✨ new talos cluster

kubernetes/cluster-0/apps/home-automation/emqx/helm-release.yaml

@@ -0,0 +1,76 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: emqx
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: emqx
+      version: 5.0.3
+      sourceRef:
+        kind: HelmRepository
+        name: emqx
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  values:
+    image:
+      repository: public.ecr.aws/emqx/emqx
+    replicaCount: 3
+    recreatePods: true
+    emqxConfig:
+      EMQX_ALLOW_ANONYMOUS: "false"
+      EMQX_AUTH__MNESIA__PASSWORD_HASH: plain
+      EMQX_AUTH__USER__1__USERNAME: ${SECRET_MQTT_USER}
+      EMQX_AUTH__USER__1__PASSWORD: ${SECRET_MQTT_PASSWORD}
+    service:
+      type: LoadBalancer
+      loadBalancerIP: ${CLUSTER_LB_EMQX}
+      externalTrafficPolicy: Local
+    ingress:
+      dashboard:
+        enabled: true
+        ingressClassName: nginx
+        path: /
+        pathType: Prefix
+        hosts:
+          - &host "emqx.${SECRET_CLUSTER_DOMAIN}"
+        tls:
+          - hosts:
+              - *host
+    metrics:
+      enabled: false
+    persistence:
+      enabled: true
+      storageClass: rook-ceph-block
+      size: 100Mi
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                  - key: app.kubernetes.io/name
+                    operator: In
+                    values: ["emqx"]
+              topologyKey: kubernetes.io/hostname
+    resources:
+      requests:
+        cpu: 100m
+        memory: 150Mi
+      limits:
+        memory: 512Mi
+  valuesFrom:
+    - targetPath: emqxConfig.EMQX_DASHBOARD__DEFAULT_PASSWORD
+      kind: Secret
+      name: emqx-config
+      valuesKey: admin_password

kubernetes/cluster-0/apps/home-automation/emqx/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secret.sops.yaml
+  - helm-release.yaml

kubernetes/cluster-0/apps/home-automation/emqx/secret.sops.yaml

@@ -0,0 +1,30 @@
+kind: Secret
+apiVersion: v1
+type: Opaque
+metadata:
+    name: emqx-config
+    namespace: default
+stringData:
+    admin_password: ENC[AES256_GCM,data:5CgeNci9Mr9bhHLG/cl9yajr02CInvng,iv:tzU2NnmprFiVfnxgXP8y+o2wgwooaWVpvq6+fKodLC8=,tag:MkDFv5wOn4B6yWUMfivQGA==,type:str]
+    user_1_username: ENC[AES256_GCM,data:np5xaBR5Ze8ml9UY8w==,iv:fmxB+fop4lc81BJnVataRvbtlaCaqfB8xL1AoFkuDDQ=,tag:00XN9H0wKoypgz7fUW4NGQ==,type:str]
+    user_1_password: ENC[AES256_GCM,data:NilXDCtXR0j+pWQYhesSogoWNQ==,iv:79TXQXTqYbzaLfMfQ/ZF5EP1UmtYAJ0aYHrD4HrYw3c=,tag:VIH6Zx00vLlpFGS9yrDAfg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvb3RQOTVNN0VzdElJSGRY
+            bytDQ045bnRMY2RGSmEvTE9jQkN4MTQrZUhnCnZ0TjF5ZTU2bWtJNzVGRXdqV0lP
+            RGtuaUVkZlluUjlsd0lvZ0ZuRE5ocEUKLS0tIGxsTjJpc0JEeUhxSjF6MU5mSlli
+            bXpSSjd3YU5hRXFKdnhVcTFKTzRqZzQKlFvt9rCRt+1EviAtZxaQVVwAEt300456
+            KDHW7U58DUO3TmzTG47/iLj7AxIgCQKUjgaU6FoiQ/DZLaVCloyWEA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-09-14T12:39:16Z"
+    mac: ENC[AES256_GCM,data:0dG5L2JMoLlTVR4RqxbCGLQAe+NR0wHKGUwCUO0+5tDS/klaUvMAaQQkQZd2UDXeK6nyrb0pQA5i6sgqrv6znT6TToMA1vujHbuXe7S7+zVVfU0nIEsPomQWSxaqLP0FSvfqJ06Q3SftLusnnAFrwo1SHfvinIl2XcA0fJWJ/dk=,iv:407K+60IDcnxm5bo1woKMVUySxWHavFr5eFcN2VhA+Q=,tag:fwPcZ4D5XeWMFwluUcaTGA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/cluster-0/apps/home-automation/frigate/config.yaml

