✨ new talos cluster

kubernetes/cluster-0/apps/home-automation/home-assistant/helm-release.yaml

@@ -0,0 +1,106 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app home-assistant
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.0.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: emqx
+      namespace: default
+    - name: postgres-cluster
+      namespace: default
+  values:
+    image:
+      repository: ghcr.io/onedr0p/home-assistant
+      tag: 2022.11.3@sha256:2ad10631a2b574b77baab79145d8b773ff7307f6d52542d0b458f599ce689d26
+    env:
+      TZ: "${TIMEZONE}"
+      POSTGRES_HOST: postgres-rw.default.svc.cluster.local.
+      POSTGRES_DB: home_assistant
+    envFrom:
+      - secretRef:
+          name: *app
+    service:
+      main:
+        type: LoadBalancer
+        loadBalancerIP: ${CLUSTER_LB_HASS}
+        externalTrafficPolicy: Local
+        ports:
+          http:
+            port: 8123
+    ingress:
+      main:
+        enabled: true
+        ingressClassName: "nginx"
+        hosts:
+          - host: &host "hass.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+          - host: &host2 "home-assistant.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+              - *host2
+    probes:
+      liveness:
+        enabled: false
+      readiness:
+        enabled: false
+      startup:
+        enabled: false
+    podSecurityContext:
+      runAsUser: 0
+      runAsGroup: 0
+      fsGroup: 0
+      fsGroupChangePolicy: "OnRootMismatch"
+    securityContext:
+      privileged: true
+    podAnnotations:
+      secret.reloader.stakater.com/reload: *app
+    persistence:
+      config:
+        enabled: true
+        existingClaim: hass-config
+      usb:
+        enabled: true
+        type: hostPath
+        hostPath: /dev/serial/by-id/usb-Arduino__www.arduino.cc__0042_5503731323735171A241-if00
+        hostPathType: CharDevice
+        mountPath: /dev/ttyUSB0
+    resources:
+      requests:
+        cpu: 10m
+        memory: 100Mi
+      limits:
+        memory: 750Mi
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - {
+                    key: "feature.node.kubernetes.io/custom-rflink",
+                    operator: In,
+                    values: ["true"],
+                  }

kubernetes/cluster-0/apps/home-automation/home-assistant/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secret.sops.yaml
+  - helm-release.yaml
+  - volume.yaml
+  - token.sops.yaml
+  - podmonitor.yaml
+patchesStrategicMerge:
+  - patches/postgres.yaml

kubernetes/cluster-0/apps/home-automation/home-assistant/patches/postgres.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app home-assistant
+  namespace: default
+spec:
+  values:
+    initContainers:
+      init-db:
+        image: ghcr.io/onedr0p/postgres-initdb:14.5
+        env:
+          - name: POSTGRES_HOST
+            value: postgres-rw.default.svc.cluster.local.
+          - name: POSTGRES_DB
+            value: home_assistant
+          - name: POSTGRES_SUPER_PASS
+            valueFrom:
+              secretKeyRef:
+                name: postgres-superuser
+                key: password
+        envFrom:
+          - secretRef:
+              name: *app

kubernetes/cluster-0/apps/home-automation/home-assistant/podmonitor.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: home-assistant
+  namespace: default
+spec:
+  podMetricsEndpoints:
+    - interval: 1m
+      path: /api/prometheus
+      port: http
+      scrapeTimeout: 30s
+      bearerTokenSecret:
+        name: home-automation
+        key: prometheus-token
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: home-assistant
+      app.kubernetes.io/name: home-assistant

