From a4660f69cfbea2a080cd6c5d0b080f4cc3c415bb Mon Sep 17 00:00:00 2001
From: Timo Makinen <tmakinen@foo.sh>
Date: Tue, 5 Dec 2023 17:15:16 +0000
Subject: [PATCH] homeassistant: Add support for zigbee dongle

---
 .../files/99-homeassistant.rules              |   1 +
 .../files/homeassistant-local.pp              | Bin 1737 -> 1919 bytes
 .../files/homeassistant-local.te              |   4 +++-
 roles/homeassistant/tasks/main.yml            |  14 ++++++++++++++
 .../homeassistant-container.service.j2        |   1 +
 5 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 roles/homeassistant/files/99-homeassistant.rules

diff --git a/roles/homeassistant/files/99-homeassistant.rules b/roles/homeassistant/files/99-homeassistant.rules
new file mode 100644
index 0000000..42b1684
--- /dev/null
+++ b/roles/homeassistant/files/99-homeassistant.rules
@@ -0,0 +1 @@
+SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", MODE="0660", GROUP="ha"
diff --git a/roles/homeassistant/files/homeassistant-local.pp b/roles/homeassistant/files/homeassistant-local.pp
index e3fe854c1d94f1f172df85610e67d50138d5d1b8..e202a252d317e3d7ace4f3fe3407dabd31587479 100644
GIT binary patch
delta 201
zcmX@f`=4(@1e2k|WJM-nP8J3R1`uYRcvoB^C9?>`W(4A*)Wj4J8w6M;)@e`P!Xz+p
zr#2(g#;5s=jBJw|nWZNeFu5?YOn%7h4rED8c3@(G@)DS3;H;F%8Z0Uk-*8O+z#KC9
z0W-(st!x651DIJRC$LCNo&&@aSU`pxWRjmeff>jHV};29tOk=eu&7LKVD%6II}hj#
OpzA;`1LMUfSs4M+#WI=z

delta 132
zcmey*canEP1e1Zo<Ul52L1qR91`uWeVh~`SxKx{wY2rnz$>~f2o23~O7#Ue7KVXuc
zJe|p9GCPY0kd~Ot%;GcoHFF9O%S=Ac!ZF#M*<rFji^}9|c7e&(tOAqoGxIRAPkz8+
eJ=vaBfsuJ~0;~Vz3yd6-&$G^9WL{j)#s~mjk0Q?i

diff --git a/roles/homeassistant/files/homeassistant-local.te b/roles/homeassistant/files/homeassistant-local.te
index 60f2983..e6b5e2b 100644
--- a/roles/homeassistant/files/homeassistant-local.te
+++ b/roles/homeassistant/files/homeassistant-local.te
@@ -1,11 +1,12 @@
 
-module homeassistant-local 1.0;
+module homeassistant-local 1.1;
 
 require {
 	type container_t;
 	type system_dbusd_var_run_t;
 	type system_dbusd_t;
 	type bluetooth_t;
+	class dir read;
 	class sock_file write;
 	class unix_stream_socket connectto;
 	class dbus send_msg;
@@ -18,4 +19,5 @@ allow bluetooth_t container_t:dbus send_msg;
 allow container_t bluetooth_t:dbus send_msg;
 allow container_t system_dbusd_t:dbus send_msg;
 allow container_t system_dbusd_t:unix_stream_socket connectto;
+allow container_t system_dbusd_var_run_t:dir read;
 allow container_t system_dbusd_var_run_t:sock_file write;
diff --git a/roles/homeassistant/tasks/main.yml b/roles/homeassistant/tasks/main.yml
index af7da3a..46fb256 100644
--- a/roles/homeassistant/tasks/main.yml
+++ b/roles/homeassistant/tasks/main.yml
@@ -55,6 +55,20 @@
     setype: container_file_t
   when: ansible_selinux_python_present
 
+- name: Allow podman to use devices
+  ansible.posix.seboolean:
+    name: container_use_devices
+    state: true
+    persistent: true
+
+- name: Allow ha to connect specific devices
+  ansible.builtin.copy:
+    dest: /etc/udev/rules.d/99-homeassistant.rules
+    src: 99-homeassistant.rules
+    mode: "0644"
+    owner: root
+    group: "{{ ansible_wheel }}"
+
 - name: Create config directory
   ansible.builtin.file:
     path: /export/homeassistant
diff --git a/roles/homeassistant/templates/homeassistant-container.service.j2 b/roles/homeassistant/templates/homeassistant-container.service.j2
index 8c83714..28d325e 100644
--- a/roles/homeassistant/templates/homeassistant-container.service.j2
+++ b/roles/homeassistant/templates/homeassistant-container.service.j2
@@ -10,6 +10,7 @@ ExecStart=/usr/bin/podman run \
     --name homeassistant \
     --env TZ=Europe/Helsinki \
     --userns keep-id \
+    --device /dev/ttyUSB0 \
     --volume /run/dbus:/run/dbus:ro \
     --volume /srv/homeassistant:/config:rw \
     docker.io/homeassistant/home-assistant:{{ homeassistant_version }}