From 86f94f96fd6aa170947a6194e1b172a1117031d3 Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Wed, 22 Jul 2026 09:04:27 -0700 Subject: [PATCH] feat(homarr): complete wiring for landing page deployment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds Homarr landing page with Authentik SSO: - k8s/argocd/apps/60-applications.yaml: multi-source Application (homarr chart from homarr-labs + in-repo values), ns dashboard, wave 8 - k8s/bootstrap/ingress/ingress.yaml: homarr.riotpiao.com → dashboard/homarr:3000 - k8s/bootstrap/coredns/coredns-configmap.yaml: rewrite homarr.riotpiao.com to ingress controller - k8s/security/iam/scripts/authentik-provision.py: added 'homarr' to SERVICES (generates OAuth provider/app + homarr-oidc secret with client-id/secret) - k8s/security/iam/rbac-dashboard-rolebinding.yaml: grants authentik-provisioner SA access to dashboard ns for secret management - k8s/security/iam/kustomization.yaml: includes new RoleBinding Homarr now fully wired: - Ingress: https://homarr.riotpiao.com - SSO: redirects to Authentik, login as rock - Persistence: 5Gi RWO on longhorn-wffc (3-replica HA) - Tile config: UI-managed (saved to PVC) --- k8s/argocd/apps/60-applications.yaml | 29 +++++++++++++++++++ k8s/bootstrap/coredns/coredns-configmap.yaml | 1 + k8s/bootstrap/ingress/ingress.yaml | 19 ++++++++++++ k8s/security/iam/kustomization.yaml | 1 + .../iam/rbac-dashboard-rolebinding.yaml | 13 +++++++++ .../iam/scripts/authentik-provision.py | 8 +++++ 6 files changed, 71 insertions(+) create mode 100644 k8s/security/iam/rbac-dashboard-rolebinding.yaml diff --git a/k8s/argocd/apps/60-applications.yaml b/k8s/argocd/apps/60-applications.yaml index eb98c0a..11f84f4 100644 --- a/k8s/argocd/apps/60-applications.yaml +++ b/k8s/argocd/apps/60-applications.yaml @@ -132,3 +132,32 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: homarr + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "8" +spec: + project: homelab + sources: + - repoURL: https://homarr-labs.github.io/charts + chart: homarr + targetRevision: "*" + helm: + valueFiles: + - $values/k8s/applications/homarr/homarr-values.yaml + - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git + targetRevision: main + ref: values + destination: + server: https://kubernetes.default.svc + namespace: dashboard + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/k8s/bootstrap/coredns/coredns-configmap.yaml b/k8s/bootstrap/coredns/coredns-configmap.yaml index abeb08c..612ea7c 100644 --- a/k8s/bootstrap/coredns/coredns-configmap.yaml +++ b/k8s/bootstrap/coredns/coredns-configmap.yaml @@ -55,6 +55,7 @@ data: rewrite name vault.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local rewrite name loki.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local rewrite name prometheus.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local + rewrite name homarr.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local rewrite name portainer.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local rewrite name longhorn.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local diff --git a/k8s/bootstrap/ingress/ingress.yaml b/k8s/bootstrap/ingress/ingress.yaml index d6b5af3..f722f13 100644 --- a/k8s/bootstrap/ingress/ingress.yaml +++ b/k8s/bootstrap/ingress/ingress.yaml @@ -295,3 +295,22 @@ spec: name: temporal-web port: number: 8080 +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: homarr + namespace: dashboard +spec: + ingressClassName: nginx + rules: + - host: homarr.riotpiao.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: homarr + port: + number: 3000 diff --git a/k8s/security/iam/kustomization.yaml b/k8s/security/iam/kustomization.yaml index 0d760b5..57f060c 100644 --- a/k8s/security/iam/kustomization.yaml +++ b/k8s/security/iam/kustomization.yaml @@ -14,6 +14,7 @@ kind: Kustomization resources: - key-rotation-cronjob.yaml - authentik-provision-job.yaml + - rbac-dashboard-rolebinding.yaml # Provisioning/verification python lives in scripts/*.py (real files, linted + # diff-friendly) and is generated into ConfigMaps here rather than embedded in diff --git a/k8s/security/iam/rbac-dashboard-rolebinding.yaml b/k8s/security/iam/rbac-dashboard-rolebinding.yaml new file mode 100644 index 0000000..cd1d211 --- /dev/null +++ b/k8s/security/iam/rbac-dashboard-rolebinding.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: authentik-provisioner + namespace: dashboard +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: authentik-provisioner +subjects: +- kind: ServiceAccount + name: authentik-provisioner + namespace: iam diff --git a/k8s/security/iam/scripts/authentik-provision.py b/k8s/security/iam/scripts/authentik-provision.py index 7373dcc..82cbf83 100644 --- a/k8s/security/iam/scripts/authentik-provision.py +++ b/k8s/security/iam/scripts/authentik-provision.py @@ -245,6 +245,14 @@ SERVICES = { "launch_url": "https://argocd.riotpiao.com", "display_name": "Argo CD", }, + "homarr": { + "client_secret_source": ("dashboard", "homarr-oidc", "client-secret"), + "generate_if_missing": True, + "extra_secret_literals": {"client-id": "homarr"}, + "redirect_uris": ["https://homarr.riotpiao.com/api/auth/callback/oidc"], + "launch_url": "https://homarr.riotpiao.com", + "display_name": "Homarr", + }, } app_pks_for_binding = []