From fc6c42356539c168b91fedf3fd629f7fdb18aa85 Mon Sep 17 00:00:00 2001
From: Mel <mel@rnrd.eu>
Date: Sat, 14 Feb 2026 22:43:04 +0100
Subject: Add Matter server to HM stack

Signed-off-by: Mel <mel@rnrd.eu>
---
 services/home-assistant.nix | 35 +++++++++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/services/home-assistant.nix b/services/home-assistant.nix
index e356c46..d240d85 100644
--- a/services/home-assistant.nix
+++ b/services/home-assistant.nix
@@ -5,7 +5,8 @@ let
 
   homeVersion = "2025.3.3";
   homeDir = "/srv/home";
-  homeLocalPort = 8123;
+  homePort = 8123;
+  matterPort = 8124;
 
   homeImage = common.pullImage {
     name = "homeassistant/home-assistant";
@@ -14,6 +15,13 @@ let
     x86.sha256 = "06ijcvdzax473fsy90657jmr2vjzh5pwdssk2vzgva8d6g3d396l";
   };
 
+  matterImage = common.pullImage {
+    registry = "github";
+    name = "matter-js/python-matter-server";
+    tag = "stable";
+    digest = "sha256:44d47c9ec91bf06fcb72a8df2dd2f36e90934c7b0d1d85f1ecb46fc695164746";
+    x86.sha256 = "sha256-976g4aYR+XqPAb5C8QU7VewvbuPP48JUR15vayHvZSw=";
+  };
 in
 {
   foundation.service.home-assistant = {
@@ -24,7 +32,9 @@ in
       customNetworkOption = "host";
       # allow home-assistant to access zigbee/matter+thread
       # dongle.
-      devices = [ "/dev/serial/by-id/usb-SMLIGHT_SMLIGHT_SLZB-07_6e29216e5272ef119d2f43848fcc3fa0-if00-port0" ];
+      devices = [
+        "/dev/serial/by-id/usb-SMLIGHT_SMLIGHT_SLZB-07_6e29216e5272ef119d2f43848fcc3fa0-if00-port0"
+      ];
       volumes = [
         [
           "/etc/localtime"
@@ -35,11 +45,28 @@ in
           "/config"
         ]
       ];
-      ports = [ 8123 ];
+      ports = [ homePort ];
     };
 
     # additional services can be added here to enable
     # more home-manager device integrations.
+
+    matter = {
+      fullImage = matterImage;
+      customNetworkOption = "host";
+      volumes = [
+        [
+          "${homeDir}/matter"
+          "/data"
+        ]
+      ];
+      ports = [ matterPort ];
+      cmd = [
+        "--port" (toString matterPort)
+        "--storage-path" "/data"
+        "--paa-root-cert-dir" "/data/credentials"
+      ];
+    };
   };
 
   services.nginx.virtualHosts = {
@@ -48,7 +75,7 @@ in
       forceSSL = true;
       listenAddresses = [ me.tailscale.ip ];
       locations."/" = {
-        proxyPass = "http://127.0.0.1:${toString homeLocalPort}";
+        proxyPass = "http://127.0.0.1:${toString homePort}";
         proxyWebsockets = true;
       };
       extraConfig = ''
-- 
cgit 1.4.1