79 lines
2.8 KiB
YAML
79 lines
2.8 KiB
YAML
# Homarr landing page with Authentik SSO
|
||
|
||
# Probe tuning (chart DOES expose these — the old PostSync patch-job was
|
||
# unnecessary and fragile: it only patched one Deployment revision, so any later
|
||
# rollout reverted to the chart's aggressive defaults). Homarr's first-boot icon
|
||
# updater blocks the event loop for ~50s ("icons updater took 49553ms"), during
|
||
# which /api/health/live can't answer within the default 10s×3 window → kubelet
|
||
# SIGTERMs the pod → CrashLoopBackOff (247 restarts, 503 at the ingress). Give
|
||
# liveness a wide window so the icon import can finish without a kill.
|
||
livenessProbe:
|
||
initialDelaySeconds: 60
|
||
periodSeconds: 30
|
||
timeoutSeconds: 5
|
||
failureThreshold: 10
|
||
readinessProbe:
|
||
initialDelaySeconds: 30
|
||
periodSeconds: 15
|
||
timeoutSeconds: 5
|
||
failureThreshold: 6
|
||
|
||
image:
|
||
repository: ghcr.io/homarr-labs/homarr
|
||
tag: "latest"
|
||
pullPolicy: Always
|
||
|
||
replicaCount: 1
|
||
|
||
# Configure SSO via environment variables
|
||
# Chart supports these via top-level env dict (not array)
|
||
env:
|
||
AUTH_PROVIDERS: "oidc,credentials"
|
||
AUTH_OIDC_ISSUER: "https://authentik.riotpiao.com/application/o/homarr/"
|
||
# AUTH_OIDC_URI (authorize endpoint) is REQUIRED in addition to ISSUER — homarr
|
||
# hides the "Sign in with Authentik" button entirely when it's absent (per the
|
||
# authentik Homarr integration + homarr SSO docs). This was the missing var.
|
||
AUTH_OIDC_URI: "https://authentik.riotpiao.com/application/o/authorize/"
|
||
AUTH_OIDC_CLIENT_NAME: "Authentik"
|
||
AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
|
||
AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
|
||
AUTH_OIDC_AUTO_LOGIN: "false"
|
||
# Link the OIDC identity to an existing homarr account with the same email.
|
||
OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING: "true"
|
||
# The analytics cron blocked the (single-threaded) Next.js event loop for ~16s
|
||
# per run ("callback took longer than expected"), compounding CPU pressure.
|
||
DISABLE_ANALYTICS: "true"
|
||
BASE_URL: "https://homarr.riotpiao.com"
|
||
NEXTAUTH_URL: "https://homarr.riotpiao.com"
|
||
|
||
# Client credentials from homarr-oidc secret
|
||
# Chart doesn't support envFrom, so we add via extraEnv
|
||
extraEnv:
|
||
- name: AUTH_OIDC_CLIENT_ID
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: homarr-oidc
|
||
key: client-id
|
||
- name: AUTH_OIDC_CLIENT_SECRET
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: homarr-oidc
|
||
key: client-secret
|
||
|
||
tolerations:
|
||
- key: node-role.kubernetes.io/control-plane
|
||
operator: Exists
|
||
effect: NoSchedule
|
||
|
||
resources:
|
||
requests:
|
||
cpu: 250m
|
||
memory: 384Mi
|
||
limits:
|
||
# Next.js 16 + bundled redis + the icon-updater (28k icons) saturated the old
|
||
# 500m limit; CPU throttling made Next.js abort with exit 134 (SIGABRT) and
|
||
# self-restart in a loop, so nginx saw no upstream and returned 502. Give it
|
||
# real CPU headroom.
|
||
cpu: "2"
|
||
memory: 1Gi
|