- Shipped
- October 18, 2026 at 8:08 PM UTC
- Author
- Kamo
- Commit
- 4d34496
One Home Assistant 2026.10.2 (digest-pinned) for IoT testing of Kamo's HOME_ASSISTANT connector and for the owner's own use under the HA account sajon. The demo integration supplies about 120 test entities. - StatefulSet in `kamo`, /config on a 10Gi longhorn volume, 1Gi memory, startup/readiness/liveness probes, preStop 10s, minReadySeconds 15. - A CiliumNetworkPolicy admits only Traefik on 8123 and lets HA out to DNS and the public internet, never a private range. In `kamo` rather than a namespace of its own: Traefik watches a fixed namespace list, and extending it rolls Traefik, which serves its self-signed default to every org for a few seconds. - configuration.yaml trusts the pod network as proxies (use_x_forwarded_for), bans an address after 10 failed sign-ins, and leaves location and units in HA's storage so they stay editable. - IngressRoute Host(home.kamouniverse.com), TLS by SNI. auto-cert pre-issues the host from STATIC_DOMAINS once its DNS record exists. Nothing on kamocrm.com. home-assistant/ is applied by hand (apply.sh, README). A deploy step would edit .forgejo/, and that forces a full reconcile. This push runs only the auto-cert step. Its live state matched origin/main before the push.