# Homarr landing page — official chart from homarr-labs/charts.
# SSO via Authentik, single-replica (UI state lives on PVC, not git).
image:
  repository: ghcr.io/homarr-labs/homarr
  tag: "1.0.0"  # Pin to stable
  pullPolicy: IfNotPresent

replicaCount: 1

service:
  type: ClusterIP
  port: 3000

persistence:
  enabled: true
  storageClass: longhorn-wffc
  accessMode: ReadWriteOnce
  size: 5Gi

env:
  - name: AUTH_PROVIDERS
    value: "oidc,credentials"
  - name: AUTH_OIDC_ISSUER
    value: "https://authentik.riotpiao.com/application/o/homarr/"
  - name: AUTH_OIDC_CALLBACK_URL
    value: "https://homarr.riotpiao.com/api/auth/callback/oidc"
  - name: AUTH_OIDC_CLIENT_NAME
    value: "Authentik"
  - name: AUTH_OIDC_GROUPS_ATTRIBUTE
    value: "groups"
  - name: AUTH_OIDC_CLIENT_ID
    valueFrom:
      secretKeyRef:
        name: homarr-oidc
        key: client-id
  - name: AUTH_OIDC_CLIENT_SECRET
    valueFrom:
      secretKeyRef:
        name: homarr-oidc
        key: client-secret
  - name: SECRET_ENCRYPTION_KEY
    valueFrom:
      secretKeyRef:
        name: homarr-secrets
        key: SECRET_ENCRYPTION_KEY
  - name: OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING
    value: "true"
  - name: BASE_URL
    value: "https://homarr.riotpiao.com"
  - name: NEXTAUTH_URL
    value: "https://homarr.riotpiao.com"

tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule

resources:
  requests:
    cpu: 100m
    memory: 256Mi
  limits:
    cpu: 500m
    memory: 512Mi

ingress:
  enabled: false  # Managed centrally in k8s/bootstrap/ingress/ingress.yaml