kubernetes/cluster-0/apps/home-automation/home-assistant/secret.sops.yaml

@@ -0,0 +1,34 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: home-assistant
+    namespace: default
+stringData:
+    HASS_SECRET_LATITUDE: ENC[AES256_GCM,data:/tafIrcH0xz+rHHUTz3wdi4=,iv:HyRcQcOvfWi6X2Y+PCILYtcB9WvrZVoZmN7DH31NdrA=,tag:QjsavnTkBCAE3xdl7YtQyg==,type:str]
+    HASS_SECRET_LONGITUDE: ENC[AES256_GCM,data:Ya0P5TJ2PcD2gbD6yNi5M44=,iv:ZnMO4G3I4jNc52q0J2UBAScJs3nrZnB1zFlbh6hkJmI=,tag:0Y00oMSmtP1wdY3cP84sgw==,type:str]
+    HASS_SECRET_ELEVATION: ENC[AES256_GCM,data:ruU=,iv:4yDZLOGfHcGXcGNuQVBmFrg3HgSpGXhsB9cwlliplVc=,tag:4f4zrnIosO3kWh9BGNz7Rw==,type:str]
+    HASS_SECRET_URL: ENC[AES256_GCM,data:WTi34088t3P1mSsuuo/+U/qpMnwpmPw7Udeul2BBlwU2TG4tIr8QL65RTVVrnLM=,iv:eAcvCs5C1g+jdNJH3b4CZMFoicfgy7DUmtCZJnL9Exo=,tag:k5KY9cbRgzHosZAxkgAlAQ==,type:str]
+    HASS_SECRET_DB_URL: ENC[AES256_GCM,data:Nl7EMtmX2U1LHLsSsIk3MbBshcR2CuOhDogrb1i9elZyP2DRlS995lerl9T8mQ98XK9HuU/qTwJAj4JUP9FikcAJpIS0Fspf9IwNai1uhQ4/RWA9d5NsgjuGhv7eueQiNg==,iv:wxT4Yf4V5RAIRbZmBS1GikzhbQEsGu7tTwKIRePKnH0=,tag:oMvx5G2p5ASckOp8vhkilA==,type:str]
+    POSTGRES_USER: ENC[AES256_GCM,data:6sFSx8XfWgkgifgAk+o=,iv:qdUCWatQb7XWskKMKUBvDQ1JqKxH5zoSznop3KRkgM4=,tag:KpeLOhEWpE5petnB3bXnRA==,type:str]
+    POSTGRES_PASS: ENC[AES256_GCM,data:cNW97km2wZz+uHnX0Hzl7g==,iv:40HsF3DN96JLnGwLMUhx3cq2hdFbPXSasn6CJuCO7Uo=,tag:4NyuUCHryWMxYBkW8vjCXA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNRm1nQmk0eE1OUVRlbmkw
+            M3RQOFc4NXJrS3lHR09QdGttNEp0YTZzNWp3ClZaQ2hxWEIzNlNSNXhONlE4QzNn
+            OVQ1ZEphd1lQR2tFMEppZS9nUy9GTFUKLS0tIEJxdXlqQURxbVlmSlJ3S3NEYWtB
+            SjVvc0k0dk1GeXF0Z3gycHVJSXRtNTgKJScEOU0jr7qw4fdBbtKfE5lI1gVLIQ1g
+            cklawiOzeLg+v+5ZmuAOk5k6VIUUNMpcrAfEbI84JRWCFRm1IngMwQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-09-14T17:35:30Z"
+    mac: ENC[AES256_GCM,data:yLIhWrFqNWF1IT/XyKyM0j5QKdnbM0pKSQd7s9Xx+G8/O9rnlBOTGyWgwazBbw83xW/BZ906TD9f7o6uAtdbLRarX2kw248oUGCuTK8EpyX+ake59OFiyLHya/XWZqpRL0/uC08467ecPdhzFb0NnrJgVfL1DW7dBwGY3fLyZBU=,iv:cq7RmU+HCR+PL7xR7PRcpQ7904YAz1qwvSBDFi93bqQ=,tag:WUiLYFXIC0y2+909Y3GW5g==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/cluster-0/apps/home-automation/home-assistant/token.sops.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: home-automation
+    namespace: default
+stringData:
+    prometheus-token: ENC[AES256_GCM,data:XQS2cNao60Cw3oWPBG3qRs69u4ZhBB8qWm5s6z13CDomfcdfA60YSSU7Vtcdb8E7wnI2t/X3Kul8Vlt8evYv/Tkh5UN1oiqa+upFQ/tOlIHFmRfz1snE5XlREc/sB2FN8xUIDRdHObfwz9NcfEcrt0MP+1mXN1IUIA5BDAAFT05TALeUjdY3CTfht6idIFlqs3YN2uvfDYoq5nKIN4J3uN0rWJI46BD+FnmpE243ChM+Cn1NS2sa,iv:lcCmW8TASJHWgOjs9qRh1XaGqPpCHn9HkU+Ma+Iqyv0=,tag:bRNDK8TEyHIMZlixYRDGGw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQWjZ1RG9QZnBQSUNNSHN4
+            MTdwMDlvaGk4NEVxdmdZOGR1QnpLNFkzOTNZCjhZeEloeWQzemp1cVJrbEpxbWJB
+            T3NXRkRxTU54MGxUbk45YTJoQkl2dWMKLS0tIFkzQ0hvQWdxK2NKQlVlNWhUODQ3
+            RDRiUkRFSVI4S29mdWRMbE9RNFhLQlUKcx+FKlWUqt5YOxIKlvNiexCarLnW3FXU
+            M+lPXuGDvjo2Pg5InhPCheuxSVxea85uRRmROTWWOfjMKNYyfMiXLw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-09-14T12:31:34Z"
+    mac: ENC[AES256_GCM,data:iTSj6ouARsJb6RN4ZoZ2hlOvkZ/LaABtvbR7VaLIC9FOdDlW68jYYyQpR2IkzG8RynHFGX8WcqxqImpN1pTWN+MHHEzFwhVhXdx5u/Utvt61W/TCmLE1C48f4IIoIRAvstWbi3h4kupo23O6GA53XatHprBPfgf+IC29FoLBoA0=,iv:AOD+DHbaw4kAveVGVB0WtQot+/MhOleTNp3tCCymKy0=,tag:AzhQeX1SI57yJusRGz/uUQ==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/cluster-0/apps/home-automation/home-assistant/volume.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: hass-config
+  namespace: default
+  labels:
+    app.kubernetes.io/name: &name home-assistant
+    app.kubernetes.io/instance: *name
+    snapshot.home.arpa/enabled: "true"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block
+  resources:
+    requests:
+      storage: 10Gi