♻️ home-automation

.github/renovate.json5

@@ -82,26 +82,15 @@
       "commitMessageExtra": "to {{newVersion}}"
     },
     // custom versioning
-    {
-      "matchDatasources": ["docker"],
-      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-(?<compatibility>.*)$",
-      "matchPackageNames": ["blakeblackshear/frigate"]
-    },
-    {
-      "matchDatasources": ["docker"],
-      "versioning": "regex:^RELEASE\\.(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)T.*Z(-(?<compatibility>.*))?$",
-      "matchPackageNames": ["quay.io/minio/minio"]
-    },
     {
       "matchDatasources": ["docker"],
       "versioning": "loose",
-      "matchPackageNames": ["ghcr.io/k8s-at-home/qbittorrent"]
+      "matchPackageNames": ["ghcr.io/onedr0p/qbittorrent"]
     },
     {
       "matchDatasources": ["docker"],
       "versioning": "regex:^version-v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
       "matchPackageNames": [
-        "ghcr.io/linuxserver/bookstack",
         "ghcr.io/linuxserver/calibre",
         "ghcr.io/linuxserver/healthchecks"
       ]

cluster/apps/home-automation/emqx/helm-release.yaml

@@ -29,8 +29,8 @@ spec:
     emqxConfig:
       EMQX_ALLOW_ANONYMOUS: "false"
       EMQX_AUTH__MNESIA__PASSWORD_HASH: plain
-      EMQX_AUTH__USER__1__USERNAME: "${SECRET_MQTT_USERNAME}"
+      EMQX_AUTH__USER__1__USERNAME: ${SECRET_MQTT_USER}
-      EMQX_AUTH__USER__1__PASSWORD: "${SECRET_MQTT_PASSWORD}"
+      EMQX_AUTH__USER__1__PASSWORD: ${SECRET_MQTT_PASSWORD}
     service:
       type: LoadBalancer
       externalIPs:

cluster/apps/home-automation/emqx/secret.sops.yaml

@@ -6,6 +6,8 @@ metadata:
     namespace: default
 stringData:
     admin_password: ENC[AES256_GCM,data:5CgeNci9Mr9bhHLG/cl9yajr02CInvng,iv:tzU2NnmprFiVfnxgXP8y+o2wgwooaWVpvq6+fKodLC8=,tag:MkDFv5wOn4B6yWUMfivQGA==,type:str]
+    user_1_username: ENC[AES256_GCM,data:np5xaBR5Ze8ml9UY8w==,iv:fmxB+fop4lc81BJnVataRvbtlaCaqfB8xL1AoFkuDDQ=,tag:00XN9H0wKoypgz7fUW4NGQ==,type:str]
+    user_1_password: ENC[AES256_GCM,data:NilXDCtXR0j+pWQYhesSogoWNQ==,iv:79TXQXTqYbzaLfMfQ/ZF5EP1UmtYAJ0aYHrD4HrYw3c=,tag:VIH6Zx00vLlpFGS9yrDAfg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -21,8 +23,8 @@ sops:
             bXpSSjd3YU5hRXFKdnhVcTFKTzRqZzQKlFvt9rCRt+1EviAtZxaQVVwAEt300456
             KDHW7U58DUO3TmzTG47/iLj7AxIgCQKUjgaU6FoiQ/DZLaVCloyWEA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-09-14T08:51:36Z"
+    lastmodified: "2022-09-14T12:39:16Z"
-    mac: ENC[AES256_GCM,data:cwjeMMjPMPF2J0cc14XcQANFnhF59445engaEJAufIi8CH6rNvqzW/7fx6KqRIgeRMoNVInd5izn+rQKAvpLCFjsntpjvihE9AOIEsxHYkZ7S6wxzDtffeEDMKPq9ybemkRkqUUWdIve2jZaFtsY5hndEmuWq+euvr4G3fqXeU4=,iv:ldP/x68he76ObwJ8dFuWL6+y87yTLsmkoABKFmmxVQY=,tag:COn18dD88/Oa7hYp8/bjdg==,type:str]
+    mac: ENC[AES256_GCM,data:0dG5L2JMoLlTVR4RqxbCGLQAe+NR0wHKGUwCUO0+5tDS/klaUvMAaQQkQZd2UDXeK6nyrb0pQA5i6sgqrv6znT6TToMA1vujHbuXe7S7+zVVfU0nIEsPomQWSxaqLP0FSvfqJ06Q3SftLusnnAFrwo1SHfvinIl2XcA0fJWJ/dk=,iv:407K+60IDcnxm5bo1woKMVUySxWHavFr5eFcN2VhA+Q=,tag:fwPcZ4D5XeWMFwluUcaTGA==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.7.3

cluster/apps/home-automation/frigate/config.yaml

@@ -5,7 +5,7 @@ logger:
     frigate.record: debug
 
 mqtt:
-  host: emqx
+  host: emqx.default.svc.cluster.local
   topic_prefix: frigate
   user: "{MQTT_USER}"
   password: "{MQTT_PASSWORD}"
@@ -18,16 +18,11 @@ detectors:
     type: edgetpu
     device: usb
 
