homeassistant

clusters/base/apps/homeassistant/helmrelease.yaml

@@ -0,0 +1,70 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: homeassistant
+  namespace: homeassistant
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: homeassistant
+  values:
+    controllers:
+      app:
+        strategy: Recreate
+        pod:
+          hostNetwork: true
+          dnsPolicy: ClusterFirstWithHostNet
+        containers:
+          app:
+            image:
+              repository: ghcr.io/home-assistant/home-assistant
+              tag: "2026.7.4"
+            env:
+              TZ: Europe/Moscow
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 100m
+                memory: 256Mi
+              limits:
+                memory: 1Gi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8123
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: p.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: homeassistant-tls
+            hosts:
+              - p.aggtaa.com
+
+    persistence:
+      config:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /config

clusters/base/apps/homeassistant/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: homeassistant
+  namespace: homeassistant
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/homeassistant/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:RTigpyVv0CaN9P2jGTvNJWoLbnLGrYa4aBWCZaGdIU2f2Jgop9f58EXMfvifFweUvOQ7+G3LpLfcO/zIctTNEYhiV4AfIIm1HIou55FgggQt1AuSSB6Fxr1p+o28KH4cou2P41avbQlM0FDwHVE4sLyqbgIXDi9eeVzEh5VvSvocYxVCW8BlVzEvmldcudmlmQuTh7OR8dw5Ra6JPlLVH+Lp5MxU4ZSPO3qHqa1lQPguMYF/I/AxB9wQkwlmsg==,iv:GQny4onyrvxts4xjNoJZ0hWUHWdnErCBMOvntEAFxxM=,tag:pkQfJfvEm0swjbWloEPb/g==,type:str]
+    passwd: ENC[AES256_GCM,data:+4iXW/1n3NZJdVN0wLOtPLqCiprT9I81XxHBW8uCVNJQw8xMUlHfZ0vfnBDlrdm7+46LD5yWYtJBUbRhY9iz6SJfn01UAm1IEoJcw3fSHSezu8Or+1iCYfvsNTLXIguRu0xOjU+jnlnQ0Ur70fLnmuYTwaaXYkkIox6L2v96cpKbzfxNMJruFOxfs+CswZdcZ/OYpCMLymcWw51/+8tHNUIh8nGNl7ftGQsxzdDFPY62IQ2U3ts1T15NVGr+8A==,iv:kcy2Pyr93OkYmjQPscRFL9pp8yNqVv1J/Im+Nq1kKrk=,tag:26qz/ZpA7WT/huLmWnCScA==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtdUhHbk80RXU4OVVaUDA0
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTelN6bE5kUzlOWjRNZGZ4
-            ZSsrT1pIRUdlWjBMUEQwS2RrZ3ZuNm1hVW5BCmFFM3g2TFlVbVo2V1lBMFZiZkdz
+            UFJybGZ5blpZRUVZT2dKNmxIYjhGU3UzOG0wCjlHbjNVQU1KWG9kYlR2WGlvcWJj
-            THRBZ2YzbUdjUmRUYVB2cEduci9aVEkKLS0tIDdSTnhlQjNsU1ovcjUrVFhGNGJX
+            dGE0K1RidVFHTHZ3dlZKUEhWUnUzeWsKLS0tIGVySEZnV3d2VXFoRlNEaTVYVU1z
-            Q1FMa2ppalExNENydUpkNG11OXZKeVkK5K7yOWwA5MyW2IdPUtYpEeXGzQ0pVhkm
+            TEdZclRlNEh2QTdDMEVOODMzbkZrK0UK/K6KhV8jNcctwOt90oByhdhV1du7EzGv
-            nwws+IoNQupvoarD5IibzUcM6AOF56i7F0MTSl+K6Lm+QBeG9k4/xg==
+            EsqpxABHhGn4dbxUp73Op3N603gwDclVQJAqMmyMRVjQVtRgC48ceQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:35Z"
+    lastmodified: "2026-08-26T10:19:40Z"
