Add Home Assistant to CrowdSec variants

Add Home Assistant (home-automation hub, port 8123) to the -crowdsec scripts
for 24.04 and 26.04, following the existing service pattern (menu entry,
detection, defaults, parse, uninstall, install block, UFW rule, Caddy template).

- Image ghcr.io/home-assistant/home-assistant:stable, config volume, privileged
  + /run/dbus for hardware integrations; documents host-networking alternative
  for full mDNS/device discovery.
- Pre-seeds config/configuration.yaml with default_config + http.trusted_proxies
  (only on a fresh install) so HA works behind the Caddy reverse proxy without
  the usual 400 'request from reverse proxy' error.
- Integrates with configure_caddy_for_service (subdomain 'home').

Added only to the -crowdsec tier (current tip); original and -no-keycloak
scripts stay frozen as the evolution record. Both variants pass 'bash -n' and a
--dry-run --unattended pass (exit 0), including with Home Assistant forced on.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK
This commit is contained in:
Claude
2026-06-03 12:20:36 +00:00
parent b6af49f1f1
commit 8f6523a47b
3 changed files with 205 additions and 0 deletions
+7
View File
@@ -12,6 +12,13 @@ complete, standalone script).
`<ver>` is `24.04` or `26.04`.
> New services are added to the **`-crowdsec`** tier only (the current tip of
> the evolution); the original and `-no-keycloak` scripts are frozen as
> historical snapshots. For example, **Home Assistant** (home-automation hub,
> port 8123) is available in the `-crowdsec` variants. It ships with a
> `trusted_proxies` config pre-seeded so it works behind the Caddy reverse
> proxy out of the box.
## Which one?
- **Original (`.sh`)** — unchanged baseline, kept for fallback. Still offers
+99
View File
@@ -2595,6 +2595,7 @@ else
[ -d "$DOCKER_DIR/caddy" ] && EXISTING_SERVICES[CADDY]="ON"
[ -d "$DOCKER_DIR/lms" ] && EXISTING_SERVICES[LYRION]="ON"
[ -d "$DOCKER_DIR/mealie" ] && EXISTING_SERVICES[MEALIE]="ON"
[ -d "$DOCKER_DIR/homeassistant" ] && EXISTING_SERVICES[HOMEASSISTANT]="ON"
[ -d "$DOCKER_DIR/minecraft" ] && EXISTING_SERVICES[MINECRAFT]="ON"
[ -d "$DOCKER_DIR/jellyfin" ] && EXISTING_SERVICES[JELLYFIN]="ON"
[ -d "$DOCKER_DIR/frigate" ] && EXISTING_SERVICES[FRIGATE]="ON"
@@ -2636,6 +2637,7 @@ else
"CROWDSEC" "Intrusion prevention (CrowdSec: bans + geo + reputation)" ${EXISTING_SERVICES[CROWDSEC]:-OFF} \
"LYRION" "Music streaming server (LMS)" ${EXISTING_SERVICES[LYRION]:-OFF} \
"MEALIE" "Recipe manager & meal planner" ${EXISTING_SERVICES[MEALIE]:-OFF} \
"HOMEASSISTANT" "Home automation hub (Home Assistant)" ${EXISTING_SERVICES[HOMEASSISTANT]:-OFF} \
"MINECRAFT" "Minecraft game server" ${EXISTING_SERVICES[MINECRAFT]:-OFF} \
"JELLYFIN" "Free media server (Emby alternative)" ${EXISTING_SERVICES[JELLYFIN]:-OFF} \
"FRIGATE" "AI-powered NVR for security cameras" ${EXISTING_SERVICES[FRIGATE]:-OFF} \
@@ -2667,6 +2669,7 @@ else
[ -n "${EXISTING_SERVICES[CROWDSEC]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS CROWDSEC \"Intrusion prevention\" ON"
[ -n "${EXISTING_SERVICES[LYRION]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS LYRION \"Music server\" ON"
[ -n "${EXISTING_SERVICES[MEALIE]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS MEALIE \"Recipe manager\" ON"
[ -n "${EXISTING_SERVICES[HOMEASSISTANT]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS HOMEASSISTANT \"Home automation\" ON"