@@ -0,0 +1,58 @@
+---
+logger:
+  default: info
+  logs:
+    frigate.record: debug
+
+mqtt:
+  host: emqx.default.svc.cluster.local.
+  topic_prefix: frigate
+  user: "{MQTT_USER}"
+  password: "{MQTT_PASSWORD}"
+
+database:
+  path: /data/frigate.db
+
+detectors:
+  coral:
+    type: edgetpu
+    device: usb
+
+ffmpeg:
+  global_args:
+    - -hide_banner
+    - -loglevel
+    - warning
+  hwaccel_args:
+    - -hwaccel
+    - vaapi
+    - -hwaccel_device
+    - /dev/dri/renderD128
+    - -hwaccel_output_format
+    - yuv420p
+  # https://github.com/blakeblackshear/frigate/issues/3296
+  output_args:
+    record: -f segment -segment_time 10 -segment_format mp4 -reset_timestamps 1 -strftime 1 -c:v copy -ar 44100 -c:a aac
+    rtmp: -c:v copy -f flv -ar 44100 -c:a aac
+
+rtmp:
+  enabled: true
+
+record:
+  enabled: true
+  retain:
+    days: 3
+    mode: all
+  events:
+    retain:
+      default: 7
+      mode: active_objects
+
+objects:
+  track:
+    - person
+  filters:
+    person:
+      min_area: 5000
+      max_area: 100000
+      threshold: 0.7

kubernetes/cluster-0/apps/home-automation/frigate/helm-release.yaml

@@ -0,0 +1,118 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app frigate
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.0.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: emqx
+      namespace: default
+    - name: intel-gpu-plugin
+      namespace: default
+    - name: node-feature-discovery
+      namespace: default
+  values:
+    fullnameOverride: *app
+    image:
+      repository: docker.io/blakeblackshear/frigate
+      tag: 0.11.1
+    env:
+      TZ: "${TIMEZONE}"
+      LIBVA_DRIVER_NAME: i965
+      MQTT_USER: "${SECRET_MQTT_USERNAME}"
+      MQTT_PASSWORD: ${SECRET_MQTT_PASSWORD}
+    service:
+      main:
+        ports:
+          http:
+            port: &port 5000
+    probes:
+      liveness: &probes
+        enabled: true
+        custom: true
+        spec:
+          httpGet:
+            path: /api/version
+            port: *port
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 3
+      readiness: *probes
+      startup:
+        enabled: false
+    ingress:
+      main:
+        enabled: true
+        ingressClassName: "nginx"
+        annotations:
+          auth.home.arpa/enabled: "true"
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+    securityContext:
+      privileged: true
+    persistence:
+      config:
+        enabled: true
+        type: configMap
+        name: *app
+        subPath: config.yaml
+        mountPath: /config/config.yml
+        readOnly: true
+      data:
+        enabled: true
+        existingClaim: frigate-config
+      usb:
+        enabled: true
+        type: hostPath
+        hostPath: /dev/bus/usb
+        hostPathType: Directory
+        mountPath: /dev/bus/usb
+      cache:
+        enabled: true
+        type: emptyDir
+        medium: Memory
+        sizeLimit: 4Gi
+        mountPath: /dev/shm
+    podAnnotations:
+      configmap.reloader.stakater.com/reload: *app
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: feature.node.kubernetes.io/custom-coral-tpu
+                  operator: In
+                  values:
+                    - "true"
+    resources:
+      requests:
+        cpu: 100m
+        memory: 1Gi
+        gpu.intel.com/i915: "1"
+      limits:
+        memory: 6Gi
+        gpu.intel.com/i915: "1"

