Installation

Daemun can run from a container, from Kubernetes, from UNRAID, or directly from source. Docker is the common deployment path for homelab installs.

Expose it carefully

Daemun can proxy data from private services. For public or shared deployments, enable built-in authentication or use a reverse proxy/VPN that enforces authentication, TLS, and strict host validation.

Docker Run the published Daemun image with Docker or Compose.

Kubernetes Deploy with Kubernetes manifests and annotations.

UNRAID Notes for UNRAID installs.

From source Build the Hono/Vite runtime locally.

HOMEPAGE_ALLOWED_HOSTS

Daemun keeps the inherited HOMEPAGE_ALLOWED_HOSTS environment variable for deployment compatibility.

The value is a comma-separated list of allowed hosts, sometimes including the port, that may host your Daemun install. The default image listens on port 3000; the optional nginx image is usually exposed on port 80. For example:

HOMEPAGE_ALLOWED_HOSTS=daemun.example.com,192.168.1.2:3000

If host validation fails, check the Daemun logs and ensure the host shown there is exactly present in HOMEPAGE_ALLOWED_HOSTS.

Setting HOMEPAGE_ALLOWED_HOSTS=* disables the check, but this is not recommended outside tightly controlled local testing.

Authentication

Password authentication needs these variables:

HOMEPAGE_AUTH_ENABLED=true
HOMEPAGE_AUTH_SECRET=long-random-secret
HOMEPAGE_AUTH_PASSWORD=your-password

OIDC uses the same switch and secret, plus HOMEPAGE_OIDC_ISSUER, HOMEPAGE_OIDC_CLIENT_ID, HOMEPAGE_OIDC_CLIENT_SECRET, and HOMEPAGE_EXTERNAL_URL. Register ${HOMEPAGE_EXTERNAL_URL}/api/auth/callback with the provider. HOMEPAGE_OIDC_SCOPE is optional and defaults to openid email profile.