hta: Enable OIDC login

inventories/chaosknoten/host_vars/hta.sops.yaml

@@ -3,6 +3,7 @@ secret__hta_django_secret_key: ENC[AES256_GCM,data:RwTP5uPYISzGvH5VZnzb4vcB8roFI
 secret__hta_hugo_repo_ssh_key: ENC[AES256_GCM,data:B09k96c8MQtpFd6Lb1BAOErSYgqmVBPpUL1IdfbM9hcBDMyxzNOWi+PGyQ3E8cfEt0EHtUQpoVd9/2wJ1ckzit1NTfUjKjssAaWXE7XW4EpKBRtX3C2OQik9JkYLNsAJ8CRBft/nb6XUYpbL5Hz5iVFe643wS6w3r2QRLv8Tjh6WwcUxAA8RZYyOzCKGuCZiE7KZ0eQ+B5XttRisy13klDwclFy/y9+rgqA1xs0k6xfsNF13JwL/FX4Gtr2BcVPc/ROO9kIl+hLzV2FEaAqyc5abiIoqZsE83fPBusRUCQgGDe/BSPq67kGLdaCCbJtAk9EUpKjiZ0I3IO3K+fWHXmNfWWygA/BqDQzfUIUQ9nip+3W+MrJjk3ZzcJhTxwc1zak7U1ikzMxnbEAK8bbhEdLyK9NMCbwhn8TBgpBsMm6WLqU3p32Yo2FdIjy4BWNRi1KybSjcxvB6vtNn4DsMAtoxPY9fmonbpE9ajMJxTeFjUpixPwKMF9mb+jE32DmR6EPIBAyIhjvvXYs7awsfBrqm7ArxJBXNDhyw7p78fjxhjgO8NdEt7Q==,iv:L1/Hv3S6bieMjCizQ4FePOUD0awu93fO6wzm9F2rv88=,tag:1fxJf/QeJzBiRds5vgEoog==,type:str]
 secret__hta_pretix_token: ENC[AES256_GCM,data:PZ/uWhH4zOJgawM9FcQE/Vr5jeVJh45kc2iemJb3JjSdYv195aSdVAr5L5IxwTGleKmSn1WNSeEUb1p2Q9yIEw==,iv:sZKBPkcAiRaxQEYbkwFYZGXy7fOwz7qgmQ/h34sUamo=,tag:A9JJgmTf90DHjPYEafqhxQ==,type:str]
 secret__hta_db_fasta_api_key: ENC[AES256_GCM,data:4XFSEJgPu/VRFEgADReKxAtiIFoZTm/1DiyPhyQdb2g=,iv:NE1Pu06zvaFmpCReI6Euwl2rHPzk10WYznKFKrJ99bo=,tag:4BL3Fchew6V7W0mcR4s6+g==,type:str]
+secret__hta_oidc_client_secret: ENC[AES256_GCM,data:l4RkqAqgDJKyxJul+q56/xT5ZlRHyBMaVtVIaXC8n/F746VQhm/F6Ry6YSIsazknP4dQmCaeMekj9c0vEsgG3OAy98KxpkzH6cLoS64U7ocseCq8H7s=,iv:g1o6Ip4ui4Q736r1NR31JBaoHGwWo/kTSeRhUVoMjfI=,tag:yzfAEgZ3kWJcPbWD0RvJ8w==,type:str]
 ansible_pull__age_private_key: ENC[AES256_GCM,data:fmm0tr2E3MYznW9vXc4TTn9fJxpyA/84DVZ+Q2hcMa0qp31P6bdIUN4DxExxE8s4/MduSYZmyjRwIUQgpSW3WjNkjMkLeX5RvDI=,iv:jZyNAxeY3WmsVRA3dUM4zlFGbnyaSJq+b7V5eILIfJg=,tag:BEfi42kTqvE87P6EvU3Hlg==,type:str]
 sops:
   age:
@@ -35,8 +36,8 @@ sops:
         T3SKXvpquNxWimzZ43GnN77IlV+mw41ynHG/CQhRfvX84svuF++WYg==
         -----END AGE ENCRYPTED FILE-----
       recipient: age1n44q80zmsnq8dehnkm8g78u0ku48zafrq4vg5pzz8ft9jkqja5jsamwxhn
-  lastmodified: "2026-11-01T19:12:19Z"
-  mac: ENC[AES256_GCM,data:bCWQh6M06KBiqyG+HER6/VNSNQyCNQeIyZ8UZTbz3AWjJAVwxwPDj5cCJQcXXGoqxlot3SRwCQYo7UWUMNNdOHLjRtr/f6kaWovxhQPQtlU18HxJIGhZc6I8ACpgcRZH8GE6n7Gp0mv90YjfipU4jJct6BtaU3Azhi0M1EJpEnA=,iv:gr4Z9kq+ubNRPQyobKGL5swG0Z9bl1txTX5MxGsWvwk=,tag:EPk648CDxK04xJDOYM0lNg==,type:str]
+  lastmodified: "2026-11-02T23:13:54Z"
+  mac: ENC[AES256_GCM,data:aXBBTolvBc8xwTf2y2jXtv5+C8sj8DzDLOtNFDnMYQQVgg1kR/8ipbrViUKngC9KzbJV223An5+OJ1OzXx7sEw6UtSCbE5xrLl0J2XDC/kHbjjfRvyK6LtpDOuLQVg+DiRiARQAur+h+7yarAFbyvh0oz+Z5S7R2FFa0/4JCIHw=,iv:e9WRIwELli2BGvf/NAmNCIpb52MnBvJQ58ntjXc3vvs=,tag:sLwlxQfV0R0Zo/rRpeIfng==,type:str]
   pgp:
     - created_at: "2026-11-01T18:44:12Z"
       enc: |-

