138 lines
3.6 KiB
Markdown
138 lines
3.6 KiB
Markdown
# Homarr Deployment - Next Steps
|
|
|
|
## Completed
|
|
✅ MinIO OIDC fully wired (k8s/infrastructure/minio/minio-tenant.yaml)
|
|
✅ Homarr base config created:
|
|
- homarr-values.yaml (SSO env vars)
|
|
- homarr-secrets.enc.yaml (SECRET_ENCRYPTION_KEY)
|
|
- kustomization.yaml (namespace: dashboard)
|
|
|
|
## TODO to Complete Homarr Deployment
|
|
|
|
### 1. Add Homarr to Authentik Provision Script
|
|
**File:** `k8s/security/iam/scripts/authentik-provision.py`
|
|
**Location:** In the `SERVICES` dict (around line 205), add:
|
|
|
|
```python
|
|
"homarr": {
|
|
"client_secret_source": ("dashboard", "homarr-oidc", "client-secret"),
|
|
"generate_if_missing": True,
|
|
"extra_secret_literals": {"client-id": "homarr"},
|
|
"redirect_uris": [
|
|
"https://homarr.riotpiao.com/api/auth/callback/oidc",
|
|
],
|
|
"launch_url": "https://homarr.riotpiao.com",
|
|
"display_name": "Homarr",
|
|
},
|
|
```
|
|
|
|
### 2. Add Dashboard RoleBinding for Authentik Provisioner
|
|
**File:** `k8s/security/iam/kustomization.yaml`
|
|
**Location:** In the `resources:` list, add:
|
|
|
|
```yaml
|
|
- rbac-dashboard-rolebinding.yaml
|
|
```
|
|
|
|
**New file:** `k8s/security/iam/rbac-dashboard-rolebinding.yaml`:
|
|
|
|
```yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: authentik-provisioner
|
|
namespace: dashboard
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: authentik-provisioner
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: authentik-provisioner
|
|
namespace: iam
|
|
```
|
|
|
|
### 3. Add Homarr Application to ArgoCD
|
|
**File:** `k8s/argocd/apps/60-applications.yaml`
|
|
**Location:** Add at the end (before the final `---`):
|
|
|
|
```yaml
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: homarr
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://homarr-labs.github.io/charts
|
|
chart: homarr
|
|
targetRevision: "*"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/applications/homarr/homarr-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: dashboard
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
```
|
|
|
|
### 4. Add Ingress Rule
|
|
**File:** `k8s/bootstrap/ingress/ingress.yaml`
|
|
**Location:** In the `rules:` list, add:
|
|
|
|
```yaml
|
|
- host: homarr.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: homarr
|
|
port:
|
|
number: 3000
|
|
```
|
|
|
|
### 5. Add CoreDNS Rewrite
|
|
**File:** `k8s/bootstrap/coredns/coredns-configmap.yaml`
|
|
**Location:** In the `rewrite name` section, add:
|
|
|
|
```
|
|
rewrite name homarr.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
```
|
|
|
|
## Verification Steps
|
|
|
|
After committing and pushing all changes:
|
|
|
|
1. Wait for ArgoCD to sync iam-jobs (authentik-provision runs)
|
|
2. Check Authentik: `kubectl -n iam port-forward svc/authentik-server 9000:9000`
|
|
- Visit http://localhost:9000, login as rock
|
|
- Should see "Homarr" tile in application launcher
|
|
3. Wait for homarr Application to sync
|
|
4. Check pod: `kubectl -n dashboard get pods`
|
|
5. Test SSO: https://homarr.riotpiao.com
|
|
- Should redirect to Authentik login
|
|
- Login as rock → should land logged-in to Homarr dashboard
|
|
|
|
## Chart Info
|
|
|
|
Homarr uses the official chart from https://homarr-labs.github.io/charts
|
|
- Chart name: `homarr`
|
|
- Pinned image: `ghcr.io/homarr-labs/homarr:1.0.0`
|
|
- Persistence: 5Gi RWO on longhorn-wffc (3-replica HA)
|
|
- Tile content is UI-managed (saved to PVC, not git)
|
|
|