diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..1a098d1 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +migration-from-old-files/ \ No newline at end of file diff --git a/clusters/base/apps/vaultwarden/secret.enc.yaml b/clusters/base/apps/vaultwarden/secret.enc.yaml index 669a0d7..ada9b73 100644 --- a/clusters/base/apps/vaultwarden/secret.enc.yaml +++ b/clusters/base/apps/vaultwarden/secret.enc.yaml @@ -4,20 +4,20 @@ metadata: name: vaultwarden-secrets namespace: vaultwarden stringData: - #ENC[AES256_GCM,data:PrvE3gQljPkmPhr4p3rpUa1f3C6PqJBjHZji3CPtj69D4Q0KIOhjJP3HXc0BGh2lc3jCNvceCA+i,iv:oyOzS2IlP3f8HYJ0aXbJhRGmFyaYGonvFOTg8/aRUsU=,tag:zHNt0gEsbg/sOLye1BpBIw==,type:comment] - ADMIN_TOKEN: ENC[AES256_GCM,data:AaFBk7Zjd9nm/4/leUScg/9Myd8vWxUJ49DeRRBHz5GdZr2i5k60nF9vpceIQ5OkWCKVwmosIxuWrj04li19aWtgMvdkzeBA1igkwPqMR+80P76CawYZ4Ppt6TAQ1mi5pdvg19+KCV8vd4Xx3EWOMpa7WH1zxw==,iv:jdpBIe+GUgcjlfqF8PDbcq16HoHXiZZpUeRU/5HryhU=,tag:OzpJegKUfNRX79K01BnWRQ==,type:str] + #ENC[AES256_GCM,data:ZSi9ncwQt1hF89l00We38ZVpj6aZSdLM1Y0p8nFeKk/fpwvZ9EHP+eZsC1sqzU0eM14TVFZMY0/s,iv:HDHYINHS11OCEBYggNrHbYVydk8uR1We1Na/q8oCS30=,tag:s09J6DNSX97/YvJaKpdasA==,type:comment] + ADMIN_TOKEN: ENC[AES256_GCM,data:qAoDEzwuADkdgydaberlQ9G6Vfnl5xG0Ff1ERn4F5HK6okP0x5o7bAnbEhRJ5aJfPE/x0+POVT0EQU9REYA0jYyZtRS8Ntszb/NiIH39uaRRzkZ4wrcHQR8aMIcWp81j4NnUp7iGL7j01H58dIY4ABmNSoV7lA==,iv:B2izY/vJqtqXpAUeyZPBBIH8nKhWeiv9c52gyMM1wvY=,tag:bJE43ntkkDv3l1alBjuhwA==,type:str] sops: age: - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZZUVHandHK09qbnozLzZC - OFVjTGdhaFZEbTNwZkUxNmFINXRNQnpFakVvCjhhbkpTVXdYdjBpMFJmalpUMWVp - d0tncG14N0V5azVnV0xkcnR2MVVPQ1kKLS0tIGx2Mm5zRllwM1VLS0tIeDVWTDZP - Mnljbyt1Um9yVmpLTGVJY0NoTktlRTQK++A3xEKCIaGAXCpq6QvsogpjYzo/FG8Y - Pi3RH9txTHVUb1xA8NqNnJTgTEWnEpV2SRmV0qhjibs1EZLpAjA8fg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBETG1pVE50Q0JPMVdEdGhz + NmZzdGRDNkNpUUdNSld1ZjdvK0ZKSm96VzJ3ClpldzFxMWpoa3FmODF0amQ4Nkpq + Mit2dENsSGZmaHBsemEwc0I3VzdZYVEKLS0tIGsvRjRCZWQ0WkU2WVROQ2Z0bThj + eVplbElrRjFXV240MytFM3JxZldxYXMKaTSYz4rprKWo8gIyNAIBmrS0QOkL4NCZ + sMo4kzEI6J6fI9uHwBtYQ5xk70EZw/XGo9JWeGxriZ1CduJqW9J7kQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-26T10:17:39Z" - mac: ENC[AES256_GCM,data:g8smWhzjNf2kewmn9+QYb2LOwZc2IxnXcYG1lQBjbLRgyPvdLt55BciTHF6c4BNNhaVQc+dx6QPhH5y6qrC4muNGVQdBCyANX+U5gZMt3cZCfaYmHAAtohrJDx16miL3MC7tGGnTnD26VD0/w9X744icH8kjsBH7ZdTG66r/bBw=,iv:r9tQNr0Gi8G0GrFKKrleEGPIR3/pVETfQxvAtqnWrRQ=,tag:NVUnW5Mk3JcW7b20TvLnDA==,type:str] + lastmodified: "2026-08-26T10:17:41Z" + mac: