mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
108 lines
3.7 KiB
Bash
Executable File
108 lines
3.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Home Assistant Bootstrap - Auto-configure OIDC with hass-openid integration
|
|
set -euo pipefail
|
|
|
|
echo "=== Home Assistant Bootstrap - Fully Automated ==="
|
|
|
|
cd "$(dirname "$0")/.." || exit 1
|
|
|
|
NS=home-assistant
|
|
|
|
# 1) Ensure namespace
|
|
kubectl get ns "${NS}" >/dev/null 2>&1 || kubectl create ns "${NS}"
|
|
|
|
# 2) Apply ExternalSecret for OIDC credentials
|
|
echo "Applying Home Assistant OIDC ExternalSecret..."
|
|
kubectl apply -f apps/home-assistant/external-secret.yaml
|
|
|
|
# 3) Wait for ESO to sync OIDC credentials
|
|
echo "Waiting for OIDC credentials to sync from Vault..."
|
|
for i in {1..30}; do
|
|
if kubectl -n "${NS}" get secret homeassistant-oidc-secret >/dev/null 2>&1; then
|
|
echo "OIDC credentials synced successfully"
|
|
break
|
|
fi
|
|
echo " waiting... (attempt $i/30)"
|
|
sleep 2
|
|
done
|
|
|
|
# 4) Wait for the PVC to be bound
|
|
echo "Waiting for PVC to be bound..."
|
|
for i in {1..60}; do
|
|
if kubectl -n "${NS}" get pvc home-assistant-config >/dev/null 2>&1; then
|
|
PVC_STATUS=$(kubectl -n "${NS}" get pvc home-assistant-config -o jsonpath='{.status.phase}')
|
|
if [ "${PVC_STATUS}" = "Bound" ]; then
|
|
echo "PVC is bound"
|
|
break
|
|
fi
|
|
fi
|
|
echo " waiting for PVC... (attempt $i/60)"
|
|
sleep 2
|
|
done
|
|
|
|
# 5) Get the running Home Assistant pod (if any)
|
|
POD_NAME=$(kubectl get pods -n "${NS}" -l app.kubernetes.io/name=home-assistant -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
|
|
|
|
if [ -n "${POD_NAME}" ] && kubectl -n "${NS}" get pod "${POD_NAME}" >/dev/null 2>&1; then
|
|
echo "Configuring existing Home Assistant pod: ${POD_NAME}"
|
|
|
|
# Get OIDC credentials
|
|
CLIENT_ID=$(kubectl get secret -n "${NS}" homeassistant-oidc-secret -o jsonpath='{.data.client_id}' | base64 -d)
|
|
CLIENT_SECRET=$(kubectl get secret -n "${NS}" homeassistant-oidc-secret -o jsonpath='{.data.client_secret}' | base64 -d)
|
|
|
|
# Create secrets.yaml
|
|
echo "Creating secrets.yaml..."
|
|
kubectl exec -n "${NS}" "${POD_NAME}" -- sh -c "cat > /config/secrets.yaml <<EOF
|
|
oidc_client_id: \"${CLIENT_ID}\"
|
|
oidc_client_secret: \"${CLIENT_SECRET}\"
|
|
EOF"
|
|
|
|
# Create oidc.yaml using Python to avoid YAML tag issues
|
|
echo "Creating oidc.yaml..."
|
|
kubectl exec -n "${NS}" "${POD_NAME}" -- python3 -c "
|
|
import os
|
|
oidc_content = '''openid:
|
|
client_id: \"!secret oidc_client_id\"
|
|
client_secret: \"!secret oidc_client_secret\"
|
|
configure_url: \"https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration\"
|
|
scope: \"openid profile email\"
|
|
username_field: \"preferred_username\"
|
|
block_login: false'''
|
|
with open('/config/oidc.yaml', 'w') as f:
|
|
f.write(oidc_content)
|
|
"
|
|
|
|
# Update configuration.yaml if needed
|
|
echo "Updating configuration.yaml..."
|
|
kubectl exec -n "${NS}" "${POD_NAME}" -- sh -c "
|
|
if ! grep -q 'packages:' /config/configuration.yaml 2>/dev/null; then
|
|
echo '' >> /config/configuration.yaml
|
|
echo 'homeassistant:' >> /config/configuration.yaml
|
|
echo ' packages: !include_dir_merge_named oidc' >> /config/configuration.yaml
|
|
fi
|
|
|
|
if ! grep -q 'use_x_forwarded_for:' /config/configuration.yaml 2>/dev/null; then
|
|
cat >> /config/configuration.yaml <<'EOF'
|
|
|
|
http:
|
|
use_x_forwarded_for: true
|
|
trusted_proxies:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
- 127.0.0.1
|
|
- ::1
|
|
EOF
|
|
fi
|
|
"
|
|
|
|
echo "Configuration complete. Restarting Home Assistant..."
|
|
kubectl rollout restart deployment -n "${NS}" home-assistant
|
|
kubectl rollout status deployment -n "${NS}" home-assistant --timeout=300s
|
|
else
|
|
echo "No running Home Assistant pod found. Configuration will be applied when pod starts."
|
|
echo "The initContainer will install hass-openid, and the configuration will be set up on first boot."
|
|
fi
|
|
|
|
echo "Home Assistant bootstrap complete!"
|