Homelabv4/apps/home-assistant/values.yaml

# Disable Istio sidecar on home-assistant pod because the init container
# (install-hass-openid) needs unrestricted network access to git clone.
# Istio CNI redirects traffic to the proxy port during init, but the proxy
# isn't running yet, causing TLS/connection failures.
# ESPHome (same namespace) still gets sidecar injection normally.
podAnnotations:
  sidecar.istio.io/inject: "false"

image:
  repository: ghcr.io/home-assistant/home-assistant
  tag: "2025.1.2"
  pullPolicy: IfNotPresent

initContainers:
  install-hass-openid:
    image: docker.io/alpine/git:2.47.2
    command:
      - /bin/sh
      - -c
      - |
        set -e
        apk add --no-cache git

        # Install hass-openid custom integration
        mkdir -p /config/custom_components /config/includes
        cd /tmp
        git clone --depth 1 https://github.com/cavefire/hass-openid.git
        cp -r hass-openid/custom_components/openid /config/custom_components/
        rm -rf hass-openid

        # Write MQTT addons config
        printf 'mqtt:\n  broker: mqtt.kube.huskypup.net\n  port: 1883\n  username: homeassistant\n  password: YOUR_MQTT_PASSWORD' > /config/includes/ha-addons.yaml

        # Write OIDC credentials to secrets.yaml (from mounted k8s secret)
        if [ -f /oidc-secret/client_id ] && [ -f /oidc-secret/client_secret ]; then
          CLIENT_ID=$(cat /oidc-secret/client_id)
          CLIENT_SECRET=$(cat /oidc-secret/client_secret)
          # Preserve existing secrets, update OIDC entries
          if [ -f /config/secrets.yaml ]; then
            sed -i '/^oidc_client_id:/d' /config/secrets.yaml
            sed -i '/^oidc_client_secret:/d' /config/secrets.yaml
          fi
          echo "oidc_client_id: \"${CLIENT_ID}\"" >> /config/secrets.yaml
          echo "oidc_client_secret: \"${CLIENT_SECRET}\"" >> /config/secrets.yaml
          echo "OIDC credentials written to secrets.yaml"
        else
          echo "WARNING: OIDC secret not mounted, skipping secrets.yaml"
        fi

        # Ensure OIDC config is in configuration.yaml
        if [ ! -f /config/configuration.yaml ]; then
          echo "Creating configuration.yaml with OIDC + HTTP proxy config..."
          cat > /config/configuration.yaml <<'OIDCEOF'
        # Home Assistant Configuration
        default_config:

        # Trust reverse proxy (Istio ingress gateway) for X-Forwarded-For
        http:
          use_x_forwarded_for: true
          trusted_proxies:
            - 10.0.0.0/8
            - 172.16.0.0/12

        # OIDC Authentication via Authentik
        openid:
          client_id: !secret oidc_client_id
          client_secret: !secret oidc_client_secret
          configure_url: "https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration"
          scope: "openid profile email"
          username_field: "preferred_username"
          create_user: true
          block_login: false
        OIDCEOF
        else
          # Ensure OIDC config exists
          if ! grep -q "^openid:" /config/configuration.yaml; then
            echo "Appending OIDC config to existing configuration.yaml..."
            cat >> /config/configuration.yaml <<'OIDCEOF'

        # OIDC Authentication via Authentik
        openid:
          client_id: !secret oidc_client_id
          client_secret: !secret oidc_client_secret
          configure_url: "https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration"
          scope: "openid profile email"
          username_field: "preferred_username"
          create_user: true
          block_login: false
        OIDCEOF
          else
            echo "OIDC config already present in configuration.yaml"
          fi
          # Ensure HTTP proxy trust exists
          if ! grep -q "use_x_forwarded_for:" /config/configuration.yaml; then
            echo "Appending HTTP proxy config..."
            cat >> /config/configuration.yaml <<'HTTPEOF'

        # Trust reverse proxy (Istio ingress gateway) for X-Forwarded-For
        http:
          use_x_forwarded_for: true
          trusted_proxies:
            - 10.0.0.0/8
            - 172.16.0.0/12
        HTTPEOF
          else
            echo "HTTP proxy config already present"
          fi
        fi
    volumeMounts:
      - name: config
        mountPath: /config
      - name: oidc-secret
        mountPath: /oidc-secret
        readOnly: true

env:
  TZ: America/New_York

service:
  main:
    ports:
      http:
        port: 8123

# Ingress disabled - Istio VirtualService handles routing
ingress:
  main:
    enabled: false

persistence:
  config:
    enabled: true
    storageClass: rook-ceph-block
    accessMode: ReadWriteOnce
    size: 10Gi
    retain: true
  oidc-secret:
    enabled: true
    type: secret
    name: homeassistant-oidc-secret
    mountPath: /oidc-secret
    readOnly: true

securityContext:
  privileged: false
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL

resources:
  requests:
    cpu: 50m
    memory: 512Mi
  limits:
    cpu: 1000m
    memory: 2Gi

probes:
  liveness:
    enabled: true
  readiness:
    enabled: true
  startup:
    enabled: true

mariadb:
  enabled: false

postgresql:
  enabled: false

influxdb:
  enabled: false

metrics:
  enabled: false