ENC[AES256_GCM,data:jw0L50e5SL/geTLLM0X53Coaxte2/cG481bsK79UZGzV8MnpXm1XkXa8gXN+8P4X5N4stFoVFMM537IAiI23yNVvp5pzfzqBAgZgvHyJn1bwJA/Rv9Gehf1unrQX32xXpNPO13D8S04kGfCansLoIrfoYVrhKnxp6K8drBl9zq4=,iv:Xyc+LWHXnbxsZMPiISw3mc6dyTaO+YO3FFnWh5wYRFo=,tag:y5YSLUswbo6jl06B0f6ZzA==,type:str] encrypted_regex: ^(data|stringData)$ version: 3.11.0 diff --git a/clusters/base/apps/zigbee2mqtt/helmrelease.yaml b/clusters/base/apps/zigbee2mqtt/helmrelease.yaml new file mode 100644 index 0000000..ed1b885 --- /dev/null +++ b/clusters/base/apps/zigbee2mqtt/helmrelease.yaml @@ -0,0 +1,84 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: zigbee2mqtt + namespace: zigbee2mqtt +spec: + interval: 30m + chart: + spec: + chart: zigbee2mqtt + version: "2.12.1" + sourceRef: + kind: HelmRepository + name: zigbee2mqtt + values: + service: + type: ClusterIP + port: 8080 + + statefulset: + storage: + enabled: true + size: 1Gi + storageClassName: longhorn + secrets: + name: zigbee2mqtt-secrets + + configmap: + enabled: true + # devices.yaml / groups.yaml already exist on the PV and are the live source + # of truth (zigbee2mqtt mutates them as devices pair/rename). Do not set + # configmap.devices here — the chart only seeds devices.yaml from it when + # the file is missing, but leaving it unset avoids any risk of clobbering + # the real data and any drift between this file and reality. + + zigbee2mqtt: + homeassistant: + enabled: true + legacy_entity_attributes: true + + permit_join: false + timezone: Europe/Moscow + + mqtt: + server: "mqtt://mosquitto.mqtt.svc.cluster.local:1883" + user: iot + password: '!secret.yaml mqtt_password' + include_device_information: true + keepalive: 60 + reject_unauthorized: true + version: 4 + + serial: + port: "tcp://10.0.64.72:6638" + adapter: ember + baudrate: 115200 + rtscts: false + + frontend: + enabled: true + port: 8080 + url: "https://zigbee2mqtt.aggtaa.com" + + advanced: + channel: 11 + pan_id: 7410 + ext_pan_id: [46, 22, 201, 245, 48, 186, 40, 6] + network_key: '!secret.yaml network_key' + log_level: info + + ingress: + enabled: true + ingressClassName: traefik + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + hosts: + - host: zigbee2mqtt.aggtaa.com + paths: + - path: / + pathType: Prefix + tls: + - secretName: zigbee2mqtt-tls + hosts: + - zigbee2mqtt.aggtaa.com diff --git a/clusters/base/apps/zigbee2mqtt/helmrepository.yaml b/clusters/base/apps/zigbee2mqtt/helmrepository.yaml new file mode 100644 index 0000000..aef341f --- /dev/null +++ b/clusters/base/apps/zigbee2mqtt/helmrepository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: zigbee2mqtt + namespace: zigbee2mqtt +spec: + interval: 1h + url: https://charts.zigbee2mqtt.io/ diff --git a/clusters/base/apps/zigbee2mqtt/kustomization.yaml b/clusters/base/apps/zigbee2mqtt/kustomization.yaml new file mode 100644 index 0000000..f6917b9 --- /dev/null +++ b/clusters/base/apps/zigbee2mqtt/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helmrepository.yaml + - secret.enc.yaml + - helmrelease.yaml diff --git a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml new file mode 100644 index 0000000..a797edb --- /dev/null +++ b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +kind: Secret +metadata: + name: zigbee2mqtt-secrets + namespace: zigbee2mqtt +stringData: + secret.yaml: ENC[AES256_GCM,data:x9YutASbHeMTPsm9wTaxuOMNzvvAJIhKwUYkS3s7rTpYgqVsMVtVLjDtbxW8V9iTOkdL2GhqpXHkuIPY77TFJ+IwB6dm321v1JjUonc48BQv/Qfqq9vNJdxnzZeQwd0RiD4Irdk38ZxUxxja+3MVKOfmGC9XGuzsoU+lFpI=,iv:SxoJzEwvpIC4DgEIuo1x7kAl7NBvb/gjBVeVThlI7KA=,tag:bXyEc9HBuHycRtfm2huoJQ==,type:str] +sops: + age: + - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5eXVjTVpUWGg5RUxRNUpS + OEg5eWVCSzYzenQvNGpDb3hpRHV0MGlQVndZCmVPZGU0NndJdDMrblc0MDhyUUlC + dG1OdzBPZ3Y0ci9TZ0dxMksxZUFZeUkKLS0tIGttMUt3d3Y1b2pyb3JEL2RvMGlN + amxpQkVkWW5Lay9XZ3NJcjQrbVlyVkEKG9hRHgo9WBbJELiEZ1rQ653LNgbm/jz5 + NqCt+kNx3oGoRFMibEsuqRV4MYNNL/epv+RPpg56LxghY0jQ6rFKjg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-08-26T10:17:42Z" + mac: ENC[AES256_GCM,data:Ehu/yxV7LfmZoMoY1xD6NUi/53goQOk3d+FYEBnii+TZKJNzpm5ftSiuuKPjT7K4CQnQuZQd5whOT7UuzFiaDiRRloN4b0RXgS0I6oHKUE0CoBjtJL3oo091+PrMACoo4c4XHkePpE6vCg3hWbiy58z3MMM2kGvJA584+GznaL0=,iv:7cGMgW2fP8M3lqhMKHHhmivWN84iAhGMtvopBD2Ico4=,tag:9keLGJ/LtOKlh3iyEk6FpQ==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.11.0 diff --git a/clusters/base/namespaces/zigbee2mqtt.yaml b/clusters/base/namespaces/zigbee2mqtt.yaml new file mode 100644 index 0000000..6cb6720 --- /dev/null +++ b/clusters/base/namespaces/zigbee2mqtt.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: zigbee2mqtt diff --git a/clusters/home/apps/kustomization.yaml b/clusters/home/apps/kustomization.yaml index 481d208..648c908 100644 --- a/clusters/home/apps/kustomization.yaml +++ b/clusters/home/apps/kustomization.yaml @@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../base/apps/vaultwarden + - ../../base/apps/zigbee2mqtt diff --git a/clusters/home/namespaces/kustomization.yaml b/clusters/home/namespaces/kustomization.yaml index 592fa79..9ee8217 100644 --- a/clusters/home/namespaces/kustomization.yaml +++ b/clusters/home/namespaces/kustomization.yaml @@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../base/namespaces/vaultwarden.yaml + - ../../base/namespaces/zigbee2mqtt.yaml