kubernetes/cluster-0/apps/home-automation/frigate/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - volume.yaml
+  - helm-release.yaml
+namespace: default
+configMapGenerator:
+  - name: frigate
+    files:
+      - config.yaml
+generatorOptions:
+  disableNameSuffixHash: true
+  annotations:
+    kustomize.toolkit.fluxcd.io/substitute: disabled

kubernetes/cluster-0/apps/home-automation/frigate/volume.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: frigate-config
+  namespace: default
+  labels:
+    app.kubernetes.io/name: &name frigate
+    app.kubernetes.io/instance: *name
+    snapshot.home.arpa/enabled: "true"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block
+  resources:
+    requests:
+      storage: 5Gi

kubernetes/cluster-0/apps/home-automation/home-assistant-code/helm-release.yaml

@@ -0,0 +1,86 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app home-assistant-code
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.0.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: home-assistant
+      namespace: default
+  values:
+    image:
+      repository: ghcr.io/coder/code-server
+      tag: 4.8.3
+    env:
+      TZ: "${TIMEZONE}"
+      GIT_SSH_COMMAND: "ssh -i /config/.ssh/id_rsa -o IdentitiesOnly=yes"
+    args:
+      - --auth
+      - "none"
+      - --user-data-dir
+      - "/config/.vscode"
+      - --extensions-dir
+      - "/config/.vscode"
+      - --port
+      - "80"
+      - "/config"
+    service:
+      main:
+        ports:
+          http:
+            port: 80
+    ingress:
+      main:
+        enabled: true
+        ingressClassName: "nginx"
+        hosts:
+          - host: &host "hass-code.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+    podSecurityContext:
+      runAsUser: 0
+      runAsGroup: 0
+      fsGroup: 0
+    persistence:
+      config:
+        enabled: true
+        existingClaim: hass-config
+    affinity:
+      podAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values: ["home-assistant"]
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values: ["home-assistant"]
+            topologyKey: kubernetes.io/hostname
+    resources:
+      requests:
+        cpu: 10m
+        memory: 100Mi
+      limits:
+        memory: 500Mi

kubernetes/cluster-0/apps/home-automation/home-assistant-code/kustomization.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml

kubernetes/cluster-0/apps/home-automation/home-assistant/helm-release.yaml

@@ -0,0 +1,106 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app home-assistant
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.0.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: emqx
+      namespace: default
+    - name: postgres-cluster
+      namespace: default
+  values:
+    image:
+      repository: ghcr.io/onedr0p/home-assistant
+      tag: 2022.11.3@sha256:2ad10631a2b574b77baab79145d8b773ff7307f6d52542d0b458f599ce689d26
+    env:
+      TZ: "${TIMEZONE}"
+      POSTGRES_HOST: postgres-rw.default.svc.cluster.local.
+      POSTGRES_DB: home_assistant
+    envFrom:
+      - secretRef:
+          name: *app
+    service:
+      main:
+        type: LoadBalancer
+        loadBalancerIP: ${CLUSTER_LB_HASS}
+        externalTrafficPolicy: Local
+        ports:
+          http:
+            port: 8123
+    ingress:
+      main:
+        enabled: true
+        ingressClassName: "nginx"
+        hosts:
+          - host: &host "hass.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+          - host: &host2 "home-assistant.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+              - *host2
+    probes:
+      liveness:
+        enabled: false
+      readiness:
+        enabled: false
+      startup:
+        enabled: false
+    podSecurityContext:
+      runAsUser: 0
+      runAsGroup: 0
+      fsGroup: 0
+      fsGroupChangePolicy: "OnRootMismatch"
+    securityContext:
+      privileged: true
+    podAnnotations:
+      secret.reloader.stakater.com/reload: *app
+    persistence:
+      config:
+        enabled: true
+        existingClaim: hass-config
+      usb:
+        enabled: true
+        type: hostPath
+        hostPath: /dev/serial/by-id/usb-Arduino__www.arduino.cc__0042_5503731323735171A241-if00
+        hostPathType: CharDevice
+        mountPath: /dev/ttyUSB0
+    resources:
+      requests:
+        cpu: 10m
+        memory: 100Mi
+      limits:
+        memory: 750Mi
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - {
+                    key: "feature.node.kubernetes.io/custom-rflink",
+                    operator: In,
+                    values: ["true"],
+                  }