[ -n "${EXISTING_SERVICES[MINECRAFT]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS MINECRAFT \"Game server\" ON"
[ -n "${EXISTING_SERVICES[JELLYFIN]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS JELLYFIN \"Media server\" ON"
[ -n "${EXISTING_SERVICES[FRIGATE]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS FRIGATE \"NVR cameras\" ON"
@@ -2717,6 +2720,7 @@ else
: ${INSTALL_CROWDSEC:="n"}
: ${INSTALL_LMS:="n"}
: ${INSTALL_MEALIE:="n"}
: ${INSTALL_HOMEASSISTANT:="n"}
: ${INSTALL_MINECRAFT:="n"}
: ${INSTALL_JELLYFIN:="n"}
: ${INSTALL_FRIGATE:="n"}
@@ -2743,6 +2747,7 @@ else
if echo "$SELECTED_SERVICES" | grep -q "CROWDSEC"; then INSTALL_CROWDSEC="y"; fi
if echo "$SELECTED_SERVICES" | grep -q "LYRION"; then INSTALL_LMS="y"; fi
if echo "$SELECTED_SERVICES" | grep -q "MEALIE"; then INSTALL_MEALIE="y"; fi
if echo "$SELECTED_SERVICES" | grep -q "HOMEASSISTANT"; then INSTALL_HOMEASSISTANT="y"; fi
if echo "$SELECTED_SERVICES" | grep -q "MINECRAFT"; then INSTALL_MINECRAFT="y"; fi
if echo "$SELECTED_SERVICES" | grep -q "JELLYFIN"; then INSTALL_JELLYFIN="y"; fi
if echo "$SELECTED_SERVICES" | grep -q "FRIGATE\""; then INSTALL_FRIGATE="y"; fi
@@ -2815,6 +2820,7 @@ else
if echo "$SELECTED_SERVICES" | grep -q "CADDY"; then uninstall_service "Caddy" "$DOCKER_DIR/caddy" "caddy"; fi
if echo "$SELECTED_SERVICES" | grep -q "LYRION"; then uninstall_service "Lyrion" "$DOCKER_DIR/lms" "lms"; fi
if echo "$SELECTED_SERVICES" | grep -q "MEALIE"; then uninstall_service "Mealie" "$DOCKER_DIR/mealie" "mealie"; fi
if echo "$SELECTED_SERVICES" | grep -q "HOMEASSISTANT"; then uninstall_service "Home Assistant" "$DOCKER_DIR/homeassistant" "homeassistant"; fi
if echo "$SELECTED_SERVICES" | grep -q "MINECRAFT"; then uninstall_service "Minecraft" "$DOCKER_DIR/minecraft" "minecraft"; fi
if echo "$SELECTED_SERVICES" | grep -q "JELLYFIN"; then uninstall_service "Jellyfin" "$DOCKER_DIR/jellyfin" "jellyfin"; fi
if echo "$SELECTED_SERVICES" | grep -q "FRIGATE\""; then uninstall_service "Frigate" "$DOCKER_DIR/frigate" "frigate"; fi
@@ -4946,6 +4952,90 @@ MEALIE_COMPOSE
fi
fi
# ---- HOME ASSISTANT ----
if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_HOMEASSISTANT" ]; then
echo ""
echo "┌─────────────────────────────────────────────────────────────────┐"
echo "│ HOME ASSISTANT - Open-source home automation hub │"
echo "│ Smart-home control, automations, dashboards. │"
echo "│ Port: 8123 │"
echo "└─────────────────────────────────────────────────────────────────┘"
prompt_yn "Install Home Assistant? (y/n):" "n" INSTALL_HOMEASSISTANT
fi
if [ "$INSTALL_HOMEASSISTANT" = "y" ] || [ "$INSTALL_HOMEASSISTANT" = "Y" ]; then
echo "Installing Home Assistant..."
HOMEASSISTANT_DIR="$DOCKER_DIR/homeassistant"
if [ "$DRY_RUN" = true ]; then
echo "[DRY-RUN] Would create $HOMEASSISTANT_DIR"
else
mkdir -p "$HOMEASSISTANT_DIR"
ensure_docker_dir_ownership "$HOMEASSISTANT_DIR"
cd "$HOMEASSISTANT_DIR"
cat > docker-compose.yml << HOMEASSISTANT_COMPOSE
name: homeassistant
services:
homeassistant:
image: ghcr.io/home-assistant/home-assistant:stable
container_name: homeassistant
hostname: homeassistant
restart: unless-stopped
privileged: true
environment:
- TZ=$(cat /etc/timezone 2>/dev/null || echo "UTC")
volumes:
- ./config:/config
- /run/dbus:/run/dbus:ro
ports:
- "8123:8123"
