Initial commit

scripts/home-assistant-bootstrap.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# Home Assistant Bootstrap - Auto-configure OIDC with hass-openid integration
+set -euo pipefail
+
+echo "=== Home Assistant Bootstrap - Fully Automated ==="
+
+cd "$(dirname "$0")/.." || exit 1
+
+NS=home-assistant
+
+# 1) Ensure namespace
+kubectl get ns "${NS}" >/dev/null 2>&1 || kubectl create ns "${NS}"
+
+# 2) Apply ExternalSecret for OIDC credentials
+echo "Applying Home Assistant OIDC ExternalSecret..."
+kubectl apply -f apps/home-assistant/external-secret.yaml
+
+# 3) Wait for ESO to sync OIDC credentials
+echo "Waiting for OIDC credentials to sync from Vault..."
+for i in {1..30}; do
+  if kubectl -n "${NS}" get secret homeassistant-oidc-secret >/dev/null 2>&1; then
+    echo "OIDC credentials synced successfully"
+    break
+  fi
+  echo "   waiting... (attempt $i/30)"
+  sleep 2
+done
+
+# 4) Wait for the PVC to be bound
+echo "Waiting for PVC to be bound..."
+for i in {1..60}; do
+  if kubectl -n "${NS}" get pvc home-assistant-config >/dev/null 2>&1; then
+    PVC_STATUS=$(kubectl -n "${NS}" get pvc home-assistant-config -o jsonpath='{.status.phase}')
+    if [ "${PVC_STATUS}" = "Bound" ]; then
+      echo "PVC is bound"
+      break
+    fi
+  fi
+  echo "   waiting for PVC... (attempt $i/60)"
+  sleep 2
+done
+
+# 5) Get the running Home Assistant pod (if any)
+POD_NAME=$(kubectl get pods -n "${NS}" -l app.kubernetes.io/name=home-assistant -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
+
+if [ -n "${POD_NAME}" ] && kubectl -n "${NS}" get pod "${POD_NAME}" >/dev/null 2>&1; then
+  echo "Configuring existing Home Assistant pod: ${POD_NAME}"
+  
+  # Get OIDC credentials
+  CLIENT_ID=$(kubectl get secret -n "${NS}" homeassistant-oidc-secret -o jsonpath='{.data.client_id}' | base64 -d)
+  CLIENT_SECRET=$(kubectl get secret -n "${NS}" homeassistant-oidc-secret -o jsonpath='{.data.client_secret}' | base64 -d)
+  
+  # Create secrets.yaml
+  echo "Creating secrets.yaml..."
+  kubectl exec -n "${NS}" "${POD_NAME}" -- sh -c "cat > /config/secrets.yaml <<EOF
+oidc_client_id: \"${CLIENT_ID}\"
+oidc_client_secret: \"${CLIENT_SECRET}\"
+EOF"
+  
+  # Create oidc.yaml using Python to avoid YAML tag issues
+  echo "Creating oidc.yaml..."
+  kubectl exec -n "${NS}" "${POD_NAME}" -- python3 -c "
+import os
+oidc_content = '''openid:
+  client_id: \"!secret oidc_client_id\"
+  client_secret: \"!secret oidc_client_secret\"
+  configure_url: \"https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration\"
+  scope: \"openid profile email\"
+  username_field: \"preferred_username\"
+  block_login: false'''
+with open('/config/oidc.yaml', 'w') as f:
+    f.write(oidc_content)
+"
+  
+  # Update configuration.yaml if needed
+  echo "Updating configuration.yaml..."
+  kubectl exec -n "${NS}" "${POD_NAME}" -- sh -c "
+    if ! grep -q 'packages:' /config/configuration.yaml 2>/dev/null; then
+      echo '' >> /config/configuration.yaml
+      echo 'homeassistant:' >> /config/configuration.yaml
+      echo '  packages: !include_dir_merge_named oidc' >> /config/configuration.yaml
+    fi
+    
+    if ! grep -q 'use_x_forwarded_for:' /config/configuration.yaml 2>/dev/null; then
+      cat >> /config/configuration.yaml <<'EOF'
+
+http:
+  use_x_forwarded_for: true
+  trusted_proxies:
+    - 10.0.0.0/8
+    - 172.16.0.0/12
+    - 192.168.0.0/16
+    - 127.0.0.1
+    - ::1
+EOF
+    fi
+  "
+  
+  echo "Configuration complete. Restarting Home Assistant..."
+  kubectl rollout restart deployment -n "${NS}" home-assistant
+  kubectl rollout status deployment -n "${NS}" home-assistant --timeout=300s
+else
+  echo "No running Home Assistant pod found. Configuration will be applied when pod starts."
+  echo "The initContainer will install hass-openid, and the configuration will be set up on first boot."
+fi
+
+echo "Home Assistant bootstrap complete!"