kubernetes/cluster-0/apps/home-automation/home-assistant/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secret.sops.yaml
+  - helm-release.yaml
+  - volume.yaml
+  - token.sops.yaml
+  - podmonitor.yaml
+patchesStrategicMerge:
+  - patches/postgres.yaml

kubernetes/cluster-0/apps/home-automation/home-assistant/patches/postgres.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app home-assistant
+  namespace: default
+spec:
+  values:
+    initContainers:
+      init-db:
+        image: ghcr.io/onedr0p/postgres-initdb:14.5
+        env:
+          - name: POSTGRES_HOST
+            value: postgres-rw.default.svc.cluster.local.
+          - name: POSTGRES_DB
+            value: home_assistant
+          - name: POSTGRES_SUPER_PASS
+            valueFrom:
+              secretKeyRef:
+                name: postgres-superuser
+                key: password
+        envFrom:
+          - secretRef:
+              name: *app

kubernetes/cluster-0/apps/home-automation/home-assistant/podmonitor.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: home-assistant
+  namespace: default
+spec:
+  podMetricsEndpoints:
+    - interval: 1m
+      path: /api/prometheus
+      port: http
+      scrapeTimeout: 30s
+      bearerTokenSecret:
+        name: home-automation
+        key: prometheus-token
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: home-assistant
+      app.kubernetes.io/name: home-assistant

