Urmel/ansible
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added homeassistant

Browse Source
This commit is contained in:
Kyattsukuro 2026-09-09 23:41:14 +02:00
parent a5752fa577
commit f80a8e9df1
15 changed files with 350 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
inventory/host_vars/beDebianMain.yml
View File

@ -1,6 +1,19 @@
_speedup_bitwarden_hetzner_record: "{{ bitwarden_records_urmel_services['Hetzner'] }}"
_speedup_bitwarden_hetzner_fields: "{{ dict(_speedup_bitwarden_hetzner_record.fields|map(attribute='name')|zip(_speedup_bitwarden_hetzner_record.fields|map(attribute='value'))) }}"
traefik_override:
main_domain: "be.urmel.de"
http_port: "8080"
https_port: "8443"
include_external_services:
homeassistant:
url: "{{ ansible_facts.default_ipv4.address }}"
hetzner_api_token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
basic_auth_password: "{{ (bitwarden_records_urmel_services['Traefik'].fields | selectattr('name', '==', 'auth_string') | first).value }}"
ddns_override:
domains:
- provider: "hetznercloud"
@ -20,17 +33,21 @@ ddns_override:
ip_version: "ipv6"
token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
traefik_override:
main_domain: "be.urmel.de"
http_port: "8080"
https_port: "8443"
hetzner_api_token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
basic_auth_password: "{{ (bitwarden_records_urmel_services['Traefik'].fields | selectattr('name', '==', 'auth_string') | first).value }}"
dns_override:
api_key: "{{ bitwarden_records_urmel_services['Pihole'].login.password }}"
domain: "pihole.arpa.be.urmel.de"
local_domain: "be.urmel.de"
domain_host: 192.168.1.2
domain_host_v6: fd00:0000:1000::2
homeassistant_override:
url: "home.be.urmel.de"
proxy_ip: 172.16.0.0/12
mqtt:
zigbee2mqtt:
zigbee_adapter_id: "usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_f4b015d959f3ef1199c2c61b6d9880ab-if00-port0"
version: latest
domain: "mqtt.arpa.be.urmel.de"
auth_token: "{{ (bitwarden_records_urmel_services['Homeassistant'].fields | selectattr('name', '==', 'mqtt_auth_token') | first).value }}"
mariadb:
password: "{{ (bitwarden_records_urmel_services['Homeassistant'].fields | selectattr('name', '==', 'mariadb_password') | first).value }}"

6
playbooks/homeassistant.yml Normal file
View File

@ -0,0 +1,6 @@
---
- hosts: beDebianMain
pre_tasks:
- include_tasks: _lazy_lookup_workaround.yml
roles:
- homeassistant

1
roles/base_server/tasks/main.yml
View File

@ -16,6 +16,7 @@
package:
name:
- vim
- curl
state: latest
- name: copy docker deamon.json

3
roles/homeassistant/README.md Normal file
View File

@ -0,0 +1,3 @@
# homeassistant
Note: Homeassistant sometimes expectes .yaml NOT .yml

18
roles/homeassistant/defaults/main.yml Normal file
View File

@ -0,0 +1,18 @@
path: /srv/{{ role_name }}
homeassistant_override: {}
homeassistant_defaults:
url: ""
version: latest
proxy_ip: ""
mqtt:
zigbee2mqtt:
version: latest
domain: ""
auth_token: ""
zigbee_adapter_id: ""
mosquitto:
version: latest
allow_anonymous: true
mariadb:
password: ""

8
roles/homeassistant/handlers/main.yml Normal file
View File

@ -0,0 +1,8 @@
- name: restart container
community.docker.docker_compose_v2:
project_src: "{{ path }}"
project_name: "{{ role_name }}"
recreate: "always"
services: ["homeassistant"]
state: "restarted"
when: not _homeassistant_already_restarted

20
roles/homeassistant/meta/main.yml Normal file
View File

@ -0,0 +1,20 @@
---
galaxy_info:
author: "Niklas Freese <niklas@urmel.de>"
description: homeassistant
company: "Urmel Services"
license: AGPL-3.0-or-later
min_ansible_version: 2.1
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies:
- role: traefik

