diff --git a/roles/homeassistant/files/99-homeassistant.rules b/roles/homeassistant/files/99-homeassistant.rules new file mode 100644 index 0000000..42b1684 --- /dev/null +++ b/roles/homeassistant/files/99-homeassistant.rules @@ -0,0 +1 @@ +SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", MODE="0660", GROUP="ha" diff --git a/roles/homeassistant/files/homeassistant-local.pp b/roles/homeassistant/files/homeassistant-local.pp index e3fe854..e202a25 100644 Binary files a/roles/homeassistant/files/homeassistant-local.pp and b/roles/homeassistant/files/homeassistant-local.pp differ diff --git a/roles/homeassistant/files/homeassistant-local.te b/roles/homeassistant/files/homeassistant-local.te index 60f2983..e6b5e2b 100644 --- a/roles/homeassistant/files/homeassistant-local.te +++ b/roles/homeassistant/files/homeassistant-local.te @@ -1,11 +1,12 @@ -module homeassistant-local 1.0; +module homeassistant-local 1.1; require { type container_t; type system_dbusd_var_run_t; type system_dbusd_t; type bluetooth_t; + class dir read; class sock_file write; class unix_stream_socket connectto; class dbus send_msg; @@ -18,4 +19,5 @@ allow bluetooth_t container_t:dbus send_msg; allow container_t bluetooth_t:dbus send_msg; allow container_t system_dbusd_t:dbus send_msg; allow container_t system_dbusd_t:unix_stream_socket connectto; +allow container_t system_dbusd_var_run_t:dir read; allow container_t system_dbusd_var_run_t:sock_file write; diff --git a/roles/homeassistant/tasks/main.yml b/roles/homeassistant/tasks/main.yml index af7da3a..46fb256 100644 --- a/roles/homeassistant/tasks/main.yml +++ b/roles/homeassistant/tasks/main.yml @@ -55,6 +55,20 @@ setype: container_file_t when: ansible_selinux_python_present +- name: Allow podman to use devices + ansible.posix.seboolean: + name: container_use_devices + state: true + persistent: true + +- name: Allow ha to connect specific devices + ansible.builtin.copy: + dest: /etc/udev/rules.d/99-homeassistant.rules + src: 99-homeassistant.rules + mode: "0644" + owner: root + group: "{{ ansible_wheel }}" + - name: Create config directory ansible.builtin.file: path: /export/homeassistant diff --git a/roles/homeassistant/templates/homeassistant-container.service.j2 b/roles/homeassistant/templates/homeassistant-container.service.j2 index 8c83714..28d325e 100644 --- a/roles/homeassistant/templates/homeassistant-container.service.j2 +++ b/roles/homeassistant/templates/homeassistant-container.service.j2 @@ -10,6 +10,7 @@ ExecStart=/usr/bin/podman run \ --name homeassistant \ --env TZ=Europe/Helsinki \ --userns keep-id \ + --device /dev/ttyUSB0 \ --volume /run/dbus:/run/dbus:ro \ --volume /srv/homeassistant:/config:rw \ docker.io/homeassistant/home-assistant:{{ homeassistant_version }}