feat(homarr): complete wiring for landing page deployment

Adds Homarr landing page with Authentik SSO:
- k8s/argocd/apps/60-applications.yaml: multi-source Application (homarr
  chart from homarr-labs + in-repo values), ns dashboard, wave 8
- k8s/bootstrap/ingress/ingress.yaml: homarr.riotpiao.com → dashboard/homarr:3000
- k8s/bootstrap/coredns/coredns-configmap.yaml: rewrite homarr.riotpiao.com
  to ingress controller
- k8s/security/iam/scripts/authentik-provision.py: added 'homarr' to SERVICES
  (generates OAuth provider/app + homarr-oidc secret with client-id/secret)
- k8s/security/iam/rbac-dashboard-rolebinding.yaml: grants authentik-provisioner
  SA access to dashboard ns for secret management
- k8s/security/iam/kustomization.yaml: includes new RoleBinding

Homarr now fully wired:
- Ingress: https://homarr.riotpiao.com
- SSO: redirects to Authentik, login as rock
- Persistence: 5Gi RWO on longhorn-wffc (3-replica HA)
- Tile config: UI-managed (saved to PVC)

k8s/argocd/apps/60-applications.yaml

@@ -132,3 +132,32 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: homarr
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "8"
+spec:
+  project: homelab
+  sources:
+    - repoURL: https://homarr-labs.github.io/charts
+      chart: homarr
+      targetRevision: "*"
+      helm:
+        valueFiles:
+          - $values/k8s/applications/homarr/homarr-values.yaml
+    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: dashboard
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

k8s/bootstrap/coredns/coredns-configmap.yaml

@@ -55,6 +55,7 @@ data:
         rewrite name vault.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
         rewrite name loki.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
         rewrite name prometheus.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+        rewrite name homarr.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
         rewrite name portainer.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
         rewrite name longhorn.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
 

k8s/bootstrap/ingress/ingress.yaml

@@ -295,3 +295,22 @@ spec:
                 name: temporal-web
                 port:
                   number: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: homarr
+  namespace: dashboard
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: homarr.riotpiao.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: homarr
+                port:
+                  number: 3000

k8s/security/iam/kustomization.yaml

@@ -14,6 +14,7 @@ kind: Kustomization
 resources:
   - key-rotation-cronjob.yaml
   - authentik-provision-job.yaml
+  - rbac-dashboard-rolebinding.yaml
 
 # Provisioning/verification python lives in scripts/*.py (real files, linted +
 # diff-friendly) and is generated into ConfigMaps here rather than embedded in

k8s/security/iam/rbac-dashboard-rolebinding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: authentik-provisioner
+  namespace: dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: authentik-provisioner
+subjects:
+- kind: ServiceAccount
+  name: authentik-provisioner
+  namespace: iam

k8s/security/iam/scripts/authentik-provision.py

@@ -245,6 +245,14 @@ SERVICES = {
         "launch_url": "https://argocd.riotpiao.com",
         "display_name": "Argo CD",
     },
+    "homarr": {
+        "client_secret_source": ("dashboard", "homarr-oidc", "client-secret"),
+        "generate_if_missing": True,
+        "extra_secret_literals": {"client-id": "homarr"},
+        "redirect_uris": ["https://homarr.riotpiao.com/api/auth/callback/oidc"],
+        "launch_url": "https://homarr.riotpiao.com",
+        "display_name": "Homarr",
+    },
 }
 
 app_pks_for_binding = []