30
roles/homeassistant/tasks/ensure_configuration.yml Normal file
View File

@ -0,0 +1,30 @@
- name: Find Home Assistant configuration templates locally
ansible.builtin.set_fact:
ha_templates: "{{ query('ansible.builtin.fileglob', role_path + '/templates/homeassistant_configuration/*.yaml.j2') }}"
- name: Template Home Assistant configuration files
ansible.builtin.template:
src: "{{ item }}"
dest: "/srv/homeassistant/config/homeassistant/{{ item | basename | regex_replace('\\.j2$', '') }}"
mode: "0644"
loop: "{{ ha_templates }}"
loop_control:
label: "{{ item | basename }}"
- name: Ensure Home Assistant configuration.yaml exists
ansible.builtin.file:
path: "/srv/homeassistant/config/homeassistant/configuration.yaml"
state: touch
mode: "0644"
modification_time: preserve
access_time: preserve
- name: Add Home Assistant configuration includes
ansible.builtin.blockinfile:
path: "/srv/homeassistant/config/homeassistant/configuration.yaml"
marker: "# {mark} ANSIBLE MANAGED CONFIGURATION INCLUDES"
insertafter: EOF
block: |
{% for item in ha_templates | sort %}
{{ item | basename | regex_replace('\.yaml\.j2$', '') }}: !include {{ item | basename | regex_replace('\.j2$', '') }}
{% endfor %}

64
roles/homeassistant/tasks/main.yml Normal file
View File

@ -0,0 +1,64 @@
---
- name: "set local variables from overrides and defaults"
set_fact:
homeassistant: "{{ (homeassistant_defaults | combine(homeassistant_override, recursive=True)) if homeassistant_override else homeassistant_defaults }}"
- name: ensure that path exists
file:
path: "{{ path }}/config/homeassistant"
state: directory
- name: ensure that mosquitto config path exists
file:
path: "{{ path }}/config/mosquitto"
state: directory
- name: ensure that mosquitto data path exists
file:
path: "{{ item }}"
state: directory
owner: "1883"
group: "1883"
loop:
- "{{ path }}/data/mosquitto"
- "{{ path }}/data/mosquitto/log"
- name: ensure that zigbee2mqtt data path exists
file:
path: "{{ path }}/data/zigbee2mqtt"
state: directory
- name: template docker-compose
template:
src: compose.yml.j2
dest: "{{ path }}/compose.yml"
- name: template .env
template:
src: .env.j2
dest: "{{ path }}/.env"
- name: template mosquitto config
template:
src: mosquitto.conf.j2
dest: "{{ path }}/config/mosquitto/mosquitto.conf"
mode: "0644"
- name: template zigbee2mqtt config
template:
src: zigbee2mqtt/configuration.yaml.j2
dest: "{{ path }}/data/zigbee2mqtt/configuration.yaml"
mode: "0644"
- name: Do configuration
include_tasks: ensure_configuration.yml
- name: ensure container is running
community.docker.docker_compose_v2:
project_src: "{{ path }}"
project_name: "{{ role_name }}"
state: "present"
pull: "always"
wait: true
services: ["mariadb", "mosquitto", "homeassistant", "zigbee2mqtt"]
register: _compose_result

