Add esphome module

modules/default.nix

@@ -24,6 +24,7 @@
     ./debug.nix
     ./dji-goggles.nix
     ./dns.nix
+    ./esphome
     ./fish.nix
     ./fonts.nix
     ./gnome.nix

modules/esphome/default.nix

@@ -0,0 +1,100 @@
+{ lib
+, pkgs
+, config
+, ...
+}:
+let
+  cfg = config.jalr.esphome;
+  esphomeParams =
+    if config.services.esphome.enableUnixSocket
+    then "--socket /run/esphome/esphome.sock"
+    else "--address ${config.services.esphome.address} --port ${toString config.services.esphome.port}";
+in
+{
+  options.jalr.esphome = with lib; with lib.types; {
+    enable = mkEnableOption "ESPHome";
+    port = mkOption {
+      description = "TCP port for esphome dashboard.";
+      type = port;
+    };
+    configDir = mkOption {
+      type = path;
+      description = "Location of the device configuration";
+    };
+    secretsFile = mkOption {
+      type = path;
+      description = "Location of the secrets file";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.esphome = {
+      enable = true;
+      address = "127.0.0.1";
+      inherit (cfg) port;
+      package = pkgs.esphome;
+    };
+
+    systemd.services.esphome = {
+      environment = {
+        "PLATFORMIO_CORE_DIR" = lib.mkForce "/var/cache/esphome/.platformio";
+      };
+      serviceConfig = {
+        BindReadOnlyPaths = [
+          "/nix/store"
+          "%d/secrets.yaml:/run/esphome/config/secrets.yaml"
+          "/etc/resolv.conf"
+          "/etc/ssl"
+          "/etc/static/ssl"
+        ];
+        TemporaryFileSystem = [
+          "/var/lib"
+        ];
+        ExecPaths = [
+          "-+/var/cache/esphome/.platformio/packages/"
+        ];
+        DeviceAllow = [
+          "char-ttyACM rw"
+          "char-ttyAMA rw"
+          "char-ttyUSB rw"
+        ];
+        ExecStartPre = [
+          (pkgs.writeShellScript "esphome-exec-start-pre" ''
+            if ! [ -d "$CACHE_DIRECTORY/.platformio/packages" ]; then
+              mkdir -p "$CACHE_DIRECTORY/.platformio/packages"
+              exit 1
+            fi
+            mkdir -p "$CACHE_DIRECTORY/.esphome"
+            for linked in \
+              .esphome \
+              .gitignore
+            do
+              ln -s "$CACHE_DIRECTORY/$linked" "/run/esphome/config/$linked"
+            done
+            ${pkgs.rsync}/bin/rsync \
+              -a \
+              --delete \
+              --checksum \
+              --exclude secrets.yaml \
+              --exclude=.esphome \
+              --exclude=.platformio \
+              --exclude=.gitignore \
+              '${cfg.configDir}/' /run/esphome/config/
+          '')
+        ];
+        ExecStart = lib.mkForce "${config.services.esphome.package}/bin/esphome dashboard ${esphomeParams} /run/esphome/config";
+        LoadCredential = "secrets.yaml:${cfg.secretsFile}";
+        PrivateTmp = true;
+        RootDirectory = "%t/esphome/chroot";
+        RuntimeDirectory = [
+          "esphome/chroot"
+          "esphome/config"
+        ];
+        StateDirectory = lib.mkForce [ ];
+        CacheDirectory = "esphome";
+        SupplementaryGroups = [ "dialout" ];
+        WorkingDirectory = lib.mkForce "/run/esphome/config";
+      };
+    };
+  };
+}

modules/esphome/devices/justfile

@@ -0,0 +1,17 @@
+import '../../../../../justfile'
+set dotenv-load
+
+download:
+    rsync \
+        -r \
+        --rsync-path='sudo rsync' \
+        --exclude '/build' \
+        --exclude '/.esphome' \
+        --exclude '.gitignore' \
+        --exclude 'secrets.yaml' \
+        ${ESPHOME_HOST}:/var/lib/esphome/ ./
+
+download-secrets:
+        umask 0077 && ssh ${ESPHOME_HOST} sudo cat /run/secrets/esphome > "/dev/shm/${ESPHOME_SECRETS_FILE}"
+        ln -sf "/dev/shm/${ESPHOME_SECRETS_FILE}" "{{justfile_directory()}}/secrets.yaml"
+