# Homarr - Modern dashboard for your homelab
# Port: 7575
# Docs: https://homarr.dev/
#
# Data stored in: /volume2/metadata/docker/homarr/appdata
# Database: SQLite at /appdata/db/db.sqlite

services:
  homarr:
    image: ghcr.io/homarr-labs/homarr:latest
    container_name: homarr
    environment:
      - TZ=America/Los_Angeles
      - SECRET_ENCRYPTION_KEY=a393eb842415bbd2f6bcf74bREDACTED_GITEA_TOKEN # pragma: allowlist secret
      # Authentik SSO via native OIDC — credentials kept as fallback if Authentik is down
      - AUTH_PROVIDER=oidc,credentials
      - AUTH_OIDC_ISSUER=https://sso.vish.gg/application/o/homarr/
      - AUTH_OIDC_CLIENT_ID="REDACTED_CLIENT_ID"
      - AUTH_OIDC_CLIENT_SECRET="REDACTED_CLIENT_SECRET" # pragma: allowlist secret
      - AUTH_OIDC_CLIENT_NAME=Authentik
      - AUTH_OIDC_AUTO_LOGIN=false
      - AUTH_LOGOUT_REDIRECT_URL=https://sso.vish.gg/application/o/homarr/end-session/
      - AUTH_OIDC_ADMIN_GROUP=Homarr Admins
      - AUTH_OIDC_OWNER_GROUP=Homarr Admins
    volumes:
      - /volume2/metadata/docker/homarr/appdata:/appdata
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - "7575:7575"
    dns:
      - 192.168.0.200    # Atlantis AdGuard (resolves .tail.vish.gg and .vish.local)
      - 192.168.0.250    # Calypso AdGuard (backup)
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true