Skip to main content

07-homebox.md

kstack: book: Centerpoint Home Lab chapter: Documents & Organization page: Homebox tags: [homebox, inventory, home-management, authentik]

Overview

emptyHomebox is a home inventory management app for tracking household items, their locations, warranties, and purchase records. The external route uses Authentik ForwardAuth for SSO. The internal route applies X-Forwarded-Proto only (Homebox manages its own session internally). Signups are disabled; registration is not allowed.

Access

Type URL Auth External https://homebox.jeeves5454.ddns.net Authentik ForwardAuth + GeoBlock + CrowdSec Internal https://homebox.home.local Homebox own session (Step-CA TLS)

Configuration

Image: ghcr.io/sysadminsmedia/homebox:latest

Key Environment Variables

Variable Value / Notes HBOX_MODE production HBOX_LOG_LEVEL info HBOX_LOG_FORMAT text HBOX_WEB_MAX_UPLOAD_SIZE 10 (MB) HBOX_OPTIONS_ALLOW_REGISTRATION false HBOX_OPTIONS_ALLOW_ANALYTICS false HBOX_STORAGE_PREFIX_PATH data TZ America/Toronto

Traefik Labels

traefik.http.routers.homebox-ext.rule: Host(`homebox.jeeves5454.ddns.net`)
traefik.http.routers.homebox-ext.entrypoints: websecure
traefik.http.routers.homebox-ext.tls.certresolver: letsencrypt
traefik.http.routers.homebox-ext.middlewares: authentik-auth@docker,plex-geoblock@file,crowdsec-bouncer@file,homebox-headers
traefik.http.routers.homebox-ext.service: homebox-svc

traefik.http.routers.homebox-int.rule: Host(`homebox.home.local`)
traefik.http.routers.homebox-int.entrypoints: websecure
traefik.http.routers.homebox-int.tls.certresolver: step-ca
traefik.http.routers.homebox-int.middlewares: homebox-headers
traefik.http.routers.homebox-int.service: homebox-svc

traefik.http.middlewares.homebox-headers.headers.customrequestheaders.X-Forwarded-Proto: https
traefik.http.services.homebox-svc.loadbalancer.server.port: 7745

Volumes / Bind Mounts

Host Path Container Path Purpose /home/jeeves/docker/homebox/data /data SQLite database and uploads

Homebox uses SQLite (homebox.db) stored in the /data bind mount with WAL journal mode and foreign key enforcement enabled.

Notes / Gotchas

    The external route applies authentik-auth@docker ForwardAuth — all external access requires a valid Authentik session. The internal route skips ForwardAuth but applies the X-Forwarded-Proto header middleware (required for HTTPS-aware links and session cookies). HBOX_OPTIONS_ALLOW_REGISTRATION: false disables self-service account creation. New accounts must be created by an admin in the Homebox UI. Homebox stores photos and attachments in the /data bind mount alongside the SQLite database. Back up the entire directory before upgrades.

    Last Updated: 2026-06-17

    Back to top