homeassistant

1---
2# ==============================================================================
3# HOME ASSISTANT SUPERVISED ROLE DEFAULTS
4# ==============================================================================
5
6# Feature flags
7homeassistant_install_supervisor: true
8homeassistant_configure_network: true
9homeassistant_install_os_agent: true
10homeassistant_validate_installation: true
11
12# Home Assistant configuration
13homeassistant_machine_type: qemux86-64  # Options: qemux86-64, qemuarm-64, generic-x86-64
14homeassistant_data_share: /usr/share/hassio
15
16# OS-Agent configuration
17homeassistant_os_agent_version: latest  # Use 'latest' or specific version like '1.7.2'
18homeassistant_os_agent_arch: "{{ 'amd64' if ansible_architecture == 'x86_64' else 'aarch64' }}"
19
20# Network configuration
21homeassistant_manage_networking: true
22homeassistant_network_interface: "{{ ansible_default_ipv4.interface }}"
23
24# Installation URLs and paths
25homeassistant_supervisor_deb_url: "https://github.com/home-assistant/supervised-installer/releases/latest/download/homeassistant-supervised.deb"
26homeassistant_os_agent_base_url: "https://github.com/home-assistant/os-agent/releases"
27
28# System dependencies
29homeassistant_system_packages:
30  - network-manager
31  - systemd-resolved
32  - curl
33  - lsb-release
34  - udisks2
35  - apparmor
36  - jq
37  - wget
38  - ca-certificates
39  - gnupg
40
41# Cleanup settings
42homeassistant_cleanup_downloads: true
43
44# Service timeouts (seconds)
45homeassistant_service_start_timeout: 300
46
47# ==============================================================================
48# DOCKER SETTINGS
49# ==============================================================================
50homeassistant_docker_base_path: /docker
51homeassistant_docker_owner: "{{ ansible_user }}"
52homeassistant_docker_group: users
53
54# ==============================================================================
55# NGINX PROXY MANAGER CONFIGURATION
56# ==============================================================================
57homeassistant_npm_enabled: true
58homeassistant_npm_container_name: npm
59homeassistant_npm_http_port: 80
60homeassistant_npm_https_port: 443
61homeassistant_npm_admin_port: 81
62
63# NPM network (from vault)
64homeassistant_npm_network_name: proxy_net
65homeassistant_npm_network_subnet: "{{ vault_homeassistant.npm_network_subnet | default('172.30.0.0/24') }}"
66homeassistant_npm_network_gateway: "{{ vault_homeassistant.npm_network_gateway | default('172.30.0.1') }}"
67homeassistant_npm_ip: "{{ vault_homeassistant.npm_ip | default('172.30.0.10') }}"
68
69# ==============================================================================
70# CROWDSEC CONFIGURATION
71# ==============================================================================
72homeassistant_crowdsec_enabled: true
73homeassistant_crowdsec_container_name: crowdsec
74homeassistant_crowdsec_instance_name: "homeassistant-npm"
75
76# CrowdSec LAPI connection (from vault — OPNsense firewall)
77homeassistant_crowdsec_lapi_host: "{{ vault_homeassistant.crowdsec_lapi_host | default('') }}"
78homeassistant_crowdsec_lapi_port: "{{ vault_homeassistant.crowdsec_lapi_port | default('8080') }}"
79
80# CrowdSec credentials (from vault)
81# The agent must be registered on the OPNsense LAPI first:
82#   cscli machines add homeassistant-npm --password <password> --url http://<firewall>:8080
83homeassistant_crowdsec_agent_password: "{{ vault_homeassistant.crowdsec_agent_password | default('') }}"
84homeassistant_crowdsec_enroll_key: "{{ vault_homeassistant.crowdsec_enroll_key | default('') }}"
85
86# ==============================================================================
87# SEMAPHORE UI CONFIGURATION
88# ==============================================================================
89# Web UI for running Ansible. LAN only on purpose: it stores SSH keys and the
90# vault password for every host, so it is not published through NPM.
91homeassistant_semaphore_enabled: true
92homeassistant_semaphore_container_name: semaphore
93homeassistant_semaphore_port: 3000
94homeassistant_semaphore_host_port: 3000
95homeassistant_semaphore_dir: "{{ homeassistant_docker_base_path }}/semaphore"
96homeassistant_semaphore_config_dir: "{{ homeassistant_semaphore_dir }}/config"   # config.json, written on first start
97homeassistant_semaphore_data_dir: "{{ homeassistant_semaphore_dir }}/data"       # database.sqlite
98homeassistant_semaphore_secrets_dir: "{{ homeassistant_semaphore_dir }}/secrets" # raw secret files, read via *_FILE
99homeassistant_semaphore_memory_limit: "1g"   # playbooks run inside this container
100
101# The image runs as uid 1001 / gid 0; bind-mounted state must belong to it
102homeassistant_semaphore_uid: 1001
103homeassistant_semaphore_gid: 0
104
105# Admin account - only applied on the very FIRST start, when config.json is
106# generated. Changing the password in vault later does not change it in
107# Semaphore; do that in the UI.
108homeassistant_semaphore_admin_user: admin
109homeassistant_semaphore_admin_name: "Semaphore Admin"
110homeassistant_semaphore_admin_email: "{{ vault_homeassistant.semaphore_admin_email | default('admin@localhost') }}"
111homeassistant_semaphore_admin_password: "{{ vault_homeassistant.semaphore_admin_password | default('') }}"
112
113# Encrypts every key/password stored in Semaphore. Must never change once set,
114# or all stored credentials become unreadable. Generate: head -c32 /dev/urandom | base64
115homeassistant_semaphore_access_key_encryption: "{{ vault_homeassistant.semaphore_access_key_encryption | default('') }}"
116
117# Extra Python packages for Semaphore's bundled Ansible venv, installed with
118# pip on every container start. netaddr backs the ipaddr filter used in this
119# repo; jmespath and passlib already ship with the image. Empty list = none.
120homeassistant_semaphore_python_requirements:
121  - netaddr
122