New service: Zigbee2Mqtt with Mosquitto for HA2

hosts/default.nix

@@ -168,7 +168,7 @@ in
   };
 
   authentik = nixpkgs.lib.nixosSystem {
-    pkgs = pkgs "x86_64-linux";
+    pkgs = pkgs-unstable "x86_64-linux";
     modules = [
       myModules
       proxmoxModule
@@ -266,4 +266,15 @@ in
     # specialArgs = { };
   };
 
+  zigbee2mqtt = nixpkgs-unstable.lib.nixosSystem {
+    pkgs = pkgs-unstable "x86_64-linux";
+    modules = [
+      myModules
+      proxmoxModule
+      ./zigbee2mqtt
+      agenix.nixosModules.default
+    ];
+    # specialArgs = { };
+  };
+
 }

hosts/deployments.nix

@@ -164,6 +164,15 @@ in
     ];
   };
 
+  zigbee2mqtt.deployment = {
+    targetHost = hosts.zigbee2mqtt;
+    tags = [
+      "lxc"
+      "bacco"
+      "zigbee2mqtt"
+    ];
+  };
+
   deadbeef.deployment = {
     allowLocalDeployment = true;
     targetHost = null;

hosts/parameters.nix

@@ -20,6 +20,7 @@
     firefly-iii = "firefly-iii.internal";
     open-webui = "open-webui.home";
     paperless = "paperless.internal";
+    zigbee2mqtt = "zigbee2mqtt.home";
   };
   domains = {
     public = "pasetto.me";

hosts/zigbee2mqtt/default.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  p = import ../parameters.nix;
+in
+{
+
+  age.secrets = {
+    mqtt-password.file = ../../secrets/mqtt-password.age;
+    zigbee2mqtt-password.file = ../../secrets/zigbee2mqtt-password.age;
+  };
+
+  my = {
+
+    networking = {
+      zigbee2mqtt = {
+        enable = true;
+        enable-metric = true;
+        mqtt-passwordFile = config.age.secrets.mqtt-password.path;
+        z2mqtt-passwordFile = config.age.secrets.zigbee2mqtt-password.path;
+      };
+    };
+
+    utils = {
+      commons.enable = true;
+      commons.gc.enable = true;
+      lxc-standard.enable = true;
+    };
+
+    virtualisation.proxmox.enable = true;
+  };
+
+  system.stateVersion = "25.05";
+}