From 34a7cf95d04de417c36073bc59f8e6d3d0ebd4a2 Mon Sep 17 00:00:00 2001
From: Scooby Husky <garrettstone499@gmail.com>
Date: Tue, 10 Mar 2026 21:51:24 -0500
Subject: [PATCH] Add HTTP proxy trust config to Home Assistant init container

Home Assistant was returning 400 errors because it received
X-Forwarded-For headers from the Istio ingress gateway but wasn't
configured to trust reverse proxies. Add use_x_forwarded_for and
trusted_proxies to the init container's configuration.yaml template.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 apps/home-assistant/values.yaml | 55 ++++++++++++++++++++++++---------
 1 file changed, 40 insertions(+), 15 deletions(-)

diff --git a/apps/home-assistant/values.yaml b/apps/home-assistant/values.yaml
index ba19f37..9b7d098 100644
--- a/apps/home-assistant/values.yaml
+++ b/apps/home-assistant/values.yaml
@@ -49,24 +49,17 @@ initContainers:
 
         # Ensure OIDC config is in configuration.yaml
         if [ ! -f /config/configuration.yaml ]; then
-          echo "Creating configuration.yaml with OIDC config..."
+          echo "Creating configuration.yaml with OIDC + HTTP proxy config..."
           cat > /config/configuration.yaml <<'OIDCEOF'
         # Home Assistant Configuration
         default_config:
 
-        # OIDC Authentication via Authentik
-        openid:
-          client_id: !secret oidc_client_id
-          client_secret: !secret oidc_client_secret
-          configure_url: "https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration"
-          scope: "openid profile email"
-          username_field: "preferred_username"
-          create_user: true
-          block_login: false
-        OIDCEOF
-        elif ! grep -q "^openid:" /config/configuration.yaml; then
-          echo "Appending OIDC config to existing configuration.yaml..."
-          cat >> /config/configuration.yaml <<'OIDCEOF'
+        # Trust reverse proxy (Istio ingress gateway) for X-Forwarded-For
+        http:
+          use_x_forwarded_for: true
+          trusted_proxies:
+            - 10.0.0.0/8
+            - 172.16.0.0/12
 
         # OIDC Authentication via Authentik
         openid:
@@ -79,7 +72,39 @@ initContainers:
           block_login: false
         OIDCEOF
         else
-          echo "OIDC config already present in configuration.yaml"
+          # Ensure OIDC config exists
+          if ! grep -q "^openid:" /config/configuration.yaml; then
+            echo "Appending OIDC config to existing configuration.yaml..."
+            cat >> /config/configuration.yaml <<'OIDCEOF'
+
+        # OIDC Authentication via Authentik
+        openid:
+          client_id: !secret oidc_client_id
+          client_secret: !secret oidc_client_secret
+          configure_url: "https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration"
+          scope: "openid profile email"
+          username_field: "preferred_username"
+          create_user: true
+          block_login: false
+        OIDCEOF
+          else
+            echo "OIDC config already present in configuration.yaml"
+          fi
+          # Ensure HTTP proxy trust exists
+          if ! grep -q "use_x_forwarded_for:" /config/configuration.yaml; then
+            echo "Appending HTTP proxy config..."
+            cat >> /config/configuration.yaml <<'HTTPEOF'
+
+        # Trust reverse proxy (Istio ingress gateway) for X-Forwarded-For
+        http:
+          use_x_forwarded_for: true
+          trusted_proxies:
+            - 10.0.0.0/8
+            - 172.16.0.0/12
+        HTTPEOF
+          else
+            echo "HTTP proxy config already present"
+          fi
         fi
     volumeMounts:
       - name: config