feat(stack): add Home Assistant smart home platform

- Add home-assistant.yml stack (port 8123, privileged mode for USB)
- External access via https://housekeeping.schweitz.net
- Health check using /manifest.json endpoint
- Update CONTAINERS.md with service profile
- Update stacks/README.md with port allocation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -12,6 +12,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Authentik SSO Milestones 4-5: Protect remaining services (deferred)
 - Disaster recovery and offsite backup strategy
 
+## [0.14.0-home-assistant] - 2025-12-14
+
+### Added
+- **Home Assistant** - Smart home automation platform
+  - Stack file: `stacks/home-assistant.yml`
+  - Port: 8123 (Home Assistant default)
+  - External access: https://housekeeping.schweitz.net via NPM with Let's Encrypt SSL
+  - Privileged mode enabled for USB device access (Z-Wave, Zigbee)
+  - Connected to docker-dataplane network
+  - Health check: `/manifest.json` endpoint (30s interval)
+  - Memory limit: 1GB
+
+### Changed
+- **CONTAINERS.md** - Added Home Assistant service profile and updated all reference tables
+- **stacks/README.md** - Added Home Assistant to applications table and port allocation
+
 ## [0.13.0-healthchecks] - 2025-12-14
 
 ### Added

CONTAINERS.md

@@ -33,6 +33,7 @@
 | **Tatlock** | 8000 | http://192.168.86.149:8000 | LAN | No | 1, 6 | ✅ Running (external) |
 | **Library Desk** | 8089 | http://192.168.86.149:8089 | LAN | No | 4 | ✅ Running (external) |
 | **AMP (Game Server)** | Varies | http://192.168.86.149:8081 | LAN | No | - | ✅ Running |
+| **Home Assistant** | 8123 | https://housekeeping.schweitz.net | Internet | No | - | ✅ Running |
 
 ### External Domains (SSL via Let's Encrypt)
 - **home.schweitz.net** → Organizr (Protected by Authentik SSO)
@@ -43,6 +44,7 @@
 - **api.schweitz.net** → Core API
 - **code.schweitz.net** → Code-Server (host service)
 - **amp.schweitz.net** → AMP Game Server
+- **housekeeping.schweitz.net** → Home Assistant
 - **tatlock.schweitz.net** → (Reserved)
 
 ### External Repositories
@@ -444,6 +446,31 @@ Nextcloud is a self-hosted cloud storage and collaboration platform providing fi
 
 ---
 
+### Home Assistant
+
+Home Assistant is an open-source smart home automation platform that integrates with thousands of IoT devices, sensors, and services to provide centralized control, automation rules, and monitoring through a web dashboard and mobile apps. It supports local processing without cloud dependencies, enabling privacy-focused home automation with features like device tracking, energy monitoring, voice assistants, and custom automations triggered by time, location, or device states. The service stores all configuration, automations, and historical data on the SSD for responsive dashboard loading, with USB device support for Z-Wave and Zigbee coordinators.
+
+| Property | Value |
+|----------|-------|
+| **Image** | `ghcr.io/home-assistant/home-assistant:stable` |
+| **Container Name** | `home-assistant` |
+| **Access URL (LAN)** | http://192.168.86.149:8123 |
+| **Access URL (Public)** | https://housekeeping.schweitz.net |
+| **External Access** | Yes (via NPM reverse proxy with SSL) |
+| **Port Mapping** | 8123:8123 (HTTP) |
+| **Network Mode** | Bridge (docker-dataplane) |
+| **Restart Policy** | `unless-stopped` |
+| **Volume Mounts** | `~/docker-data/home-assistant/config:/config` (SSD - configs, database, automations) |
+| **Environment** | `TZ=Europe/Amsterdam` |
+| **Privileged Mode** | Yes (for USB device access: Z-Wave, Zigbee dongles) |
+| **Resource Limits** | Memory: 1GB |
+| **GPU Required** | No |
+| **Dependencies** | NPM (reverse proxy), USB devices (optional) |
+| **Health Check** | `curl -fSs http://localhost:8123/api/` (30s interval) |
+| **Features** | Device integrations, automations, dashboards, energy monitoring, voice assistants, mobile apps |
+
+---
+
 ### Samba
 
 Samba provides SMB/CIFS network file sharing for seamless access to homelab storage from Windows, macOS, Linux, and mobile devices, exposing curated shares for media libraries, downloads, and backups with configurable read-only and read-write permissions. It runs as a single container on the samba_default network, serving three shares: Media (read-write access to Jellyfin content), Downloads (read-write for torrent clients), and Backups (read-only for safe data recovery). The service uses password authentication for the user jpmschweitzer and stores its minimal configuration on the SSD while directly mounting HDD paths for zero-copy file access with native performance.
@@ -516,6 +543,7 @@ Gitea is a lightweight, self-hosted Git service providing repository hosting, is
 | **Nextcloud** | https://cloud.schweitz.net | Yes | Cloud storage & sync |
 | **Gitea** | https://git.schweitz.net | Yes | Git repository hosting |
 | **Samba** | \\\\192.168.86.149 | No | Network file shares |
+| **Home Assistant** | https://housekeeping.schweitz.net | Yes | Smart home automation |
 | **Watchtower** | N/A (background) | N/A | Auto-updates |
 
