From eb7d6031f8619fc21402327fefa439d7cb416f83 Mon Sep 17 00:00:00 2001 From: admin Date: Tue, 30 Jun 2026 23:36:01 -0700 Subject: [PATCH] refactor(homeassistant): move to folder-based layout --- homeassistant/homeassistant.yaml | 181 +++++++++++++++++++++++++++++++ 1 file changed, 181 insertions(+) create mode 100644 homeassistant/homeassistant.yaml diff --git a/homeassistant/homeassistant.yaml b/homeassistant/homeassistant.yaml new file mode 100644 index 0000000..e6d4ddd --- /dev/null +++ b/homeassistant/homeassistant.yaml @@ -0,0 +1,181 @@ +services: + homeassistant: + image: ghcr.io/home-assistant/home-assistant:stable + hostname: home + networks: + - traefik_backend + - postgresql_db-backend + dns: + - 127.0.0.11 # Docker embedded DNS first + - 1.1.1.1 # Public fallback for external resolution + ports: + - 8123:8123 + volumes: + - /volume1/docker/Home Assistant/config:/config + - /volume1/docker/letsencrypt/certs:/ssl + - /var/run/docker.sock:/var/run/docker.sock + - /etc/localtime:/etc/localtime:ro + healthcheck: + test: "bash -c 'printf \"GET / HTTP/1.1\n\n\" > /dev/tcp/127.0.0.1/8123; exit $$?;'" + interval: 90s + retries: 5 + start_period: 5s + timeout: 15s + deploy: + labels: + - traefik.enable=true + - traefik.http.routers.hass.rule=Host(`home.${DOMAIN}`) + - traefik.http.routers.hass.tls=true + - traefik.http.routers.hass.tls.certresolver=letsencrypt + - traefik.http.routers.hass.entrypoints=websecure + - traefik.http.services.hass.loadbalancer.server.port=8123 + - traefik.swarm.network=traefik_backend + - traefik.http.services.hass.loadbalancer.server.scheme=https + - traefik.http.routers.hass.middlewares=crowdsec@file + - autoheal=true + resources: + limits: + cpus: '4' # Limit to 0.5 CPU core + memory: 4G + + frigate-nvr: + hostname: frigate + image: ghcr.io/blakeblackshear/frigate:0.17.1 + cap_add: + - CAP_PERFMON + - SYS_ADMIN + volumes: + - /etc/localtime:/etc/localtime:ro + - /volume1/docker/frigate/config:/config + - /volume1/docker/frigate/media:/media/frigate + - /volume1/docker/letsencrypt/certs/certs/nvr.${DOMAIN}.crt:/etc/letsencrypt/live/frigate/fullchain.pem + - /volume1/docker/letsencrypt/certs/private/nvr.${DOMAIN}.key:/etc/letsencrypt/live/frigate/privkey.pem + - /dev/dri/renderD128:/dev/dri/renderD128 + - type: tmpfs + target: /tmp/cache + tmpfs: + size: 5000000000 + - type: tmpfs + target: /dev/shm + tmpfs: + size: 15000000000 + environment: + FRIGATE_RTSP_PASSWORD: "${FRIGATE_RTSP_PASSWORD}" + networks: + - traefik_backend + deploy: + labels: + - traefik.enable=true + - traefik.http.routers.frigate-auth.rule=Host(`nvr.${DOMAIN}`) + - traefik.http.routers.frigate-ip.rule=Host(`nvr.${DOMAIN}`) && ClientIP(`10.0.0.0/8`) + - traefik.http.routers.frigate-auth.tls=true + - traefik.http.routers.frigate-ip.tls=true + - traefik.http.routers.frigate-auth.tls.certresolver=letsencrypt + - traefik.http.routers.frigate-ip.tls.certresolver=letsencrypt + - traefik.http.routers.frigate-auth.entrypoints=websecure + - traefik.http.routers.frigate-ip.entrypoints=websecure + - traefik.http.services.frigate.loadbalancer.server.port=5000 + - traefik.swarm.network=traefik_backend + - traefik.http.routers.frigate-auth.middlewares=forwardAuth-authentik@file, crowdsec@file + + MQTT: + command: + - "/usr/sbin/mosquitto" + - "-c" + - "/mosquitto/config/mosquitto.conf" + entrypoint: + - "/docker-entrypoint.sh" + image: "public.ecr.aws/docker/library/eclipse-mosquitto:latest" + stdin_open: true + tty: true + hostname: mqtt + networks: + - traefik_backend + volumes: + - /volume1/docker/MQTT/config:/mosquitto/config + - /volume1/docker/MQTT/data:/mosquitto/data + - /volume1/docker/MQTT/log:/mosquitto/log + deploy: + endpoint_mode: dnsrr + labels: + - traefik.enable=true + - traefik.tcp.routers.mqtt.entrypoints=mqtt + - traefik.tcp.routers.mqtt.rule=HostSNI(`*`) + - traefik.tcp.services.mqtt.loadbalancer.server.port=1883 + - traefik.tcp.routers.mqtt.service=mqtt + - traefik.swarm.network=traefik_backend + + Zigbee2MQTT: + command: + - "/sbin/tini" + - "--" + - "node" + - "index.js" + entrypoint: + - "docker-entrypoint.sh" + environment: + - "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + - "NODE_ENV=production" + - "TZ=Pacific/Los_Angeles" + image: "ghcr.io/koenkk/zigbee2mqtt:latest" + hostname: zb + networks: + - traefik_backend + healthcheck: + test: "wget --no-verbose --tries=1 --header 'Host: zigbee2mqtt.koseduhemak.de' --spider http://localhost:8080 || exit 1" + start_period: 60s + interval: 5s + retries: 5 + timeout: 5s + stdin_open: true + tty: true + volumes: + - /volume1/docker/Zigbee2MQTT/data:/app/data + working_dir: "/app" + deploy: + labels: + - traefik.enable=true + - traefik.http.routers.zigbee.rule=Host(`zb.${DOMAIN}`) + - traefik.http.routers.zigbee.tls=true + - traefik.http.routers.zigbee.tls.certresolver=letsencrypt + - traefik.http.routers.zigbee.entrypoints=websecure + - traefik.http.services.zigbee.loadbalancer.server.port=8080 + - traefik.swarm.network=traefik_backend + - traefik.http.routers.zigbee.middlewares=forwardAuth-authentik@file, crowdsec@file + resources: + limits: + cpus: '1' + memory: 512M + + ESPHome: + image: ghcr.io/esphome/esphome:latest + volumes: + - /volume1/docker/esphome/config:/config + hostname: esp + networks: + - traefik_backend + deploy: + labels: + - traefik.enable=true + - traefik.http.routers.esphome.rule=Host(`esp.${DOMAIN}`) + - traefik.http.routers.esphome.tls=true + - traefik.http.routers.esphome.tls.certresolver=letsencrypt + - traefik.http.routers.esphome.entrypoints=websecure + - traefik.http.services.esphome.loadbalancer.server.port=6052 + - traefik.swarm.network=traefik_backend + - traefik.http.routers.esphome.middlewares=forwardAuth-authentik@file, crowdsec@file + resources: + limits: + cpus: '10' + memory: 4G + +networks: + postgresql_db-backend: + external: true + traefik_backend: + external: true + traefik_frontend: + external: true + host: + name: host + external: true