kubernetes/cluster-0/apps/home-automation/home-assistant/secret.sops.yaml

@@ -0,0 +1,34 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: home-assistant
+    namespace: default
+stringData:
+    HASS_SECRET_LATITUDE: ENC[AES256_GCM,data:/tafIrcH0xz+rHHUTz3wdi4=,iv:HyRcQcOvfWi6X2Y+PCILYtcB9WvrZVoZmN7DH31NdrA=,tag:QjsavnTkBCAE3xdl7YtQyg==,type:str]
+    HASS_SECRET_LONGITUDE: ENC[AES256_GCM,data:Ya0P5TJ2PcD2gbD6yNi5M44=,iv:ZnMO4G3I4jNc52q0J2UBAScJs3nrZnB1zFlbh6hkJmI=,tag:0Y00oMSmtP1wdY3cP84sgw==,type:str]
+    HASS_SECRET_ELEVATION: ENC[AES256_GCM,data:ruU=,iv:4yDZLOGfHcGXcGNuQVBmFrg3HgSpGXhsB9cwlliplVc=,tag:4f4zrnIosO3kWh9BGNz7Rw==,type:str]
+    HASS_SECRET_URL: ENC[AES256_GCM,data:WTi34088t3P1mSsuuo/+U/qpMnwpmPw7Udeul2BBlwU2TG4tIr8QL65RTVVrnLM=,iv:eAcvCs5C1g+jdNJH3b4CZMFoicfgy7DUmtCZJnL9Exo=,tag:k5KY9cbRgzHosZAxkgAlAQ==,type:str]
+    HASS_SECRET_DB_URL: ENC[AES256_GCM,data:Nl7EMtmX2U1LHLsSsIk3MbBshcR2CuOhDogrb1i9elZyP2DRlS995lerl9T8mQ98XK9HuU/qTwJAj4JUP9FikcAJpIS0Fspf9IwNai1uhQ4/RWA9d5NsgjuGhv7eueQiNg==,iv:wxT4Yf4V5RAIRbZmBS1GikzhbQEsGu7tTwKIRePKnH0=,tag:oMvx5G2p5ASckOp8vhkilA==,type:str]
+    POSTGRES_USER: ENC[AES256_GCM,data:6sFSx8XfWgkgifgAk+o=,iv:qdUCWatQb7XWskKMKUBvDQ1JqKxH5zoSznop3KRkgM4=,tag:KpeLOhEWpE5petnB3bXnRA==,type:str]
+    POSTGRES_PASS: ENC[AES256_GCM,data:cNW97km2wZz+uHnX0Hzl7g==,iv:40HsF3DN96JLnGwLMUhx3cq2hdFbPXSasn6CJuCO7Uo=,tag:4NyuUCHryWMxYBkW8vjCXA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNRm1nQmk0eE1OUVRlbmkw
+            M3RQOFc4NXJrS3lHR09QdGttNEp0YTZzNWp3ClZaQ2hxWEIzNlNSNXhONlE4QzNn
+            OVQ1ZEphd1lQR2tFMEppZS9nUy9GTFUKLS0tIEJxdXlqQURxbVlmSlJ3S3NEYWtB
+            SjVvc0k0dk1GeXF0Z3gycHVJSXRtNTgKJScEOU0jr7qw4fdBbtKfE5lI1gVLIQ1g
+            cklawiOzeLg+v+5ZmuAOk5k6VIUUNMpcrAfEbI84JRWCFRm1IngMwQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-09-14T17:35:30Z"
+    mac: ENC[AES256_GCM,data:yLIhWrFqNWF1IT/XyKyM0j5QKdnbM0pKSQd7s9Xx+G8/O9rnlBOTGyWgwazBbw83xW/BZ906TD9f7o6uAtdbLRarX2kw248oUGCuTK8EpyX+ake59OFiyLHya/XWZqpRL0/uC08467ecPdhzFb0NnrJgVfL1DW7dBwGY3fLyZBU=,iv:cq7RmU+HCR+PL7xR7PRcpQ7904YAz1qwvSBDFi93bqQ=,tag:WUiLYFXIC0y2+909Y3GW5g==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/cluster-0/apps/home-automation/home-assistant/token.sops.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: home-automation
+    namespace: default
+stringData:
+    prometheus-token: ENC[AES256_GCM,data:XQS2cNao60Cw3oWPBG3qRs69u4ZhBB8qWm5s6z13CDomfcdfA60YSSU7Vtcdb8E7wnI2t/X3Kul8Vlt8evYv/Tkh5UN1oiqa+upFQ/tOlIHFmRfz1snE5XlREc/sB2FN8xUIDRdHObfwz9NcfEcrt0MP+1mXN1IUIA5BDAAFT05TALeUjdY3CTfht6idIFlqs3YN2uvfDYoq5nKIN4J3uN0rWJI46BD+FnmpE243ChM+Cn1NS2sa,iv:lcCmW8TASJHWgOjs9qRh1XaGqPpCHn9HkU+Ma+Iqyv0=,tag:bRNDK8TEyHIMZlixYRDGGw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQWjZ1RG9QZnBQSUNNSHN4
+            MTdwMDlvaGk4NEVxdmdZOGR1QnpLNFkzOTNZCjhZeEloeWQzemp1cVJrbEpxbWJB
+            T3NXRkRxTU54MGxUbk45YTJoQkl2dWMKLS0tIFkzQ0hvQWdxK2NKQlVlNWhUODQ3
+            RDRiUkRFSVI4S29mdWRMbE9RNFhLQlUKcx+FKlWUqt5YOxIKlvNiexCarLnW3FXU
+            M+lPXuGDvjo2Pg5InhPCheuxSVxea85uRRmROTWWOfjMKNYyfMiXLw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-09-14T12:31:34Z"
+    mac: ENC[AES256_GCM,data:iTSj6ouARsJb6RN4ZoZ2hlOvkZ/LaABtvbR7VaLIC9FOdDlW68jYYyQpR2IkzG8RynHFGX8WcqxqImpN1pTWN+MHHEzFwhVhXdx5u/Utvt61W/TCmLE1C48f4IIoIRAvstWbi3h4kupo23O6GA53XatHprBPfgf+IC29FoLBoA0=,iv:AOD+DHbaw4kAveVGVB0WtQot+/MhOleTNp3tCCymKy0=,tag:AzhQeX1SI57yJusRGz/uUQ==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/cluster-0/apps/home-automation/home-assistant/volume.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: hass-config
+  namespace: default
+  labels:
+    app.kubernetes.io/name: &name home-assistant
+    app.kubernetes.io/instance: *name
+    snapshot.home.arpa/enabled: "true"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block
+  resources:
+    requests:
+      storage: 10Gi

