zigbee2mqtt

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:PrvE3gQljPkmPhr4p3rpUa1f3C6PqJBjHZji3CPtj69D4Q0KIOhjJP3HXc0BGh2lc3jCNvceCA+i,iv:oyOzS2IlP3f8HYJ0aXbJhRGmFyaYGonvFOTg8/aRUsU=,tag:zHNt0gEsbg/sOLye1BpBIw==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:AaFBk7Zjd9nm/4/leUScg/9Myd8vWxUJ49DeRRBHz5GdZr2i5k60nF9vpceIQ5OkWCKVwmosIxuWrj04li19aWtgMvdkzeBA1igkwPqMR+80P76CawYZ4Ppt6TAQ1mi5pdvg19+KCV8vd4Xx3EWOMpa7WH1zxw==,iv:jdpBIe+GUgcjlfqF8PDbcq16HoHXiZZpUeRU/5HryhU=,tag:OzpJegKUfNRX79K01BnWRQ==,type:str]
+    #ENC[AES256_GCM,data:ZSi9ncwQt1hF89l00We38ZVpj6aZSdLM1Y0p8nFeKk/fpwvZ9EHP+eZsC1sqzU0eM14TVFZMY0/s,iv:HDHYINHS11OCEBYggNrHbYVydk8uR1We1Na/q8oCS30=,tag:s09J6DNSX97/YvJaKpdasA==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:qAoDEzwuADkdgydaberlQ9G6Vfnl5xG0Ff1ERn4F5HK6okP0x5o7bAnbEhRJ5aJfPE/x0+POVT0EQU9REYA0jYyZtRS8Ntszb/NiIH39uaRRzkZ4wrcHQR8aMIcWp81j4NnUp7iGL7j01H58dIY4ABmNSoV7lA==,iv:B2izY/vJqtqXpAUeyZPBBIH8nKhWeiv9c52gyMM1wvY=,tag:bJE43ntkkDv3l1alBjuhwA==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZZUVHandHK09qbnozLzZC
-            OFVjTGdhaFZEbTNwZkUxNmFINXRNQnpFakVvCjhhbkpTVXdYdjBpMFJmalpUMWVp
-            d0tncG14N0V5azVnV0xkcnR2MVVPQ1kKLS0tIGx2Mm5zRllwM1VLS0tIeDVWTDZP
-            Mnljbyt1Um9yVmpLTGVJY0NoTktlRTQK++A3xEKCIaGAXCpq6QvsogpjYzo/FG8Y
-            Pi3RH9txTHVUb1xA8NqNnJTgTEWnEpV2SRmV0qhjibs1EZLpAjA8fg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBETG1pVE50Q0JPMVdEdGhz
+            NmZzdGRDNkNpUUdNSld1ZjdvK0ZKSm96VzJ3ClpldzFxMWpoa3FmODF0amQ4Nkpq
+            Mit2dENsSGZmaHBsemEwc0I3VzdZYVEKLS0tIGsvRjRCZWQ0WkU2WVROQ2Z0bThj
+            eVplbElrRjFXV240MytFM3JxZldxYXMKaTSYz4rprKWo8gIyNAIBmrS0QOkL4NCZ
+            sMo4kzEI6J6fI9uHwBtYQ5xk70EZw/XGo9JWeGxriZ1CduJqW9J7kQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:17:39Z"
-    mac: ENC[AES256_GCM,data:g8smWhzjNf2kewmn9+QYb2LOwZc2IxnXcYG1lQBjbLRgyPvdLt55BciTHF6c4BNNhaVQc+dx6QPhH5y6qrC4muNGVQdBCyANX+U5gZMt3cZCfaYmHAAtohrJDx16miL3MC7tGGnTnD26VD0/w9X744icH8kjsBH7ZdTG66r/bBw=,iv:r9tQNr0Gi8G0GrFKKrleEGPIR3/pVETfQxvAtqnWrRQ=,tag:NVUnW5Mk3JcW7b20TvLnDA==,type:str]
+    lastmodified: "2026-08-26T10:17:41Z"
+    mac: ENC[AES256_GCM,data:jw0L50e5SL/geTLLM0X53Coaxte2/cG481bsK79UZGzV8MnpXm1XkXa8gXN+8P4X5N4stFoVFMM537IAiI23yNVvp5pzfzqBAgZgvHyJn1bwJA/Rv9Gehf1unrQX32xXpNPO13D8S04kGfCansLoIrfoYVrhKnxp6K8drBl9zq4=,iv:Xyc+LWHXnbxsZMPiISw3mc6dyTaO+YO3FFnWh5wYRFo=,tag:y5YSLUswbo6jl06B0f6ZzA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/helmrelease.yaml