-objects:
-  track:
-    - person
-  filters:
-    person:
-      min_area: 2500
-      max_area: 100000
-      threshold: 0.7
-
 ffmpeg:
+  global_args:
+    - -hide_banner
+    - -loglevel
+    - warning
   hwaccel_args:
     - -hwaccel
     - vaapi
@@ -35,44 +30,29 @@ ffmpeg:
     - /dev/dri/renderD128
     - -hwaccel_output_format
     - yuv420p
-  # Enable audio on recordings...
+  # https://github.com/blakeblackshear/frigate/issues/3296
-  # might cause issues on recording playback
+  output_args:
-  # output_args:
+    record: -f segment -segment_time 10 -segment_format mp4 -reset_timestamps 1 -strftime 1 -c:v copy -ar 44100 -c:a aac
-  #   record: -f segment -segment_time 10 -segment_format mp4 -reset_timestamps 1 -strftime 1 -c:v copy -c:a aac
+    rtmp: -c:v copy -f flv -ar 44100 -c:a aac
 
 rtmp:
   enabled: true
 
-# snapshots:
+record:
-#   enabled: true
+  enabled: true
-#   timestamp: false
+  retain:
-#   bounding_box: true
+    days: 3
-#   retain:
+    mode: all
-#     default: 7
+  events:
+    retain:
+      default: 7
+      mode: active_objects
 
-# record:
+objects:
-#   enabled: true
+  track:
-#   retain:
+    - person
-#     days: 2
+  filters:
-#     mode: motion
+    person:
-#   events:
+      min_area: 5000
-#     retain:
+      max_area: 100000
-#       default: 5
+      threshold: 0.7
-#       mode: active_objects
-
-cameras:
-  # --
-  frigate_river:
-    ffmpeg:
-      inputs:
-        - path: rtsp://192.168.1.2:7447/GtBsJuujvMQwA42n
-          roles:
-            - detect
-        - path: rtsp://192.168.1.2:7447/b2K0uh13iekTbyA1
-          roles:
-            - rtmp
-            - record
-    detect:
-      width: 1024
-      height: 576
-      fps: 10

cluster/apps/home-automation/frigate/helm-release.yaml

@@ -3,27 +3,39 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: &app frigate
-  namespace: home-automation
+  namespace: default
 spec:
-  interval: 5m
+  interval: 15m
   chart:
     spec:
-      chart: kah-common-chart
+      chart: app-template
-      version: 1.2.2
+      version: 0.1.1
       sourceRef:
         kind: HelmRepository
-        name: k8s-at-home-charts
+        name: bjw-s-charts
         namespace: flux-system
-      interval: 5m
   install:
     createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: emqx
+      namespace: default
+    - name: intel-gpu-plugin
+      namespace: default
+    - name: node-feature-discovery
+      namespace: default
   values:
     fullnameOverride: *app
     image:
       repository: docker.io/blakeblackshear/frigate
-      tag: 0.10.1-amd64
+      tag: 0.11.0-rc2
     env:
       TZ: "${TIMEZONE}"
+      LIBVA_DRIVER_NAME: i965
       MQTT_USER: "${SECRET_MQTT_USERNAME}"
       MQTT_PASSWORD: ${SECRET_MQTT_PASSWORD}
     service:
@@ -32,18 +44,7 @@ spec:
           http:
             port: &port 5000
     probes:
-      liveness:
+      liveness: &probes
-        enabled: true
-        custom: true
-        spec:
-          httpGet:
-            path: /api/version
-            port: *port
-          initialDelaySeconds: 0
-          periodSeconds: 10
-          timeoutSeconds: 1
-          failureThreshold: 3
-      readiness:
         enabled: true
         custom: true
         spec:
@@ -54,24 +55,17 @@ spec:
           periodSeconds: 10
           timeoutSeconds: 1
           failureThreshold: 3
+      readiness: *probes
       startup:
-        enabled: true
+        enabled: false
-        custom: true
-        spec:
-          httpGet:
-            path: /api/version
-            port: *port
-          failureThreshold: 30
-          periodSeconds: 10
     ingress:
       main:
         enabled: true
         ingressClassName: "nginx"
         annotations:
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.default.svc.cluster.local/api/verify"
+          auth.home.arpa/enabled: "true"
-          nginx.ingress.kubernetes.io/auth-signin: "https://auth.${SECRET_CLUSTER_DOMAIN}"
         hosts:
-          - host: &host "frigate.${SECRET_CLUSTER_DOMAIN}"
+          - host: &host "{{ .Release.Name }}.${SECRET_CLUSTER_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
@@ -116,9 +110,9 @@ spec:
                     - "true"
     resources:
       requests:
-        cpu: 500m
+        cpu: 100m
-        memory: 1000Mi
+        memory: 1Gi
         gpu.intel.com/i915: "1"
       limits:
-        memory: 6000Mi
+        memory: 6Gi
         gpu.intel.com/i915: "1"

cluster/apps/home-automation/frigate/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 resources:
   - volume.yaml
   - helm-release.yaml
-namespace: home-automation
+namespace: default
 configMapGenerator:
   - name: frigate
     files:

cluster/apps/home-automation/frigate/volume.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: frigate-config
-  namespace: home-automation
+  namespace: default
   labels:
     kasten-io/backup: "true"
 spec:
@@ -12,4 +12,4 @@ spec:
   storageClassName: rook-ceph-block
   resources:
     requests:
-      storage: 1Gi
+      storage: 5Gi

