cluster/infrastructure/home-assistant/nomad.hcl

job "home-assistant" {
  datacenters = [ "homelab-1" ]
  type = "service"

  constraint {
    attribute = "${attr.unique.hostname}"
    value = "blowhole"
  }

  group "zigbee2mqtt" {
    count = 1

    restart {
      attempts = 5
      delay = "5s"
    }

    network {
      mode = "bridge"

      port "http" {
	static = 8456
	to = 8456
      }
    }

    volume "home-assistant_zigbee2mqtt" {
      type = "csi"
      source = "home-assistant_zigbee2mqtt"
      read_only = false

      attachment_mode = "file-system"
      access_mode     = "single-node-writer"
    }

    service {
      name = "zigbee2mqtt"
      port = "8456"

      connect {
	sidecar_service {
	  proxy {
	    upstreams {
	      destination_name = "mqtt"
	      local_bind_port  = 1883
	      datacenter = "homelab-1"
	    }
	  }
	}
      }
    }

    task "zigbee2mqtt" {
      driver = "docker"

      vault {
	policies = ["zigbee2mqtt-policy"]
      }

      config {
	image = "nixng-zigbee2mqtt:local"

	memory_hard_limit = 256

	devices = [
	  {
	    host_path = "/dev/serial/by-id/usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_4c004e9c53c9eb118a9f8b4f1d69213e-if00-port0"
	    container_path = "/dev/serial/by-id/usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_4c004e9c53c9eb118a9f8b4f1d69213e-if00-port0"
	  }
	]
      }

      resources {
	cpu = 128
	memory = 128
      }

      volume_mount {
	volume = "home-assistant_zigbee2mqtt"
	destination = "/var/zigbee2mqtt"
	read_only = false
      }

      template {
	data = <<EOF
{{ with secret "kv/data/zigbee2mqtt" }}
XIAOMI_HUB_ADDRESS={{ .Data.data.xiaomi_hub_address }}
{{ end }}
{{ with secret "kv/data/mqtt" }}
MQTT_PASSWORD={{ .Data.data.password }}
MQTT_USER={{ .Data.data.user }}
{{ end }}
EOF
	destination = "secrets/environment"
	env = true
	perms = "444"
      }
    }
  }

  group "mqtt" {
    count = 1

    restart {
      attempts = 5
      delay = "5s"
    }

    network {
      mode = "bridge"
    }

    volume "home-assistant_mosquitto" {
      type = "csi"
      source = "home-assistant_mosquitto"
      read_only = false

      attachment_mode = "file-system"
      access_mode     = "single-node-writer"
    }

    service {
      name = "mqtt"
      port = "1883"

      connect {
	sidecar_service {}
      }
    }

    task "mosquitto" {
      driver = "docker"

      vault {
	policies = ["mosquitto-policy"]
      }

      config {
	image = "nixng-mosquitto:local"

	memory_hard_limit = 256
      }

      resources {
	cpu = 128
	memory = 128
      }
      
      volume_mount {
	volume = "home-assistant_mosquitto"
	destination = "/var/mosquitto"
	read_only = false
      }

      template {
	data = <<EOF
{{ with secret "kv/data/mqtt" }}
{{ .Data.data.user}}:{{ .Data.data.hash }}
{{ end }}
EOF
	destination = "secrets/mqtt_password"
	perms = "444"
      }
    }
  }

  group "home-assistant" {
    count = 1

    restart {
      attempts = 5
      delay = "5s"
    }

    network {
      mode = "bridge"
    
      port "http" {
	static = 8123
	to = 8123
      }
    }

    volume "home-assistant_hass" {
      type = "csi"
      source = "home-assistant_hass"
      read_only = false

      attachment_mode = "file-system"
      access_mode     = "single-node-writer"
    }

    service {
      name = "home-assistant"
      port = "8123"

      connect {
	sidecar_service {
	  proxy {
	    upstreams {
	      destination_name = "mqtt"
	      local_bind_port  = 1883
	      datacenter = "homelab-1"
	    }
	  }
	}
      }
    }

    task "home-assistant" {
      driver = "docker"

      vault {
	policies = ["home-assistant-policy"]
      }

      config {
	image = "nixng-home-assistant:local"

	memory_hard_limit = 256
      }

      resources {
	cpu = 128
	memory = 128
      }

      volume_mount {
	volume = "home-assistant_hass"
	destination = "/var/home-assistant"
	read_only = false
      }

      template {
	data = <<EOF
{{ with secret "kv/data/home-assistant" }}
LATITUDE={{ .Data.data.latitude }}
LONGTITUDE={{ .Data.data.longtitude }}
ELEVATION={{ .Data.data.elevation }}
TIME_ZONE={{ .Data.data.time_zone }}
{{ end }}
EOF
	destination = "secrets/environment"
	env = true
	perms = "400"
      }
    }
  }
}