Add HTTP proxy trust config to Home Assistant init container

Home Assistant was returning 400 errors because it received
X-Forwarded-For headers from the Istio ingress gateway but wasn't
configured to trust reverse proxies. Add use_x_forwarded_for and
trusted_proxies to the init container's configuration.yaml template.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/home-assistant/values.yaml

@@ -49,24 +49,17 @@ initContainers:
 
         # Ensure OIDC config is in configuration.yaml
         if [ ! -f /config/configuration.yaml ]; then
-          echo "Creating configuration.yaml with OIDC config..."
+          echo "Creating configuration.yaml with OIDC + HTTP proxy config..."
           cat > /config/configuration.yaml <<'OIDCEOF'
         # Home Assistant Configuration
         default_config:
 
-        # OIDC Authentication via Authentik
+        # Trust reverse proxy (Istio ingress gateway) for X-Forwarded-For
-        openid:
+        http:
-          client_id: !secret oidc_client_id
+          use_x_forwarded_for: true
-          client_secret: !secret oidc_client_secret
+          trusted_proxies:
-          configure_url: "https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration"
+            - 10.0.0.0/8
-          scope: "openid profile email"
+            - 172.16.0.0/12
-          username_field: "preferred_username"
-          create_user: true
-          block_login: false
-        OIDCEOF
-        elif ! grep -q "^openid:" /config/configuration.yaml; then
-          echo "Appending OIDC config to existing configuration.yaml..."
-          cat >> /config/configuration.yaml <<'OIDCEOF'
 
         # OIDC Authentication via Authentik
         openid:
@@ -79,7 +72,39 @@ initContainers:
           block_login: false
         OIDCEOF
         else
-          echo "OIDC config already present in configuration.yaml"
+          # Ensure OIDC config exists
+          if ! grep -q "^openid:" /config/configuration.yaml; then
+            echo "Appending OIDC config to existing configuration.yaml..."
+            cat >> /config/configuration.yaml <<'OIDCEOF'
+
+        # OIDC Authentication via Authentik
+        openid:
+          client_id: !secret oidc_client_id
+          client_secret: !secret oidc_client_secret
+          configure_url: "https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration"
+          scope: "openid profile email"
+          username_field: "preferred_username"
+          create_user: true
+          block_login: false
+        OIDCEOF
+          else
+            echo "OIDC config already present in configuration.yaml"
+          fi
+          # Ensure HTTP proxy trust exists
+          if ! grep -q "use_x_forwarded_for:" /config/configuration.yaml; then
+            echo "Appending HTTP proxy config..."
+            cat >> /config/configuration.yaml <<'HTTPEOF'
+
+        # Trust reverse proxy (Istio ingress gateway) for X-Forwarded-For
+        http:
+          use_x_forwarded_for: true
+          trusted_proxies:
+            - 10.0.0.0/8
+            - 172.16.0.0/12
+        HTTPEOF
+          else
+            echo "HTTP proxy config already present"
+          fi
         fi
     volumeMounts:
       - name: config