EZ-Homelab/docker-compose/homeassistant.yml

# Home Assistant and IoT Services
# Home automation platform and related tools
# Place in /opt/stacks/homeassistant/docker-compose.yml

services:
  # Home Assistant - Home automation platform
  # Access at: https://ha.${DOMAIN}
  # NOTE: No Authelia - HA has its own authentication
  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:2024.1
    container_name: homeassistant
    restart: unless-stopped
    network_mode: host  # Required for device discovery
    volumes:
      - /opt/stacks/homeassistant/config:/config
      - /etc/localtime:/etc/localtime:ro
    environment:
      - TZ=${TZ}
    privileged: true
    labels:
      - "homelab.category=iot"
      - "homelab.description=Home automation platform"
      # Note: network_mode: host means Traefik can't proxy this directly
      # Use Traefik's file provider or external host routing

  # ESPHome - ESP8266/ESP32 firmware manager
  # Access at: https://esphome.${DOMAIN}
  esphome:
    image: ghcr.io/esphome/esphome:latest
    container_name: esphome
    restart: unless-stopped
    networks:
      - homelab-network
      - traefik-network
    volumes:
      - /opt/stacks/esphome/config:/config
      - /etc/localtime:/etc/localtime:ro
    environment:
      - TZ=${TZ}
      - ESPHOME_DASHBOARD_USE_PING=true
    privileged: true  # For USB device access
    labels:
      - "homelab.category=iot"
      - "homelab.description=ESP8266/ESP32 firmware manager"
      - "traefik.enable=true"
      - "traefik.http.routers.esphome.rule=Host(`esphome.${DOMAIN}`)"
      - "traefik.http.routers.esphome.entrypoints=websecure"
      - "traefik.http.routers.esphome.tls.certresolver=letsencrypt"
      - "traefik.http.routers.esphome.middlewares=authelia@docker"
      - "traefik.http.services.esphome.loadbalancer.server.port=6052"

  # TasmoAdmin - Tasmota device manager
  # Access at: https://tasmoadmin.${DOMAIN}
  tasmoadmin:
    image: ghcr.io/tasmoadmin/tasmoadmin:latest
    container_name: tasmoadmin
    restart: unless-stopped
    networks:
      - homelab-network
      - traefik-network
    volumes:
      - /opt/stacks/tasmoadmin/data:/data
    environment:
      - TZ=${TZ}
    labels:
      - "homelab.category=iot"
      - "homelab.description=Tasmota device management"
      - "traefik.enable=true"
      - "traefik.http.routers.tasmoadmin.rule=Host(`tasmoadmin.${DOMAIN}`)"
      - "traefik.http.routers.tasmoadmin.entrypoints=websecure"
      - "traefik.http.routers.tasmoadmin.tls.certresolver=letsencrypt"
      - "traefik.http.routers.tasmoadmin.middlewares=authelia@docker"
      - "traefik.http.services.tasmoadmin.loadbalancer.server.port=80"

  # MotionEye - Video surveillance
  # Access at: https://motioneye.${DOMAIN}
  motioneye:
    image: ccrisan/motioneye:master-amd64
    container_name: motioneye
    restart: unless-stopped
    networks:
      - homelab-network
      - traefik-network
    ports:
      - "8765:8765"  # Optional: direct access
    volumes:
      - /opt/stacks/motioneye/config:/etc/motioneye
      - /mnt/surveillance:/var/lib/motioneye  # Large video files on separate drive
    environment:
      - TZ=${TZ}
    labels:
      - "homelab.category=iot"
      - "homelab.description=Video surveillance system"
      - "traefik.enable=true"
      - "traefik.http.routers.motioneye.rule=Host(`motioneye.${DOMAIN}`)"
      - "traefik.http.routers.motioneye.entrypoints=websecure"
      - "traefik.http.routers.motioneye.tls.certresolver=letsencrypt"
      - "traefik.http.routers.motioneye.middlewares=authelia@docker"
      - "traefik.http.services.motioneye.loadbalancer.server.port=8765"

  # Node-RED - Flow-based automation (Home Assistant addon alternative)
  # Access at: https://nodered.${DOMAIN}
  nodered:
    image: nodered/node-red:latest
    container_name: nodered
    restart: unless-stopped
    networks:
      - homelab-network
      - traefik-network
    volumes:
      - /opt/stacks/nodered/data:/data
    environment:
      - TZ=${TZ}
    labels:
      - "homelab.category=iot"
      - "homelab.description=Flow-based automation programming"
      - "traefik.enable=true"
      - "traefik.http.routers.nodered.rule=Host(`nodered.${DOMAIN}`)"
      - "traefik.http.routers.nodered.entrypoints=websecure"
      - "traefik.http.routers.nodered.tls.certresolver=letsencrypt"
      - "traefik.http.routers.nodered.middlewares=authelia@docker"
      - "traefik.http.services.nodered.loadbalancer.server.port=1880"

  # Mosquitto - MQTT broker (Home Assistant addon alternative)
  # Used by: Home Assistant, ESPHome, Tasmota devices
  mosquitto:
    image: eclipse-mosquitto:latest
    container_name: mosquitto
    restart: unless-stopped
    networks:
      - homelab-network
    ports:
      - "1883:1883"  # MQTT
      - "9001:9001"  # Websockets
    volumes:
      - /opt/stacks/mosquitto/config:/mosquitto/config
      - /opt/stacks/mosquitto/data:/mosquitto/data
      - /opt/stacks/mosquitto/log:/mosquitto/log
    labels:
      - "homelab.category=iot"
      - "homelab.description=MQTT message broker"

  # Zigbee2MQTT - Zigbee to MQTT bridge (Home Assistant addon alternative)
  # Access at: https://zigbee2mqtt.${DOMAIN}
  zigbee2mqtt:
    image: koenkk/zigbee2mqtt:latest
    container_name: zigbee2mqtt
    restart: unless-stopped
    networks:
      - homelab-network
      - traefik-network
    volumes:
      - /opt/stacks/zigbee2mqtt/data:/app/data
      - /run/udev:/run/udev:ro
    devices:
      - /dev/ttyACM0:/dev/ttyACM0  # Zigbee adapter - adjust as needed
    environment:
      - TZ=${TZ}
    labels:
      - "homelab.category=iot"
      - "homelab.description=Zigbee to MQTT bridge"
      - "traefik.enable=true"
      - "traefik.http.routers.zigbee2mqtt.rule=Host(`zigbee2mqtt.${DOMAIN}`)"
      - "traefik.http.routers.zigbee2mqtt.entrypoints=websecure"
      - "traefik.http.routers.zigbee2mqtt.tls.certresolver=letsencrypt"
      - "traefik.http.routers.zigbee2mqtt.middlewares=authelia@docker"
      - "traefik.http.services.zigbee2mqtt.loadbalancer.server.port=8080"

networks:
  homelab-network:
    external: true
  traefik-network:
    external: true