resources/chaosknoten/hta/docker_compose/compose.yaml.j2

@@ -35,6 +35,12 @@ services:
       HUGO_REPO_KNOWN_HOSTS: 'git.hamburg.ccc.de ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC91Cgx/Ow3oRm1GdB5mkGbUEIKsWfggsVrvHy2EwLfTKPeDdFDzEwQaN6gzUxiLHhk6zNK4ygCOhMjEQFPw2mRAgsSk0vRnGxnnd+AhPfCMK+nZ4mAJ2EIeGiOMpYoJ49XytL+H0hwJcFlawxzkuOMFve65mOmJnA5zhDX8EsBbi8ulnuOfiXV/iq8VSRWONNCX/rgUJDBcryGAii7LY4zfTg7taWFmBZpFq/qcMaqXLwp6L63c7POmjUsrN8WphRUTYNoeZh7gmUZNanqGpGotsKisU+sQThuMpMEm7imSAtqL1qYfjPTxjlcreL1asqfvjp5K1apt+NSQdEbeRbcAU1xLjKzW3pzYh1bWvC1FJfgFHptEfqgkK3ebCBoS9xVUXtnyvUbbi569QM1Qly+W5r6N8a4aZHnVD4RFAzHNNDFYaks1E6uKfdgLQcwzLhXcB+fRMy8+b4RLz46vS/dYcrxKVMLtBiVZis9pd4GZ4IVLUXu9Z3ixFPBdf/YtW/WrKJKyEydEh0nMP0o49sWTI25yhxKPL2JXLlaQozVD6sxUP1wDU2MW1OvNlf4JsomyYiQ9gjsacP63RL5G8193Hw4A+r77pILQbv3PzVze1wqU/fyOBt/IImxxQ6fOy1sjohRuaXAPn4NaFTbykecyvr4GUaFvK5evG8Ao5Ql3w==\ngit.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILrfbiDq3l25G7FUvbAGEdbBvIlbm+Od+P33OgIup2IR'
       PRETIX_URL: https://tickets.hamburg.ccc.de
       PRETIX_TOKEN: {{ secret__hta_pretix_token | to_json }}
+      OIDC_RP_CLIENT_ID: hta
+      OIDC_RP_CLIENT_SECRET: {{ secret__hta_oidc_client_secret | to_json }}
+      OIDC_OP_AUTHORIZATION_ENDPOINT: https://id.hamburg.ccc.de/realms/ccchh/protocol/openid-connect/auth
+      OIDC_OP_TOKEN_ENDPOINT: https://id.hamburg.ccc.de/realms/ccchh/protocol/openid-connect/token
+      OIDC_OP_USER_ENDPOINT: https://id.hamburg.ccc.de/realms/ccchh/protocol/openid-connect/userinfo
+      OIDC_OP_JWKS_ENDPOINT: https://id.hamburg.ccc.de/realms/ccchh/protocol/openid-connect/certs
     volumes:
       - data:/data
     ports: