refactor(peertube): make the role clearnet-only

PeerTube distributes video over WebRTC and the role proxies its tracker socket on purpose (templates/proxy.conf.j2:48, with a raised read timeout because peers ping every fifteen minutes). Tor carries no UDP and an onion client cannot hold peer connections, so an onion PeerTube is the app without the feature it exists for. What remained was plain HTTP video at Tor throughput, and a login path that only worked through a sed over the vendored dist of a third-party plugin.

That patch is gone with this change, along with PEERTUBE_OIDC_ALLOW_INSECURE_ISSUER, the variable that gated it, and both tor pins in meta/variants.yml. The root TODO entry describing it is removed too - it carried a three-step exit path (upstream MR, fork, delete) that no longer needs walking. The https-on-onion entry keeps its analysis and loses only the sentence that named peertube among the per-consumer workarounds.

The discovery gate stays. Failing the deploy when the plugin registered without building a client is not tor-specific and was the honest half of e64ed1cd9.

tor.enabled becomes a literal false rather than the block being deleted. Two lints define the contract: test_tor_contract requires every domain-serving role to declare the block, and test_sso_variant_requires_tor names a literal false as the first of three cases that may opt out of pinning the onion on with a reason. Deleting the block failed both; this is the language they specify.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

TODO.md

@@ -38,34 +38,7 @@ reachability). The items below are the ones that are NOT fixed yet.
   refusal happens at name resolution and is scheme-independent. Unblocking needs a
   CA that issues for v3 `.onion` (HARICA, CA/B Forum ballot 144) — procurement,
   not code. Until then the per-consumer fixes stand: SOCKS proxy for libcurl
-  clients, and the `PEERTUBE_OIDC_ALLOW_INSECURE_ISSUER` dist patch for
-  openid-client v6.
-
-- **peertube OIDC dist patch — a hack, kept deliberately, remove when upstream
-  lands.** `roles/web-app-peertube/tasks/oidc/enable.yml` runs a `sed` over the
-  npm-installed `dist/main.js` of `peertube-plugin-auth-openid-connect` so the
-  plugin honours `PEERTUBE_OIDC_ALLOW_INSECURE_ISSUER` (set in `templates/env.j2`
-  only when the issuer is an onion). It exists because openid-client v6 refuses a
-  non-HTTPS issuer and the plugin gates its own escape hatch on `NODE_ENV` alone,
-  which would swap PeerTube's whole runtime profile. Patching a third party's
-  compiled output is fragile by construction; the `grep -q` after the `sed` is
-  what keeps it honest — an upstream release that moves the line fails the deploy
-  loudly instead of silently doing nothing.
-  Exit path, in order: (1) file the issue and MR upstream — the plugin is an
-  official Framasoft one by Chocobozzz, AGPL-3.0 per the repo root `LICENSE`
-  (the npm package just ships no license field), and the fix is a
-  `registerSetting({ name: 'allow-insecure-issuer', type: 'input-checkbox',
-  default: false })` OR-ed into the existing condition; issue text and patch are
-  written and waiting. Currently blocked: the framagit account is not approved
-  yet. (2) Until it merges, run a fork — `git subtree split --prefix=
-  peertube-plugin-auth-openid-connect` gives a standalone repo (the 16 official
-  plugins sit flat in the root with no shared build, so nothing is missing except
-  the root `LICENSE`, which must be copied), built with `npm ci && npm run build`
-  because `library: ./dist/main.js` and `.npmignore` excludes `src`, and installed
-  with `--plugin-path`: `--npm-name` cannot take a git URL because
-  `getTypeFromNpmName` requires a `peertube-plugin-*` name, while `--plugin-path`
-  only needs the *directory* to carry that name. (3) Delete the sed task, the env
-  var and this entry once the setting is released.
+  clients. peertube is no longer among them - it is a clearnet-only role.
 
 - **dual-family providers** — the one real remaining design gap. On a CI onion
   node, tor-enabled providers (e.g. mastodon) are onion-exclusive: their domain

roles/web-app-peertube/meta/services.yml

@@ -95,12 +95,11 @@ prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"
 
-# nocheck: playwright-service-flag
+# nocheck: sso-variant-tor — PeerTube distributes over WebRTC, which Tor does not carry, so an onion instance loses the feature the app exists for; and its OIDC plugin accepts a plaintext issuer only through a sed over vendored dist code
 tor:
   bond: 1
-  enabled: "{{ 'svc-net-tor' in group_names }}"
-  shared: true # nocheck: dynamic-flag
-# nocheck: dynamic-flag
+  enabled: false
+  shared: false # nocheck: dynamic-flag
 # nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer
 container_backup: # nocheck: bond-baseline backup host joins outside the variant topology
   bond: 1

roles/web-app-peertube/meta/variants.yml

@@ -35,8 +35,6 @@
     seaweedfs:
       enabled: true
       shared: true
-    tor:
-      enabled: true
 - services:
     container_backup:
       enabled: false
@@ -69,6 +67,3 @@
     seaweedfs:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
-    tor:
-      enabled: false
-      shared: false # nocheck: variants-static-override

roles/web-app-peertube/tasks/oidc/enable.yml

@@ -56,15 +56,6 @@
       changed_when: true
       delegate_to: "{{ PEERTUBE_HOST_NODE }}"
 
-- name: "🩹 Let the OIDC plugin accept the plaintext onion issuer"
-  ansible.builtin.shell: |
-    # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
-    container exec {{ PEERTUBE_LOCAL_CID | quote }} sh -c 'f=/data/plugins/node_modules/{{ PEERTUBE_OIDC_PLUGIN }}/dist/main.js; sed -i "s#const discoverInsecureConfig = process.env.NODE_ENV#const discoverInsecureConfig = process.env.PEERTUBE_OIDC_ALLOW_INSECURE_ISSUER || process.env.NODE_ENV#" "$f"; grep -q PEERTUBE_OIDC_ALLOW_INSECURE_ISSUER "$f"'
-  when: PEERTUBE_OIDC_INSECURE_ISSUER | bool
-  changed_when: true
-  delegate_to: "{{ PEERTUBE_HOST_NODE }}"
-  notify: container recreate
-
 - name: "🔄 Update the settings column of the auth-openid-connect plugin"
   database_query:
     mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

roles/web-app-peertube/templates/env.j2

@@ -56,6 +56,3 @@ PEERTUBE_SMTP_DISABLE_STARTTLS={{ 'false' if email.start_tls else 'true' }}
 {% endif %}
 
 PEERTUBE_ADMIN_EMAIL={{ email['from'] }}
-{% if PEERTUBE_OIDC_INSECURE_ISSUER | bool %}
-PEERTUBE_OIDC_ALLOW_INSECURE_ISSUER=1
-{% endif %}

roles/web-app-peertube/vars/main.yml

@@ -7,8 +7,6 @@ PEERTUBE_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, enti
 
 PEERTUBE_OIDC_PLUGIN: "peertube-plugin-auth-openid-connect"
 PEERTUBE_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
-PEERTUBE_OIDC_INSECURE_ISSUER: "{{ PEERTUBE_OIDC_ENABLED | bool and (lookup('config', application_id, 'services.tor.enabled') | bool) and (OIDC.CLIENT.ISSUER_URL
-  is search('\\.onion(/|:|$)')) }}"
 
 PEERTUBE_LIVE_ENABLED: "{{ lookup('config', application_id, 'services.peertube.live.enabled') | bool }}"
 PEERTUBE_RTMP_PORT: "{{ lookup('config', application_id, 'services.peertube.ports.internal.rtmp') }}"