fix(homarr): add AUTH_OIDC_URI + email account linking — homarr hides the Authentik sign-in button unless AUTH_OIDC_URI (authorize endpoint) is set alongside AUTH_OIDC_ISSUER (per authentik/homarr SSO docs); was the missing var

2026-08-18 15:08:04 -07:00
parent fc10a9871a
commit c3ffc611f4
7 changed files with 224 additions and 0 deletions
@@ -0,0 +1,58 @@
+# Wave 7 — Kong, the cluster's internal API gateway (namespace `api`).
+#
+# Sits between nginx and the backend services: nginx owns the edge and TLS,
+# Kong owns routing policy, auth and rate limiting. Wave 7 puts it after the
+# data/messaging tiers it fronts and before the wave-8 applications that
+# publish routes into it.
+#
+# DB-less: routing config comes from Kubernetes objects (Ingress with
+# `ingressClassName: kong`, plus KongPlugin/KongConsumer CRDs), so git remains
+# the source of truth and there are no migration Jobs on upgrade.
+#
+# CRDs ship in the chart's crds/ directory; ArgoCD applies those by default
+# (helm.skipCrds is left false).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kong
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "7"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  sources:
+    - repoURL: https://charts.konghq.com
+      chart: kong
+      targetRevision: "3.4.1"
+      helm:
+        valueFiles:
+          - $values/k8s/apps/api/kong-values.yaml
+    - repoURL: [email protected]:Riotpiaole/riotpiao.homelab.com.git
+      targetRevision: main
+      ref: values
+    # The nginx Ingress for api.riotpiao.com. Kept in this Application rather
+    # than the central k8s/bootstrap/ingress/ingress.yaml because that one syncs
+    # in wave 1, before namespace `api` exists.
+    - repoURL: [email protected]:Riotpiaole/riotpiao.homelab.com.git
+      targetRevision: main
+      path: k8s/apps/api
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: api
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      # The chart's CRDs exceed the annotation size limit that client-side
+      # apply relies on; server-side apply avoids the
+      # "metadata.annotations: Too long" failure CRDs commonly hit.
+      - ServerSideApply=true
+    retry:
+      limit: 3
+      backoff:
+        duration: 10s
+        factor: 2
+        maxDuration: 3m