cluster/apps/home-automation/home-assistant-code/helm-release.yaml

@@ -0,0 +1,85 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app home-assistant-code
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 0.1.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s-charts
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: home-assistant
+      namespace: default
+  values:
+    image:
+      repository: ghcr.io/coder/code-server
+      tag: 4.7.0
+    env:
+      TZ: "${TIMEZONE}"
+    args:
+      - --auth
+      - "none"
+      - --user-data-dir
+      - "/config/.vscode"
+      - --extensions-dir
+      - "/config/.vscode"
+      - --port
+      - "80"
+      - "/config"
+    service:
+      main:
+        ports:
+          http:
+            port: 80
+    ingress:
+      main:
+        enabled: true
+        ingressClassName: "nginx"
+        hosts:
+          - host: &host "hass-code.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+    podSecurityContext:
+      runAsUser: 0
+      runAsGroup: 0
+      fsGroup: 0
+    persistence:
+      config:
+        enabled: true
+        existingClaim: hass-config
+    affinity:
+      podAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values: ["home-assistant"]
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values: ["home-assistant"]
+            topologyKey: kubernetes.io/hostname
+    resources:
+      requests:
+        cpu: 10m
+        memory: 100Mi
+      limits:
+        memory: 500Mi

cluster/apps/home-automation/home-assistant-code/kustomization.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml

cluster/apps/home-automation/home-assistant/helm-release.yaml

@@ -2,73 +2,67 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
-  name: home-assistant
+  name: &app home-assistant
-  namespace: home-automation
+  namespace: default
 spec:
-  interval: 5m
+  interval: 15m
   chart:
     spec:
-      # renovate: registryUrl=https://k8s-at-home.com/charts/
+      chart: app-template
-      chart: home-assistant
+      version: 0.1.1
-      version: 13.4.2
       sourceRef:
         kind: HelmRepository
-        name: k8s-at-home-charts
+        name: bjw-s-charts
         namespace: flux-system
-      interval: 5m
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: emqx
+      namespace: default
+    - name: postgres
+      namespace: default
   values:
     image:
-      repository: ghcr.io/home-assistant/home-assistant
+      repository: ghcr.io/onedr0p/home-assistant
-      tag: 2022.9.2
+      tag: 2022.9.2@sha256:f352e0d02860ed5aa73cbbf0a4b63728c9bf42a5367f9639dbaddf62f143289f
-
     env:
       TZ: "${TIMEZONE}"
-      HASS_SECRET_URL: https://home-assistant.${SECRET_CLUSTER_DOMAIN}
+      POSTGRES_HOST: postgres-rw.default.svc.cluster.local
-      HASS_SECRET_LATITUDE: ${SECRET_HASS_LATITUDE}
+      POSTGRES_DB: home_assistant
-      HASS_SECRET_LONGITUDE: ${SECRET_HASS_LONGITUDE}
+    envFrom:
-      HASS_SECRET_ELEVATION: ${SECRET_HASS_ELEVATION}
+      - secretRef:
-      HASS_SECRET_MQTT_USERNAME: ${SECRET_MQTT_USERNAME}
+          name: *app
-      HASS_SECRET_MQTT_PASSWORD: ${SECRET_MQTT_PASSWORD}
-      HASS_SECRET_DB_URL: ${SECRET_HASS_DB_URL}
-
-    hostNetwork: true
-    dnsPolicy: ClusterFirstWithHostNet
-
-    securityContext:
-      privileged: true
-
     service:
       main:
-        annotations:
-          prometheus.io/probe: "true"
-          prometheus.io/protocol: tcp
         type: LoadBalancer
         externalIPs:
           - ${CLUSTER_LB_HASS}
         externalTrafficPolicy: Local
-
+        ports:
+          http:
+            port: 8123
     ingress:
       main:
         enabled: true
         ingressClassName: "nginx"
         hosts:
-          - host: "hass.${SECRET_CLUSTER_DOMAIN}"
+          - host: &host "hass.${SECRET_CLUSTER_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
-          - host: "home-assistant.${SECRET_CLUSTER_DOMAIN}"
+          - host: &host2 "home-assistant.${SECRET_CLUSTER_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
         tls:
           - hosts:
-              - "hass.${SECRET_CLUSTER_DOMAIN}"
+              - *host
-              - "home-assistant.${SECRET_CLUSTER_DOMAIN}"
+              - *host2
-
-    prometheus:
-      serviceMonitor:
-        enabled: false
-
     probes:
       liveness:
         enabled: false
@@ -76,10 +70,15 @@ spec:
         enabled: false
       startup:
         enabled: false
-
+    podSecurityContext:
-    postgresql:
+      runAsUser: 0
-      enabled: false
+      runAsGroup: 0
-
+      fsGroup: 0
+      fsGroupChangePolicy: "OnRootMismatch"
+    securityContext:
+      privileged: true
+    podAnnotations:
+      secret.reloader.stakater.com/reload: *app
     persistence:
       config:
         enabled: true
@@ -90,44 +89,12 @@ spec:
         hostPath: /dev/serial/by-id/usb-Arduino__www.arduino.cc__0042_5503731323735171A241-if00
         hostPathType: CharDevice
         mountPath: /dev/ttyUSB0
-
-    addons:
-      codeserver:
-        enabled: true
-        image:
-          repository: ghcr.io/k8s-at-home/code-server
-          tag: v4.6.0
-        workingDir: "/config"
-        args:
-          - --auth
-          - "none"
-          - --user-data-dir
-          - "/config/.vscode"
-          - --extensions-dir
-          - "/config/.vscode"
-        ingress:
-          enabled: true
-          ingressClassName: "nginx"
-          annotations:
-            nginx.ingress.kubernetes.io/auth-url: "http://authelia.default.svc.cluster.local/api/verify"
-            nginx.ingress.kubernetes.io/auth-signin: "https://auth.${SECRET_CLUSTER_DOMAIN}"
-          hosts:
-            - host: "hass-config.${SECRET_CLUSTER_DOMAIN}"
-              paths:
-                - path: /
-                  pathType: Prefix
-          tls:
-            - hosts:
-                - "hass-config.${SECRET_CLUSTER_DOMAIN}"
-        volumeMounts:
-          - name: config
-            mountPath: /config
-
     resources:
       requests:
-        cpu: 500m
+        cpu: 10m
-        memory: 1000Mi
+        memory: 100Mi
-
+      limits:
+        memory: 750Mi
     affinity:
       nodeAffinity:
         requiredDuringSchedulingIgnoredDuringExecution:

