feat(homarr): deploy dashboard to k8s on home subdomain

Local-only IngressRoute (home.workstation.internal, home.gigaforust.internal), prod commented out. Compose stack for test stand.

homarr/.env.example

@@ -0,0 +1,4 @@
+SECRET_ENCRYPTION_KEY="REPLACE_ME"
+TZ="Europe/Bratislava"
+PUID="1000"
+PGID="1000"

homarr/compose.yaml

@@ -0,0 +1,38 @@
+services:
+  homarr:
+    container_name: homarr
+    image: ghcr.io/homarr-labs/homarr:v2.1.2
+    restart: unless-stopped
+    volumes:
+      - ./appdata:/appdata
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./kubeconfig:/app/config/kubeconfig:ro
+    env_file: .env
+    ports:
+      - 80:7575
+      - 81:3000
+    environment:
+      - TZ=${TZ:-Europe/Bratislava}
+      - TURBO_TELEMETRY_DISABLED=1
+      - KUBECONFIG=/app/config/kubeconfig
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.homarr.loadbalancer.server.port=7575"
+
+      # Prod Router
+      - "traefik.http.routers.homarr.rule=Host(`homarr.forust.xyz`)"
+      - "traefik.http.routers.homarr.entrypoints=websecure"
+      - "traefik.http.routers.homarr.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.homarr-local.rule=Host(`homarr.workstation.internal`)"
+      - "traefik.http.routers.homarr-local.entrypoints=websecure"
+      - "traefik.http.routers.homarr-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.homarr-dev.rule=Host(`homarr.gigaforust.internal`)"
+      - "traefik.http.routers.homarr-dev.entrypoints=websecure"
+      - "traefik.http.routers.homarr-dev.tls=true"
+    networks:
+      - proxy
+networks:
+  proxy:
+    external: true

homarr/k8s/certificates.yaml

@@ -0,0 +1,28 @@
+# apiVersion: cert-manager.io/v1
+# kind: Certificate
+# metadata:
+#   name: home-prod-tls
+#   namespace: homarr
+# spec:
+#   secretName: home-prod-tls
+#   dnsNames:
+#     - home.forust.xyz
+#   issuerRef:
+#     name: letsencrypt-prod
+#     kind: ClusterIssuer
+# ---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: internal-wildcard-tls
+  namespace: homarr
+spec:
+  secretName: internal-wildcard-tls
+  dnsNames:
+    - "*.workstation.internal"
+    - "*.gigaforust.internal"
+    - workstation.internal
+    - gigaforust.internal
+  issuerRef:
+    name: internal-ca
+    kind: ClusterIssuer

homarr/k8s/config.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: homarr-config
+  namespace: homarr
+data:
+  TZ: "Europe/Bratislava"
+  TURBO_TELEMETRY_DISABLED: "1"
+  ENABLE_KUBERNETES: "true"

homarr/k8s/homarr.yaml

@@ -0,0 +1,81 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: homarr-service
+  namespace: homarr
+spec:
+  selector:
+    app: homarr
+  ports:
+    - port: 7575
+      targetPort: 7575
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: homarr-deployment
+  namespace: homarr
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: homarr
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: homarr
+    spec:
+      serviceAccountName: homarr
+      containers:
+        - name: homarr
+          image: ghcr.io/homarr-labs/homarr:v2.1.2
+          envFrom:
+            - configMapRef:
+                name: homarr-config
+            - secretRef:
+                name: homarr-secrets
+          ports:
+            - containerPort: 7575
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 7575
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 7575
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            failureThreshold: 3
+          volumeMounts:
+            - name: homarr-data
+              mountPath: /appdata
+          resources:
+            requests:
+              cpu: "250m"
+              memory: "350Mi"
+            limits:
+              cpu: "500m"
+              memory: "700Mi"
+      volumes:
+        - name: homarr-data
+          persistentVolumeClaim:
+            claimName: homarr-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: homarr-pvc
+  namespace: homarr
+spec:
+  resources:
+    requests:
+      storage: 2Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce

homarr/k8s/ingress.yaml

@@ -0,0 +1,33 @@
+# apiVersion: traefik.io/v1alpha1
+# kind: IngressRoute
+# metadata:
+#   name: homarr-prod
+#   namespace: homarr
+# spec:
+#   entryPoints:
+#     - websecure
+#   routes:
+#     - match: Host(`home.forust.xyz`)
+#       kind: Rule
+#       services:
+#         - name: homarr-service
+#           port: 7575
+#   tls:
+#     secretName: home-prod-tls
+# ---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: homarr-local
+  namespace: homarr
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`home.workstation.internal`) || Host(`home.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: homarr-service
+          port: 7575
+  tls:
+    secretName: internal-wildcard-tls

homarr/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: homarr

homarr/k8s/rbac.yaml

@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: homarr
+  namespace: homarr
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: homarr-readonly
+rules:
+  - apiGroups: [""]
+    resources:
+      - pods
+      - services
+      - endpoints
+      - namespaces
+      - nodes
+      - configmaps
+      - persistentvolumeclaims
+      - events
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources:
+      - deployments
+      - statefulsets
+      - daemonsets
+      - replicasets
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources:
+      - ingresses
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["traefik.io"]
+    resources:
+      - ingressroutes
+      - ingressroutetcps
+      - ingressrouteudps
+      - middlewares
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["metrics.k8s.io"]
+    resources:
+      - pods
+      - nodes
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: homarr-readonly
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: homarr-readonly
+subjects:
+  - kind: ServiceAccount
+    name: homarr
+    namespace: homarr

homarr/k8s/secrets.yaml.example

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: homarr-secrets
+  namespace: homarr
+type: Opaque
+stringData:
+  # openssl rand -hex 32
+  SECRET_ENCRYPTION_KEY: "REPLACE_ME"