab-style OIDC var structure for consistency

Implements pretix authentication via Keycloak/SSO.
See: https://chatgpt.com/share/68b19721-341c-800f-b372-527164474018

roles/web-app-pretix/templates/Dockerfile.j2

@@ -0,0 +1,4 @@
+ARG PRETIX_BASE_IMAGE={{ PRETIX_IMAGE }}:{{ PRETIX_VERSION }}
+FROM ${PRETIX_BASE_IMAGE}
+# Install OIDC auth plugin for Pretix
+RUN python -m pip install --no-cache-dir "pretix-oidc=={{ PRETIX_OIDC_PLUGIN_VERSION }}"

roles/web-app-pretix/templates/docker-compose.yml.j2

@@ -1,20 +1,32 @@
-
 services:
-
 {% include 'roles/docker-compose/templates/base.yml.j2' %}
 
   application:
-    image: "{{ applications | get_app_conf(application_id, 'images.' ~ application_id, True) }}"
-    volumes: []
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        PRETIX_BASE_IMAGE: "{{ PRETIX_IMAGE }}:{{ PRETIX_VERSION }}"
+    image: "{{ PRETIX_IMAGE }}:{{ PRETIX_VERSION }}-oidc"
+    container_name: "{{ PRETIX_CONTAINER }}"
+    hostname: '{{ PRETIX_HOSTNAME}}'
+    command: ["all"]
     ports:
-      - "127.0.0.1:{{ ports.localhost.http[application_id] }}:{{ container_port }}"
+      - "127.0.0.1:{{ ports.localhost.http[application_id] }}:80"
+    volumes:
+      - 'data:/data'
+      - 'config:/etc/pretix'
 {% include 'roles/docker-container/templates/healthcheck/curl.yml.j2' %}
 {% include 'roles/docker-container/templates/base.yml.j2' %}
-{% include 'roles/docker-container/templates/depends_on/dmbs_excl.yml.j2' %}
+    depends_on:
+      - database
+      - redis
 {% include 'roles/docker-container/templates/networks.yml.j2' %}
 
 {% include 'roles/docker-compose/templates/volumes.yml.j2' %}
+  config:
+    name: {{ PRETIX_CONF_VOLUME }}
+  data:
+    name: {{ PRETIX_DATA_VOLUME }}
 
 {% include 'roles/docker-compose/templates/networks.yml.j2' %}
-
-

roles/web-app-pretix/templates/env.j2

@@ -0,0 +1,34 @@
+## Pretix core
+PRETIX_PRETIX_INSTANCE_NAME="{{ PRIMARY_DOMAIN | upper }} Tickets"
+PRETIX_PRETIX_URL="{{ PRETIX_URL }}"
+PRETIX_PRETIX_AUTH_BACKENDS="pretix.base.auth.NativeAuthBackend{% if PRETIX_OIDC_ENABLED %},pretix_oidc.auth.OIDCAuthBackend{% endif %}"
+
+## Locale
+PRETIX_LOCALE_TIMEZONE="{{ HOST_TIMEZONE }}"
+
+## Database
+PRETIX_DATABASE_BACKEND="postgresql"
+PRETIX_DATABASE_NAME="{{ database_name }}"
+PRETIX_DATABASE_USER="{{ database_username }}"
+PRETIX_DATABASE_PASSWORD="{{ database_password }}"
+PRETIX_DATABASE_HOST="{{ database_host }}"
+PRETIX_DATABASE_PORT="{{ database_port }}"
+
+## Redis
+PRETIX_REDIS_LOCATION="redis://redis:6379/1"
+PRETIX_REDIS_SESSIONS="true"
+
+## OIDC (plugin)
+{% if PRETIX_OIDC_ENABLED %}
+PRETIX_OIDC_TITLE="{{ PRETIX_OIDC_LABEL | replace('\"','\\\"') }}"
+PRETIX_OIDC_ISSUER="{{ PRETIX_OIDC_ISSUER }}"
+PRETIX_OIDC_AUTHORIZATION_ENDPOINT="{{ PRETIX_OIDC_AUTH_URL }}"
+PRETIX_OIDC_TOKEN_ENDPOINT="{{ PRETIX_OIDC_TOKEN_URL }}"
+PRETIX_OIDC_USERINFO_ENDPOINT="{{ PRETIX_OIDC_USERINFO_URL }}"
+PRETIX_OIDC_END_SESSION_ENDPOINT="{{ PRETIX_OIDC_LOGOUT_URL }}"
+PRETIX_OIDC_JWKS_URI="{{ PRETIX_OIDC_JWKS_URL }}"
+PRETIX_OIDC_CLIENT_ID="{{ PRETIX_OIDC_CLIENT_ID }}"
+PRETIX_OIDC_CLIENT_SECRET="{{ PRETIX_OIDC_CLIENT_SECRET }}"
+PRETIX_OIDC_SCOPES="{{ PRETIX_OIDC_SCOPES }}"
+PRETIX_OIDC_UNIQUE_ATTRIBUTE="{{ PRETIX_OIDC_UNIQUE_ATTRIBUTE }}"
+{% endif %}