cluster/apps/home-automation/home-assistant/kustomization.yaml

@@ -1,7 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - secret.sops.yaml
   - helm-release.yaml
   - volume.yaml
   - token.sops.yaml
   - podmonitor.yaml
+patchesStrategicMerge:
+  - patches/postgres.yaml

cluster/apps/home-automation/home-assistant/patches/postgres.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app home-assistant
+  namespace: default
+spec:
+  values:
+    initContainers:
+      init-db:
+        image: ghcr.io/onedr0p/postgres-initdb:14.5
+        env:
+          - name: POSTGRES_HOST
+            value: postgres-rw.default.svc.cluster.local
+          - name: POSTGRES_DB
+            value: home_assistant
+          - name: POSTGRES_SUPER_PASS
+            valueFrom:
+              secretKeyRef:
+                name: postgres-superuser
+                key: password
+        envFrom:
+          - secretRef:
+              name: *app

cluster/apps/home-automation/home-assistant/podmonitor.yaml

@@ -3,7 +3,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: PodMonitor
 metadata:
   name: home-assistant
-  namespace: home-automation
+  namespace: default
 spec:
   podMetricsEndpoints:
     - interval: 1m

cluster/apps/home-automation/home-assistant/secret.sops.yaml

@@ -0,0 +1,34 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: home-assistant
+    namespace: default
+stringData:
+    HASS_SECRET_LATITUDE: ENC[AES256_GCM,data:/tafIrcH0xz+rHHUTz3wdi4=,iv:HyRcQcOvfWi6X2Y+PCILYtcB9WvrZVoZmN7DH31NdrA=,tag:QjsavnTkBCAE3xdl7YtQyg==,type:str]
+    HASS_SECRET_LONGITUDE: ENC[AES256_GCM,data:Ya0P5TJ2PcD2gbD6yNi5M44=,iv:ZnMO4G3I4jNc52q0J2UBAScJs3nrZnB1zFlbh6hkJmI=,tag:0Y00oMSmtP1wdY3cP84sgw==,type:str]
+    HASS_SECRET_ELEVATION: ENC[AES256_GCM,data:ruU=,iv:4yDZLOGfHcGXcGNuQVBmFrg3HgSpGXhsB9cwlliplVc=,tag:4f4zrnIosO3kWh9BGNz7Rw==,type:str]
+    HASS_SECRET_URL: ENC[AES256_GCM,data:WTi34088t3P1mSsuuo/+U/qpMnwpmPw7Udeul2BBlwU2TG4tIr8QL65RTVVrnLM=,iv:eAcvCs5C1g+jdNJH3b4CZMFoicfgy7DUmtCZJnL9Exo=,tag:k5KY9cbRgzHosZAxkgAlAQ==,type:str]
+    HASS_SECRET_DB_URL: ENC[AES256_GCM,data:Nl7EMtmX2U1LHLsSsIk3MbBshcR2CuOhDogrb1i9elZyP2DRlS995lerl9T8mQ98XK9HuU/qTwJAj4JUP9FikcAJpIS0Fspf9IwNai1uhQ4/RWA9d5NsgjuGhv7eueQiNg==,iv:wxT4Yf4V5RAIRbZmBS1GikzhbQEsGu7tTwKIRePKnH0=,tag:oMvx5G2p5ASckOp8vhkilA==,type:str]
+    POSTGRES_USER: ENC[AES256_GCM,data:6sFSx8XfWgkgifgAk+o=,iv:qdUCWatQb7XWskKMKUBvDQ1JqKxH5zoSznop3KRkgM4=,tag:KpeLOhEWpE5petnB3bXnRA==,type:str]
+    POSTGRES_PASS: ENC[AES256_GCM,data:cNW97km2wZz+uHnX0Hzl7g==,iv:40HsF3DN96JLnGwLMUhx3cq2hdFbPXSasn6CJuCO7Uo=,tag:4NyuUCHryWMxYBkW8vjCXA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNRm1nQmk0eE1OUVRlbmkw
+            M3RQOFc4NXJrS3lHR09QdGttNEp0YTZzNWp3ClZaQ2hxWEIzNlNSNXhONlE4QzNn
+            OVQ1ZEphd1lQR2tFMEppZS9nUy9GTFUKLS0tIEJxdXlqQURxbVlmSlJ3S3NEYWtB
+            SjVvc0k0dk1GeXF0Z3gycHVJSXRtNTgKJScEOU0jr7qw4fdBbtKfE5lI1gVLIQ1g
+            cklawiOzeLg+v+5ZmuAOk5k6VIUUNMpcrAfEbI84JRWCFRm1IngMwQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-09-14T17:35:30Z"
+    mac: ENC[AES256_GCM,data:yLIhWrFqNWF1IT/XyKyM0j5QKdnbM0pKSQd7s9Xx+G8/O9rnlBOTGyWgwazBbw83xW/BZ906TD9f7o6uAtdbLRarX2kw248oUGCuTK8EpyX+ake59OFiyLHya/XWZqpRL0/uC08467ecPdhzFb0NnrJgVfL1DW7dBwGY3fLyZBU=,iv:cq7RmU+HCR+PL7xR7PRcpQ7904YAz1qwvSBDFi93bqQ=,tag:WUiLYFXIC0y2+909Y3GW5g==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

