Story Crater Bot
ff8bc74f63
MinIO (Part B): - k8s/infrastructure/minio/minio-tenant.yaml: added full OIDC env block (CONFIG_URL, CLIENT_ID, CLIENT_SECRET from minio-oidc secret, CLAIM_NAME, REDIRECT_URI, DISPLAY_NAME, SCOPES) — MinIO console SSO login will now work Homarr (Part C1 - base): - k8s/applications/homarr/homarr-values.yaml: official chart config with Authentik SSO (AUTH_PROVIDERS=oidc, all OIDC env vars, client creds from homarr-oidc secret, SECRET_ENCRYPTION_KEY from SOPS secret) - k8s/applications/homarr/homarr-secrets.enc.yaml: age-encrypted SECRET_ENCRYPTION_KEY (stable key — rotating it breaks saved integrations) - k8s/applications/homarr/kustomization.yaml: namespace dashboard Still TODO for Homarr: - Add 'homarr' to authentik-provision.py SERVICES dict - Add Application to 60-applications.yaml (multi-source: chart + values) - Add ingress rule (k8s/bootstrap/ingress/ingress.yaml) - Add CoreDNS rewrite (k8s/bootstrap/coredns/coredns-configmap.yaml) - Add dashboard RoleBinding for authentik-provisioner SA
68 lines
1.6 KiB
YAML
68 lines
1.6 KiB
YAML
# Homarr landing page — official chart from homarr-labs/charts.
|
|
# SSO via Authentik, single-replica (UI state lives on PVC, not git).
|
|
image:
|
|
repository: ghcr.io/homarr-labs/homarr
|
|
tag: "1.0.0" # Pin to stable
|
|
pullPolicy: IfNotPresent
|
|
|
|
replicaCount: 1
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 3000
|
|
|
|
persistence:
|
|
enabled: true
|
|
storageClass: longhorn-wffc
|
|
accessMode: ReadWriteOnce
|
|
size: 5Gi
|
|
|
|
env:
|
|
- name: AUTH_PROVIDERS
|
|
value: "oidc,credentials"
|
|
- name: AUTH_OIDC_ISSUER
|
|
value: "https://authentik.riotpiao.com/application/o/homarr/"
|
|
- name: AUTH_OIDC_CALLBACK_URL
|
|
value: "https://homarr.riotpiao.com/api/auth/callback/oidc"
|
|
- name: AUTH_OIDC_CLIENT_NAME
|
|
value: "Authentik"
|
|
- name: AUTH_OIDC_GROUPS_ATTRIBUTE
|
|
value: "groups"
|
|
- name: AUTH_OIDC_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: homarr-oidc
|
|
key: client-id
|
|
- name: AUTH_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: homarr-oidc
|
|
key: client-secret
|
|
- name: SECRET_ENCRYPTION_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: homarr-secrets
|
|
key: SECRET_ENCRYPTION_KEY
|
|
- name: OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING
|
|
value: "true"
|
|
- name: BASE_URL
|
|
value: "https://homarr.riotpiao.com"
|
|
- name: NEXTAUTH_URL
|
|
value: "https://homarr.riotpiao.com"
|
|
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
ingress:
|
|
enabled: false # Managed centrally in k8s/bootstrap/ingress/ingress.yaml
|