From d528cfbea3e7d3cb45842ec463b3ed144ab086c5 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 3 Jun 2026 12:25:15 +0000
Subject: [PATCH] Home Assistant: prompt for bridge vs host networking

Let the user choose Home Assistant's networking mode at install time in the
-crowdsec variants:
- Bridge (default): publishes port 8123, works behind Caddy, isolated.
- Host: shares the host network for LAN device auto-discovery (Cast, HomeKit,
  mDNS/Zeroconf, some Zigbee/Z-Wave/Bluetooth).

The compose file is generated conditionally; both modes verified to produce
valid YAML, and both scripts pass 'bash -n' and a --dry-run --unattended pass.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK
---
 SCRIPT-VARIANTS.md                    |  5 ++++-
 ubuntu-post-install-24.04-crowdsec.sh | 24 ++++++++++++++++++++----
 ubuntu-post-install-26.04-crowdsec.sh | 24 ++++++++++++++++++++----
 3 files changed, 44 insertions(+), 9 deletions(-)

diff --git a/SCRIPT-VARIANTS.md b/SCRIPT-VARIANTS.md
index 955b7f8..0f7ec6e 100644
--- a/SCRIPT-VARIANTS.md
+++ b/SCRIPT-VARIANTS.md
@@ -17,7 +17,10 @@ complete, standalone script).
 > historical snapshots. For example, **Home Assistant** (home-automation hub,
 > port 8123) is available in the `-crowdsec` variants. It ships with a
 > `trusted_proxies` config pre-seeded so it works behind the Caddy reverse
-> proxy out of the box.
+> proxy out of the box, and the installer asks whether to use **bridge**
+> networking (port 8123 published — proxy-friendly, isolated) or **host**
+> networking (needed for LAN device auto-discovery: Chromecast, HomeKit,
+> mDNS, some Zigbee/Z-Wave/Bluetooth).
 
 ## Which one?
 
diff --git a/ubuntu-post-install-24.04-crowdsec.sh b/ubuntu-post-install-24.04-crowdsec.sh
index 656028f..25bd220 100644
--- a/ubuntu-post-install-24.04-crowdsec.sh
+++ b/ubuntu-post-install-24.04-crowdsec.sh
@@ -4974,6 +4974,25 @@ MEALIE_COMPOSE
             ensure_docker_dir_ownership "$HOMEASSISTANT_DIR"
             cd "$HOMEASSISTANT_DIR"
 
+            # Networking mode: bridge (published port) vs host networking.
+            echo ""
+            echo "  Home Assistant networking mode:"
+            echo "    1) Bridge  - container gets its own network; port 8123 is published"
+            echo "                 to the host. Works behind the Caddy reverse proxy and"
+            echo "                 keeps HA isolated. Recommended for most setups."
+            echo "    2) Host    - HA shares the host's network directly. Needed for"
+            echo "                 auto-discovery of devices on your LAN (Chromecast/Cast,"
+            echo "                 HomeKit, mDNS/Zeroconf, some Zigbee/Z-Wave & Bluetooth)."
+            prompt_text "  Choose networking mode [1]:" "1" HA_NETMODE
+            if [ "$HA_NETMODE" = "2" ]; then
+                HA_NET_LINES="    network_mode: host"
+                echo "  → Host networking selected (best device discovery)."
+            else
+                HA_NET_LINES="    ports:
+      - \"8123:8123\""
+                echo "  → Bridge networking selected (port 8123 published)."
+            fi
+
             cat > docker-compose.yml << HOMEASSISTANT_COMPOSE
 name: homeassistant
 
@@ -4989,10 +5008,7 @@ services:
     volumes:
       - ./config:/config
       - /run/dbus:/run/dbus:ro
-    ports:
-      - "8123:8123"
-    # For full device/mDNS auto-discovery (Zigbee/Z-Wave/Bluetooth/Cast),
-    # remove the 'ports:' block above and add:  network_mode: host
+${HA_NET_LINES}
 HOMEASSISTANT_COMPOSE
 
             mkdir -p config
diff --git a/ubuntu-post-install-26.04-crowdsec.sh b/ubuntu-post-install-26.04-crowdsec.sh
index c99443c..3412afe 100644
--- a/ubuntu-post-install-26.04-crowdsec.sh
+++ b/ubuntu-post-install-26.04-crowdsec.sh
@@ -4954,6 +4954,25 @@ MEALIE_COMPOSE
             ensure_docker_dir_ownership "$HOMEASSISTANT_DIR"
             cd "$HOMEASSISTANT_DIR"
 
+            # Networking mode: bridge (published port) vs host networking.
+            echo ""
+            echo "  Home Assistant networking mode:"
+            echo "    1) Bridge  - container gets its own network; port 8123 is published"
+            echo "                 to the host. Works behind the Caddy reverse proxy and"
+            echo "                 keeps HA isolated. Recommended for most setups."
+            echo "    2) Host    - HA shares the host's network directly. Needed for"
+            echo "                 auto-discovery of devices on your LAN (Chromecast/Cast,"
+            echo "                 HomeKit, mDNS/Zeroconf, some Zigbee/Z-Wave & Bluetooth)."
+            prompt_text "  Choose networking mode [1]:" "1" HA_NETMODE
+            if [ "$HA_NETMODE" = "2" ]; then
+                HA_NET_LINES="    network_mode: host"
+                echo "  → Host networking selected (best device discovery)."
+            else
+                HA_NET_LINES="    ports:
+      - \"8123:8123\""
+                echo "  → Bridge networking selected (port 8123 published)."
+            fi
+
             cat > docker-compose.yml << HOMEASSISTANT_COMPOSE
 name: homeassistant
 
@@ -4969,10 +4988,7 @@ services:
     volumes:
       - ./config:/config
       - /run/dbus:/run/dbus:ro
-    ports:
-      - "8123:8123"
-    # For full device/mDNS auto-discovery (Zigbee/Z-Wave/Bluetooth/Cast),
-    # remove the 'ports:' block above and add:  network_mode: host
+${HA_NET_LINES}
 HOMEASSISTANT_COMPOSE
 
             mkdir -p config