refactor(homeassistant): move to folder-based layout

2026-06-30 23:36:01 -07:00
parent 9ff21ff018
commit eb7d6031f8
1 changed files with 181 additions and 0 deletions
@@ -0,0 +1,181 @@
+services:
+  homeassistant:
+    image: ghcr.io/home-assistant/home-assistant:stable
+    hostname: home
+    networks:
+      - traefik_backend
+      - postgresql_db-backend
+    dns:
+      - 127.0.0.11       # Docker embedded DNS first
+      - 1.1.1.1          # Public fallback for external resolution
+    ports:
+       - 8123:8123
+    volumes:
+      - /volume1/docker/Home Assistant/config:/config
+      - /volume1/docker/letsencrypt/certs:/ssl
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /etc/localtime:/etc/localtime:ro
+    healthcheck:
+      test: "bash -c 'printf \"GET / HTTP/1.1\n\n\" > /dev/tcp/127.0.0.1/8123; exit $$?;'"
+      interval: 90s
+      retries: 5
+      start_period: 5s
+      timeout: 15s
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.hass.rule=Host(`home.${DOMAIN}`)
+        - traefik.http.routers.hass.tls=true
+        - traefik.http.routers.hass.tls.certresolver=letsencrypt
+        - traefik.http.routers.hass.entrypoints=websecure
+        - traefik.http.services.hass.loadbalancer.server.port=8123
+        - traefik.swarm.network=traefik_backend
+        - traefik.http.services.hass.loadbalancer.server.scheme=https
+        - traefik.http.routers.hass.middlewares=crowdsec@file
+        - autoheal=true
+      resources:
+        limits:
+          cpus: '4' # Limit to 0.5 CPU core
+          memory: 4G
+
+  frigate-nvr:
+    hostname: frigate
+    image: ghcr.io/blakeblackshear/frigate:0.17.1
+    cap_add:
+      - CAP_PERFMON
+      - SYS_ADMIN
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /volume1/docker/frigate/config:/config
+      - /volume1/docker/frigate/media:/media/frigate
+      - /volume1/docker/letsencrypt/certs/certs/nvr.${DOMAIN}.crt:/etc/letsencrypt/live/frigate/fullchain.pem
+      - /volume1/docker/letsencrypt/certs/private/nvr.${DOMAIN}.key:/etc/letsencrypt/live/frigate/privkey.pem
+      - /dev/dri/renderD128:/dev/dri/renderD128
+      - type: tmpfs
+        target: /tmp/cache
+        tmpfs:
+          size: 5000000000
+      - type: tmpfs
+        target: /dev/shm
+        tmpfs:
+          size: 15000000000
+    environment:
+      FRIGATE_RTSP_PASSWORD: "${FRIGATE_RTSP_PASSWORD}"
+    networks:
+      - traefik_backend
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.frigate-auth.rule=Host(`nvr.${DOMAIN}`)
+        - traefik.http.routers.frigate-ip.rule=Host(`nvr.${DOMAIN}`) && ClientIP(`10.0.0.0/8`)
+        - traefik.http.routers.frigate-auth.tls=true
+        - traefik.http.routers.frigate-ip.tls=true
+        - traefik.http.routers.frigate-auth.tls.certresolver=letsencrypt
+        - traefik.http.routers.frigate-ip.tls.certresolver=letsencrypt
+        - traefik.http.routers.frigate-auth.entrypoints=websecure
+        - traefik.http.routers.frigate-ip.entrypoints=websecure
+        - traefik.http.services.frigate.loadbalancer.server.port=5000
+        - traefik.swarm.network=traefik_backend
+        - traefik.http.routers.frigate-auth.middlewares=forwardAuth-authentik@file, crowdsec@file
+
+  MQTT:
+    command:
+      - "/usr/sbin/mosquitto"
+      - "-c"
+      - "/mosquitto/config/mosquitto.conf"
+    entrypoint:
+      - "/docker-entrypoint.sh"
+    image: "public.ecr.aws/docker/library/eclipse-mosquitto:latest"
+    stdin_open: true
+    tty: true
+    hostname: mqtt
+    networks:
+      - traefik_backend
+    volumes:
+      - /volume1/docker/MQTT/config:/mosquitto/config
+      - /volume1/docker/MQTT/data:/mosquitto/data
+      - /volume1/docker/MQTT/log:/mosquitto/log
+    deploy:
+      endpoint_mode: dnsrr
+      labels:
+        - traefik.enable=true
+        - traefik.tcp.routers.mqtt.entrypoints=mqtt
+        - traefik.tcp.routers.mqtt.rule=HostSNI(`*`)
+        - traefik.tcp.services.mqtt.loadbalancer.server.port=1883
+        - traefik.tcp.routers.mqtt.service=mqtt
+        - traefik.swarm.network=traefik_backend
+
+  Zigbee2MQTT:
+    command:
+      - "/sbin/tini"
+      - "--"
+      - "node"
+      - "index.js"
+    entrypoint:
+      - "docker-entrypoint.sh"
+    environment:
+      - "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+      - "NODE_ENV=production"
+      - "TZ=Pacific/Los_Angeles"
+    image: "ghcr.io/koenkk/zigbee2mqtt:latest"
+    hostname: zb
+    networks:
+      - traefik_backend
+    healthcheck:
+      test: "wget --no-verbose --tries=1 --header 'Host: zigbee2mqtt.koseduhemak.de' --spider http://localhost:8080 || exit 1"
+      start_period: 60s
+      interval: 5s
+      retries: 5
+      timeout: 5s
+    stdin_open: true
+    tty: true
+    volumes:
+      - /volume1/docker/Zigbee2MQTT/data:/app/data
+    working_dir: "/app"
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.zigbee.rule=Host(`zb.${DOMAIN}`)
+        - traefik.http.routers.zigbee.tls=true
+        - traefik.http.routers.zigbee.tls.certresolver=letsencrypt
+        - traefik.http.routers.zigbee.entrypoints=websecure
+        - traefik.http.services.zigbee.loadbalancer.server.port=8080
+        - traefik.swarm.network=traefik_backend
+        - traefik.http.routers.zigbee.middlewares=forwardAuth-authentik@file, crowdsec@file
+      resources:
+        limits:
+          cpus: '1'
+          memory: 512M
+
+  ESPHome:
+    image: ghcr.io/esphome/esphome:latest
+    volumes:
+      - /volume1/docker/esphome/config:/config
+    hostname: esp
+    networks:
+      - traefik_backend
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.esphome.rule=Host(`esp.${DOMAIN}`)
+        - traefik.http.routers.esphome.tls=true
+        - traefik.http.routers.esphome.tls.certresolver=letsencrypt
+        - traefik.http.routers.esphome.entrypoints=websecure
+        - traefik.http.services.esphome.loadbalancer.server.port=6052
+        - traefik.swarm.network=traefik_backend
+        - traefik.http.routers.esphome.middlewares=forwardAuth-authentik@file, crowdsec@file
+      resources:
+        limits:
+          cpus: '10'
+          memory: 4G
+
+networks:
+  postgresql_db-backend:
+    external: true
+  traefik_backend:
+    external: true
+  traefik_frontend:
+    external: true
+  host:
+    name: host
+    external: true