Homarr Deployment - Next Steps

Completed

✅ MinIO OIDC fully wired (k8s/infrastructure/minio/minio-tenant.yaml) ✅ Homarr base config created:

homarr-values.yaml (SSO env vars)
homarr-secrets.enc.yaml (SECRET_ENCRYPTION_KEY)
kustomization.yaml (namespace: dashboard)

TODO to Complete Homarr Deployment

1. Add Homarr to Authentik Provision Script

File: k8s/security/iam/scripts/authentik-provision.py Location: In the SERVICES dict (around line 205), add:

"homarr": {
    "client_secret_source": ("dashboard", "homarr-oidc", "client-secret"),
    "generate_if_missing": True,
    "extra_secret_literals": {"client-id": "homarr"},
    "redirect_uris": [
        "https://homarr.riotpiao.com/api/auth/callback/oidc",
    ],
    "launch_url": "https://homarr.riotpiao.com",
    "display_name": "Homarr",
},

2. Add Dashboard RoleBinding for Authentik Provisioner

File: k8s/security/iam/kustomization.yaml Location: In the resources: list, add:

  - rbac-dashboard-rolebinding.yaml

New file: k8s/security/iam/rbac-dashboard-rolebinding.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: authentik-provisioner
  namespace: dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: authentik-provisioner
subjects:
- kind: ServiceAccount
  name: authentik-provisioner
  namespace: iam

3. Add Homarr Application to ArgoCD

File: k8s/argocd/apps/60-applications.yaml Location: Add at the end (before the final ---):

---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: homarr
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "8"
spec:
  project: homelab
  sources:
    - repoURL: https://homarr-labs.github.io/charts
      chart: homarr
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/applications/homarr/homarr-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: dashboard
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

4. Add Ingress Rule

File: k8s/bootstrap/ingress/ingress.yaml Location: In the rules: list, add:

  - host: homarr.riotpiao.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: homarr
            port:
              number: 3000

5. Add CoreDNS Rewrite

File: k8s/bootstrap/coredns/coredns-configmap.yaml Location: In the rewrite name section, add:

        rewrite name homarr.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local

Verification Steps

After committing and pushing all changes:

Wait for ArgoCD to sync iam-jobs (authentik-provision runs)
Check Authentik: kubectl -n iam port-forward svc/authentik-server 9000:9000
- Visit http://localhost:9000, login as rock
- Should see "Homarr" tile in application launcher
Wait for homarr Application to sync
Check pod: kubectl -n dashboard get pods
Test SSO: https://homarr.riotpiao.com
- Should redirect to Authentik login
- Login as rock → should land logged-in to Homarr dashboard

Chart Info

Homarr uses the official chart from https://homarr-labs.github.io/charts

Chart name: homarr
Pinned image: ghcr.io/homarr-labs/homarr:1.0.0
Persistence: 5Gi RWO on longhorn-wffc (3-replica HA)
Tile content is UI-managed (saved to PVC, not git)

3.6 KiB Raw Blame History