-    mac: ENC[AES256_GCM,data:3QF3UD5S7Pj94NFgc+ZdR4hPVeVWJAxh+OyfrJQC4qkVgqRtgHy30MnTq5n5cMBurdLgB9OVd0kCWKzpYW3bt7pqkrofyT5GLbDwzGGGbrv1bNflLG8goXbLO/C38m/tyeKewS4rulYbtY9X69K8xC8JB9LZ/W+KgYLSvhYM5Lw=,iv:ocqHPMwyC9sEgrCROOmKL02ihPqb0vldhtmwXqo1Jt4=,tag:mT0h2Z1Q3lxqb6mYtNe0JQ==,type:str]
+    mac: ENC[AES256_GCM,data:2jQfOzgHqf0aviMP84il3b+Jo2OBYpqYog+IaXhmycWrziOKEY1lZ9XFOfL95r/pNnvbNQ1wvBvVFHGWoK/c9kEcNi8GQazgh/nb3sWZvyNqAWa4d/g+chPS1RyAbick/LI58n6BdofhHqE6EEcsSv4/7UIykCgb1Un+bUspxX4=,iv:7LesiWpvL75Bc3IYUDKG3z179rss7YyIe7HD3cjbJ78=,tag:Puk0nYTBOzm0rcdSQNpHUw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:3wxEn1go8nLWA6Kttm96p9xtRP9/g9KlVy9op9TCMCCi8MW4VTIxiOf5ptlRogfEgpueK8R5ZMFH,iv:Ks7BcybpkxiqCMx0Em8Y1mcVGrS+7gsf+jCOm7ibqmQ=,tag:omF6s0SzcvN2ewABICkGgg==,type:comment]
+    #ENC[AES256_GCM,data:Y6oq3QU9EsZV6PHGEswP1H0HhHUwbMYGSw57WuLH2sZpEzLWHJFxmCIyAdlm9G95h5NEgcC8w0ly,iv:9649RQTcz/s65kDEF9c/DabUXHTmXAnmOuaWptKC0xs=,tag:dcnccNBa2w/RQYyDX3uN+A==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:+bW1tb3OBq6DaxO4anbtxAf6FGxzWDRmnLTlY9oMI0EyqIjF2nSNtpgtuU4bqZ9JAeVBOJpzfGQH+yZDilEXeRLuZc9puhCiow773J+5zYJOYJS6PUs7IWWKerteAA7NWQGHtl1MMTPdNqqqYAtpHsiRtB0LHg==,iv:6OY5BLInFcmoz6HLw57ZWS+7bKXNRchhxrRtOkrIOto=,tag:oRKnkUEuXSNtTx+VVPspWg==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:7waC9Yo4ZRq43y4CYlEiyUR6iveWg5Ynnz06pL0em8A6U/kQRNBwhX9uhanaMgnt721qrKg85Huej4KtRk/W6qLR/hhuRCHuQCP8sJruh4Wn8v9GhMDZqzK01tZKEE3xgTCIx4b9Y62VqulH1qkIZyfsPq+nMw==,iv:qmhJf7byCG1L7FvVx8T53u5e64jJ3n8dvxVG9eFVJzA=,tag:mnTR6Bxsyb6agbUMOxMeqA==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiQWtXV0dLMDN4U096c2dj
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhdE9VSklhUVJ0OE5LdVdB
-            WGNmSHBTRGI3YTIxOUtIeWFYV3hPaVY1L2tzCjdYSCtqYm9yWWovQiszYmJ3Smxx
+            Rjhxc2JzV2F6YnRhZlUvaHJLTW9SRitZTkFvCmFvdkV4SWVmaHRncHNKWjJJaXpl
-            U0dkSHpkTlJKcEVFVFVQcGZnMFZ5bFkKLS0tIDB2L2tLR0gvU1Zha1kvenExclFK
+            MGpkcUpOSkJROGZFS3N3L2owcnc0b28KLS0tIE8yMm85TXRqSGU0K3NtT0x2a3FU
-            UDFDa3dQUWtKWUc4NVdrMERqb09wRjQKiFXKOnWNsuCkDkpGGrOLVlPgKarwQeH8
+            Z05sSitucGJpajJZSHB5d2h3QXA3Y1EKvUl7vv+jgKq4bvT22DvRc8lHqg+IiVhu
-            1lSt1mCW17L2YiCngKHtCrBpQWod7qdA0AtO50UR/XFe/tXK/fji3w==
+            fdHC0quIvcEuCi6jh0Gon/Dv4BfhrT3J7F7GKhLwURwmGFNgNHQtoA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:36Z"
+    lastmodified: "2026-08-26T10:19:42Z"
-    mac: ENC[AES256_GCM,data:Ihp3P1KqvsmonCuFkoOi7BpnDc3FGP4tOPcaIt5XAGX1f51zaLzOR7grElMCwggwuoJenZW7L2IdzX+YRDdS8zfE51hgXSQH8NzHmmlgEMRv60T97aAD5IzjPzB4GDI6TpcNI81acgrxTfYAPcExdIdMd75+nXMDLKB0Ku2FoOU=,iv:XC9LxbqZaRw0OXRoKA8EL9z5qmtDxUa4sKOwSJZRXLI=,tag:X9uxGb024AnLRjR/Nd8KJg==,type:str]
