jakman85andClaude Opus 4.8
1749603f87
Deploy Homepage (gethomepage) as the apex landing dashboard aggregating links to cluster services, in its OWN non-gating post-platform Flux Kustomization (clusters/base/homepage.yaml, dependsOn platform-config, wait:false) — mirrors headlamp/oauth2-proxy so a leaf UI can never gate the platform chain. - platform/homepage/: plain manifests (ns, config ConfigMap, Deployment, Service, default-deny+Cilium ingress NP, apex HTTPRoute). Non-root pod, HOMEPAGE_ALLOWED_HOSTS, bundled mdi-* icons (DNS-only egress). - gateway.yaml: add https-apex + http-apex-redirect listeners for the bare apex (the *.home wildcard listener does NOT match it). Apex is already a SAN on the wildcard cert — no new Certificate. - Forward-auth annotated (auth-mode=forward-auth) but NOT enforced: the Gateway ext-authz mechanism is an unbuilt Phase-6 WS-NET TODO (same status as all other forward-auth apps). Flagged as PM follow-up. Gate: lint/l0/render-golden(10/10)/l1 green; conformance skipped (no cluster). Co-Authored-By: Claude Opus 4.8 <[email protected]>
136 lines
4.3 KiB
YAML
136 lines
4.3 KiB
YAML
---
|
|
# Homepage configuration (gethomepage). Each key is mounted read-only into /app/config via a subPath
|
|
# (deployment.yaml) — the exact file set the app expects (services/settings/bookmarks/widgets +
|
|
# docker/kubernetes + custom.css/js). Plain link tiles only: NO service-widget API keys are wired
|
|
# here (that needs per-service secrets — flagged as a follow-up), so nothing sensitive lives in this
|
|
# ConfigMap. Icons use the app-BUNDLED Material Design set (`mdi-*`) so no icon CDN is fetched and the
|
|
# pod's egress stays DNS-only (networkpolicy.yaml). Brand icons (selfh.st/dashboard-icons) would need
|
|
# world:443 egress — deliberately not used.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: homepage
|
|
namespace: homepage
|
|
labels:
|
|
app.kubernetes.io/name: homepage
|
|
data:
|
|
settings.yaml: |
|
|
---
|
|
title: Home Network
|
|
headerStyle: clean
|
|
theme: dark
|
|
color: slate
|
|
hideVersion: true
|
|
layout:
|
|
Platform:
|
|
style: row
|
|
columns: 3
|
|
Media:
|
|
style: row
|
|
columns: 3
|
|
Network & Infra:
|
|
style: row
|
|
columns: 3
|
|
|
|
services.yaml: |
|
|
---
|
|
- Platform:
|
|
- Headlamp:
|
|
href: https://headlamp.home.keithjackson.dev
|
|
description: Kubernetes dashboard (per-user OIDC RBAC)
|
|
icon: mdi-kubernetes
|
|
- Grafana:
|
|
href: https://grafana.home.keithjackson.dev
|
|
description: Metrics, logs & dashboards (fronts Prometheus/Loki/Alertmanager)
|
|
icon: mdi-chart-areaspline
|
|
- Semaphore:
|
|
href: https://semaphore.home.keithjackson.dev
|
|
description: Ansible automation & CI
|
|
icon: mdi-cog-play
|
|
- Gitea:
|
|
href: https://gitea.home.keithjackson.dev
|
|
description: Git hosting & Actions (GitOps source of truth)
|
|
icon: mdi-git
|
|
- Keycloak:
|
|
href: https://keycloak.home.keithjackson.dev
|
|
description: Identity provider (SSO / OIDC)
|
|
icon: mdi-account-key
|
|
|
|
- Media:
|
|
- Plex:
|
|
href: https://plex.home.keithjackson.dev
|
|
description: Media streaming
|
|
icon: mdi-plex
|
|
- Overseerr:
|
|
href: https://seerr.home.keithjackson.dev
|
|
description: Media requests
|
|
icon: mdi-play-box-multiple
|
|
- Sonarr:
|
|
href: https://sonarr.home.keithjackson.dev
|
|
description: TV library manager
|
|
icon: mdi-television-classic
|
|
- Radarr:
|
|
href: https://radarr.home.keithjackson.dev
|
|
description: Movie library manager
|
|
icon: mdi-movie-open
|
|
- Jackett:
|
|
href: https://jackett.home.keithjackson.dev
|
|
description: Indexer proxy
|
|
icon: mdi-magnify
|
|
- qBittorrent:
|
|
href: https://qbittorrent.home.keithjackson.dev
|
|
description: Download client (VPN egress)
|
|
icon: mdi-download-network
|
|
|
|
- Network & Infra:
|
|
- Pi-hole:
|
|
href: https://pihole.home.keithjackson.dev
|
|
description: Network-wide DNS & ad-blocking
|
|
icon: mdi-shield-check
|
|
- UniFi:
|
|
href: https://unifi.home.keithjackson.dev:11443
|
|
description: Network controller (UOS)
|
|
icon: mdi-router-network
|
|
- Nextcloud:
|
|
href: https://nextcloud.home.keithjackson.dev
|
|
description: Files, calendar & contacts
|
|
icon: mdi-cloud
|
|
|
|
bookmarks.yaml: |
|
|
---
|
|
- Operations:
|
|
- Gitea (external):
|
|
- abbr: GT
|
|
href: https://gitea.keithjackson.dev
|
|
- Auth portal:
|
|
- abbr: SSO
|
|
href: https://auth.home.keithjackson.dev
|
|
- Reference:
|
|
- Homepage docs:
|
|
- abbr: HP
|
|
href: https://gethomepage.dev
|
|
|
|
widgets.yaml: |
|
|
---
|
|
- datetime:
|
|
text_size: xl
|
|
format:
|
|
dateStyle: long
|
|
timeStyle: short
|
|
hour12: false
|
|
- search:
|
|
provider: duckduckgo
|
|
target: _blank
|
|
|
|
# No Docker integration (Homepage does not reach the Docker socket in-cluster).
|
|
docker.yaml: |
|
|
---
|
|
|
|
# No Kubernetes integration (no SA / cluster RBAC granted — avoids scope creep; the kubernetes
|
|
# widget would need a read-only ServiceAccount. Left empty deliberately).
|
|
kubernetes.yaml: |
|
|
---
|
|
|
|
custom.css: ""
|
|
custom.js: ""
|