19864d79b2
Bundle of cross-role changes for the gymb services deployment: - Traefik routers: OR-combine opnform/homarr/bookstack Host rules with new *_extra_domains (internal *.int.* FQDNs for a DMZ reverseproxy), and emit tls.certresolver only when traefik_cert_mode == acme (drawio, homarr, opnform, send). - Split-horizon: bookstack_extra_hosts / opnform_extra_hosts add container /etc/hosts overrides so containers reach the IdP public FQDN over the LAN. - bookstack: assert the OIDC issuer resolves concretely (reject "//v2.0"), allowing non-Entra IdPs that override bookstack_oidc_issuer. - homarr: derive the bcrypt salt from the password digest so the admin hash is idempotent — no spurious template changes / container restarts. - opnform: PATCH an existing OIDC connection instead of skipping (applies corrected inventory on re-run); add OIDC_FORCE_LOGIN (enabled only after bootstrap) and an optional direct-SSO ingress entrypoint. Docs: READMEs and meta/argument_specs.yml updated for all new variables.
78 lines
No EOL
2.6 KiB
YAML
78 lines
No EOL
2.6 KiB
YAML
#SPDX-License-Identifier: MIT-0
|
|
---
|
|
# defaults file for homarr
|
|
|
|
# Base directory configuration (inherited from base role or defined here)
|
|
docker_compose_base_dir: /etc/docker/compose
|
|
docker_volume_base_dir: /srv/data
|
|
|
|
# homarr-specific configuration
|
|
homarr_base_path: /srv/data/homarr
|
|
homarr_docker_compose_dir: "{{ docker_compose_base_dir }}/homarr"
|
|
homarr_docker_volume_dir: "{{ docker_volume_base_dir }}/homarr"
|
|
homarr_appdata_dir: "{{ homarr_docker_volume_dir }}/homarr/appdata"
|
|
homarr_db: "{{ homarr_appdata_dir }}/db/db.sqlite"
|
|
|
|
# Service configuration
|
|
homarr_domain: "homarr.local.test"
|
|
# Additional hostnames the homarr router answers on (e.g. an internal
|
|
# *.int.* FQDN so a DMZ reverseproxy can hit a backend hostname covered
|
|
# by the cert).
|
|
homarr_extra_domains: []
|
|
homarr_image: "ghcr.io/homarr-labs/homarr:latest"
|
|
homarr_port: 7575
|
|
homarr_use_docker: false
|
|
|
|
# REQUIRED: 64-character hex string used to encrypt integration credentials.
|
|
# Generate with: openssl rand -hex 32
|
|
# Provide via OpenBao lookup, Ansible Vault, or extra-vars.
|
|
# Never commit a real key to version control.
|
|
homarr_secret_encryption_key: ""
|
|
|
|
# URL — used for BASE_URL, NEXTAUTH_URL and the completion message
|
|
homarr_base_url: "https://home.local.test"
|
|
|
|
# Auth providers (comma-separated): credentials, oidc, ldap
|
|
homarr_auth_providers: "credentials"
|
|
|
|
# OIDC configuration (only used when 'oidc' is in homarr_auth_providers)
|
|
homarr_oidc_issuer: ""
|
|
homarr_oidc_client_id: ""
|
|
homarr_oidc_client_name: ""
|
|
homarr_oidc_scopes: "openid profile email groups"
|
|
homarr_oidc_groups_attribute: "groups"
|
|
homarr_oidc_client_secret: ""
|
|
homarr_oidc_auto_login: "false"
|
|
|
|
# OIDC admin group (must exist in the identity provider)
|
|
homarr_oidc_admin_group: "homarr-admins"
|
|
|
|
# Board configuration
|
|
homarr_default_board_name: "Home"
|
|
homarr_default_board_public: true
|
|
|
|
# Traefik configuration
|
|
homarr_traefik_network: "proxy"
|
|
homarr_use_ssl: true
|
|
|
|
# Local admin (override in inventory or via vault)
|
|
homarr_admin_username: "admin"
|
|
homarr_admin_email: "admin@example.com"
|
|
homarr_admin_password: "ChangeMe123!"
|
|
|
|
# Applications shown on the default board.
|
|
# Override in your project/inventory vars. Each app needs:
|
|
# id, name, icon, href, width (1-10). Optional: description, height (default 1).
|
|
# Apps are automatically packed left-to-right into the desktop grid (10 cols),
|
|
# scaled to tablet (6 cols) and mobile (2 cols).
|
|
#
|
|
# Example:
|
|
# homarr_apps:
|
|
# - id: nextcloud
|
|
# name: Nextcloud
|
|
# description: Cloud Storage & Collaboration
|
|
# icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/nextcloud.png
|
|
# href: https://cloud.example.com
|
|
# width: 2
|
|
# height: 1
|
|
homarr_apps: [] |