1
roles/homeassistant/templates/.env.j2 Normal file
View File

@ -0,0 +1 @@
SUBNET=172.31.254

100
roles/homeassistant/templates/compose.yml.j2 Normal file
View File

@ -0,0 +1,100 @@
version: '3'
services:
homeassistant:
image: homeassistant/home-assistant:{{ homeassistant.version }}
volumes:
# We do not yes manage configs with ansible
- ./config/homeassistant:/config
- /etc/localtime:/etc/localtime:ro
restart: unless-stopped
environment:
TZ: Europe/Berlin
network_mode: "host"
# networks:
# local_network:
# ipv4_address: ${SUBNET}.2
depends_on:
- zigbee2mqtt
- mariadb
- mosquitto
extra_hosts:
- "zwave:${SUBNET}.3"
- "zigbee2mqtt:${SUBNET}.6"
- "mariadb:${SUBNET}.4"
- "mosquitto:${SUBNET}.5"
# ports:
# - 8123:8123
# - 1400:1400
# - 1401:1401
{% if homeassistant.mqtt.zigbee2mqtt.zigbee_adapter_id %}
zigbee2mqtt:
# 8080
image: ghcr.io/koenkk/zigbee2mqtt:{{ homeassistant.mqtt.zigbee2mqtt.version }}
restart: unless-stopped
volumes:
- ./data/zigbee2mqtt:/app/data
- /run/udev:/run/udev:ro
environment:
- TZ=Europe/Berlin
networks:
local_network:
ipv4_address: ${SUBNET}.6
exposed:
devices:
# Make sure this matched your adapter location
- /dev/serial/by-id/{{ homeassistant.mqtt.zigbee2mqtt.zigbee_adapter_id }}:/dev/ttyUSB0
labels:
traefik.enable: true
traefik.http.routers.homeassistant-mqtt.entrypoints: https
traefik.http.routers.homeassistant-mqtt.rule: Host(`{{ homeassistant.mqtt.zigbee2mqtt.domain }}`)
traefik.http.services.homeassistant-mqtt.loadbalancer.server.port: 8080
traefik.http.routers.homeassistant-mqtt.tls: "true"
traefik.http.routers.homeassistant-mqtt.tls.certresolver: hetzner
traefik.http.routers.homeassistant-mqtt.middlewares: local-only@file
{% endif %}
mosquitto:
image: eclipse-mosquitto:{{ homeassistant.mqtt.mosquitto.version }}
restart: unless-stopped
user: "1883:1883"
volumes:
- ./config/mosquitto:/mosquitto/config:ro
- ./data/mosquitto:/mosquitto/data
- ./data/mosquitto/log:/mosquitto/log
environment:
- TZ=Europe/Berlin
networks:
local_network:
ipv4_address: ${SUBNET}.5
mariadb:
image: mariadb:10.11.2
volumes:
- ./data/mariadb:/var/lib/mysql
- ./config/mariadb:/etc/mysql/conf.d
- /etc/localtime:/etc/localtime:ro
restart: unless-stopped
environment:
MARIADB_ROOT_PASSWORD: {{ homeassistant.mariadb.password }}
MARIADB_MYSQL_LOCALHOST_USER: "yes"
MARIADB_MYSQL_LOCALHOST_GRANTS: "yes"
MARIADB_AUTO_UPGRADE: "yes"
MARIADB_DISABLE_UPGRADE_BACKUP: "yes"
TZ: Europe/Berlin
networks:
local_network:
ipv4_address: ${SUBNET}.4
networks:
local_network:
ipam:
driver: default
config:
- subnet: ${SUBNET}.0/24
exposed:
name: traefik_exposed
external: true

5
roles/homeassistant/templates/homeassistant_configuration/http.yaml.j2 Normal file
View File

@ -0,0 +1,5 @@
use_x_forwarded_for: true
trusted_proxies:
- {{ homeassistant.proxy_ip }}
# DOSE NOT WORK, MUST BE SET MANUALY AT FIRST BOOT

9
roles/homeassistant/templates/mosquitto.conf.j2 Normal file
View File

@ -0,0 +1,9 @@
# Ansible managed
persistence true
persistence_location /mosquitto/data/
log_dest file /mosquitto/log/mosquitto.log
listener 1883
protocol mqtt
allow_anonymous {{ 'true' if homeassistant.mqtt.mosquitto.allow_anonymous else 'false' }}

13
roles/homeassistant/templates/zigbee2mqtt/configuration.yaml.j2 Normal file
View File