cluster/apps/home-automation/home-assistant/token.sops.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Secret
 metadata:
     name: home-automation
-    namespace: home-automation
+    namespace: default
 stringData:
     prometheus-token: ENC[AES256_GCM,data:XQS2cNao60Cw3oWPBG3qRs69u4ZhBB8qWm5s6z13CDomfcdfA60YSSU7Vtcdb8E7wnI2t/X3Kul8Vlt8evYv/Tkh5UN1oiqa+upFQ/tOlIHFmRfz1snE5XlREc/sB2FN8xUIDRdHObfwz9NcfEcrt0MP+1mXN1IUIA5BDAAFT05TALeUjdY3CTfht6idIFlqs3YN2uvfDYoq5nKIN4J3uN0rWJI46BD+FnmpE243ChM+Cn1NS2sa,iv:lcCmW8TASJHWgOjs9qRh1XaGqPpCHn9HkU+Ma+Iqyv0=,tag:bRNDK8TEyHIMZlixYRDGGw==,type:str]
 sops:
@@ -20,8 +20,8 @@ sops:
             RDRiUkRFSVI4S29mdWRMbE9RNFhLQlUKcx+FKlWUqt5YOxIKlvNiexCarLnW3FXU
             M+lPXuGDvjo2Pg5InhPCheuxSVxea85uRRmROTWWOfjMKNYyfMiXLw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-07-03T14:41:50Z"
+    lastmodified: "2022-09-14T12:31:34Z"
-    mac: ENC[AES256_GCM,data:rCAXrXozuI+YJwCDMWQeMvzC3Aoa/Eb89AQEBbLeOQMp7z5p7VCuzaSP52vsW50ii/Rr+VjgDEhoyVSiRAw9IoqcQCjNFZfW6nbXyKZIQGgSfiDKg5DrZLsLOJEg5JUX9u8zzVB2VyIpuDAtDrZHgmvBq+t/gSncSNzb7UW2Aw4=,iv:nkSndVS3YbIGPLMvPWwjgfRL8L5Qac71Jls1OBvX3s8=,tag:nmCKDjXBURMtQpQ5WfjHSg==,type:str]
+    mac: ENC[AES256_GCM,data:iTSj6ouARsJb6RN4ZoZ2hlOvkZ/LaABtvbR7VaLIC9FOdDlW68jYYyQpR2IkzG8RynHFGX8WcqxqImpN1pTWN+MHHEzFwhVhXdx5u/Utvt61W/TCmLE1C48f4IIoIRAvstWbi3h4kupo23O6GA53XatHprBPfgf+IC29FoLBoA0=,iv:AOD+DHbaw4kAveVGVB0WtQot+/MhOleTNp3tCCymKy0=,tag:AzhQeX1SI57yJusRGz/uUQ==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.7.3

cluster/apps/home-automation/home-assistant/volume.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: hass-config
-  namespace: home-automation
+  namespace: default
   labels:
     kasten-io/backup: "true"
 spec:

cluster/apps/home-automation/kustomization.yaml

@@ -1,9 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - namespace.yaml
   - emqx
   # - frigate
   - home-assistant
+  - home-assistant-code
   - zigbee2mqtt
+  - zigbee2mqtt-exporter
   - zwavejs2mqtt

cluster/apps/home-automation/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: home-automation

cluster/apps/home-automation/zigbee2mqtt-exporter/helm-release.yaml

@@ -0,0 +1,57 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app zigbee2mqtt-exporter
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 0.1.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s-charts
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: emqx
+      namespace: default
+    - name: zigbee2mqtt
+      namespace: default
+  values:
+    image:
+      repository: docker.io/kpetrem/mqtt-exporter
+      tag: latest@sha256:c70814150116a96e09292d08571a9e04f7df0048f152f7af2f167c09ad4ac95f
+    env:
+      LOG_LEVEL: DEBUG
+      LOG_MQTT_MESSAGE: "True"
+      MQTT_ADDRESS: emqx.default.svc.cluster.local
+      MQTT_TOPIC: "zigbee2mqtt/#"
+      MQTT_V5_PROTOCOL: "True"
+      MQTT_USERNAME: ${SECRET_MQTT_USER}
+      MQTT_PASSWORD: ${SECRET_MQTT_PASSWORD}
+      PROMETHEUS_PORT: &port 80
+      PROMETHEUS_PREFIX: zigbee2mqtt_
+      ZIGBEE2MQTT_AVAILABILITY: "True"
+    service:
+      main:
+        ports:
+          http:
+            port: *port
+    podSecurityContext:
+      runAsUser: 1000
+      runAsGroup: 1000
+    resources:
+      requests:
+        cpu: 10m
+        memory: 50Mi
+      limits:
+        memory: 200Mi

