apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  namespace: home-apps
  name: ha-pvc
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: nfs-client
  resources:
    requests:
      storage: 10Gi
---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ha
  namespace: home-apps
  labels:
    app: ha
spec:
  # Disable HA for now
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: ha
  template:
    metadata:
      labels:
        app: ha
        name: ha
    spec:
      containers:
        - name: ha
          image: ghcr.io/home-assistant/home-assistant:2025.6
          imagePullPolicy: IfNotPresent
          securityContext:
            privileged: true
            # runAsUser: 0
            # capabilities:
            #   add: ["NET_ADMIN"]
          ports:
            - containerPort: 8123
              name: web
              protocol: TCP
          env:
            - name: TZ
              value: "Australia/Melbourne"
            - name: DISABLE_JEMALLOC
              value: "true"
          volumeMounts:
            - name: config
              mountPath: /config
            - name: local-time
              mountPath: /etc/localtime
            - name: dbus
              mountPath: /run/dbus

          resources:
            requests:
              cpu: 200m
              memory: 400Mi
            limits:
              cpu: 500m
              memory: 800Mi
      volumes:
      - name: config
        persistentVolumeClaim:
          claimName: ha-pvc
      - name: local-time
        hostPath:
            path: /etc/localtime
            type: File
      - name: dbus
        hostPath:
          path: /run/dbus
          type: Directory

---

apiVersion: v1
kind: Service
metadata:
  name: ha
  labels:
    name: ha
spec:
  type: ClusterIP
  selector:
    app: ha
  ports:
    - name: ha
      targetPort: web
      port: 80
      protocol: TCP
# ---

# apiVersion: v1
# kind: Service
# metadata:
#   name: home-assistant-lb
#   annotations:
#     metallb.universe.tf/loadBalancerIPs: 192.168.1.201
#   labels:
#     name: home-assistant
# spec:
#   type: LoadBalancer
#   externalIPs:
#     - 192.168.1.201
#   selector:
#     app: ha
#   ports:
#     - name: ha
#       targetPort: web
#       port: 80
#       protocol: TCP


---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ha-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    # nginx.ingress.kubernetes.io/auth-url: "https://id.junv.cc/oauth2/auth"
    # nginx.ingress.kubernetes.io/auth-signin: "https://id.junv.cc/oauth2/start?rd=https%3A%2F%2F$host$request_uri"
spec:
  tls:
  - hosts:
    - home.junv.cc
    secretName: home-assistant-tls
  rules:
  - host: home.junv.cc
    http:
      paths:
      - backend:
          service:
            name: ha
            port:
              number: 80
        path: /
        pathType: Prefix
