2026-07-22 11:17:22 -07:00
|
|
|
|
# Homarr landing page with Authentik SSO
|
2026-08-13 06:33:34 -07:00
|
|
|
|
|
|
|
|
|
|
# Probe tuning (chart DOES expose these — the old PostSync patch-job was
|
|
|
|
|
|
# unnecessary and fragile: it only patched one Deployment revision, so any later
|
|
|
|
|
|
# rollout reverted to the chart's aggressive defaults). Homarr's first-boot icon
|
|
|
|
|
|
# updater blocks the event loop for ~50s ("icons updater took 49553ms"), during
|
|
|
|
|
|
# which /api/health/live can't answer within the default 10s×3 window → kubelet
|
|
|
|
|
|
# SIGTERMs the pod → CrashLoopBackOff (247 restarts, 503 at the ingress). Give
|
|
|
|
|
|
# liveness a wide window so the icon import can finish without a kill.
|
|
|
|
|
|
livenessProbe:
|
|
|
|
|
|
initialDelaySeconds: 60
|
|
|
|
|
|
periodSeconds: 30
|
|
|
|
|
|
timeoutSeconds: 5
|
|
|
|
|
|
failureThreshold: 10
|
|
|
|
|
|
readinessProbe:
|
|
|
|
|
|
initialDelaySeconds: 30
|
|
|
|
|
|
periodSeconds: 15
|
|
|
|
|
|
timeoutSeconds: 5
|
|
|
|
|
|
failureThreshold: 6
|
2026-08-18 15:08:03 -07:00
|
|
|
|
|
2026-07-22 08:59:51 -07:00
|
|
|
|
image:
|
|
|
|
|
|
repository: ghcr.io/homarr-labs/homarr
|
2026-08-18 15:08:03 -07:00
|
|
|
|
tag: "latest"
|
|
|
|
|
|
pullPolicy: Always
|
2026-07-22 08:59:51 -07:00
|
|
|
|
|
|
|
|
|
|
replicaCount: 1
|
|
|
|
|
|
|
2026-07-22 11:17:22 -07:00
|
|
|
|
# Configure SSO via environment variables
|
|
|
|
|
|
# Chart supports these via top-level env dict (not array)
|
|
|
|
|
|
env:
|
|
|
|
|
|
AUTH_PROVIDERS: "oidc,credentials"
|
|
|
|
|
|
AUTH_OIDC_ISSUER: "https://authentik.riotpiao.com/application/o/homarr/"
|
2026-08-13 07:26:59 -07:00
|
|
|
|
# AUTH_OIDC_URI (authorize endpoint) is REQUIRED in addition to ISSUER — homarr
|
|
|
|
|
|
# hides the "Sign in with Authentik" button entirely when it's absent (per the
|
|
|
|
|
|
# authentik Homarr integration + homarr SSO docs). This was the missing var.
|
|
|
|
|
|
AUTH_OIDC_URI: "https://authentik.riotpiao.com/application/o/authorize/"
|
2026-07-22 11:17:22 -07:00
|
|
|
|
AUTH_OIDC_CLIENT_NAME: "Authentik"
|
|
|
|
|
|
AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
|
|
|
|
|
|
AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
|
|
|
|
|
|
AUTH_OIDC_AUTO_LOGIN: "false"
|
2026-08-13 07:26:59 -07:00
|
|
|
|
# Link the OIDC identity to an existing homarr account with the same email.
|
|
|
|
|
|
OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING: "true"
|
2026-08-13 08:03:22 -07:00
|
|
|
|
# The analytics cron blocked the (single-threaded) Next.js event loop for ~16s
|
|
|
|
|
|
# per run ("callback took longer than expected"), compounding CPU pressure.
|
|
|
|
|
|
DISABLE_ANALYTICS: "true"
|
2026-07-22 11:17:22 -07:00
|
|
|
|
BASE_URL: "https://homarr.riotpiao.com"
|
|
|
|
|
|
NEXTAUTH_URL: "https://homarr.riotpiao.com"
|
|
|
|
|
|
|
|
|
|
|
|
# Client credentials from homarr-oidc secret
|
|
|
|
|
|
# Chart doesn't support envFrom, so we add via extraEnv
|
|
|
|
|
|
extraEnv:
|
|
|
|
|
|
- name: AUTH_OIDC_CLIENT_ID
|
|
|
|
|
|
valueFrom:
|
|
|
|
|
|
secretKeyRef:
|
|
|
|
|
|
name: homarr-oidc
|
|
|
|
|
|
key: client-id
|
|
|
|
|
|
- name: AUTH_OIDC_CLIENT_SECRET
|
|
|
|
|
|
valueFrom:
|
|
|
|
|
|
secretKeyRef:
|
|
|
|
|
|
name: homarr-oidc
|
|
|
|
|
|
key: client-secret
|
|
|
|
|
|
|
2026-07-22 08:59:51 -07:00
|
|
|
|
tolerations:
|
|
|
|
|
|
- key: node-role.kubernetes.io/control-plane
|
|
|
|
|
|
operator: Exists
|
|
|
|
|
|
effect: NoSchedule
|
|
|
|
|
|
|
|
|
|
|
|
resources:
|
|
|
|
|
|
requests:
|
2026-08-13 08:03:22 -07:00
|
|
|
|
cpu: 250m
|
|
|
|
|
|
memory: 384Mi
|
2026-07-22 08:59:51 -07:00
|
|
|
|
limits:
|
2026-08-13 08:03:22 -07:00
|
|
|
|
# Next.js 16 + bundled redis + the icon-updater (28k icons) saturated the old
|
|
|
|
|
|
# 500m limit; CPU throttling made Next.js abort with exit 134 (SIGABRT) and
|
|
|
|
|
|
# self-restart in a loop, so nginx saw no upstream and returned 502. Give it
|
|
|
|
|
|
# real CPU headroom.
|
|
|
|
|
|
cpu: "2"
|
|
|
|
|
|
memory: 1Gi
|