@ -0,0 +1,13 @@
# Ansible managed
homeassistant: true
mqtt:
base_topic: zigbee2mqtt
server: 'mqtt://mosquitto:1883'
serial:
port: /dev/ttyUSB0
advanced:
log_level: info
frontend:
enabled: true
auth_token: {{ homeassistant.mqtt.zigbee2mqtt.auth_token }}
version: 5

112
shelf/be.urmel.md
View File

@ -1,11 +1,41 @@
# Proxmox WLAN IP-Tables
### V4
```
# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
# Generated by iptables-save v1.8.11 on Wed Sep 9 03:31:03 2026
*nat
:PREROUTING ACCEPT [607:102422]
:INPUT ACCEPT [226:15893]
:OUTPUT ACCEPT [237:16252]
:POSTROUTING ACCEPT [2202:155522]
-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.250.2:8443
-A PREROUTING ! -s 192.168.250.0/24 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.250.2:53
-A PREROUTING ! -s 192.168.250.0/24 -p udp -m udp --dport 67 -j DNAT --to-destination 192.168.250.2:67
-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.250.2:8443
-A PREROUTING ! -s 192.168.250.0/24 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.250.2:53
-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE
COMMIT
# Completed on Wed Sep 9 03:31:03 2026
# Generated by iptables-save v1.8.11 on Wed Sep 9 03:31:03 2026
*raw
:PREROUTING ACCEPT [91865:11405819]
:OUTPUT ACCEPT [10786:3643869]
-A PREROUTING -i fwbr+ -j CT --zone 1
-A PREROUTING -i fwbr+ -j CT --zone 100
COMMIT
# Completed on Wed Sep 9 03:31:03 2026
# Generated by iptables-save v1.8.11 on Wed Sep 9 03:31:03 2026
*filter
:INPUT ACCEPT [479923:96015305]
:FORWARD ACCEPT [309996:354561575]
:OUTPUT ACCEPT [475252:104246097]
:INPUT ACCEPT [12340:2837091]
:FORWARD ACCEPT [34550:5062071]
:OUTPUT ACCEPT [10728:3637989]
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 51820 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 51820 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 80 -j ACCEPT
@ -16,59 +46,15 @@
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8080 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 8443 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8443 -j ACCEPT
# -A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 53 -j ACCEPT
# -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 53 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 67 -j ACCEPT
COMMIT
# Completed on Sun Jul 26 18:26:48 2026
# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
*raw
:PREROUTING ACCEPT [936759:484955391]
:OUTPUT ACCEPT [475255:104246408]
-A PREROUTING -i fwbr+ -j CT --zone 1
-A PREROUTING -i fwbr+ -j CT --zone 100
-A PREROUTING -i fwbr+ -j CT --zone 1
-A PREROUTING -i fwbr+ -j CT --zone 100
-A PREROUTING -i fwbr+ -j CT --zone 100
-A PREROUTING -i fwbr+ -j CT --zone 1
-A PREROUTING -i fwbr+ -j CT --zone 1
-A PREROUTING -i fwbr+ -j CT --zone 1
COMMIT
# Completed on Sun Jul 26 18:26:48 2026
# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
*nat
:PREROUTING ACCEPT [157187:35876890]
:INPUT ACCEPT [9697:1450815]
:OUTPUT ACCEPT [12692:835211]
:POSTROUTING ACCEPT [12719:836855]
-A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
-A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
-A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
-A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.250.2:8443
-A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination 192.168.250.2:8443
# -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.250.2:53
# -A PREROUTING -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.250.2:53
-A PREROUTING -p udp -m udp --dport 67 -j DNAT --to-destination 192.168.250.2:67
-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE
-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j SNAT --to-source 192.168.1.2
-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE
COMMIT
# Completed on Sun Jul 26 18:26:48 2026
# Completed on Wed Sep 9 03:31:03 2026
```
### V6
```
# /etc/iptables/rules.v6
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
@ -91,36 +77,32 @@ COMMIT
COMMIT
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -i fwbr+ -j CT --zone 1
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820
-A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820
-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820
-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820
-A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A POSTROUTING -s fd00:0:ffff::/64 -o wlp2s0 -j MASQUERADE