Optimized Peertube OIDC draft

roles/docker-peertube/tasks/disable-oidc.yml

@@ -0,0 +1,5 @@
+- name: "Uninstall auth-openid-connect plugin for Peertube"
+  command: >
+    docker exec {{ container_name }} \
+    npm run plugin:uninstall -- --npm-name {{oidc_plugin}}
+  ignore_errors: true

roles/docker-peertube/tasks/enable-oidc.yml

@@ -0,0 +1,16 @@
+- name: "Install auth-openid-connect plugin for Peertube"
+  command: >
+    docker exec {{ container_name }} \
+    npm run plugin:install -- --npm-name {{oidc_plugin}}
+
+- name: Update Peertube config for OpenID Connect
+  ansible.builtin.lineinfile:
+    path: /opt/peertube/config/production.yaml
+    regexp: '^{{ item.key }}:'
+    line: "{{ item.key }}: {{ item.value }}"
+  loop:
+    - { key: "oidc.client_id", value: "{{ oidc_client_id }}" }
+    - { key: "oidc.client_secret", value: "{{ oidc_client_secret }}" }
+    - { key: "oidc.discover_url", value: "{{ oidc_discover_url }}" }
+    - { key: "oidc.scope", value: "openid email profile" }
+  become: yes

roles/docker-peertube/tasks/main.yml

@@ -13,3 +13,11 @@
 
 - name: "copy docker-compose.yml and env file"
   include_tasks: copy-docker-compose-and-env.yml
+
+- name: "Install and activate auth-openid-connect plugin if OIDC is enabled"
+  include_tasks: enable-oidc.yml
+  when: applications | is_feature_enabled('oidc',application_id)
+
+- name: "Deinstall and disable auth-openid-connect plugin if OIDC is enabled"
+  include_tasks: disable-oidc.yml
+  when: applications | is_feature_enabled('oidc',application_id)

roles/docker-peertube/vars/configuration.yml

@@ -4,6 +4,7 @@ features:
   css:                false
   portfolio_iframe:   false
   central_database:   true
+  oidc:               false
 csp:
   flags:
     script-src:

roles/docker-peertube/vars/main.yml

@@ -1,2 +1,4 @@
-application_id:      "peertube"
-database_type:      "postgres"
+application_id: "peertube"
+database_type:  "postgres"
+container_name: "{{ application_id }}"
+oidc_plugin:    "peertube-plugin-auth-openid-connect"