k8s/ha: init home-assistant

k8s/home-assistant/home-assistant.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: home-assistant
+  namespace: apps
+spec:
+  project: apps
+  source:
+    repoURL: "https://github.com/ttrssreal/jix"
+    path: "k8s/home-assistant/resources"
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: home-assistant
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+      allowEmpty: false

k8s/home-assistant/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: home-assistant

k8s/home-assistant/resources/config.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: home-assistant-http
+  namespace: home-assistant
+data:
+  http.yaml: |
+    use_x_forwarded_for: true
+    trusted_proxies:
+     - 0.0.0.0/0

k8s/home-assistant/resources/deployment.yaml

@@ -0,0 +1,70 @@
+# https://github.com/abalage/home-assistant-k8s/blob/3d3c0b2621f6/base/deployment.yml
+#
+# [!IMPORTANT]
+# Need to add this line to runtime `configuration.yaml`:
+# http: !include http.yaml
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: home-assistant
+  namespace: home-assistant
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: home-assistant
+  template:
+    metadata:
+      labels:
+        app: home-assistant
+    spec:
+      hostNetwork: true
+      automountServiceAccountToken: false
+      containers:
+      - name: core
+        image: "ghcr.io/home-assistant/home-assistant:2025.2.4"
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          privileged: true
+        ports:
+          - name: http
+            containerPort: 8123
+            protocol: TCP
+        livenessProbe:
+          tcpSocket:
+            port: 8123
+          initialDelaySeconds: 0
+          failureThreshold: 3
+          timeoutSeconds: 1
+          periodSeconds: 10
+        readinessProbe:
+          tcpSocket:
+            port: 8123
+          initialDelaySeconds: 0
+          failureThreshold: 3
+          timeoutSeconds: 1
+          periodSeconds: 10
+        startupProbe:
+          tcpSocket:
+            port: 8123
+          initialDelaySeconds: 0
+          failureThreshold: 30
+          timeoutSeconds: 1
+          periodSeconds: 5
+        volumeMounts:
+          - name: ha-config-root
+            mountPath: /config
+          - name: http-config
+            mountPath: /config/http.yaml
+            subPath: http.yaml
+      restartPolicy: Always
+      volumes:
+        - name: http-config
+          configMap:
+            name: home-assistant-http
+        - name: ha-config-root
+          persistentVolumeClaim:
+            claimName: home-assistant-config-root

k8s/home-assistant/resources/ingress.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: home-assistant
+  namespace: home-assistant
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+
+    # mtls
+    nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true"
+    nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
+    nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1"
+    # FIXME: part of declarative secret management
+    nginx.ingress.kubernetes.io/auth-tls-secret: default/ca-secret
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: ha.k8s.jessie.cafe
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: home-assistant
+                port:
+                  name: http
+  tls:
+  - hosts:
+    - ha.k8s.jessie.cafe
+    secretName: home-assistant-cert

k8s/home-assistant/resources/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: home-assistant-config-root
+  namespace: home-assistant
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

k8s/home-assistant/resources/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: home-assistant
+  namespace: home-assistant
+spec:
+  selector:
+    app: home-assistant
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8123
+      targetPort: http

nixos/ari/kubernetes.nix

@@ -22,6 +22,7 @@
             "k8s/k8s-dashboard"
             "k8s/longhorn"
             "k8s/radicale-calendar"
+            "k8s/home-assistant"
           ];
         };