viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[ci skip] Deploy Wyoming Whisper STT service for Home Assistant voice input

Browse source 
Add Wyoming Faster Whisper (rhasspy/wyoming-whisper) as a new K8s service
exposed via Traefik TCP entrypoint on port 10300. Accessible from ha-london
RPi via VPN at 10.0.20.202:10300.
This commit is contained in:
Viktor Barzin 2026-02-08 00:09:03 +00:00
parent e067504170
commit d89947c2fd
No known key found for this signature in database
GPG key ID: 0EB088298288D958
4 changed files with 166 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

25
modules/kubernetes/main.tf
View file

@ -83,6 +83,7 @@ variable "public_ip" {}
variable "cloudflare_proxied_names" {}
variable "cloudflare_non_proxied_names" {}
variable "owntracks_credentials" {}
variable "ollama_api_credentials" {}
variable "dawarich_database_password" {}
variable "geoapify_api_key" {}
variable "tandoor_database_password" {}
@ -134,8 +135,8 @@ variable "defcon_level" {
locals {
defcon_modules = {
1 : ["wireguard", "technitium", "headscale", "traefik", "xray", "authentik", "cloudflare", "authelia", "monitoring"], # Critical connectivity services
2 : ["vaultwarden", "redis", "immich", "nvidia", "metrics-server", "uptime-kuma", "crowdsec", "kyverno"], # Storage and other db services
3 : ["reverse-proxy"], # Cluster admin services (k8s-dashboard chart repo still 404)
2 : ["vaultwarden", "redis", "immich", "nvidia", "metrics-server", "uptime-kuma", "crowdsec", "kyverno"], # Storage and other db services
3 : ["reverse-proxy"], # Cluster admin services (k8s-dashboard chart repo still 404)
4 : [
"mailserver", "shadowsocks", "webhook_handler", "tuya-bridge", "dawarich", "owntracks", "nextcloud",
"calibre", "onlyoffice", "f1-stream", "rybbit", "isponsorblocktv", "actualbudget"
@ -146,7 +147,7 @@ locals {
"url", "excalidraw", "travel_blog", "dashy", "send", "ytdlp", "wealthfolio", "rybbit", "stirling-pdf",
"networking-toolbox", "navidrome", "freshrss", "forgejo", "tor-proxy", "real-estate-crawler", "n8n",
"changedetection", "linkwarden", "matrix", "homepage", "meshcentral", "diun", "cyberchef", "ntfy", "ollama",
"servarr", "jsoncrack", "paperless-ngx", "frigate", "audiobookshelf", "tandoor", "ebook2audiobook", "netbox", "speedtest", "resume", "freedify", "mcaptcha", "affine", "plotting-book"
"servarr", "jsoncrack", "paperless-ngx", "frigate", "audiobookshelf", "tandoor", "ebook2audiobook", "netbox", "speedtest", "resume", "freedify", "mcaptcha", "affine", "plotting-book", "whisper"
],
}
active_modules = distinct(flatten([
@ -729,10 +730,11 @@ module "servarr" {
# }
module "ollama" { # Disabled as it requires too much resources...
source = "./ollama"
for_each = contains(local.active_modules, "ollama") ? { ollama = true } : {}
tls_secret_name = var.tls_secret_name
tier = local.tiers.gpu
source = "./ollama"
for_each = contains(local.active_modules, "ollama") ? { ollama = true } : {}
tls_secret_name = var.tls_secret_name
tier = local.tiers.gpu
ollama_api_credentials = var.ollama_api_credentials
depends_on = [null_resource.core_services]
}
@ -1086,3 +1088,12 @@ module "plotting-book" {
depends_on = [null_resource.core_services]
}
module "whisper" {
source = "./whisper"
for_each = contains(local.active_modules, "whisper") ? { whisper = true } : {}
tls_secret_name = var.tls_secret_name
tier = local.tiers.gpu
depends_on = [null_resource.core_services]
}

18
modules/kubernetes/traefik/main.tf
View file

@ -46,14 +46,14 @@ resource "helm_release" "traefik" {
providers = {
kubernetesIngress = {
enabled = true
allowExternalNameServices = true
publishedService = { enabled = true }
enabled = true
allowExternalNameServices = true
publishedService = { enabled = true }
}
kubernetesCRD = {
enabled = true
allowExternalNameServices = true
allowCrossNamespace = true
enabled = true
allowExternalNameServices = true
allowCrossNamespace = true
}
}
@ -97,6 +97,12 @@ resource "helm_release" "traefik" {
protocol = "UDP"
expose = { default = true }
}
whisper-tcp = {
port = 10300
exposedPort = 10300
protocol = "TCP"
expose = { default = true }
}
}
service = {

123
modules/kubernetes/whisper/main.tf Normal file
View file

@ -0,0 +1,123 @@
variable "tls_secret_name" {}
variable "tier" { type = string }
resource "kubernetes_namespace" "whisper" {
metadata {
name = "whisper"
}
}
module "tls_secret" {
source = "../setup_tls_secret"
namespace = kubernetes_namespace.whisper.metadata[0].name
tls_secret_name = var.tls_secret_name
}
resource "kubernetes_deployment" "whisper" {
metadata {
name = "whisper"
namespace = kubernetes_namespace.whisper.metadata[0].name
labels = {
app = "whisper"
tier = var.tier
}
}
spec {
replicas = 1
strategy {
type = "Recreate"
}
selector {
match_labels = {
app = "whisper"
}
}
template {
metadata {
labels = {
app = "whisper"
}
}
spec {
node_selector = {
"gpu" : "true"
}
toleration {
key = "nvidia.com/gpu"
operator = "Equal"
value = "true"
effect = "NoSchedule"
}
container {
name = "whisper"
image = "rhasspy/wyoming-whisper:latest"
args = ["--model", "small-int8", "--language", "en", "--beam-size", "1"]
port {
container_port = 10300
protocol = "TCP"
}
volume_mount {
name = "data"
mount_path = "/data"
}
}
volume {
name = "data"
nfs {
server = "10.0.10.15"
path = "/mnt/main/whisper"
}
}
}
}
}
}
resource "kubernetes_service" "whisper" {
metadata {
name = "whisper"
namespace = kubernetes_namespace.whisper.metadata[0].name
labels = {
app = "whisper"
}
}
spec {
selector = {
app = "whisper"
}
port {
name = "wyoming"
port = 10300
target_port = 10300
protocol = "TCP"
}
}
}
# TCP passthrough from Traefik to whisper service
resource "kubernetes_manifest" "whisper_tcp_ingressroute" {
manifest = {
apiVersion = "traefik.io/v1alpha1"
kind = "IngressRouteTCP"
metadata = {
name = "whisper-tcp"
namespace = "traefik"
}
spec = {
entryPoints = ["whisper-tcp"]
routes = [{
match = "HostSNI(`*`)"
services = [{
name = "whisper"
namespace = "whisper"
port = 10300
}]
}]
}
}
}