rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
128 Commits 3 Branches 0 Tags
ae8d86242deca9535cfba11eabeb141d6002b322
Commit Graph
6 Commits
Author SHA1 Message Date
Story Crater Bot bc8ffb70e5 feat(homarr): add Authentik SSO configuration 
Configure Homarr to use Authentik for OIDC authentication:
- AUTH_PROVIDERS: oidc,credentials (both SSO and local auth)
- AUTH_OIDC_ISSUER: Authentik endpoint
- CLIENT_ID/SECRET: from homarr-oidc secret
- Groups attribute for authorization

Allows users to sign in via Authentik SSO.
 2026-08-18 15:08:03 -07:00
Story Crater Bot b0b6ac3bb3 fix(homarr): use python:3.12-alpine + wget kubectl in probe patch Job 
bitnami/kubectl:1.31 doesn't exist (Bitnami retired versioned tags in 2025).
Standard pattern: python:3.12-alpine + wget kubectl binary.
 2026-08-18 15:08:03 -07:00
Story Crater Bot 2f564f02f8 fix(homarr): remove encrypted secret from kustomization 
homarr-patches Application doesn't have SOPS support.
Secret is managed by sops-secrets Application instead.

Kustomization now only contains:
- fix-probes-job.yaml (PostSync hook)
 2026-08-18 15:08:03 -07:00
Story Crater Bot d394efc78a fix(homarr): probe tuning via dedicated PostSync patch-job Application (chart-values/Kustomize-patch/controller.probes attempts superseded) 2026-08-18 15:08:03 -07:00
Story Crater Bot ab2f1eeeb3 feat(homarr): bring up chart (repo/sourceRepos, image tag, minimal values schema) 2026-08-18 15:08:03 -07:00
Story Crater Bot ff8bc74f63 feat(sso): complete MinIO OIDC env + add Homarr landing page base config 
MinIO (Part B):
- k8s/infrastructure/minio/minio-tenant.yaml: added full OIDC env block
  (CONFIG_URL, CLIENT_ID, CLIENT_SECRET from minio-oidc secret, CLAIM_NAME,
  REDIRECT_URI, DISPLAY_NAME, SCOPES) — MinIO console SSO login will now work

Homarr (Part C1 - base):
- k8s/applications/homarr/homarr-values.yaml: official chart config with
  Authentik SSO (AUTH_PROVIDERS=oidc, all OIDC env vars, client creds from
  homarr-oidc secret, SECRET_ENCRYPTION_KEY from SOPS secret)
- k8s/applications/homarr/homarr-secrets.enc.yaml: age-encrypted
  SECRET_ENCRYPTION_KEY (stable key — rotating it breaks saved integrations)
- k8s/applications/homarr/kustomization.yaml: namespace dashboard

Still TODO for Homarr:
- Add 'homarr' to authentik-provision.py SERVICES dict
- Add Application to 60-applications.yaml (multi-source: chart + values)
- Add ingress rule (k8s/bootstrap/ingress/ingress.yaml)
- Add CoreDNS rewrite (k8s/bootstrap/coredns/coredns-configmap.yaml)
- Add dashboard RoleBinding for authentik-provisioner SA
 2026-08-18 15:08:03 -07:00