kubernetes/cluster-0/apps/home-automation/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - emqx
+  # - frigate
+  - home-assistant
+  - home-assistant-code
+  - zigbee2mqtt
+  - zwavejs2mqtt

kubernetes/cluster-0/apps/home-automation/zigbee2mqtt/helm-release.yaml

@@ -0,0 +1,75 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app zigbee2mqtt
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.0.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: node-feature-discovery
+      namespace: default
+    - name: emqx
+      namespace: default
+  values:
+    fullnameOverride: *app
+    image:
+      repository: koenkk/zigbee2mqtt
+      tag: 1.28.2
+    env:
+      TZ: "${TIMEZONE}"
+      ZIGBEE2MQTT_DATA: /data
+    service:
+      main:
+        ports:
+          http:
+            port: &port 8080
+    ingress:
+      main:
+        enabled: true
+        ingressClassName: "nginx"
+        annotations:
+          auth.home.arpa/enabled: "true"
+        hosts:
+          - host: &host "zigbee.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+    securityContext:
+      privileged: true
+    persistence:
+      config:
+        enabled: true
+        existingClaim: zigbee2mqtt-config
+        mountPath: "/data"
+      usb:
+        enabled: true
+        type: hostPath
+        hostPath: /dev/serial/by-id/usb-1a86_USB_Serial-if00-port0
+        hostPathType: CharDevice
+    nodeSelector:
+      feature.node.kubernetes.io/custom-zigbee: "true"
+    resources:
+      requests:
+        memory: 100Mi
+        cpu: 100m
+      limits:
+        memory: 700Mi

kubernetes/cluster-0/apps/home-automation/zigbee2mqtt/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
+  - volume.yaml
+  - prometheus-rule.yaml
+patchesStrategicMerge:
+  - patches/env.yaml
+  - patches/exporter.yaml

