FigJam Diagram: K3s Homelab — Home Assistant & IoT Integration (expires 2026-04-13)
Smart home hub managing automation, device control, and Google Assistant integration. Deployed on k3s with hostNetwork: true for mDNS/SSDP device discovery.
home-assistantpajikos/home-assistant v0.3.43privileged (hostNetwork + NET_ADMIN + NET_RAW required)k3s-agent-2 (stable IP for mDNS)192.168.20.202Why no Authentik? The HA companion mobile app and Google Assistant webhook are incompatible with Authentik forwardAuth cookie redirects. Home Assistant handles its own authentication and OAuth2 flows. The public IngressRoute in
public-ingressnamespace routes directly to HA with no middleware.
| Route | URL | Auth |
|---|---|---|
| Internal | ha.k3s.internal.strommen.systems |
Direct, no middleware |
| Public UI | ha.k3s.strommen.systems |
HA native auth (no Authentik forwardAuth) |
| Google Assistant API | ha.k3s.strommen.systems/api/google_assistant |
HA-managed OAuth2 (open path, must remain accessible) |
| Integration | Protocol | Notes |
|---|---|---|
| Philips Hue | mDNS | Lights + scenes |
| LG webOS TV (x2) | SSDP | 42" + 65" C4, power/volume/input |
| Google Cast | mDNS | Chromecasts + Home speakers (TTS) |
| Apple AirPlay | Bonjour | Media control + remote |
| UniFi Network | HTTP | Presence detection, device tracking |
| YoLink | OAuth2 Cloud | Hub + 4 leak sensors |
| Google Nest | OAuth2/Pub-Sub | Thermostat + cameras ($5 SDM API) |
| Google Assistant | Cloud Actions | Voice control via fulfillment URL |
| Kasa HS300 | KLAP/SHIP 2.0 (LAN, port 80) | Smart plugs — power monitoring |
| Setting | Value | Notes |
|---|---|---|
hostNetwork |
true |
mDNS/SSDP device discovery |
dnsPolicy |
ClusterFirstWithHostNet |
Required with hostNetwork |
nodeSelector |
k3s-agent-2 |
Stable host IP for mDNS |
service.type |
LoadBalancer |
MetalLB assigns 192.168.20.202 |
persistence.size |
5Gi |
Longhorn RWO for /config |
capabilities.add |
NET_BIND_SERVICE, NET_ADMIN, NET_RAW |
mDNS + DHCP watching + Bluetooth |
ip_ban_enabled |
false |
Traefik pod IP would get banned instead of real client |
trusted_proxies |
10.42.0.0/16, 192.168.1.0/24, 192.168.20.0/24 |
k3s pods + home + server VLAN |
Living room TV dashboard automation: kubernetes/apps/home-assistant/automations-living-room.yaml
Triggers a Grafana playlist on the living room TV at scheduled times via HDMI-CEC scene.
/api/prometheus (port 8123) at 60s intervalha-prometheus-token secret (namespace: home-assistant); bootstrap:kubectl create secret generic ha-prometheus-token \
--namespace home-assistant \
--from-literal=token=<long-lived-access-token>
kubernetes/apps/home-assistant/
values.yaml -- Helm values (chart: pajikos/home-assistant v0.3.43)
ingress.yaml -- Internal IngressRoute + cert-manager Certificate
servicemonitor.yaml -- Prometheus ServiceMonitor
automations-living-room.yaml -- Living room TV dashboard trigger
configuration.yaml, automations, scripts) lives in the Longhorn PVC — not in Git/api/google_assistant pathhostNetwork: true required for mDNS/SSDP — pod uses node network namespace, pinned to k3s-agent-2 for stable IPpublic-ingress namespace (uses the shared public-wildcard-tls certificate) but has no auth middlewareip_ban_enabled: false required because Traefik presents its own pod IP as the source for all requests; without this, the proxy IP would be banned on any auth failure