# For full device/mDNS auto-discovery (Zigbee/Z-Wave/Bluetooth/Cast),
# remove the 'ports:' block above and add: network_mode: host
HOMEASSISTANT_COMPOSE
mkdir -p config
# Pre-seed trusted_proxies so HA works behind the Caddy reverse proxy.
# Only written on a fresh install (never clobber an existing config).
if [ ! -f config/configuration.yaml ]; then
cat > config/configuration.yaml << 'HA_CONFIG'
# Loads default set of integrations. Do not remove.
default_config:
# Allow access through a reverse proxy (e.g. Caddy)
http:
use_x_forwarded_for: true
trusted_proxies:
- 172.16.0.0/12
- 192.168.0.0/16
- 10.0.0.0/8
- 127.0.0.1
- ::1
HA_CONFIG
fi
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$HOMEASSISTANT_DIR"
echo ""
echo "✓ Home Assistant configured at $HOMEASSISTANT_DIR"
# Configure Caddy reverse proxy before starting
configure_caddy_for_service "Home Assistant" "8123" "home"
prompt_yn "Start Home Assistant now? (y/n):" "y" START_HOMEASSISTANT
if [ "$START_HOMEASSISTANT" = "y" ] || [ "$START_HOMEASSISTANT" = "Y" ]; then
docker compose up -d 2>/dev/null && echo " ✓ Home Assistant started" || echo " ⚠ Failed to start"
fi
echo " Access at: http://localhost:8123"
echo " First run: open the URL and create your admin account (onboarding)."
echo " Note: first startup can take a minute while HA initializes."
echo ""
fi
fi
# ---- MINECRAFT SERVER ----
if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_MINECRAFT" ]; then
echo ""
@@ -5463,6 +5553,11 @@ CADDY_ENV
# reverse_proxy mealie:9000
# }
# Home Assistant (home)
# home.{$MY_DOMAIN} {
# reverse_proxy homeassistant:8123
# }
# ntfy (notifications)
# ntfy.{$MY_DOMAIN} {
# reverse_proxy ntfy:80
@@ -7144,6 +7239,10 @@ if [ "$CONFIGURE_UFW" = "y" ] || [ "$CONFIGURE_UFW" = "Y" ]; then
ufw allow 9925/tcp comment 'Mealie' 2>/dev/null
echo " ✓ Allowed Mealie (9925)"
fi
if [ "$INSTALL_HOMEASSISTANT" = "y" ] || [ "$INSTALL_HOMEASSISTANT" = "Y" ]; then
ufw allow 8123/tcp comment 'Home Assistant' 2>/dev/null
echo " ✓ Allowed Home Assistant (8123)"
fi
if [ "$INSTALL_MAGICMIRROR" = "y" ] || [ "$INSTALL_MAGICMIRROR" = "Y" ]; then
ufw allow 8081:8083/tcp comment 'MagicMirror' 2>/dev/null
echo " ✓ Allowed MagicMirror (8081-8083)"
+99
View File
@@ -2595,6 +2595,7 @@ else
[ -d "$DOCKER_DIR/caddy" ] && EXISTING_SERVICES[CADDY]="ON"
[ -d "$DOCKER_DIR/lms" ] && EXISTING_SERVICES[LYRION]="ON"
[ -d "$DOCKER_DIR/mealie" ] && EXISTING_SERVICES[MEALIE]="ON"
[ -d "$DOCKER_DIR/homeassistant" ] && EXISTING_SERVICES[HOMEASSISTANT]="ON"
[ -d "$DOCKER_DIR/minecraft" ] && EXISTING_SERVICES[MINECRAFT]="ON"
[ -d "$DOCKER_DIR/jellyfin" ] && EXISTING_SERVICES[JELLYFIN]="ON"
[ -d "$DOCKER_DIR/frigate" ] && EXISTING_SERVICES[FRIGATE]="ON"
@@ -2636,6 +2637,7 @@ else
"CROWDSEC" "Intrusion prevention (CrowdSec: bans + geo + reputation)" ${EXISTING_SERVICES[CROWDSEC]:-OFF} \
"LYRION" "Music streaming server (LMS)" ${EXISTING_SERVICES[LYRION]:-OFF} \
"MEALIE" "Recipe manager & meal planner" ${EXISTING_SERVICES[MEALIE]:-OFF} \
"HOMEASSISTANT" "Home automation hub (Home Assistant)" ${EXISTING_SERVICES[HOMEASSISTANT]:-OFF} \
"MINECRAFT" "Minecraft game server" ${EXISTING_SERVICES[MINECRAFT]:-OFF} \
"JELLYFIN" "Free media server (Emby alternative)" ${EXISTING_SERVICES[JELLYFIN]:-OFF} \
