From bc8ffb70e5662ad3ed741495d784db6424cf381b Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 22 Jul 2026 11:17:22 -0700
Subject: [PATCH] feat(homarr): add Authentik SSO configuration

Configure Homarr to use Authentik for OIDC authentication:
- AUTH_PROVIDERS: oidc,credentials (both SSO and local auth)
- AUTH_OIDC_ISSUER: Authentik endpoint
- CLIENT_ID/SECRET: from homarr-oidc secret
- Groups attribute for authorization

Allows users to sign in via Authentik SSO.
---
 k8s/applications/homarr/homarr-values.yaml | 28 +++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/k8s/applications/homarr/homarr-values.yaml b/k8s/applications/homarr/homarr-values.yaml
index 18fb44a..4535cc2 100644
--- a/k8s/applications/homarr/homarr-values.yaml
+++ b/k8s/applications/homarr/homarr-values.yaml
@@ -1,4 +1,4 @@
-# Homarr landing page - minimal config
+# Homarr landing page with Authentik SSO
 # Probes patched via PostSync hook (chart doesn't support customization)
 
 image:
@@ -8,6 +8,32 @@ image:
 
 replicaCount: 1
 
+# Configure SSO via environment variables
+# Chart supports these via top-level env dict (not array)
+env:
+  AUTH_PROVIDERS: "oidc,credentials"
+  AUTH_OIDC_ISSUER: "https://authentik.riotpiao.com/application/o/homarr/"
+  AUTH_OIDC_CLIENT_NAME: "Authentik"
+  AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
+  AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
+  AUTH_OIDC_AUTO_LOGIN: "false"
+  BASE_URL: "https://homarr.riotpiao.com"
+  NEXTAUTH_URL: "https://homarr.riotpiao.com"
+
+# Client credentials from homarr-oidc secret
+# Chart doesn't support envFrom, so we add via extraEnv
+extraEnv:
+  - name: AUTH_OIDC_CLIENT_ID
+    valueFrom:
+      secretKeyRef:
+        name: homarr-oidc
+        key: client-id
+  - name: AUTH_OIDC_CLIENT_SECRET
+    valueFrom:
+      secretKeyRef:
+        name: homarr-oidc
+        key: client-secret
+
 tolerations:
   - key: node-role.kubernetes.io/control-plane
     operator: Exists