cluster/apps/home-automation/zigbee2mqtt-exporter/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
+  - prometheus.yaml

cluster/apps/home-automation/zigbee2mqtt-exporter/prometheus.yaml

@@ -0,0 +1,52 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: &app zigbee2mqtt-exporter
+  namespace: default
+  labels: &labels
+    app.kubernetes.io/instance: *app
+    app.kubernetes.io/name: *app
+spec:
+  selector:
+    matchLabels:
+      <<: *labels
+  endpoints:
+    - port: http
+      scheme: http
+      path: /metrics
+      interval: 1m
+      scrapeTimeout: 10s
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: zigbee2mqtt-exporter
+  namespace: default
+spec:
+  groups:
+    - name: zigbee2mqtt-exporter.rules
+      rules:
+        - alert: Zigbee2MqttExporterAbsent
+          annotations:
+            summary: Zigbee2Mqtt Exporter has disappeared from Prometheus target discovery.
+          expr: absent(up{job=~".*mqtt-exporter.*"} == 1)
+          for: 15m
+          labels:
+            severity: critical
+        - alert: Zigbee2MqttUnavailable
+          annotations:
+            summary: The zigbee device connection is lost,
+              connection on topic {{$labels.topic}} is down.
+          expr: zigbee2mqtt_zigbee_availability == 0
+          for: 60m
+          labels:
+            severity: critical
+        - alert: Zigbee2MqttBatteryLow
+          annotations:
+            summary: The zigbee device battery level is low,
+              battery level on topic {{$labels.topic}} is at {{$value}}%.
+          expr: zigbee2mqtt_battery < 10
+          for: 60m
+          labels:
+            severity: warning

cluster/apps/home-automation/zigbee2mqtt/helm-release.yaml

@@ -3,12 +3,11 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: zigbee2mqtt
-  namespace: home-automation
+  namespace: default
 spec:
-  interval: 5m
+  interval: 15m
   chart:
     spec:
-      # renovate: registryUrl=https://k8s-at-home.com/charts/
       chart: zigbee2mqtt
       version: 9.4.2
       sourceRef:
@@ -18,7 +17,7 @@ spec:
       interval: 5m
   values:
     image:
-      repository: koenkk/zigbee2mqtt
+      repository: ghcr.io/koenkk/zigbee2mqtt
       tag: 1.27.2
 
     env:
@@ -32,9 +31,9 @@ spec:
       permit_join: false
       mqtt:
         base_topic: zigbee2mqtt
-        server: "mqtt://emqx"
+        server: "mqtt://emqx.default.svc.cluster.local"
-        user: "${SECRET_MQTT_USERNAME}"
+        user: ${SECRET_MQTT_USER}
-        password: "${SECRET_MQTT_PASSWORD}"
+        password: ${SECRET_MQTT_PASSWORD}
       serial:
         port: /dev/serial/by-id/usb-1a86_USB_Serial-if00-port0
       advanced:
@@ -64,12 +63,6 @@ spec:
     securityContext:
       privileged: true
 
-    service:
-      main:
-        annotations:
-          prometheus.io/probe: "true"
-          prometheus.io/protocol: "http"
-
     ingress:
       main:
         enabled: true

cluster/apps/home-automation/zigbee2mqtt/volume.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: zigbee2mqtt-config
-  namespace: home-automation
+  namespace: default
   labels:
     kasten-io/backup: "true"
 spec:

cluster/apps/home-automation/zwavejs2mqtt/helm-release.yaml

@@ -2,72 +2,96 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
-  name: zwavejs2mqtt
+  name: &app zwavejs2mqtt
-  namespace: home-automation
+  namespace: default
 spec:
-  releaseName: zwavejs2mqtt
+  interval: 15m
-  interval: 5m
   chart:
     spec:
-      # renovate: registryUrl=https://k8s-at-home.com/charts/
+      chart: app-template
-      chart: zwavejs2mqtt
+      version: 0.1.1
-      version: 5.4.2
       sourceRef:
         kind: HelmRepository
-        name: k8s-at-home-charts
+        name: bjw-s-charts
         namespace: flux-system
-      interval: 5m
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: node-feature-discovery
+      namespace: default
   values:
     image:
       repository: ghcr.io/zwave-js/zwavejs2mqtt
       tag: 7.1.0
-
     env:
       TZ: "${TIMEZONE}"
-
-    securityContext:
-      privileged: true
-
     service:
       main:
-        annotations:
+        ports:
-          prometheus.io/probe: "true"
+          http:
-          prometheus.io/protocol: http
+            port: &port 8091
-
+          websocket:
+            enabled: true
+            port: 3000
+    probes:
+      liveness: &probes
+        enabled: true
+        custom: true
+        spec:
+          httpGet:
+            path: /health
+            port: *port
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 3
+      readiness: *probes
+      startup:
+        enabled: false
     ingress:
       main:
         enabled: true
         ingressClassName: "nginx"
         annotations:
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.default.svc.cluster.local/api/verify"
+          auth.home.arpa/enabled: "true"
-          nginx.ingress.kubernetes.io/auth-signin: "https://auth.${SECRET_CLUSTER_DOMAIN}"
         hosts:
-          - host: zwave.${SECRET_CLUSTER_DOMAIN}
+          - host: &host "zwave.${SECRET_CLUSTER_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
         tls:
           - hosts:
-              - zwave.${SECRET_CLUSTER_DOMAIN}
+              - *host
-
+    securityContext:
+      privileged: true
     persistence:
       config:
         enabled: true
         existingClaim: zwavejs2mqtt-config
-        mountPath: /usr/src/app/store
+        mountPath: /data
       usb:
         enabled: true
         type: hostPath
         hostPath: /dev/serial/by-id/usb-0658_0200-if00
         hostPathType: CharDevice
-
+        mountPath: /dev/ttyUSB0
+    resources:
+      requests:
+        cpu: 10m
+        memory: 100Mi
+      limits:
+        memory: 500Mi
     affinity:
       nodeAffinity:
         requiredDuringSchedulingIgnoredDuringExecution:
           nodeSelectorTerms:
             - matchExpressions:
-                - {
+                - key: feature.node.kubernetes.io/custom-zwave
-                    key: "feature.node.kubernetes.io/custom-zwave",
+                  operator: In
-                    operator: In,
+                  values:
-                    values: ["true"],
+                    - "true"
-                  }

cluster/apps/home-automation/zwavejs2mqtt/volume.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: zwavejs2mqtt-config
-  namespace: home-automation
+  namespace: default
   labels:
     kasten-io/backup: "true"
 spec:

