added home-assistant container

.gitattributes

@@ -1,3 +1,5 @@
 .pass.sh filter=git-crypt diff=git-crypt
 ansible/vars/vault.yml filter=git-crypt diff=git-crypt
+ansible/roles/hass/files/automations.yaml filter=git-crypt diff=git-crypt
+ansible/roles/hass/files/configuration.yaml filter=git-crypt diff=git-crypt
 *.yml linguist-detectable

ansible/deploy_home.yml

@@ -10,6 +10,7 @@
   - role: pihole
   - role: http
   - role: drone
+  - role: hass
   - role: nfs
     tags: nfs
   - role: motion

ansible/roles/hass/meta/main.yml

@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: http

ansible/roles/hass/tasks/hass.yml

@@ -0,0 +1,38 @@
+---
+- name: create home-assistant host directory volumes
+  become: true
+  file:
+    path: "{{ item }}"
+    state: directory
+  with_items:
+    - /usr/share/hass
+    - /usr/share/hass/media
+    - /var/lib/private/hass
+  tags: hass
+
+- name: copy configuration and automations
+  become: true
+  copy:
+    src: "files/{{ item }}"
+    dest: "/var/lib/private/hass/{{ item }}"
+    mode: 644
+  with_items:
+    - configuration.yaml
+    - automations.yaml
+  tags: hass
+
+- name: create home-assistant server container
+  diff: false
+  docker_container:
+    name: hass
+    image: ghcr.io/home-assistant/home-assistant:stable
+    recreate: true
+    restart: true
+    restart_policy: on-failure
+    restart_retries: 3
+    volumes:
+      - /var/lib/hass:/config
+      - /usr/share/hass:/share
+    ports:
+      - "8123:8123"
+  tags: hass

ansible/roles/hass/tasks/main.yml

@@ -0,0 +1,2 @@
+---
+- import_tasks: hass.yml

ansible/roles/http/defaults/main.yml

@@ -7,6 +7,7 @@ deps: [
 
 ci_server_name: ci.bdebyl.net
 pi_server_name: pi.bdebyl.net
+assistant_server_name: assistant.bdebyl.net
 home_server_name: home.bdebyl.net
 parts_server_name: parts.bdebyl.net
 install_path: /usr/share

ansible/roles/http/files/nginx/nginx.conf

@@ -10,6 +10,11 @@ events {
 }
 
 http {
+  map $http_upgrade $connection_upgrade {
+    default upgrade;
+    '' close;
+  }
+
   include mime.types;
 
   default_type application/octet-stream;

ansible/roles/http/tasks/http.yml

@@ -38,6 +38,7 @@
     - "{{ ci_server_name }}.http.conf"
     - "{{ pi_server_name }}.conf"
     - "{{ home_server_name }}.conf"
+    - "{{ assistant_server_name }}.conf"
     - "{{ parts_server_name }}.conf"
   notify: restart_nginx
   tags: http
@@ -59,5 +60,7 @@
     - "{{ ci_server_name }}.http.conf"
     - "{{ pi_server_name }}.conf"
     - "{{ parts_server_name }}.conf"
+    - "{{ home_server_name }}.conf"
+    - "{{ assistant_server_name }}.conf"
   notify: restart_nginx
   tags: http

ansible/roles/http/templates/nginx/sites/assistant.bdebyl.net.conf.j2

@@ -0,0 +1,17 @@
+server {
+  listen 80;
+  server_name {{ assistant_server_name }};
+
+  location / {
+    allow 192.168.1.0/24;
+    allow 127.0.0.1;
+    deny all;
+
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header Upgrade         $http_upgrade;
+    proxy_set_header Connection      $connection_upgrade;
+
+    proxy_buffering off;
+    proxy_pass http://localhost:8123;
+  }
+}