feat(homepage): apex landing dashboard at home.keithjackson.dev

Deploy Homepage (gethomepage) as the apex landing dashboard aggregating links to cluster services, in its OWN non-gating post-platform Flux Kustomization (clusters/base/homepage.yaml, dependsOn platform-config, wait:false) — mirrors headlamp/oauth2-proxy so a leaf UI can never gate the platform chain. - platform/homepage/: plain manifests (ns, config ConfigMap, Deployment, Service, default-deny+Cilium ingress NP, apex HTTPRoute). Non-root pod, HOMEPAGE_ALLOWED_HOSTS, bundled mdi-* icons (DNS-only egress). - gateway.yaml: add https-apex + http-apex-redirect listeners for the bare apex (the *.home wildcard listener does NOT match it). Apex is already a SAN on the wildcard cert — no new Certificate. - Forward-auth annotated (auth-mode=forward-auth) but NOT enforced: the Gateway ext-authz mechanism is an unbuilt Phase-6 WS-NET TODO (same status as all other forward-auth apps). Flagged as PM follow-up. Gate: lint/l0/render-golden(10/10)/l1 green; conformance skipped (no cluster). Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-28 12:17:25 -05:00
1 parent ebe0371b1b
commit 1749603f87
@@ -0,0 +1,135 @@
+---
+# Homepage configuration (gethomepage). Each key is mounted read-only into /app/config via a subPath
+# (deployment.yaml) — the exact file set the app expects (services/settings/bookmarks/widgets +
+# docker/kubernetes + custom.css/js). Plain link tiles only: NO service-widget API keys are wired
+# here (that needs per-service secrets — flagged as a follow-up), so nothing sensitive lives in this
+# ConfigMap. Icons use the app-BUNDLED Material Design set (`mdi-*`) so no icon CDN is fetched and the
+# pod's egress stays DNS-only (networkpolicy.yaml). Brand icons (selfh.st/dashboard-icons) would need
+# world:443 egress — deliberately not used.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: homepage
+  namespace: homepage
+  labels:
+    app.kubernetes.io/name: homepage
+data:
+  settings.yaml: |
+    ---
+    title: Home Network
+    headerStyle: clean
+    theme: dark
+    color: slate
+    hideVersion: true
+    layout:
+      Platform:
+        style: row
+        columns: 3
+      Media:
+        style: row
+        columns: 3
+      Network & Infra:
+        style: row
+        columns: 3
+
+  services.yaml: |
+    ---
+    - Platform:
+        - Headlamp:
+            href: https://headlamp.home.keithjackson.dev
+            description: Kubernetes dashboard (per-user OIDC RBAC)
+            icon: mdi-kubernetes
+        - Grafana:
+            href: https://grafana.home.keithjackson.dev
+            description: Metrics, logs & dashboards (fronts Prometheus/Loki/Alertmanager)
+            icon: mdi-chart-areaspline
+        - Semaphore:
+            href: https://semaphore.home.keithjackson.dev
+            description: Ansible automation & CI
+            icon: mdi-cog-play
+        - Gitea:
+            href: https://gitea.home.keithjackson.dev
+            description: Git hosting & Actions (GitOps source of truth)
+            icon: mdi-git
+        - Keycloak:
+            href: https://keycloak.home.keithjackson.dev
+            description: Identity provider (SSO / OIDC)
+            icon: mdi-account-key
+
+    - Media:
+        - Plex:
+            href: https://plex.home.keithjackson.dev
+            description: Media streaming
+            icon: mdi-plex
+        - Overseerr:
+            href: https://seerr.home.keithjackson.dev
+            description: Media requests
+            icon: mdi-play-box-multiple
+        - Sonarr:
+            href: https://sonarr.home.keithjackson.dev
+            description: TV library manager
+            icon: mdi-television-classic
+        - Radarr:
+            href: https://radarr.home.keithjackson.dev
+            description: Movie library manager
+            icon: mdi-movie-open
+        - Jackett:
+            href: https://jackett.home.keithjackson.dev
+            description: Indexer proxy
+            icon: mdi-magnify
+        - qBittorrent:
+            href: https://qbittorrent.home.keithjackson.dev
+            description: Download client (VPN egress)
+            icon: mdi-download-network
+
+    - Network & Infra:
+        - Pi-hole:
+            href: https://pihole.home.keithjackson.dev
+            description: Network-wide DNS & ad-blocking
+            icon: mdi-shield-check
+        - UniFi:
+            href: https://unifi.home.keithjackson.dev:11443
+            description: Network controller (UOS)
+            icon: mdi-router-network
+        - Nextcloud:
+            href: https://nextcloud.home.keithjackson.dev
+            description: Files, calendar & contacts
+            icon: mdi-cloud
+
+  bookmarks.yaml: |
+    ---
+    - Operations:
+        - Gitea (external):
+            - abbr: GT
+              href: https://gitea.keithjackson.dev
+        - Auth portal:
+            - abbr: SSO
+              href: https://auth.home.keithjackson.dev
+    - Reference:
+        - Homepage docs:
+            - abbr: HP
+              href: https://gethomepage.dev
+
+  widgets.yaml: |
+    ---
+    - datetime:
+        text_size: xl
+        format:
+          dateStyle: long
+          timeStyle: short
+          hour12: false
+    - search:
+        provider: duckduckgo
+        target: _blank
+
+  # No Docker integration (Homepage does not reach the Docker socket in-cluster).
+  docker.yaml: |
+    ---
+
+  # No Kubernetes integration (no SA / cluster RBAC granted — avoids scope creep; the kubernetes
+  # widget would need a read-only ServiceAccount. Left empty deliberately).
+  kubernetes.yaml: |
+    ---
+
+  custom.css: ""
+  custom.js: ""