cluster/configuration/cluster-secrets.sops.yaml

@@ -16,10 +16,6 @@ stringData:
     SECRET_EMAIL_SMTP_USERNAME: ENC[AES256_GCM,data:U8UiC6SdBbX9JbpRglyXfofDzYf+LNY=,iv:BLqn6nWm+il2yxWBJgpjlLKp5/eVh8L9qSEfM9LzUEo=,tag:1+afhSVYeHTvzzBiTxP7Ew==,type:str]
     SECRET_GITEA_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:VWetZHP8haXPy1r20RMJvECxEWw=,iv:B3+rjPXWSbyCdi4KAy/FeMbtNUv40UIWN462OWfv9Ww=,tag:5wK7nUGu7HmdC90d2jllwQ==,type:str]
     SECRET_GRAFANA_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:3igfeqGHygjnmJXnoiKV7W8Tm2M=,iv:Hrjh38GuRvzS4Hi69QftBhaAJ02is5B0E5h23XICpUc=,tag:O4JFVSaoTQDhf3QZPLbn1Q==,type:str]
-    SECRET_HASS_DB_URL: ENC[AES256_GCM,data:Rrq3O82kQksrHzBlH/+iVFoyOGUNkvwO0PQa6wKWCjR9u4niYEFgy0q7pkU8VhF250GASrM2B+pGfio0+IfgAS1OHJdWIeqwA9N1Lw==,iv:YvdgnaSVhwFqB80wgbk5dhbri6BWV23wOFw7A7yvr+w=,tag:3+8heFgAELFJy/6HKWOFyA==,type:str]
-    SECRET_HASS_LATITUDE: ENC[AES256_GCM,data:t3MRZlv84+0w0oNAYPl9XsQ=,iv:4Res2auWXUXGNBgbg6nhv347oFOKD5v2c4901u6Cxis=,tag:DrYJmj14uL902BGqSuyGtA==,type:str]
-    SECRET_HASS_LONGITUDE: ENC[AES256_GCM,data:4oVXOt3rIcGoG4hw2rmdlFg=,iv:o9xgLwOqmFf6lKmemdnsHoII3IkJ5/8kTVqYEyz9cTI=,tag:cWgo7COp7macBiQJm/Me9A==,type:str]
-    SECRET_HASS_ELEVATION: ENC[AES256_GCM,data:hzc=,iv:xoLUrHGxKl8io37Xus6aLPdS8F0E820v2Syj9SRKME4=,tag:KDJl+51oIuk+uamy+WkX9g==,type:str]
     SECRET_HEALTHCHECKS_DB_PASSWORD: ENC[AES256_GCM,data:DVnyW1CpzkwcS9h5FtKuzg==,iv:qXxN0NyGEOwNcw+geeWeH4kOdhtAOzgSJ2rPOCBudEk=,tag:WPTg09xR++yY+znP+o/lqQ==,type:str]
     SECRET_HEALTHECKS_SECRET_KEY: ENC[AES256_GCM,data:t/88WWwJw4DywbCvKur4mapyBrHB/ypYhEb+3SI3coM=,iv:N/lRnrrWyO9Z4sK4dVt+nwSN6cBN+DUtIt4kYLdvJ5I=,tag:SOgAakGtFTsXs+AprGvgrg==,type:str]
     SECRET_HEALTHCHECKS_SUPERUSER_EMAIL: ENC[AES256_GCM,data:fWTxCifpo1NKYQCvcsd5vj+lmHNTrC355K2v,iv:fzIotAiPRtVq738UZX6DiDeVylLH0f2LZEalnpum7WU=,tag:HgNkq8Cb/1XG/sQONFLivA==,type:str]
@@ -35,8 +31,8 @@ stringData:
     SECRET_MINIO_ACCESS_KEY: ENC[AES256_GCM,data:cv4//sg=,iv:dx1hciCvVBFcKXbAqoArkTjc/YLyKUp1sXPGuPoX7lw=,tag:+AYVkGKVWXR06h+TwTO9ZQ==,type:str]
     SECRET_MINIO_SECRET_KEY: ENC[AES256_GCM,data:qcV/b9q12949ZYExzDP3Yy2nAOY=,iv:7qg5IGEWBF1idgZxObcbWyxeNDAXbuwuf4BqwqC67Qo=,tag:wx44bn38jTel2TocUkCghA==,type:str]
     SECRET_MINIO_ENDPOINT: ENC[AES256_GCM,data:2/+oaWr84857KBx8yXrR7JK+EFIGw7ed,iv:iyfCkYl7yIgwDn0fR95rjcLj5Tsrho17ubGW1KDfym8=,tag:o2VTxHOjKrbX94wbRKHRRA==,type:str]
-    SECRET_MQTT_USERNAME: ENC[AES256_GCM,data:KkxVYfSPPz/bBFphww==,iv:zh83aX1OySv2+n1mhTmcgK9SzCAQcVtvlmXbAhiNQcE=,tag:mCHE13e12m4DHOWelYY4Zg==,type:str]
+    SECRET_MQTT_USER: ENC[AES256_GCM,data:Ggn82GysDHM2b/uNhQ==,iv:f5NXCE5/nfTqq1zdtBNH6Lu8ndf5YZKHgEWc9O0fB0I=,tag:z1OUzEeVgm+a9QRBxo9BEg==,type:str]
-    SECRET_MQTT_PASSWORD: ENC[AES256_GCM,data:8B3BfPFPQm/eZnhMYe4DOGdmiQ==,iv:a1PzZHBVDSVTE0oDy1Abb99F4RyPNIIm8cMV53AySQk=,tag:VzaPwV9bu9R7brGRy7N7wg==,type:str]
+    SECRET_MQTT_PASSWORD: ENC[AES256_GCM,data:WBqLezPi1sbzyzfubG71KfR+tg==,iv:gKDgjpPwZ+fEWs+zn3aHiiKglsEl/kue/vx2FaSAtsA=,tag:jXECLxyekqmejJfi11DKsQ==,type:str]
     SECRET_OUTLINE_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:BB/eZQ/oLQ09AxGwKRddbiyiRMA=,iv:dhiyOUP3GyvHXUdPYqQKPQCMmqornj6WVWtfreq9T6A=,tag:WijFyu8XGk3dklYJR4/81A==,type:str]
     SECRET_PGADMIN_EMAIL: ENC[AES256_GCM,data:Cqvgf0l1A3V8C43YJ20RkCToOGQrxA==,iv:6TsLUzW0yMnx+pGK9MLD/1pm7TGcoVz/Ibn4wYGWZ3k=,tag:YBHhIJl28Cnnncz+fPbPNw==,type:str]
     SECRET_PGADMIN_PASSWORD: ENC[AES256_GCM,data:1TDN5XLr4ZGQC4qjF9A=,iv:ydluXBbIfFYNEfhgNKxtVOOdqsY2SX+40CjyN4nOsvQ=,tag:hPmQpDYQR3X67AEIOa6sog==,type:str]
@@ -69,8 +65,8 @@ sops:
             WG82VkdBMlNnRzBySFQzMk41cEtXSlEKBqOmq9UpO61C85+pj0ibdT31y4pmFsbm
             pTi4N0vv81kcf4ilqBU5h1gudNCb42Q2iL0eGNR4e3JzH4iaNsvnEg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-09-14T08:56:56Z"
+    lastmodified: "2022-09-14T17:06:41Z"
-    mac: ENC[AES256_GCM,data:te7yzlwzehJrp5y62kFvLDlE+Sxi/84Li2sT2Kcv6g8I+FVErnWej0bfC6Hetp9xvkAOY8fmJqBLutlQW1GEboQuYoEM/eehW4etpCLS33teF8ETVG+9VVVh/hZ1PY9kwkAL0Q8JR7dZeRNc/mQoIoDY0fPoDZnwa0kvE4nfuNE=,iv:Z1Wdi68VRRWLRkB8/LB1HZC72yQQ5jmxsHjQHfU6Y6E=,tag:YYCJFoCyspgnwt8Yy11p9g==,type:str]
+    mac: ENC[AES256_GCM,data:yqm4qJlW0/I78/qQz8qAxwU2JazdTvj3seQy9s6hgwo2li1rRuEvIj6fwCBoj6uycFoR1GoNpl68W0LkB9/hM5+qvilfixJOl3KEKfSj1boMKyZE3p+3eTntzGcRZNEM+51LUCgg3NbUCbQd/qp1gZTXqrU3ZEBiZ0KfdN21mrc=,iv:WXTHvWiaBOXEW+2VgQQxU+hizKE8ZN4Ao5q7WoS8HuA=,tag:v1II9bNs5KaxBPfzWGj/aw==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.7.3