lament/pantheon
1
Code Issues 2 Pull requests 1 Activity Actions

dash.lament.gay drops podman: homarr out, homepage-dashboard in #123

Merged
lament merged 1 commit from dash-homepage-dashboard into main 2026-08-02 18:57:53 -05:00
Conversation 0 Commits 1 Files changed 6 +277 -17
lament commented 2026-08-02 18:53:40 -05:00
Owner
Copy link

dash.lament.gay moves off Homarr's podman container onto homepage-dashboard, nixpkgs-native.

  • Homarr's whole container stack is gone: homarr.nix, containers.nix (the shared podman-runtime module - nothing else used it), its OIDC client + secrets in keycloak.nix/realm-lament.json. No more netavark/podman as a maintenance surface for this service.
  • homepage-dashboard.nix: directory-driven like any other web service, but stays VPN-only (no public) - upstream has zero OIDC/auth of its own (confirmed via their own maintainer discussions), so there's nothing to SSO against
    • the app only binds 0.0.0.0, can't be published straight on minerva's WG address - fronted by a localCaddy hop (same pattern as nextcloud), with the usual allowedHosts/X-Forwarded-Proto gotchas from that hop forwarding the real Host header through
    • config lives in a group-writable state dir for now, not the module's read-only /etc symlinks - DynamicUser fights chgrp to a shared group (EOVERFLOW, not a permissions error), so this drops to a static user+group with lament added via members, seeded once from the Nix-rendered config. staging setup: hand-edit the layout live, freeze the settled version back into the module's services/widgets options later
  • nextcloud.nix: unrelated drive-by touch, no functional change

left for later: the UI still isn't landing for Sarah (fundamentally a card grid, no masonry) - she wants to build a custom dashboard instead, tracked in a separate ~/Projects/dash-app repo (HANDOFF.md here has the pointer). homepage-dashboard stays the interim landing page, no urgency to iterate on it further.

> `dash.lament.gay` moves off Homarr's podman container onto `homepage-dashboard`, nixpkgs-native. - Homarr's whole container stack is gone: `homarr.nix`, `containers.nix` (the shared podman-runtime module - nothing else used it), its OIDC client + secrets in `keycloak.nix`/`realm-lament.json`. No more netavark/podman as a maintenance surface for this service. - `homepage-dashboard.nix`: directory-driven like any other web service, but stays VPN-only (no `public`) - upstream has zero OIDC/auth of its own (confirmed via their own maintainer discussions), so there's nothing to SSO against - the app only binds `0.0.0.0`, can't be published straight on minerva's WG address - fronted by a `localCaddy` hop (same pattern as nextcloud), with the usual `allowedHosts`/`X-Forwarded-Proto` gotchas from that hop forwarding the real `Host` header through - config lives in a group-writable state dir for now, not the module's read-only `/etc` symlinks - `DynamicUser` fights `chgrp` to a shared group (`EOVERFLOW`, not a permissions error), so this drops to a static user+group with `lament` added via `members`, seeded once from the Nix-rendered config. staging setup: hand-edit the layout live, freeze the settled version back into the module's `services`/`widgets` options later - `nextcloud.nix`: unrelated drive-by touch, no functional change left for later: the UI still isn't landing for Sarah (fundamentally a card grid, no masonry) - she wants to build a custom dashboard instead, tracked in a separate `~/Projects/dash-app` repo (`HANDOFF.md` here has the pointer). homepage-dashboard stays the interim landing page, no urgency to iterate on it further.
dash: replace homarr with homepage-dashboard, ditch podman entirely
All checks were successful
CI / check (pull_request) Successful in 50s
Details
CI / deploy (pull_request) Has been skipped
Details
CI / build (pull_request) Successful in 2m39s
Details
CI / dry-activate (pull_request) Successful in 33s
Details
CI / check (push) Has been skipped
Details
CI / build (push) Has been skipped
Details
CI / dry-activate (push) Has been skipped
Details
CI / deploy (push) Successful in 2m49s
Details
a46d42512e 
no more container/netavark plumbing - homepage-dashboard is nixpkgs-native.
stays VPN-only (upstream has zero OIDC/auth of its own, confirmed via their
own maintainer discussions), fronted by a local caddy hop since the app can
only bind 0.0.0.0 and can't be published straight on minerva's WG address.
config lives in a group-writable state dir for now (static user, not
DynamicUser - that fights chgrp to a shared group) so the layout can be
hand-tuned before freezing it back into the module.

homarr's OIDC client/secrets/containers.nix module all ripped out.
HANDOFF.md added: sarah wants to build a custom dashboard instead, tracked
in a separate ~/Projects/dash-app repo - this stays the interim landing page.
lament scheduled this pull request to auto merge when all checks succeed 2026-08-02 18:54:55 -05:00
lament merged commit a46d42512e into main 2026-08-02 18:57:53 -05:00
lament deleted branch dash-homepage-dashboard 2026-08-02 18:57:54 -05:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
chore
lockfile bumps, CI, reorg, docs, formatting

  
desktop
niri, theming, browser, WM/terminal, gaming

  
dropped
This is a dropped feature

  
fix
This fixes a problem

  
fleet
This is a fleet issue

  
networking
WG, DNS/kresd, NAT, firewall, site-mesh

  
security
auth, identity, secrets, hardening

  
service
new or changed app services

No labels
chore
desktop
dropped
fix
fleet
networking
security
service
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
lament/pantheon!123
No description provided.