@@ -0,0 +1,84 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: zigbee2mqtt
+  namespace: zigbee2mqtt
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: zigbee2mqtt
+      version: "2.12.1"
+      sourceRef:
+        kind: HelmRepository
+        name: zigbee2mqtt
+  values:
+    service:
+      type: ClusterIP
+      port: 8080
+
+    statefulset:
+      storage:
+        enabled: true
+        size: 1Gi
+        storageClassName: longhorn
+      secrets:
+        name: zigbee2mqtt-secrets
+
+    configmap:
+      enabled: true
+      # devices.yaml / groups.yaml already exist on the PV and are the live source
+      # of truth (zigbee2mqtt mutates them as devices pair/rename). Do not set
+      # configmap.devices here — the chart only seeds devices.yaml from it when
+      # the file is missing, but leaving it unset avoids any risk of clobbering
+      # the real data and any drift between this file and reality.
+
+    zigbee2mqtt:
+      homeassistant:
+        enabled: true
+        legacy_entity_attributes: true
+
+      permit_join: false
+      timezone: Europe/Moscow
+
+      mqtt:
+        server: "mqtt://mosquitto.mqtt.svc.cluster.local:1883"
+        user: iot
+        password: '!secret.yaml mqtt_password'
+        include_device_information: true
+        keepalive: 60
+        reject_unauthorized: true
+        version: 4
+
+      serial:
+        port: "tcp://10.0.64.72:6638"
+        adapter: ember
+        baudrate: 115200
+        rtscts: false
+
+      frontend:
+        enabled: true
+        port: 8080
+        url: "https://zigbee2mqtt.aggtaa.com"
+
+      advanced:
+        channel: 11
+        pan_id: 7410
+        ext_pan_id: [46, 22, 201, 245, 48, 186, 40, 6]
+        network_key: '!secret.yaml network_key'
+        log_level: info
+
+    ingress:
+      enabled: true
+      ingressClassName: traefik
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt-prod
+      hosts:
+        - host: zigbee2mqtt.aggtaa.com
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - secretName: zigbee2mqtt-tls
+          hosts:
+            - zigbee2mqtt.aggtaa.com

clusters/base/apps/zigbee2mqtt/helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: zigbee2mqtt
+  namespace: zigbee2mqtt
+spec:
+  interval: 1h
+  url: https://charts.zigbee2mqtt.io/

clusters/base/apps/zigbee2mqtt/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease.yaml

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: zigbee2mqtt-secrets
+    namespace: zigbee2mqtt
+stringData:
+    secret.yaml: ENC[AES256_GCM,data:x9YutASbHeMTPsm9wTaxuOMNzvvAJIhKwUYkS3s7rTpYgqVsMVtVLjDtbxW8V9iTOkdL2GhqpXHkuIPY77TFJ+IwB6dm321v1JjUonc48BQv/Qfqq9vNJdxnzZeQwd0RiD4Irdk38ZxUxxja+3MVKOfmGC9XGuzsoU+lFpI=,iv:SxoJzEwvpIC4DgEIuo1x7kAl7NBvb/gjBVeVThlI7KA=,tag:bXyEc9HBuHycRtfm2huoJQ==,type:str]
+sops:
+    age:
+        - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5eXVjTVpUWGg5RUxRNUpS
+            OEg5eWVCSzYzenQvNGpDb3hpRHV0MGlQVndZCmVPZGU0NndJdDMrblc0MDhyUUlC
+            dG1OdzBPZ3Y0ci9TZ0dxMksxZUFZeUkKLS0tIGttMUt3d3Y1b2pyb3JEL2RvMGlN
+            amxpQkVkWW5Lay9XZ3NJcjQrbVlyVkEKG9hRHgo9WBbJELiEZ1rQ653LNgbm/jz5
+            NqCt+kNx3oGoRFMibEsuqRV4MYNNL/epv+RPpg56LxghY0jQ6rFKjg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:17:42Z"
+    mac: ENC[AES256_GCM,data:Ehu/yxV7LfmZoMoY1xD6NUi/53goQOk3d+FYEBnii+TZKJNzpm5ftSiuuKPjT7K4CQnQuZQd5whOT7UuzFiaDiRRloN4b0RXgS0I6oHKUE0CoBjtJL3oo091+PrMACoo4c4XHkePpE6vCg3hWbiy58z3MMM2kGvJA584+GznaL0=,iv:7cGMgW2fP8M3lqhMKHHhmivWN84iAhGMtvopBD2Ico4=,tag:9keLGJ/LtOKlh3iyEk6FpQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/namespaces/zigbee2mqtt.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: zigbee2mqtt

clusters/home/apps/kustomization.yaml

@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../../base/apps/vaultwarden
+  - ../../base/apps/zigbee2mqtt

clusters/home/namespaces/kustomization.yaml

@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../../base/namespaces/vaultwarden.yaml
+  - ../../base/namespaces/zigbee2mqtt.yaml