feat(iam): wire all 9 consumer manifests to Zitadel OIDC

k8s/apps/homarr/homarr-values.yaml

@@ -1,78 +0,0 @@
-# Homarr landing page with Authentik SSO
-
-# Probe tuning (chart DOES expose these — the old PostSync patch-job was
-# unnecessary and fragile: it only patched one Deployment revision, so any later
-# rollout reverted to the chart's aggressive defaults). Homarr's first-boot icon
-# updater blocks the event loop for ~50s ("icons updater took 49553ms"), during
-# which /api/health/live can't answer within the default 10s×3 window → kubelet
-# SIGTERMs the pod → CrashLoopBackOff (247 restarts, 503 at the ingress). Give
-# liveness a wide window so the icon import can finish without a kill.
-livenessProbe:
-  initialDelaySeconds: 60
-  periodSeconds: 30
-  timeoutSeconds: 5
-  failureThreshold: 10
-readinessProbe:
-  initialDelaySeconds: 30
-  periodSeconds: 15
-  timeoutSeconds: 5
-  failureThreshold: 6
-
-image:
-  repository: ghcr.io/homarr-labs/homarr
-  tag: "latest"
-  pullPolicy: Always
-
-replicaCount: 1
-
-# Configure SSO via environment variables
-# Chart supports these via top-level env dict (not array)
-env:
-  AUTH_PROVIDERS: "oidc,credentials"
-  AUTH_OIDC_ISSUER: "https://zitadel.riotpiao.com"
-  # AUTH_OIDC_URI (authorize endpoint) is REQUIRED in addition to ISSUER — homarr
-  # hides the "Sign in with Authentik" button entirely when it's absent (per the
-  # authentik Homarr integration + homarr SSO docs). This was the missing var.
-  AUTH_OIDC_URI: "https://zitadel.riotpiao.com/oauth/v2/authorize"
-  AUTH_OIDC_CLIENT_NAME: "Zitadel"
-  AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
-  AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
-  AUTH_OIDC_AUTO_LOGIN: "false"
-  # Link the OIDC identity to an existing homarr account with the same email.
-  OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING: "true"
-  # The analytics cron blocked the (single-threaded) Next.js event loop for ~16s
-  # per run ("callback took longer than expected"), compounding CPU pressure.
-  DISABLE_ANALYTICS: "true"
-  BASE_URL: "https://homarr.riotpiao.com"
-  NEXTAUTH_URL: "https://homarr.riotpiao.com"
-
-# Client credentials from homarr-oidc secret
-# Chart doesn't support envFrom, so we add via extraEnv
-extraEnv:
-  - name: AUTH_OIDC_CLIENT_ID
-    valueFrom:
-      secretKeyRef:
-        name: homarr-oidc
-        key: client-id
-  - name: AUTH_OIDC_CLIENT_SECRET
-    valueFrom:
-      secretKeyRef:
-        name: homarr-oidc
-        key: client-secret
-
-tolerations:
-  - key: node-role.kubernetes.io/control-plane
-    operator: Exists
-    effect: NoSchedule
-
-resources:
-  requests:
-    cpu: 250m
-    memory: 384Mi
-  limits:
-    # Next.js 16 + bundled redis + the icon-updater (28k icons) saturated the old
-    # 500m limit; CPU throttling made Next.js abort with exit 134 (SIGABRT) and
-    # self-restart in a loop, so nginx saw no upstream and returned 502. Give it
-    # real CPU headroom.
-    cpu: "2"
-    memory: 1Gi

k8s/apps/homarr/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: dashboard
-# Probes are now tuned via homarr-values.yaml (chart-native); the old
-# fix-probes-job PostSync hook is removed. homarr-secrets/auth-oidc/db-encryption
-# Secrets are delivered by the sops-secrets (ksops) Application.
-resources: []