cloonar-assistant/modules/cloonar-assistant/home-assistant/default.nix

{ config, pkgs, ... }:
let
  domain = config.cloonar-assistant.domain;
  pkgs-with-home-assistant = import (builtins.fetchGit {
    name = "new-home-assistant";
    url = "https://github.com/nixos/nixpkgs/";
    rev = "18dd725c29603f582cf1900e0d25f9f1063dbf11";
  }) {};

  home-assistant-config = recursiveUpdate config.home-assistant {
    package = pkgs-with-home-assistant.home-assistant;
  };
  uid = config.ids.uids.hass;
  gid = config.ids.gids.hass;
in
{
  users.users.hass = {
    home = "/var/lib/hass";
    createHome = true;
    group = "hass";
    uid = uid;
    extraGroups = [ "dialout" ];
  };
  users.groups.hass.gid = gid;

  services.nginx.enable = true;
  services.nginx.virtualHosts."${domain}" = {
    forceSSL = true;
    extraConfig = ''
      proxy_buffering off;
    '';
    locations."/".extraConfig = ''
      proxy_pass http://10.233.0.2:8123;
      proxy_set_header Host $host;
      proxy_redirect http:// https://;
      proxy_http_version 1.1;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection $connection_upgrade;
    '';
  };

  security.acme.certs."${domain}" = {
    group = "ssl-users";
    allowKeysForGroup = true; 
  };

  users.groups.ssl-users = {};

  sops.secrets."home-assistant-secrets.yaml" = {
    owner = "hass";
    restartUnits = [ "container@hass.service" ];
  };

  containers.hass = {
    autoStart = true;
    ephemeral = false;
    privateNetwork = true;
    hostAddress = "10.233.0.1";
    localAddress = "10.233.0.2";
    bindMounts = {
      "/etc/localtime" = {
        hostPath = "/etc/localtime";
      };
      "/var/lib/hass" = {
        hostPath = "/var/lib/hass/";
        isReadOnly = false;
      };
      "/var/lib/hass/secrets.yaml" = {
        hostPath = config.sops.secrets."home-assistant-secrets.yaml".path;
      };
    };
    config = { lib, config, pkgs, ... }: {
      imports = [
      ];

      environment.systemPackages = [
        pkgs.mariadb
      ];

      services.home-assistant = recursiveUpdate home-assistant-config {
        extraComponents = [
          "mobile_app"
          "backup"
        ];
      }

      systemd.services.install-hacs = {
        description = "Install HACS";
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
          Type = "oneshot";
        };
        script = ''
          set -e
          HACS_VERSION="2.0.5"  # Replace with the latest version
          HACS_DIR="/var/lib/hass/custom_components/hacs"
          
          mkdir -p "$HACS_DIR"
          ${pkgs.curl}/bin/curl -L "https://github.com/hacs/integration/releases/download/$HACS_VERSION/hacs.zip" -o /tmp/hacs.zip
          ${pkgs.unzip}/bin/unzip -o /tmp/hacs.zip -d "$HACS_DIR"
          rm /tmp/hacs.zip
          chown -R hass:hass "$HACS_DIR"
        '';
      };

      services.home-assistant.extraPackages = ps: with ps; [
        mysqlclient
      ];

      services.mysql = {
        enable = true;
        package = pkgs.mariadb;
        ensureDatabases = [ "hass" ];
        ensureUsers = [
          {
            name = "hass";
            ensurePermissions = {
              "hass.*" = "ALL PRIVILEGES";
            };
          }
        ];

      };

      services.mysqlBackup = {
        enable = true;
        databases = [ "hass" ];
      };

      services.home-assistant.config =
        let
          hiddenEntities = [
            "sensor.last_boot"
            "sensor.date"
          ];
        in
        {
          recorder = {
            db_url = "mysql://hass@localhost/hass?unix_socket=/var/run/mysqld/mysqld.sock";
          };
          homeassistant = {
            name = "Home";
            latitude = "!secret home_latitude";
            longitude = "!secret home_longitude";
            elevation = "!secret home_elevation";
            unit_system = "metric";
            currency = "EUR";
            country = "AT";
            time_zone = "Europe/Vienna";
            external_url = "https://${domain}";
          };
          zone = {
            name = "Home";
            latitude = "!secret home_latitude";
            longitude = "!secret home_longitude";
            radius = 35;
            icon = "mdi:account-multiple";

          };
          automation = "!include automations.yaml";
          frontend = { };
          http = {
            use_x_forwarded_for = true;
            trusted_proxies = [
              "127.0.0.1"
              "::1"
            ];
          };
          api = { };
          history.exclude = {
            entities = hiddenEntities;
            domains = [
              "automation"
              "updater"
            ];
          };
          "map" = { };
          # logbook.exclude.entities = "hiddenEntities";
          logger = {
            default = "warning";
          };

          network = { };
          zeroconf = { };
          system_health = { };
          default_config = { };
          system_log = { };
        };

      users.users.hass.extraGroups = [ "dialout" ];
      networking.firewall.allowedTCPPorts = [ 8123 ];
      system.stateVersion = "23.05";
    };
  };
}