"FRIGATE" "AI-powered NVR for security cameras" ${EXISTING_SERVICES[FRIGATE]:-OFF} \
@@ -2667,6 +2669,7 @@ else
[ -n "${EXISTING_SERVICES[CROWDSEC]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS CROWDSEC \"Intrusion prevention\" ON"
[ -n "${EXISTING_SERVICES[LYRION]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS LYRION \"Music server\" ON"
[ -n "${EXISTING_SERVICES[MEALIE]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS MEALIE \"Recipe manager\" ON"
[ -n "${EXISTING_SERVICES[HOMEASSISTANT]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS HOMEASSISTANT \"Home automation\" ON"
[ -n "${EXISTING_SERVICES[MINECRAFT]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS MINECRAFT \"Game server\" ON"
[ -n "${EXISTING_SERVICES[JELLYFIN]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS JELLYFIN \"Media server\" ON"
[ -n "${EXISTING_SERVICES[FRIGATE]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS FRIGATE \"NVR cameras\" ON"
@@ -2717,6 +2720,7 @@ else
: ${INSTALL_CROWDSEC:="n"}
: ${INSTALL_LMS:="n"}
: ${INSTALL_MEALIE:="n"}
: ${INSTALL_HOMEASSISTANT:="n"}
: ${INSTALL_MINECRAFT:="n"}
: ${INSTALL_JELLYFIN:="n"}
: ${INSTALL_FRIGATE:="n"}
@@ -2743,6 +2747,7 @@ else
if echo "$SELECTED_SERVICES" | grep -q "CROWDSEC"; then INSTALL_CROWDSEC="y"; fi
if echo "$SELECTED_SERVICES" | grep -q "LYRION"; then INSTALL_LMS="y"; fi
if echo "$SELECTED_SERVICES" | grep -q "MEALIE"; then INSTALL_MEALIE="y"; fi
if echo "$SELECTED_SERVICES" | grep -q "HOMEASSISTANT"; then INSTALL_HOMEASSISTANT="y"; fi
if echo "$SELECTED_SERVICES" | grep -q "MINECRAFT"; then INSTALL_MINECRAFT="y"; fi
if echo "$SELECTED_SERVICES" | grep -q "JELLYFIN"; then INSTALL_JELLYFIN="y"; fi
if echo "$SELECTED_SERVICES" | grep -q "FRIGATE\""; then INSTALL_FRIGATE="y"; fi
@@ -2815,6 +2820,7 @@ else
if echo "$SELECTED_SERVICES" | grep -q "CADDY"; then uninstall_service "Caddy" "$DOCKER_DIR/caddy" "caddy"; fi
if echo "$SELECTED_SERVICES" | grep -q "LYRION"; then uninstall_service "Lyrion" "$DOCKER_DIR/lms" "lms"; fi
if echo "$SELECTED_SERVICES" | grep -q "MEALIE"; then uninstall_service "Mealie" "$DOCKER_DIR/mealie" "mealie"; fi
if echo "$SELECTED_SERVICES" | grep -q "HOMEASSISTANT"; then uninstall_service "Home Assistant" "$DOCKER_DIR/homeassistant" "homeassistant"; fi
if echo "$SELECTED_SERVICES" | grep -q "MINECRAFT"; then uninstall_service "Minecraft" "$DOCKER_DIR/minecraft" "minecraft"; fi
if echo "$SELECTED_SERVICES" | grep -q "JELLYFIN"; then uninstall_service "Jellyfin" "$DOCKER_DIR/jellyfin" "jellyfin"; fi
if echo "$SELECTED_SERVICES" | grep -q "FRIGATE\""; then uninstall_service "Frigate" "$DOCKER_DIR/frigate" "frigate"; fi
@@ -4926,6 +4932,90 @@ MEALIE_COMPOSE
fi
fi
# ---- HOME ASSISTANT ----
if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_HOMEASSISTANT" ]; then
echo ""
echo "┌─────────────────────────────────────────────────────────────────┐"
echo "│ HOME ASSISTANT - Open-source home automation hub │"
echo "│ Smart-home control, automations, dashboards. │"
echo "│ Port: 8123 │"
echo "└─────────────────────────────────────────────────────────────────┘"
prompt_yn "Install Home Assistant? (y/n):" "n" INSTALL_HOMEASSISTANT
fi
if [ "$INSTALL_HOMEASSISTANT" = "y" ] || [ "$INSTALL_HOMEASSISTANT" = "Y" ]; then
echo "Installing Home Assistant..."
