Homarr

Deploy Homarr on Kubernetes — a modern application dashboard with real-time status monitoring, Docker/Kubernetes integration, and a drag-and-drop widget editor. Connects to media servers (Plex, Jellyfin), *arr apps (Sonarr, Radarr), and many other services.

Key Features

• Embedded Redis — no separate Redis required (external Redis optional for multi-instance)
• Three database backends — SQLite (default), PostgreSQL, MySQL with auto-detection
• Integration encryption — all service credentials encrypted via SECRET_ENCRYPTION_KEY
• Kubernetes workload discovery — optional live workload status in the dashboard
• Auth providers — local credentials, LDAP, and OIDC
• Database-aware backup — tar for SQLite (/appdata), pg_dump/mysqldump for SQL databases

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install homarr helmforge/homarr -f values.yaml

OCI registry:

helm install homarr oci://ghcr.io/helmforgedev/helm/homarr -f values.yaml

Upgrade Notes

The chart defaults to Homarr v1.67.0. This skips the v1.65.0 MySQL migration regression; upstream fixed that issue in v1.66.1, and v1.67.0 keeps the fix while adding the latest Homarr improvements. Review the upstream Homarr release notes before upgrading production environments.

Deployment Examples

# values.yaml — Homarr with SQLite (zero database configuration)
homarr:
  authProviders: credentials
  logLevel: info

encryption:
  existingSecret: homarr-encryption-key # key: secret-encryption-key
  existingSecretKey: secret-encryption-key # Generate: openssl rand -hex 32

persistence:
  enabled: true
  size: 1Gi

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: dash.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: homarr-tls
      hosts:
        - dash.example.com

# values.yaml — Homarr with bundled PostgreSQL
homarr:
  authProviders: credentials

encryption:
  existingSecret: homarr-encryption-key

postgresql:
  enabled: true
  auth:
    database: homarr
    username: homarr
    password: 'strong-db-password'
  primary:
    persistence:
      enabled: true
      size: 10Gi

persistence:
  enabled: true
  size: 1Gi

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: homarr-backups
    existingSecret: homarr-s3-credentials

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: dash.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Homarr with Kubernetes workload discovery enabled
# Requires cluster RBAC access; configure serviceAccount if needed
homarr:
  enableKubernetes: true # live workload status in the dashboard
  authProviders: credentials

encryption:
  existingSecret: homarr-encryption-key

persistence:
  enabled: true
  size: 1Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: dash.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Homarr with OIDC authentication (e.g. Keycloak, Authelia)
homarr:
  authProviders: oidc # or: credentials,oidc for both
  extraEnv:
    - name: AUTH_OIDC_ISSUER
      value: 'https://auth.example.com/realms/myrealm'
    - name: AUTH_OIDC_CLIENT_ID
      value: homarr
    - name: AUTH_OIDC_CLIENT_SECRET
      valueFrom:
        secretKeyRef:
          name: homarr-oidc-credentials
          key: client-secret
    - name: AUTH_OIDC_CALLBACK_URL
      value: 'https://dash.example.com/api/auth/callback/oidc'

encryption:
  existingSecret: homarr-encryption-key

persistence:
  enabled: true
  size: 1Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: dash.example.com
      paths:
        - path: /
          pathType: Prefix

Configuration Reference

Core

Image

Homarr Configuration

Encryption Key

Database

Auto-detection precedence (database.mode: auto):

Subcharts

Redis

Persistence

Service and Ingress

Gateway API

Use gatewayAPI.enabled to render a native Kubernetes Gateway API HTTPRoute for Homarr. Ingress stays disabled by default and can coexist with the route when a migration needs both objects.

gatewayAPI:
  enabled: true
  parentRefs:
    - name: shared-gateway
      namespace: gateway-system
      sectionName: https
  hostnames:
    - dash.example.com
  paths:
    - type: PathPrefix
      value: /

Dual-Stack Networking

Homarr’s Service supports Kubernetes dual-stack networking through optional service.ipFamilyPolicy and service.ipFamilies values. Defaults omit both fields so existing installs inherit cluster defaults.

service:
  ipFamilyPolicy: PreferDualStack

Backup

Database-aware backup: SQLite archives the full /appdata directory (tar). PostgreSQL uses pg_dump. MySQL uses mysqldump.

External Secrets

Homarr can render an External Secrets Operator ExternalSecret that projects SECRET_ENCRYPTION_KEY and AUTH_SECRET into the Kubernetes Secret configured by encryption.existingSecret.

encryption:
  existingSecret: homarr-encryption

externalSecrets:
  enabled: true
  secretStoreRef:
    name: platform-secrets
    kind: ClusterSecretStore
  data:
    - secretKey: secret-encryption-key
      remoteRef:
        key: homarr/credentials
        property: secret-encryption-key
    - secretKey: auth-secret
      remoteRef:
        key: homarr/credentials
        property: auth-secret

More Information

• Homarr Official Documentation
• Homarr GitHub Repository
• HelmForge Homarr Chart Source