♻️ flux kustomizations

kubernetes/apps/default/home-assistant/app/helmrelease.yaml

@@ -0,0 +1,108 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app home-assistant
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.2.0
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  dependsOn:
+    - name: cloudnative-pg
+    - name: emqx
+    - name: rook-ceph-cluster
+      namespace: rook-ceph
+  values:
+    image:
+      repository: ghcr.io/onedr0p/home-assistant
+      tag: 2022.12.8@sha256:472d563ab3eadcfde16848ffa59954c63cc10e71630b6e41081b8eac8c6d5ca7
+    env:
+      TZ: "${TIMEZONE}"
+      POSTGRES_HOST: ${POSTGRES_HOST}
+      POSTGRES_DB: home_assistant
+    envFrom:
+      - secretRef:
+          name: *app
+    service:
+      main:
+        type: LoadBalancer
+        loadBalancerIP: ${CLUSTER_LB_HASS}
+        externalTrafficPolicy: Local
+        ports:
+          http:
+            port: 8123
+    ingress:
+      main:
+        enabled: true
+        ingressClassName: "nginx"
+        hosts:
+          - host: &host "hass.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+          - host: &host2 "home-assistant.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+              - *host2
+    probes:
+      liveness:
+        enabled: false
+      readiness:
+        enabled: false
+      startup:
+        enabled: false
+    podSecurityContext:
+      runAsUser: 0
+      runAsGroup: 0
+      fsGroup: 0
+      fsGroupChangePolicy: "OnRootMismatch"
+    securityContext:
+      privileged: true
+    podAnnotations:
+      secret.reloader.stakater.com/reload: *app
+    persistence:
+      config:
+        enabled: true
+        existingClaim: hass-config
+      usb:
+        enabled: true
+        type: hostPath
+        hostPath: /dev/serial/by-id/usb-Arduino__www.arduino.cc__0042_5503731323735171A241-if00
+        hostPathType: CharDevice
+        mountPath: /dev/ttyUSB0
+    resources:
+      requests:
+        cpu: 10m
+        memory: 100Mi
+      limits:
+        memory: 750Mi
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - {
+                    key: "feature.node.kubernetes.io/custom-rflink",
+                    operator: In,
+                    values: ["true"],
+                  }

kubernetes/apps/default/home-assistant/app/kustomization.yaml

@@ -0,0 +1,16 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: default
+resources:
+  - ./helmrelease.yaml
+  - ./replicationsource.yaml
+  - ./restic.sops.yaml
+  - ./secret.sops.yaml
+  - ./token.sops.yaml
+  - ./podmonitor.yaml
+  - ./volume.yaml
+patchesStrategicMerge:
+  - ./patches/addons.yaml
+  - ./patches/postgres.yaml

kubernetes/apps/default/home-assistant/app/patches/addons.yaml

@@ -0,0 +1,42 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: home-assistant
+  namespace: default
+spec:
+  values:
+    addons:
+      codeserver:
+        enabled: true
+        image:
+          repository: ghcr.io/coder/code-server
+          tag: 4.9.1
+        env:
+          TZ: ${TIMEZONE}
+        workingDir: /config
+        args:
+          - --auth
+          - "none"
+          - --user-data-dir
+          - "/config/.vscode"
+          - --extensions-dir
+          - "/config/.vscode"
+        ingress:
+          enabled: true
+          ingressClassName: nginx
+          annotations:
+            hajimari.io/appName: "Hass Config"
+            hajimari.io/icon: cib:visual-studio-code
+          hosts:
+            - host: &host hass-code.${SECRET_CLUSTER_DOMAIN}
+              paths:
+                - path: /
+                  pathType: Prefix
+          tls:
+            - hosts:
+                - *host
+        volumeMounts:
+          - name: config
+            mountPath: /config

kubernetes/apps/default/home-assistant/app/patches/postgres.yaml

@@ -0,0 +1,25 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app home-assistant
+  namespace: default
+spec:
+  values:
+    initContainers:
+      init-db:
+        image: ghcr.io/onedr0p/postgres-initdb:14.6
+        env:
+          - name: POSTGRES_HOST
+            value: ${POSTGRES_HOST}
+          - name: POSTGRES_DB
+            value: home_assistant
+          - name: POSTGRES_SUPER_PASS
+            valueFrom:
+              secretKeyRef:
+                name: postgres-superuser
+                key: password
+        envFrom:
+          - secretRef:
+              name: *app

kubernetes/apps/default/home-assistant/app/podmonitor.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: home-assistant
+  namespace: default
+spec:
+  podMetricsEndpoints:
+    - interval: 1m
+      path: /api/prometheus
+      port: http
+      scrapeTimeout: 30s
+      bearerTokenSecret:
+        name: home-automation
+        key: prometheus-token
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: home-assistant
+      app.kubernetes.io/name: home-assistant

kubernetes/apps/default/home-assistant/app/replicationsource.yaml

@@ -0,0 +1,23 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: home-assistant
+  namespace: default
+spec:
+  sourcePVC: hass-config
+  trigger:
+    schedule: "0 0 * * *"
+  restic:
+    copyMethod: Snapshot
+    pruneIntervalDays: 10
+    repository: home-assistant-restic
+    cacheCapacity: 2Gi
+    volumeSnapshotClassName: csi-ceph-blockpool
+    storageClassName: rook-ceph-block
+    retain:
+      hourly: 0
+      daily: 10
+      weekly: 0
+      monthly: 0

kubernetes/apps/default/home-assistant/app/restic.sops.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: home-assistant-restic
+    namespace: default
+type: Opaque
+stringData:
+    #ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment]
+    RESTIC_REPOSITORY: ENC[AES256_GCM,data:PSUxcuB0ZkoJ3+ims+yBY8gFGbn/JmM29lw7+TZ/ewbyMJeqMpWK4cvNIMzTt0M7dTcVdPiR8NPDyCpVI6maxA==,iv:crebRNDxmJSpGlh83bju2aTLS1aj8CLWaS6gdfeHHBU=,tag:mWjowas5pf0tx7lJyLGCTA==,type:str]
+    #ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment]
+    RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str]
+    #ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment]
+    #ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment]
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ
+            THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB
+            TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN
+            dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4
+            3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-12-28T06:57:49Z"
+    mac: ENC[AES256_GCM,data:UOdoegFqPZEQYiGM8Pq1QJEIWkd5/5vzgcIDE9NHy4qwBMz182s1Vse5gGa+pWRTHWhLNxC6zjuhZjcBPFCa1K1dGF4dFDYRRxoG+wVEg200mdmYb4t0RPWnJ9tlDV8p0JXa53CJTvuB2+eQSQhCix2sjaOLU5LdEfbP5VYiN3U=,iv:HE6EQHPh5zC6pxBjGHmxU3xt/1Dwk1wHUl0H21W7dvs=,tag:+FaKITLwr7zXB9lKZ7c6kQ==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/apps/default/home-assistant/app/secret.sops.yaml

@@ -0,0 +1,34 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: home-assistant
+    namespace: default
+stringData:
+    HASS_SECRET_LATITUDE: ENC[AES256_GCM,data:/tafIrcH0xz+rHHUTz3wdi4=,iv:HyRcQcOvfWi6X2Y+PCILYtcB9WvrZVoZmN7DH31NdrA=,tag:QjsavnTkBCAE3xdl7YtQyg==,type:str]
+    HASS_SECRET_LONGITUDE: ENC[AES256_GCM,data:Ya0P5TJ2PcD2gbD6yNi5M44=,iv:ZnMO4G3I4jNc52q0J2UBAScJs3nrZnB1zFlbh6hkJmI=,tag:0Y00oMSmtP1wdY3cP84sgw==,type:str]
+    HASS_SECRET_ELEVATION: ENC[AES256_GCM,data:ruU=,iv:4yDZLOGfHcGXcGNuQVBmFrg3HgSpGXhsB9cwlliplVc=,tag:4f4zrnIosO3kWh9BGNz7Rw==,type:str]
+    HASS_SECRET_URL: ENC[AES256_GCM,data:WTi34088t3P1mSsuuo/+U/qpMnwpmPw7Udeul2BBlwU2TG4tIr8QL65RTVVrnLM=,iv:eAcvCs5C1g+jdNJH3b4CZMFoicfgy7DUmtCZJnL9Exo=,tag:k5KY9cbRgzHosZAxkgAlAQ==,type:str]
+    HASS_SECRET_DB_URL: ENC[AES256_GCM,data:Nl7EMtmX2U1LHLsSsIk3MbBshcR2CuOhDogrb1i9elZyP2DRlS995lerl9T8mQ98XK9HuU/qTwJAj4JUP9FikcAJpIS0Fspf9IwNai1uhQ4/RWA9d5NsgjuGhv7eueQiNg==,iv:wxT4Yf4V5RAIRbZmBS1GikzhbQEsGu7tTwKIRePKnH0=,tag:oMvx5G2p5ASckOp8vhkilA==,type:str]
+    POSTGRES_USER: ENC[AES256_GCM,data:6sFSx8XfWgkgifgAk+o=,iv:qdUCWatQb7XWskKMKUBvDQ1JqKxH5zoSznop3KRkgM4=,tag:KpeLOhEWpE5petnB3bXnRA==,type:str]
+    POSTGRES_PASS: ENC[AES256_GCM,data:cNW97km2wZz+uHnX0Hzl7g==,iv:40HsF3DN96JLnGwLMUhx3cq2hdFbPXSasn6CJuCO7Uo=,tag:4NyuUCHryWMxYBkW8vjCXA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNRm1nQmk0eE1OUVRlbmkw
+            M3RQOFc4NXJrS3lHR09QdGttNEp0YTZzNWp3ClZaQ2hxWEIzNlNSNXhONlE4QzNn
+            OVQ1ZEphd1lQR2tFMEppZS9nUy9GTFUKLS0tIEJxdXlqQURxbVlmSlJ3S3NEYWtB
+            SjVvc0k0dk1GeXF0Z3gycHVJSXRtNTgKJScEOU0jr7qw4fdBbtKfE5lI1gVLIQ1g
+            cklawiOzeLg+v+5ZmuAOk5k6VIUUNMpcrAfEbI84JRWCFRm1IngMwQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-09-14T17:35:30Z"
+    mac: ENC[AES256_GCM,data:yLIhWrFqNWF1IT/XyKyM0j5QKdnbM0pKSQd7s9Xx+G8/O9rnlBOTGyWgwazBbw83xW/BZ906TD9f7o6uAtdbLRarX2kw248oUGCuTK8EpyX+ake59OFiyLHya/XWZqpRL0/uC08467ecPdhzFb0NnrJgVfL1DW7dBwGY3fLyZBU=,iv:cq7RmU+HCR+PL7xR7PRcpQ7904YAz1qwvSBDFi93bqQ=,tag:WUiLYFXIC0y2+909Y3GW5g==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/apps/default/home-assistant/app/token.sops.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: home-automation
+    namespace: default
+stringData:
+    prometheus-token: ENC[AES256_GCM,data:XQS2cNao60Cw3oWPBG3qRs69u4ZhBB8qWm5s6z13CDomfcdfA60YSSU7Vtcdb8E7wnI2t/X3Kul8Vlt8evYv/Tkh5UN1oiqa+upFQ/tOlIHFmRfz1snE5XlREc/sB2FN8xUIDRdHObfwz9NcfEcrt0MP+1mXN1IUIA5BDAAFT05TALeUjdY3CTfht6idIFlqs3YN2uvfDYoq5nKIN4J3uN0rWJI46BD+FnmpE243ChM+Cn1NS2sa,iv:lcCmW8TASJHWgOjs9qRh1XaGqPpCHn9HkU+Ma+Iqyv0=,tag:bRNDK8TEyHIMZlixYRDGGw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQWjZ1RG9QZnBQSUNNSHN4
+            MTdwMDlvaGk4NEVxdmdZOGR1QnpLNFkzOTNZCjhZeEloeWQzemp1cVJrbEpxbWJB
+            T3NXRkRxTU54MGxUbk45YTJoQkl2dWMKLS0tIFkzQ0hvQWdxK2NKQlVlNWhUODQ3
+            RDRiUkRFSVI4S29mdWRMbE9RNFhLQlUKcx+FKlWUqt5YOxIKlvNiexCarLnW3FXU
+            M+lPXuGDvjo2Pg5InhPCheuxSVxea85uRRmROTWWOfjMKNYyfMiXLw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-09-14T12:31:34Z"
+    mac: ENC[AES256_GCM,data:iTSj6ouARsJb6RN4ZoZ2hlOvkZ/LaABtvbR7VaLIC9FOdDlW68jYYyQpR2IkzG8RynHFGX8WcqxqImpN1pTWN+MHHEzFwhVhXdx5u/Utvt61W/TCmLE1C48f4IIoIRAvstWbi3h4kupo23O6GA53XatHprBPfgf+IC29FoLBoA0=,iv:AOD+DHbaw4kAveVGVB0WtQot+/MhOleTNp3tCCymKy0=,tag:AzhQeX1SI57yJusRGz/uUQ==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/apps/default/home-assistant/app/volume.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: hass-config
+  namespace: default
+  labels:
+    app.kubernetes.io/name: &name home-assistant
+    app.kubernetes.io/instance: *name
+    snapshot.home.arpa/enabled: "true"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block
+  resources:
+    requests:
+      storage: 10Gi