dotfiles/terranix/containers/home-assistant/default.nix

{ elib, vars, ... }:
let
  inherit (elib)
    nfsVolume
    nomadJob;
in
{
  resource."nomad_volume"."home-assistant_hass" = nfsVolume {
    volume_name = "home-assistant_hass";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/var/nfs/home-assistant_hass";
    mount_flags = [ "nfsvers=3" "hard" "async" ];
  };

  resource."nomad_volume"."home-assistant_db" = nfsVolume {
    volume_name = "home-assistant_db";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/var/nfs/home-assistant_db";
    mount_flags = [ "nfsvers=3" "hard" "async" ];
  };

  resource."nomad_volume"."home-assistant_zigbee2mqtt" = nfsVolume {
    volume_name = "home-assistant_zigbee2mqtt";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/var/nfs/home-assistant_zigbee2mqtt";
    mount_flags = [ "nfsvers=3" "hard" "async" ];
  };

  resource."nomad_volume"."home-assistant_mosquitto" = nfsVolume {
    volume_name   = "home-assistant_mosquitto";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/var/nfs/home-assistant_mosquitto";
    mount_flags = [ "nfsvers=3" "hard" "async" ];
  };

  resource."vault_policy"."home-assistant-policy" = {
    name = "home-assistant-policy";
    policy = ''
      path "kv/data/cluster/home-assistant" {
        capabilities = ["read"]
      }
    '';
  };

  resource."vault_policy"."zigbee2mqtt-policy" = {
    name = "zigbee2mqtt-policy";
    policy = ''
      path "kv/data/cluster/mqtt" {
        capabilities = ["read"]
      }

      path "kv/data/cluster/zigbee2mqtt" {
        capabilities = ["read"]
      }
    '';
  };

  resource."vault_policy"."mosquitto-policy" = {
    name = "mosquitto-policy";
    policy = ''
      path "kv/data/cluster/mqtt" {
        capabilities = ["read"]
      }
    '';
  };

  resource."nomad_job"."home-assistant" = nomadJob {
    jobspec = ./job.hcl;

    vars = {
      flake_ref = "${vars.flake_host}?rev=${vars.flake_rev}&ref=${vars.flake_ref}";
      flake_sha = vars.flake_sha;
    };
  };
}