helmrelease.yaml

---
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: home-assistant
spec:
  interval: 30m
  chart:
    spec:
      chart: app-template
      version: 3.7.3
      sourceRef:
        kind: HelmRepository
        name: bjw-s
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    cleanupOnFail: true
    remediation:
      strategy: rollback
      retries: 3
  driftDetection:
    mode: enabled
  values:
    controllers:
      home-assistant:
        annotations:
          reloader.stakater.com/auto: "true"
        containers:
          app:
            image:
              repository: ghcr.io/home-operations/home-assistant
              tag: 2025.12.5@sha256:6be0843b06ad82233639e56f261b2377f78df140e3d16d2d08b2c29c8889b697
            env:
              TZ: ${TIMEZONE}
              HASS_HTTP_TRUSTED_PROXY_1: "${NODE_CIDR}"
              HASS_HTTP_TRUSTED_PROXY_2: "${POD_CIDR}"
              HASS_HTTP_TRUSTED_PROXY_3: "${SERVICE_CIDR}"
              HASS_URL: "https://hass.${SECRET_DOMAIN}"
            envFrom:
              - secretRef:
                  name: home-assistant-secret
            securityContext:
              runAsNonRoot: true
              allowPrivilegeEscalation: false
              readOnlyRootFilesystem: true
              capabilities: { drop: ["ALL"] }
            resources:
              requests:
                cpu: 10m
              limits:
                memory: 2Gi
          code-server:
            dependsOn: app
            image:
              repository: ghcr.io/coder/code-server
              tag: 4.115.0@sha256:cbd5e05849367e521f774b760602cb9e0a8da1f159eaf89600490eec34129fe5
            args:
              [
                "--auth",
                "none",
                "--user-data-dir",
                "/config/.vscode",
                "--extensions-dir",
                "/config/.vscode",
                "--port",
                "12321",
                "/config",
              ]
            securityContext:
              runAsNonRoot: true
            resources:
              requests:
                cpu: 10m
              limits:
                memory: 512Mi
          filebrowser:
            dependsOn: app
            image:
              repository: docker.io/filebrowser/filebrowser
              tag: v2.63.1@sha256:0effd18992e8bd895649df97304bf69806e75ab94a5d75fce82d7276bd6067ab
            args:
              - --port
              - "8080"
              - --root
              - /data
            env:
              TZ: ${TIMEZONE}
              FB_DATABASE: /config/filebrowser.db
              FB_ROOT: /config
              FB_LOG: stdout
              FB_NOAUTH: true
            securityContext:
              runAsNonRoot: true
              allowPrivilegeEscalation: false
              readOnlyRootFilesystem: true
              capabilities: { drop: ["ALL"] }
            resources:
              requests:
                cpu: 100m
              limits:
                memory: 2Gi
          everything-presence-mmwave-configurator:
            dependsOn: app
            image:
              repository: docker.io/everythingsmarthome/everything-presence-mmwave-configurator
              tag: 1.2.2@sha256:866f2fc495d42da2adfde079c31e5830bd69f5c574b6efaafc87a830412d9fd5
            env:
              TZ: ${TIMEZONE}
              HA_URL: http://127.0.0.1:8123
            envFrom:
              - secretRef:
                  name: home-assistant-secret
            probes:
              liveness: &probes
                enabled: true
                custom: true
                spec:
                  httpGet:
                    path: /api/entities/binary_sensor.everything_presence_lite_93bbb0_occupancy
                    port: &mmwave-config-port 8099
                  initialDelaySeconds: 10
                  periodSeconds: 10
                  timeoutSeconds: 1
                  failureThreshold: 3
              readiness: *probes
            securityContext:
              allowPrivilegeEscalation: true
              readOnlyRootFilesystem: false
              runAsUser: 0
              runAsGroup: 0
              fsGroup: 0
            resources:
              requests:
                cpu: 10m
              limits:
                memory: 512Mi
    defaultPodOptions:
      hostNetwork: true # necessary for mDNS to work
      nodeSelector:
        sonoff.feature.node.kubernetes.io/thread-dongle: "true"
      securityContext:
        runAsNonRoot: false
        runAsUser: 568
        runAsGroup: 568
        fsGroup: 568
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile: { type: RuntimeDefault }
        supplementalGroups:
          - 20 # 'dialout' group, udev assigns the usb dongle to this group.
    service:
      app:
        controller: home-assistant
        # Required for hostNetwork to ensure traffic reaches the node IP
        ipFamilyPolicy: PreferDualStack
        type: LoadBalancer
        ports:
          http:
            port: 8123
          code-server:
            port: 12321
          filebrowser:
            port: 80
            targetPort: 8080
          everything-presence-mmwave-configurator:
            port: *mmwave-config-port
    serviceMonitor:
      app:
        serviceName: home-assistant
        enabled: true
        endpoints:
          - port: http
            scheme: http
            path: /api/prometheus
            interval: 30s
            scrapeTimeout: 10s
            bearerTokenSecret:
              name: home-assistant-secret
              key: HASS_SERVICEMONITOR_TOKEN
    ingress:
      app:
        annotations:
          external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN}
          gethomepage.dev/enabled: "true"
          gethomepage.dev/group: Home Automation
          gethomepage.dev/icon: sh-home-assistant.svg
          gethomepage.dev/name: Home Assistant
          gethomepage.dev/pod-selector: app.kubernetes.io/name=home-assistant
          gethomepage.dev/widget.type: homeassistant
          gethomepage.dev/widget.url: http://home-assistant.default.svc:8123
          gethomepage.dev/widget.key: ${SECRET_HOMEPAGE_VAR_HOMEASSISTANT_API_TOKEN}
        className: external
        hosts:
          - host: hass.${SECRET_DOMAIN}
            paths:
              - path: /
                service:
                  identifier: app
                  port: http
      code-server:
        annotations:
          external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
        className: internal
        hosts:
          - host: hass-code.${SECRET_DOMAIN}
            paths:
              - path: /
                service:
                  identifier: app
                  port: code-server
      filebrowser:
        annotations:
          external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
        className: internal
        hosts:
          - host: hass-files.${SECRET_DOMAIN}
            paths:
              - path: /
                service:
                  identifier: app
                  port: filebrowser
      everything-presence-mmwave-configurator:
        annotations:
          external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
        className: internal
        hosts:
          - host: hass-mmwave-config.${SECRET_DOMAIN}
            paths:
              - path: /
                service:
                  identifier: app
                  port: everything-presence-mmwave-configurator
    persistence:
      config:
        existingClaim: home-assistant-data-2
        globalMounts:
          - path: /config
      logs:
        type: emptyDir
        globalMounts:
          - path: /config/logs
      tts:
        type: emptyDir
        globalMounts:
          - path: /config/tts
      tmp:
        type: emptyDir
        globalMounts:
          - path: /tmp