# Homarr Deployment - Next Steps

## Completed
✅ MinIO OIDC fully wired (k8s/infrastructure/minio/minio-tenant.yaml)
✅ Homarr base config created:
   - homarr-values.yaml (SSO env vars)
   - homarr-secrets.enc.yaml (SECRET_ENCRYPTION_KEY)
   - kustomization.yaml (namespace: dashboard)

## TODO to Complete Homarr Deployment

### 1. Add Homarr to Authentik Provision Script
**File:** `k8s/security/iam/scripts/authentik-provision.py`
**Location:** In the `SERVICES` dict (around line 205), add:

```python
"homarr": {
    "client_secret_source": ("dashboard", "homarr-oidc", "client-secret"),
    "generate_if_missing": True,
    "extra_secret_literals": {"client-id": "homarr"},
    "redirect_uris": [
        "https://homarr.riotpiao.com/api/auth/callback/oidc",
    ],
    "launch_url": "https://homarr.riotpiao.com",
    "display_name": "Homarr",
},
```

### 2. Add Dashboard RoleBinding for Authentik Provisioner
**File:** `k8s/security/iam/kustomization.yaml`
**Location:** In the `resources:` list, add:

```yaml
  - rbac-dashboard-rolebinding.yaml
```

**New file:** `k8s/security/iam/rbac-dashboard-rolebinding.yaml`:

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: authentik-provisioner
  namespace: dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: authentik-provisioner
subjects:
- kind: ServiceAccount
  name: authentik-provisioner
  namespace: iam
```

### 3. Add Homarr Application to ArgoCD
**File:** `k8s/argocd/apps/60-applications.yaml`
**Location:** Add at the end (before the final `---`):

```yaml
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: homarr
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "8"
spec:
  project: homelab
  sources:
    - repoURL: https://homarr-labs.github.io/charts
      chart: homarr
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/applications/homarr/homarr-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: dashboard
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
```

### 4. Add Ingress Rule
**File:** `k8s/bootstrap/ingress/ingress.yaml`
**Location:** In the `rules:` list, add:

```yaml
  - host: homarr.riotpiao.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: homarr
            port:
              number: 3000
```

### 5. Add CoreDNS Rewrite
**File:** `k8s/bootstrap/coredns/coredns-configmap.yaml`
**Location:** In the `rewrite name` section, add:

```
        rewrite name homarr.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
```

## Verification Steps

After committing and pushing all changes:

1. Wait for ArgoCD to sync iam-jobs (authentik-provision runs)
2. Check Authentik: `kubectl -n iam port-forward svc/authentik-server 9000:9000`
   - Visit http://localhost:9000, login as rock
   - Should see "Homarr" tile in application launcher
3. Wait for homarr Application to sync
4. Check pod: `kubectl -n dashboard get pods`
5. Test SSO: https://homarr.riotpiao.com
   - Should redirect to Authentik login
   - Login as rock → should land logged-in to Homarr dashboard

## Chart Info

Homarr uses the official chart from https://homarr-labs.github.io/charts
- Chart name: `homarr`
- Pinned image: `ghcr.io/homarr-labs/homarr:1.0.0`
- Persistence: 5Gi RWO on longhorn-wffc (3-replica HA)
- Tile content is UI-managed (saved to PVC, not git)