kubernetes/cluster-0/apps/home-automation/zigbee2mqtt/patches/env.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: zigbee2mqtt
+  namespace: default
+spec:
+  values:
+    env:
+      TZ: "${TIMEZONE}"
+      ZIGBEE2MQTT_DATA: /data
+      ZIGBEE2MQTT_CONFIG_ADVANCED_HOMEASSISTANT_DISCOVERY_TOPIC: homeassistant
+      ZIGBEE2MQTT_CONFIG_ADVANCED_HOMEASSISTANT_LEGACY_ENTITY_ATTRIBUTES: "true"
+      ZIGBEE2MQTT_CONFIG_ADVANCED_HOMEASSISTANT_LEGACY_TRIGGERS: "true"
+      ZIGBEE2MQTT_CONFIG_ADVANCED_HOMEASSISTANT_STATUS_TOPIC: homeassistant/status
+      ZIGBEE2MQTT_CONFIG_ADVANCED_LAST_SEEN: ISO_8601
+      ZIGBEE2MQTT_CONFIG_ADVANCED_LEGACY_API: "false"
+      ZIGBEE2MQTT_CONFIG_ADVANCED_LEGACY_AVAILABILITY_PAYLOAD: "false"
+      ZIGBEE2MQTT_CONFIG_ADVANCED_LOG_LEVEL: warn
+      ZIGBEE2MQTT_CONFIG_ADVANCED_LOG_OUTPUT: '["console"]'
+      ZIGBEE2MQTT_CONFIG_ADVANCED_NETWORK_KEY: "[204, 61, 75, 23, 44, 230, 24, 203, 53, 5, 248, 32, 50, 84, 44, 159]"
+      ZIGBEE2MQTT_CONFIG_AVAILABILITY_ACTIVE_TIMEOUT: 60
+      ZIGBEE2MQTT_CONFIG_AVAILABILITY_PASSIVE_TIMEOUT: 2000
+      ZIGBEE2MQTT_CONFIG_DEVICE_OPTIONS_LEGACY: "false"
+      ZIGBEE2MQTT_CONFIG_DEVICE_OPTIONS_RETAIN: "true"
+      ZIGBEE2MQTT_CONFIG_EXPERIMENTAL_NEW_API: "true"
+      ZIGBEE2MQTT_CONFIG_FRONTEND_PORT: 8080
+      ZIGBEE2MQTT_CONFIG_FRONTEND_URL: "https://zigbee.${SECRET_CLUSTER_DOMAIN}"
+      ZIGBEE2MQTT_CONFIG_HOMEASSISTANT: "true"
+      ZIGBEE2MQTT_CONFIG_MQTT_INCLUDE_DEVICE_INFORMATION: "true"
+      ZIGBEE2MQTT_CONFIG_MQTT_KEEPALIVE: 60
+      ZIGBEE2MQTT_CONFIG_MQTT_REJECT_UNAUTHORIZED: "true"
+      ZIGBEE2MQTT_CONFIG_MQTT_SERVER: "mqtt://emqx.default.svc.cluster.local."
+      ZIGBEE2MQTT_CONFIG_MQTT_VERSION: 5
+      ZIGBEE2MQTT_CONFIG_MQTT_USER:
+        valueFrom:
+          secretKeyRef:
+            name: emqx-config
+            key: user_1_username
+      ZIGBEE2MQTT_CONFIG_MQTT_PASSWORD:
+        valueFrom:
+          secretKeyRef:
+            name: emqx-config
+            key: user_1_password
+      ZIGBEE2MQTT_CONFIG_PERMIT_JOIN: "false"
+      ZIGBEE2MQTT_CONFIG_SERIAL_PORT: /dev/serial/by-id/usb-1a86_USB_Serial-if00-port0
+
+      # ZIGBEE2MQTT_CONFIG_DEVICES: devices.yaml
+      # ZIGBEE2MQTT_CONFIG_GROUPS: groups.yaml

kubernetes/cluster-0/apps/home-automation/zigbee2mqtt/patches/exporter.yaml

@@ -0,0 +1,39 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app zigbee2mqtt
+  namespace: default
+spec:
+  values:
+    additionalContainers:
+      exporter:
+        name: exporter
+        image: docker.io/kpetrem/mqtt-exporter:latest@sha256:c70814150116a96e09292d08571a9e04f7df0048f152f7af2f167c09ad4ac95f
+        env:
+          - name: LOG_LEVEL
+            value: DEBUG
+          - name: LOG_MQTT_MESSAGE
+            value: "True"
+          - name: MQTT_ADDRESS
+            value: emqx.default.svc.cluster.local
+          - name: MQTT_TOPIC
+            value: "zigbee2mqtt/#"
+          - name: MQTT_V5_PROTOCOL
+            value: "True"
+          - name: MQTT_USERNAME
+            valueFrom:
+              secretKeyRef:
+                name: emqx-config
+                key: user_1_username
+          - name: MQTT_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: emqx-config
+                key: user_1_password
+          - name: PROMETHEUS_PORT
+            value: &port 80
+          - name: PROMETHEUS_PREFIX
+            value: zigbee2mqtt_
+          - name: ZIGBEE2MQTT_AVAILABILITY
+            value: "True"

