From f4b232ac07ca5d8296705942f44adffbf8ebfe2f Mon Sep 17 00:00:00 2001
From: Konstantin Renner <konstantin@renner.uno>
Date: Sat, 9 May 2026 17:00:19 +0200
Subject: [PATCH] home-assistant: add code-server sidecar for /config editing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vscode.home.renner.uno (LAN-only) edits HA's /config in a browser.
Sidecar in the HA pod rather than a separate Deployment because the
config PVC is RWO ceph-block; the alternative was migrating to RWX
ceph-filesystem, which would touch HA's running state for no other
benefit.

Auth is --auth=none — trust-the-network on the LAN. The Ingress
omits the cloudflare-proxied annotation, so external-dns-unifi
publishes a UniFi DNS A record for vscode.home.renner.uno -> the
ingress-nginx LB and external-dns-cloudflare leaves it alone.
DNS-01 via Cloudflare gets the cert without WAN reachability.

Pod restart caveat: rolling the home-assistant Deployment now
restarts HA + config-reconciler + code-server together, which is
fine on a Recreate strategy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../apps/home-assistant/deployment.yaml       | 41 +++++++++++++++++++
 .../apps/home-assistant/kustomization.yaml    |  2 +
 .../apps/home-assistant/vscode-ingress.yaml   | 27 ++++++++++++
 .../apps/home-assistant/vscode-service.yaml   | 15 +++++++
 4 files changed, 85 insertions(+)
 create mode 100644 kubernetes/apps/home-assistant/vscode-ingress.yaml
 create mode 100644 kubernetes/apps/home-assistant/vscode-service.yaml

diff --git a/kubernetes/apps/home-assistant/deployment.yaml b/kubernetes/apps/home-assistant/deployment.yaml
index eb1785f4..3f3e6670 100644
--- a/kubernetes/apps/home-assistant/deployment.yaml
+++ b/kubernetes/apps/home-assistant/deployment.yaml
@@ -256,6 +256,42 @@ spec:
               memory: 64Mi
             limits:
               memory: 128Mi
+        # Browser-based VS Code editing /config in-place. Sidecar (not
+        # separate Deployment) because the config PVC is RWO ceph-block.
+        # Exposed LAN-only on vscode.home.renner.uno; --auth=none means
+        # any LAN client can edit, matching the user's trust-the-network
+        # model. Runs as root so its writes match HA's root-owned files.
+        - name: code-server
+          image: codercom/code-server:4.118.0
+          args:
+            - "--auth=none"
+            - "--bind-addr=0.0.0.0:8080"
+            - "--disable-telemetry"
+            - "--disable-update-check"
+            - "/config"
+          env:
+            - name: HOME
+              value: /var/lib/code-server
+            - name: TZ
+              value: Europe/Berlin
+          ports:
+            - name: vscode
+              containerPort: 8080
+              protocol: TCP
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: vscode-state
+              mountPath: /var/lib/code-server
+          resources:
+            requests:
+              cpu: 50m
+              memory: 256Mi
+            limits:
+              memory: 1Gi
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
       volumes:
         - name: config
           persistentVolumeClaim:
@@ -266,3 +302,8 @@ spec:
         - name: stromzaehler
           hostPath:
             path: /dev/serial/by-id/usb-FTDI_FT230X_Basic_UART_DK0E1GP5-if00-port0
+        # code-server's settings/extensions cache. Not on the config PVC
+        # so installed extensions don't pollute HA's /config listing.
+        # Trade-off: extensions reset across pod restarts.
+        - name: vscode-state
+          emptyDir: {}
diff --git a/kubernetes/apps/home-assistant/kustomization.yaml b/kubernetes/apps/home-assistant/kustomization.yaml
index 87f101a5..a951c0a4 100644
--- a/kubernetes/apps/home-assistant/kustomization.yaml
+++ b/kubernetes/apps/home-assistant/kustomization.yaml
@@ -8,7 +8,9 @@ resources:
   - deployment.yaml
   - service.yaml
   - iot-service.yaml
+  - vscode-service.yaml
   - ingress.yaml
+  - vscode-ingress.yaml
   - prometheus-token.sops.yaml
   - rbac.yaml
   - mosquitto-bootstrap.yaml
diff --git a/kubernetes/apps/home-assistant/vscode-ingress.yaml b/kubernetes/apps/home-assistant/vscode-ingress.yaml
new file mode 100644
index 00000000..c1abe5b1
--- /dev/null
+++ b/kubernetes/apps/home-assistant/vscode-ingress.yaml
@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: home-assistant-vscode
+  namespace: home-assistant
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-buffering: "off"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: vscode.home.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: home-assistant-vscode
+                port:
+                  number: 80
+  tls:
+    - secretName: home-assistant-vscode-tls
+      hosts:
+        - vscode.home.renner.uno
diff --git a/kubernetes/apps/home-assistant/vscode-service.yaml b/kubernetes/apps/home-assistant/vscode-service.yaml
new file mode 100644
index 00000000..67ba6d13
--- /dev/null
+++ b/kubernetes/apps/home-assistant/vscode-service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: home-assistant-vscode
+  namespace: home-assistant
+  labels:
+    app.kubernetes.io/name: home-assistant
+    app.kubernetes.io/component: vscode
+spec:
+  selector:
+    app.kubernetes.io/name: home-assistant
+  ports:
+    - name: vscode
+      port: 80
+      targetPort: 8080