first running hass stuff

bundles/homeassistant/files/homeassistant.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Home Assistant
+After=network-online.target
+
+[Service]
+Type=simple
+User=homeassistant
+WorkingDirectory=/var/opt/homeassistant
+ExecStart=/opt/homeassistant/venv/bin/hass -c "/var/opt/homeassistant"
+RestartForceExitStatus=100
+
+[Install]
+WantedBy=multi-user.target

bundles/homeassistant/items.py

@@ -0,0 +1,64 @@
+users = {
+    'homeassistant': {
+        'home': '/var/opt/homeassistant',
+    },
+}
+
+directories = {
+    '/opt/homeassistant': {
+        'owner': 'homeassistant',
+    },
+    '/var/opt/homeassistant': {
+        'owner': 'homeassistant',
+    },
+}
+
+files = {
+    '/etc/systemd/system/homeassistant.service': {
+        'triggers': {
+            'action:systemd-reload',
+            'svc_systemd:homeassistant:restart',
+        },
+    },
+}
+
+actions = {
+    'homeassistant_create_virtualenv': {
+        'command': 'sudo -u homeassistant /usr/bin/python3 -m virtualenv -p python3 /opt/homeassistant/venv/',
+        'unless': 'test -d /opt/homeassistant/venv/',
+        'needs': {
+            'directory:/opt/homeassistant',
+            'user:homeassistant',
+            'pkg_apt:bluez',
+            'pkg_apt:libffi-dev',
+            'pkg_apt:libssl-dev',
+            'pkg_apt:libjpeg-dev',
+            'pkg_apt:zlib1g-dev',
+            'pkg_apt:autoconf',
+            'pkg_apt:build-essential',
+            'pkg_apt:libopenjp2-7',
+            'pkg_apt:libtiff5',
+            'pkg_apt:libturbojpeg0-dev',
+            'pkg_apt:tzdata',
+        },
+    },
+    'homeassistant_install': {
+        'command': 'sudo -u homeassistant /opt/homeassistant/venv/bin/pip install homeassistant',
+        'unless': 'test -f /opt/homeassistant/venv/bin/hass',
+        'needs': {
+            'action:homeassistant_create_virtualenv',
+        },
+        'triggers': {
+            'svc_systemd:homeassistant:restart',
+        },
+    },
+}
+
+svc_systemd = {
+    'homeassistant': {
+        'needs': {
+            'action:homeassistant_install',
+            'file:/etc/systemd/system/homeassistant.service',
+        },
+    },
+}

bundles/homeassistant/metadata.py

@@ -0,0 +1,78 @@
+from bundlewrap.metadata import atomic
+
+defaults = {
+    'apt': {
+        'packages': {
+            'bluez':  {},
+            'libffi-dev': {},
+            'libssl-dev': {},
+            'libjpeg-dev': {},
+            'zlib1g-dev': {},
+            'autoconf': {},
+            'build-essential': {},
+            'libopenjp2-7': {},
+            'libtiff5': {},
+            'libturbojpeg0-dev': {},
+            'tzdata': {},
+        },
+    },
+    'backups': {
+        'paths': {
+            '/opt/homeassistant',
+            '/var/opt/homeassistant',
+        },
+    },
+}
+@metadata_reactor.provides(
+    'icinga2_api/homeassistant/services/HOMESSISTANT UPDATE',
+)
+def icinga_check_for_new_release(metadata):
+    return {
+        'icinga2_api': {
+            'homeassistant': {
+                'services': {
+                    'HOMEASSISTANT UPDATE': {
+                        'command_on_monitored_host': '/usr/local/share/icinga/plugins/check_github_for_new_release homeassistant/core {}'.format(metadata.get('homeassistant/version')),
+                        'vars.notification.mail': True,
+                        'check_interval': '60m',
+                    },
+                },
+            },
+        },
+    }
+
+@metadata_reactor.provides(
+    'nginx/vhosts/homeassistant',
+)
+def nginx(metadata):
+    if not node.has_bundle('nginx'):
+        raise DoNotRunAgain
+
+    return {
+        'nginx': {
+            'vhosts': {
+                'homeassistant': {
+                    'domain': metadata.get('homeassistant/domain'),
+                    'website_check_path': '/',
+                    'website_check_string': 'Homeassistant',
+                    'locations': {
+                        '/': {
+                            'target': 'http://127.0.0.1:8123',
+                        },
+                    },
+                },
+            },
+        },
+    }
+
+@metadata_reactor.provides(
+    'firewall/port_rules/8123',
+)
+def firewall(metadata):
+    return {
+        'firewall': {
+            'port_rules': {
+                '8123': atomic(metadata.get('nginx/restrict-to', {'*'})),
+            },
+        },
+    }

nodes/home.hass.toml

@@ -1,5 +1,8 @@
 hostname = "172.19.138.25"
-bundles = []
+bundles = [
+  'homeassistant',
+  'nginx'
+]
 groups = ["debian-bullseye"]
 
 [metadata.backups]
@@ -13,3 +16,16 @@ ipv6_accept_ra = true
 [metadata.vm]
 cpu = 2
 ram = 2
+
+[metadata.homeassistant]
+domain = 'hass.home.kunbox.net'
+version = '2022.12.8'
+
+[metadata.nginx]
+restrict-to = [
+  '172.19.136.0/25',
+  '172.19.138.0/24',
+]
+
+[metadata.nginx.vhosts.homeassistant]
+ssl = '_.home.kunbox.net'