+    mac: ENC[AES256_GCM,data:CkbxFWHNiDfVQym/bprJ3nm3DEF02cyFlWOTblrp0XjDQJxKMpD+x6+KJ/JquOQaM3RQcSPOBQMCE3bT5fy7rNfSaxPK+56isianUKy+si9MQ7qJBcIrLkvhOR2avOeZoBey6fWLdI4J1HUwndjlEcU9YgZA48sHKAD3COugeN0=,iv:OiQhlSpKQHEFDeAfsqnMBClqnSBpw+h+EjBwfA5mnYE=,tag:E8S8qmqZyi9FIpd0eyjbww==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:gyesuhrwYATlknEQYfP1/FooMSTwMoM16qQIxTPNDBcEohACw1FbAC0tbwuil3hvvFr759zgDTB4x7APr8KNmPflnksS88m0lsaHfec2M/N5aKM/b6WIEU+ZG3o93mu8j67rGkabGMSDE3w6PO7D6VT/U2o7L0IaQ6QQ0Ko=,iv:pTNNmgo7s16txjf2vRcYQC2w0w/TrJCYYGTEIAfnaeg=,tag:hitkwIgOma2vbFDyHiZVSQ==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:LnTHC/0PVJ6NV91atNXrU4Jh6bRFHxAOWyxGsuympNLlBxoetMchlVugY+Xr6FhaNJafZR/Jpbh/sqfK/PgoTb8GxKrMPt39+nUXnLn9vfXcHzn+JA9/bFcqWLEYWQiMiGLnpk9L/Q61lN4WsoeTcyzgtwNhSxSV4h456Ek=,iv:pmD0Cr+AliKYnDHEvsuxJRl5kYyTet7OO1pKjWrMMow=,tag:dOzWpZn7KREAfxDcxud13w==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByc21ZL0dmYzdkcFRIQUhC
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLVUFpenVCQVYxQXYrMlhk
-            Vm1wUVRNNGxVZ2tUc2xYdTNhVVZZZjFZYW5jCmNkQW1jc0VYQVlPVWtndHM2Q1Er
+            V1hDQjZqUUUyY1VOcDY2b3o4Z05YNkFFSnlnCnZxN2E1MHluM0U3blJBVnE4TnJ4
-            U3RRUUdwdWQ2ckhmRHBZdmxaWW5PNjgKLS0tIGVyT2R4K2V2QWVpVjRZUGhBSHd4
+            T24vZk5scGNMUE5HMUZQbXBwZmVMU1UKLS0tIGFpVGNHbTNhOTExcGltL21YZ2NJ
-            TC9jNVg5NXpsMlJrUW1wNWxjT0FVMmcKJrBwX36CGSMcYZywYPOXj+Soe8AK2KqS
+            c2lLRElqRFpRSFZDT0ZweHNERC94WG8Kn3rWhvHpZ88g8vh7Os7h3NrVwQMoYoSF
-            W9VOpxQ3MwxgHSfaGyYTAuSe9jUNQ8OHx3jBbKyRcqH+p/esNRLwcA==
+            jckIjD5baIW/5X8pd/P08FYGNbWVYoF6l0GZeeteELGBv8DuhdjwNQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:37Z"
+    lastmodified: "2026-08-26T10:19:42Z"
-    mac: ENC[AES256_GCM,data:4+UMZ6BPLbSB4G924+qzSiw1XJm1xTWu65hqLfmfF1Dwr5mE4qHxVoz4BCNgmFW65CTNUA/LkeDNvbKTe5u9GpiGMnAXP7cJBT+cqUprE7OsyrGWb1R3jRTAEZb4Lj0DZzzIjuiuEqviwNe2y2D3AaNYghVrkebd/60U63Y2w+0=,iv:f+4/ples1ldJeQt7sd1ZLXvjvftskGcQQ52jTFXKovQ=,tag:wFWZjaGHDcDxmzrxpwNqTQ==,type:str]
+    mac: ENC[AES256_GCM,data:Quhs928FUdHAF6p+vQyb2xjTdGBQWDl/avGrl37oarsfeBxlmLnZaUXfh88DK1YDa/nZ+X1fj6H72lUhm7he8Tr7G//cimMO40Ms8pwu4vV7N1bu0/yliLec2X1KU4Xqchkcgdpj/Ij131NzS8yrmXIw0L+zULZli74jdJ+oGT0=,iv:m9iHR4AIn/U/dOXyUAtPWIkkqr4lRKsuQjTILuMFOlk=,tag:V2dccS/SISnX2FwEi5pQJA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/namespaces/homeassistant.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: homeassistant

clusters/home/apps/homeassistant.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: homeassistant
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/homeassistant
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s

clusters/home/apps/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - radicale.yaml
   - authelia.yaml
   - mosquitto.yaml
+  - homeassistant.yaml

clusters/home/namespaces/kustomization.yaml

@@ -8,3 +8,4 @@ resources:
   - ../../base/namespaces/auth.yaml
   - ../../base/namespaces/metallb-system.yaml
   - ../../base/namespaces/mqtt.yaml
+  - ../../base/namespaces/homeassistant.yaml