# Homarr landing page with Authentik SSO

# Probe tuning (chart DOES expose these — the old PostSync patch-job was
# unnecessary and fragile: it only patched one Deployment revision, so any later
# rollout reverted to the chart's aggressive defaults). Homarr's first-boot icon
# updater blocks the event loop for ~50s ("icons updater took 49553ms"), during
# which /api/health/live can't answer within the default 10s×3 window → kubelet
# SIGTERMs the pod → CrashLoopBackOff (247 restarts, 503 at the ingress). Give
# liveness a wide window so the icon import can finish without a kill.
livenessProbe:
  initialDelaySeconds: 60
  periodSeconds: 30
  timeoutSeconds: 5
  failureThreshold: 10
readinessProbe:
  initialDelaySeconds: 30
  periodSeconds: 15
  timeoutSeconds: 5
  failureThreshold: 6

image:
  repository: ghcr.io/homarr-labs/homarr
  tag: "latest"
  pullPolicy: Always

replicaCount: 1

# Configure SSO via environment variables
# Chart supports these via top-level env dict (not array)
env:
  AUTH_PROVIDERS: "oidc,credentials"
  AUTH_OIDC_ISSUER: "https://authentik.riotpiao.com/application/o/homarr/"
  AUTH_OIDC_CLIENT_NAME: "Authentik"
  AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
  AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
  AUTH_OIDC_AUTO_LOGIN: "false"
  BASE_URL: "https://homarr.riotpiao.com"
  NEXTAUTH_URL: "https://homarr.riotpiao.com"

# Client credentials from homarr-oidc secret
# Chart doesn't support envFrom, so we add via extraEnv
extraEnv:
  - name: AUTH_OIDC_CLIENT_ID
    valueFrom:
      secretKeyRef:
        name: homarr-oidc
        key: client-id
  - name: AUTH_OIDC_CLIENT_SECRET
    valueFrom:
      secretKeyRef:
        name: homarr-oidc
        key: client-secret

tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule

resources:
  requests:
    cpu: 100m
    memory: 256Mi
  limits:
    cpu: 500m
    memory: 512Mi