HOMEASSISTANT_DIR="$DOCKER_DIR/homeassistant"
if [ "$DRY_RUN" = true ]; then
echo "[DRY-RUN] Would create $HOMEASSISTANT_DIR"
else
mkdir -p "$HOMEASSISTANT_DIR"
ensure_docker_dir_ownership "$HOMEASSISTANT_DIR"
cd "$HOMEASSISTANT_DIR"
cat > docker-compose.yml << HOMEASSISTANT_COMPOSE
name: homeassistant
services:
homeassistant:
image: ghcr.io/home-assistant/home-assistant:stable
container_name: homeassistant
hostname: homeassistant
restart: unless-stopped
privileged: true
environment:
- TZ=$(cat /etc/timezone 2>/dev/null || echo "UTC")
volumes:
- ./config:/config
- /run/dbus:/run/dbus:ro
ports:
- "8123:8123"
# For full device/mDNS auto-discovery (Zigbee/Z-Wave/Bluetooth/Cast),
# remove the 'ports:' block above and add: network_mode: host
HOMEASSISTANT_COMPOSE
mkdir -p config
# Pre-seed trusted_proxies so HA works behind the Caddy reverse proxy.
# Only written on a fresh install (never clobber an existing config).
if [ ! -f config/configuration.yaml ]; then
cat > config/configuration.yaml << 'HA_CONFIG'
# Loads default set of integrations. Do not remove.
default_config:
# Allow access through a reverse proxy (e.g. Caddy)
http:
use_x_forwarded_for: true
trusted_proxies:
- 172.16.0.0/12
- 192.168.0.0/16
- 10.0.0.0/8
- 127.0.0.1
- ::1
HA_CONFIG
fi
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$HOMEASSISTANT_DIR"
echo ""
echo "✓ Home Assistant configured at $HOMEASSISTANT_DIR"
# Configure Caddy reverse proxy before starting
configure_caddy_for_service "Home Assistant" "8123" "home"
prompt_yn "Start Home Assistant now? (y/n):" "y" START_HOMEASSISTANT
if [ "$START_HOMEASSISTANT" = "y" ] || [ "$START_HOMEASSISTANT" = "Y" ]; then
docker compose up -d 2>/dev/null && echo " ✓ Home Assistant started" || echo " ⚠ Failed to start"
fi
echo " Access at: http://localhost:8123"
echo " First run: open the URL and create your admin account (onboarding)."
echo " Note: first startup can take a minute while HA initializes."
echo ""
fi
fi
# ---- MINECRAFT SERVER ----
if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_MINECRAFT" ]; then
echo ""
@@ -5443,6 +5533,11 @@ CADDY_ENV
# reverse_proxy mealie:9000
# }
# Home Assistant (home)
# home.{$MY_DOMAIN} {
# reverse_proxy homeassistant:8123
# }
# ntfy (notifications)
# ntfy.{$MY_DOMAIN} {
# reverse_proxy ntfy:80
@@ -7124,6 +7219,10 @@ if [ "$CONFIGURE_UFW" = "y" ] || [ "$CONFIGURE_UFW" = "Y" ]; then
ufw allow 9925/tcp comment 'Mealie' 2>/dev/null
echo " ✓ Allowed Mealie (9925)"
fi
if [ "$INSTALL_HOMEASSISTANT" = "y" ] || [ "$INSTALL_HOMEASSISTANT" = "Y" ]; then
ufw allow 8123/tcp comment 'Home Assistant' 2>/dev/null
echo " ✓ Allowed Home Assistant (8123)"
fi
if [ "$INSTALL_MAGICMIRROR" = "y" ] || [ "$INSTALL_MAGICMIRROR" = "Y" ]; then
ufw allow 8081:8083/tcp comment 'MagicMirror' 2>/dev/null
echo " ✓ Allowed MagicMirror (8081-8083)"