kubernetes/cluster-0/apps/home-automation/zigbee2mqtt/prometheus-rule.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: zigbee2mqtt-exporter
+  namespace: default
+spec:
+  groups:
+    - name: zigbee2mqtt-exporter.rules
+      rules:
+        - alert: Zigbee2MqttExporterAbsent
+          annotations:
+            summary: Zigbee2Mqtt Exporter has disappeared from Prometheus target discovery.
+          expr: absent(up{job=~".*mqtt-exporter.*"} == 1)
+          for: 15m
+          labels:
+            severity: critical
+        - alert: Zigbee2MqttUnavailable
+          annotations:
+            summary: The zigbee device connection is lost,
+              connection on topic {{$labels.topic}} is down.
+          expr: zigbee2mqtt_zigbee_availability == 0
+          for: 60m
+          labels:
+            severity: critical
+        - alert: Zigbee2MqttBatteryLow
+          annotations:
+            summary: The zigbee device battery level is low,
+              battery level on topic {{$labels.topic}} is at {{$value}}%.
+          expr: zigbee2mqtt_battery < 10
+          for: 60m
+          labels:
+            severity: warning

kubernetes/cluster-0/apps/home-automation/zigbee2mqtt/volume.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: zigbee2mqtt-config
+  namespace: default
+  labels:
+    app.kubernetes.io/name: &name zigbee2mqtt
+    app.kubernetes.io/instance: *name
+    snapshot.home.arpa/enabled: "true"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block
+  resources:
+    requests:
+      storage: 1Gi

kubernetes/cluster-0/apps/home-automation/zwavejs2mqtt/helm-release.yaml

@@ -0,0 +1,102 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app zwavejs2mqtt
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.0.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: node-feature-discovery
+      namespace: default
+    - name: emqx
+      namespace: default
+  values:
+    image:
+      repository: ghcr.io/zwave-js/zwave-js-ui
+      tag: 8.4.1
+    env:
+      TZ: "${TIMEZONE}"
+    service:
+      main:
+        ports:
+          http:
+            port: &port 8091
+          websocket:
+            enabled: true
+            port: 3000
+    serviceMonitor:
+      main:
+        enabled: true
+    probes:
+      liveness: &probes
+        enabled: true
+        custom: true
+        spec:
+          httpGet:
+            path: /health
+            port: *port
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 3
+      readiness: *probes
+      startup:
+        enabled: false
+    ingress:
+      main:
+        enabled: true
+        ingressClassName: "nginx"
+        annotations:
+          auth.home.arpa/enabled: "true"
+        hosts:
+          - host: &host "zwave.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+    securityContext:
+      privileged: true
+    persistence:
+      config:
+        enabled: true
+        existingClaim: zwavejs2mqtt-config
+        mountPath: /usr/src/app/store
+      usb:
+        enabled: true
+        type: hostPath
+        hostPath: /dev/serial/by-id/usb-0658_0200-if00
+        hostPathType: CharDevice
+        mountPath: /dev/ttyUSB0
+    resources:
+      requests:
+        cpu: 10m
+        memory: 100Mi
+      limits:
+        memory: 500Mi
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: feature.node.kubernetes.io/custom-zwave
+                  operator: In
+                  values:
+                    - "true"

kubernetes/cluster-0/apps/home-automation/zwavejs2mqtt/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
+  - volume.yaml

kubernetes/cluster-0/apps/home-automation/zwavejs2mqtt/volume.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: zwavejs2mqtt-config
+  namespace: default
+  labels:
+    app.kubernetes.io/name: &name zwavejs2mqtt
+    app.kubernetes.io/instance: *name
+    snapshot.home.arpa/enabled: "true"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block
+  resources:
+    requests:
+      storage: 1Gi