feat(smarthome): extract Matter Server + AirCast from HA; fix create path - #248
Merged
Conversation
The hand-maintained secrets.env drifts across machines (absent or half-filled on
a second laptop). Replace it with a committed schema + a generator that fills every
secret from Bitwarden Secrets Manager, so any machine rebuilds a complete, correct
secrets.env with one command.
- secrets.env.template: canonical schema (non-secret values literal; the 21 secret
keys blank). Replaces the stale secrets.env.example (removed, was ~9 keys behind).
- scripts/secrets-sync.{sh,ps1}: regenerate secrets.env from the SM "Homelab"
project (bws + Keychain/DPAPI token, EU region). Proven byte-identical .sh vs .ps1;
warns loudly on any expected key missing from SM (the half-filled alarm).
- scripts/secrets-migrate.sh: one-shot seed of SM from the vault + local secrets.env
(vault strictly read-only, SM add-only).
- docs/plans/secrets-bitwarden-sm.md: design, vault audit, and validation record
(candidate ADR-0008; supersedes BL-010's secrets-backend decision).
- CLAUDE.md / PowerOrchestrator deploy.sh: point at the template + secrets-sync.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Hash-matched each live secrets.env value against every vault item to find its true source (an earlier by-name audit had guessed wrong for 6 keys): - Repoint 3 to the CORRECT vault items in secrets-migrate.sh: SYNOLOGY_PASSWORD → DSM1813: Homelab, UNIFI_API_KEY → Homelab MCP API Key, HOMEASSISTANT_TOKEN → Home Assistant: Claude Token. - 3 have no vault item at all (drift; lived only in secrets.env) → sourced as local: PROXMOX_TOKEN_SECRET, GITHUB_PACKAGES_PAT, PANGOLIN_API_KEY. SM already holds the correct live values (validated 38/38); this makes the migrate mapping reproducible. Migrate re-run is idempotent (skips all 21). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Idempotent first-run setup for a Windows machine: installs the bws CLI (official release into ~/.local/bin + user PATH), pins the EU region, stores the SM access token DPAPI-encrypted (per-user) at ~/.config/bws/access-token.dpapi, then runs secrets-sync.ps1 to generate secrets.env. Re-run with -Force to replace the token. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…one members
Pull two apps out of the HAOS supervisor into first-class SmartHome members on the
IoT VLAN (1040), same segment as their devices (mDNS):
- matter-server (CT 6001, Docker host): runs the upstream image HA's add-on wraps
(python-matter-server). HA connects over WS (ws://10.40.62.181:5580/ws). Docker-host
route because community-scripts DISABLED the native ct/matter-server.sh server-side
(python-matter-server archived 2026-06-23). IPv6 override on the CT for Matter; note
VLAN 1040 still needs RA/SLAAC enabled before device commissioning works.
- aircast (CT 6002, Docker host): AirConnect (1activegeek/airconnect), network_mode host
so mDNS/RTP reach the LAN. Verified discovering ("Living Room TV").
Engine fix (unblocks ALL creates): community-scripts build.func gained a host
"LXC-stack upgrade available?" gate that prompts via `read </dev/tty` — fatal to
non-interactive SSH creates once a pve-container/lxc-pve update is pending on the node.
Pass DISABLE_UPDATE=yes + PHS_SILENT=1 (build.func's own unattended escapes) on every
create. This bit us today; every new CT create was aborting.
Both CTs live + DHCP-reserved. VS Code + HA's cloudflared add-ons are being dropped
HA-side; HA exposure moves to Pangolin (follow-up).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…he :8123 port-forward Declare HA as a Pangolin resource — homeassistant.lab.chrison.dev → 192.168.179.102:8123, SSO-gated (badger) — replacing the raw :8123 UniFi port-forward that put HA's UI directly on the internet. Reconciled live via the integration API (add-only): resource created, route verified (302 → Pangolin SSO, valid *.lab wildcard cert). Follow-ups (gated, not in this change): - HA-side: add 10.10.0.13 (Traefik) to trusted_proxies + use_x_forwarded_for, else HA rejects the proxied request after SSO. - Retire the :8123 port-forward once end-to-end access via Pangolin is confirmed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Extracts two apps out of the HAOS supervisor into first-class SmartHome members on the IoT VLAN (1040), and fixes an upstream-triggered break in the CT create path.
ghcr.io/home-assistant-libs/python-matter-server(Docker host)10.40.62.1811activegeek/airconnect(Docker host)10.40.147.133Both live + DHCP-reserved. Verified: matter-server WS on
:5580; aircast discovering Chromecasts.Notable
ct/matter-server.shserver-side (python-matter-server archived 2026-06-23). We run the same image the add-on wrapped. HA connects viaws://10.40.62.181:5580/ws.chip … Network is unreachable) until IPv6 is enabled on the IoT VLAN. HA↔matter WS works over IPv4 regardless.build.funcadded a host "LXC-stack upgrade available?" gate that prompts viaread </dev/tty— fatal to non-interactive SSH creates once apve-container/lxc-pveupdate is pending. PassingDISABLE_UPDATE=yes PHS_SILENT=1(build.func's own unattended escapes) on every create. This was breaking all new CT creation today.Not in this PR (follow-ups)
:8123port-forward).🤖 Generated with Claude Code