homeassistant: Add support for zigbee dongle

roles/homeassistant/files/99-homeassistant.rules

@@ -0,0 +1 @@
+SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", MODE="0660", GROUP="ha"

roles/homeassistant/files/homeassistant-local.te

@@ -1,11 +1,12 @@
 
-module homeassistant-local 1.0;
+module homeassistant-local 1.1;
 
 require {
 	type container_t;
 	type system_dbusd_var_run_t;
 	type system_dbusd_t;
 	type bluetooth_t;
+	class dir read;
 	class sock_file write;
 	class unix_stream_socket connectto;
 	class dbus send_msg;
@@ -18,4 +19,5 @@ allow bluetooth_t container_t:dbus send_msg;
 allow container_t bluetooth_t:dbus send_msg;
 allow container_t system_dbusd_t:dbus send_msg;
 allow container_t system_dbusd_t:unix_stream_socket connectto;
+allow container_t system_dbusd_var_run_t:dir read;
 allow container_t system_dbusd_var_run_t:sock_file write;

roles/homeassistant/tasks/main.yml

@@ -55,6 +55,20 @@
     setype: container_file_t
   when: ansible_selinux_python_present
 
+- name: Allow podman to use devices
+  ansible.posix.seboolean:
+    name: container_use_devices
+    state: true
+    persistent: true
+
+- name: Allow ha to connect specific devices
+  ansible.builtin.copy:
+    dest: /etc/udev/rules.d/99-homeassistant.rules
+    src: 99-homeassistant.rules
+    mode: "0644"
+    owner: root
+    group: "{{ ansible_wheel }}"
+
 - name: Create config directory
   ansible.builtin.file:
     path: /export/homeassistant

roles/homeassistant/templates/homeassistant-container.service.j2

@@ -10,6 +10,7 @@ ExecStart=/usr/bin/podman run \
     --name homeassistant \
     --env TZ=Europe/Helsinki \
     --userns keep-id \
+    --device /dev/ttyUSB0 \
     --volume /run/dbus:/run/dbus:ro \
     --volume /srv/homeassistant:/config:rw \
     docker.io/homeassistant/home-assistant:{{ homeassistant_version }}