 ---
@@ -550,6 +578,7 @@ Gitea is a lightweight, self-hosted Git service providing repository hosting, is
 | **Nextcloud** | `~/docker-data/nextcloud/` | `/mnt/media/nextcloud/data/` | Config: ~200MB, DB: ~100MB, User data: variable |
 | **Gitea** | `~/docker-data/gitea/` | N/A | Data: ~100MB, DB: ~50MB, Repos: variable |
 | **Samba** | `~/docker-data/samba/` | Mounts: `/mnt/media/` (shares) | Config: ~5MB |
+| **Home Assistant** | `~/docker-data/home-assistant/config/` | N/A | Config: ~100MB, DB: ~50MB |
 
 **SSD Usage (docker-data):** ~6-11GB (configs, caches, databases)
 **HDD Usage (/mnt/media):** ~2.1TB / 3.6TB (58% used)
@@ -562,7 +591,7 @@ Gitea is a lightweight, self-hosted Git service providing repository hosting, is
 
 | Network Name | Containers | Purpose |
 |--------------|------------|---------|
-| **docker-dataplane** | Ollama, Open WebUI, Core API, Qdrant, PostgreSQL Shared, Redis Shared, Headscale, Nextcloud, Gitea, Samba, Watchtower, Organizr, Netdata | Unified service mesh for all containerized applications |
+| **docker-dataplane** | Ollama, Open WebUI, Core API, Qdrant, PostgreSQL Shared, Redis Shared, Headscale, Nextcloud, Gitea, Samba, Watchtower, Organizr, Netdata, Home Assistant | Unified service mesh for all containerized applications |
 | **host** | Portainer, NPM | Direct host port access for infrastructure management |
 
 **Benefits of Consolidation**:

stacks/README.md

@@ -43,6 +43,7 @@ review the http://core-api/docs openapi documentation for infrastructure managem
 | **Nextcloud** | `nextcloud.yml` | 8082 | No | Cloud storage (includes DB and Redis) |
 | **Gitea** | `gitea.yml` | 3002, 2222 | No | Git repository hosting (includes PostgreSQL) |
 | **Samba** | `samba.yml` | 139, 445 | No | Network file sharing |
+| **Home Assistant** | `home-assistant.yml` | 8123 | No | Smart home automation platform |
 
 ## Port Allocation
 
@@ -54,6 +55,9 @@ review the http://core-api/docs openapi documentation for infrastructure managem
 - 8085: Headscale
 - 8096: Jellyfin
 
+### Home Automation Services (8100-8199)
+- 8123: Home Assistant
+
 ### Git & Development Services
 - 2222: Gitea SSH
 - 3002: Gitea HTTP

stacks/home-assistant.yml

@@ -0,0 +1,79 @@
+version: '3.8'
+
+# Home Assistant - Smart Home Automation Platform
+# Port: 8123 (Home Assistant default)
+# GPU: No
+# Storage: SSD (config and database)
+
+services:
+  home-assistant:
+    image: ghcr.io/home-assistant/home-assistant:stable
+    container_name: home-assistant
+    restart: unless-stopped
+    ports:
+      - "8123:8123"
+    volumes:
+      # Config on SSD (includes database, automations, scripts)
+      - /home/jpmschweitzer/docker-data/home-assistant/config:/config
+    environment:
+      - TZ=Europe/Amsterdam
+    # Privileged mode for USB device access (Z-Wave, Zigbee dongles)
+    privileged: true
+    networks:
+      - docker-dataplane
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fSs http://localhost:8123/manifest.json || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 120s
+    deploy:
+      resources:
+        limits:
+          memory: 1G
+
+networks:
+  docker-dataplane:
+    external: true
+    name: docker-dataplane
+
+# Setup Instructions:
+# 1. Create config directory:
+#    mkdir -p /home/jpmschweitzer/docker-data/home-assistant/config
+#
+# 2. Deploy this stack via Portainer or:
+#    docker compose -f home-assistant.yml up -d
+#
+# 3. Wait for initial setup (1-2 minutes)
+#
+# 4. Access web interface: http://localhost:8123
+#    or external: https://housekeeping.schweitz.net
+#
+# 5. Complete the onboarding wizard:
+#    - Create admin account
+#    - Set home location
+#    - Configure integrations
+#
+# USB Device Access:
+# Privileged mode is enabled for Z-Wave, Zigbee, or other USB devices.
+# For specific device mapping instead, replace privileged: true with:
+#   devices:
+#     - /dev/ttyUSB0:/dev/ttyUSB0
+#     - /dev/ttyACM0:/dev/ttyACM0
+#
+# NPM Configuration:
+# Domain: housekeeping.schweitz.net
+# Scheme: http
+# Forward Hostname/IP: home-assistant
+# Forward Port: 8123
+# Websockets Support: ENABLED (required for HA)
+# SSL: Let's Encrypt
+#
+# After NPM setup, add to configuration.yaml:
+#
+# http:
+#   use_x_forwarded_for: true
+#   trusted_proxies:
+#     - 172.16.0.0/12
+#     - 192.168.0.0/16
+#     - 10.0.0.0/8