fix(audit): track the heating-can image pins, not the deleted Ansible vars

#476 merged first, which removed edge_open3e_pkg, edge_e3oncan_repo and
edge_e3oncan_version in favour of the image. The audit entry added here still
told the agent to read those, so it would have gone looking for variables
that no longer exist and reported nothing -- the same silent non-auditing the
entry was written to prevent.

Repointed at where the pins actually live now: OPEN3E_REF and E3ONCAN_REF as
ARGs in ci/images/heating-can/Containerfile. The awkward specifics carry over
unchanged, since they are properties of the upstreams rather than of how we
package them: open3e publishes no tags so the comparison must be against
commits, and E3onCAN's pin is an untagged commit later than its newest tag.

Added a note the previous version could not have made: heating_can_image is
:latest, so the node follows whatever CI last built. The Containerfile ARGs
are what actually fix the versions, and bumping one is what requires a
rebuild -- otherwise a reader could reasonably conclude the tag is the pin.

The pin commit itself is now a no-op against master and survives only as the
audit registration; its conflict on heating-can/defaults resolved in favour of
the image.

Co-Authored-By: Claude Bot <claude-bot@renner.uno>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.woodpecker/build-ci-images.yml

@@ -217,3 +217,32 @@ steps:
           --dockerfile Containerfile \
           --destination gitea.renner.uno/gitea_admin/alpine-openssl:$TAG \
           --destination gitea.renner.uno/gitea_admin/alpine-openssl:latest
+
+  # Heating CAN readers: open3e (Vitocal/VX3) + E3onCAN (E380 meter), one image
+  # run as two services on edge-1. Replaces pip-into-venv on the host, where an
+  # unpinned VCS requirement re-cloned and restarted the heating bridge on every
+  # Ansible converge. Not a ci-* image -- it is a runtime artifact -- but it
+  # builds the same way and lands in the same registry so the audit sees it.
+  - name: build-heating-can
+    image: gcr.io/kaniko-project/executor:v1.23.2-debug
+    directory: ci/images/heating-can
+    depends_on: []
+    when:
+      - event: manual
+      - event: push
+        path: ["ci/images/heating-can/**", ".woodpecker/build-ci-images.yml"]
+    environment:
+      GITEA_USER: gitea_admin
+      GITEA_TOKEN:
+        from_secret: ci_images_token
+    commands:
+      - mkdir -p /kaniko/.docker
+      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
+      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
+      - TAG=$(date +%Y-%m-%d)
+      - |
+        /kaniko/executor \
+          --context . \
+          --dockerfile Containerfile \
+          --destination gitea.renner.uno/gitea_admin/heating-can:$TAG \
+          --destination gitea.renner.uno/gitea_admin/heating-can:latest

ansible/docs/edge-host.md

@@ -33,13 +33,43 @@ Build and boot the dedicated installer image — see
    (partitions the internal disk — NVMe if present, else the eMMC; the
    installer autodetects — installs the ansible-ready base system with SSH
    keys, DHCP, docker — asks for confirmation before wiping).
-3. Add the DHCP reservation/DNS entry for `edge-1.srv.renner.uno` on the
-   UDM, confirm `ssh root@edge-1.srv.renner.uno` works.
-4. From the workstation:
+3. Confirm the box resolves and is reachable by name — `ssh root@<host>` must
+   work before anything else. The UDM registers DHCP leases in DNS, so the
+   record appears on its own; the host is identified by name everywhere
+   (inventory, plays, this file) and its address is never recorded. Do not
+   pin it to a reservation.
+4. Add the host to `[edge_host]` in `inventory/pve_hosts.yml`, by name.
+   That group is the base: every edge thin client belongs to it, and it
+   assumes no peripherals.
+5. From the workstation:
    ```
-   ansible-playbook -i inventory/pve_hosts.yml plays/common.yml -l edge_host
    ansible-playbook -i inventory/pve_hosts.yml plays/install-edge-host.yml
    ```
+   One unrestricted run over the whole group. The play is self-contained --
+   it carries `certificates` and `common` itself, so there is no second
+   command and no `--limit`. Running it converges every edge host, which is
+   the point: a run that touches only the new box tells you nothing about
+   the others.
+
+## Peripherals
+
+Each attached device is its own inventory group and its own playbook. Group
+membership states which hardware a host physically has -- there are no flags
+and no `when:` on the roles, so moving a stick between boxes is a one-line
+inventory change.
+
+| device | group | playbook |
+|---|---|---|
+| Innomaker USB2CAN (Vitocal/VX3 + E380) | `heating_can` | `plays/install-heating-can.yml` |
+| Nabu Casa ZWA-2 Z-Wave radio | `zwave_gateway` | `plays/install-zwave-gateway.yml` |
+| FTDI serial power-meter head | `power_meter` | `plays/install-power-meter.yml` |
+
+Add the host to the matching group, then run that playbook. They depend on
+the base play having run: all three need the local MQTT bridge, and two of
+them need docker.
+
+A host with nothing attached is simply absent from all three groups and needs
+none of these commands.
 
 ## Secrets (before first play run)
 
@@ -85,7 +115,7 @@ zwave-js (order matters — never two servers on one radio):
       `kubectl -n home-assistant exec deploy/zwave-js -- tar cf - -C /usr/src/app store | tar xf - -C /opt/edge-host/zwave-js/`
 - [ ] Scale down in-cluster: `kubectl -n home-assistant scale deploy/zwave-js --replicas 0`
 - [ ] Move the ZWA-2 stick to edge-1, `docker compose up -d zwave-js`
-- [ ] Point HA `zwave_js` integration at `ws://edge-1.srv.renner.uno:3000`
+- [ ] Point HA `zwave_js` integration at `ws://edge-1.iot.renner.uno:3000`
 - [ ] Nodes alive in the UI on :8091 → remove the flux kustomization
       `home-assistant-zwavejs` + PVC in a follow-up PR
 
@@ -113,8 +143,12 @@ Afterwards:
   deliberate for sml2mqtt, acceptable for zwave-js). If a zwave-js bump
   changes its Alpine major, also update `edge_zwave_alpine_base` and refresh
   the preloaded `.so` (see "Logging & eMMC" → zwave-js).
-- open3e updates: re-run the play; the pip task tracks the git default
-  branch (pin `edge_open3e_pkg` to a tag if that ever bites).
+- open3e / E3onCAN updates: both are pinned to commits in
+  `roles/heating-can/defaults/main.yml`, so re-running the play does NOT pick
+  up upstream changes -- that is deliberate, these drive the heat pump. The
+  weekly update-audit reports when either falls behind (see
+  `ci/agents/update-audit/prompt.md`); bump the pin and re-run.
+  Pinning to a tag is not an option for open3e: it publishes none.
 - Ad-hoc CAN scans: `systemctl stop open3e` first (single-instance rule),
   restart afterwards.
 - can-utils (`candump`) is AUR-only on Arch — install manually via

ansible/inventory/group_vars/edge_host/vars.yml

@@ -1,6 +1,6 @@
 ---
 # Secret indirection — real values live in vault.yml (ansible-vault) next
-# to this file; see roles/edge-host/README.md for how to populate it from
+# to this file; see docs/edge-host.md for how to populate it from
 # the cluster secrets.
 edge_sml2mqtt_mqtt_password: "{{ vault_edge_sml2mqtt_mqtt_password }}"
 edge_open3e_mqtt_password: "{{ vault_edge_open3e_mqtt_password }}"
@@ -36,3 +36,18 @@ keepalived_ntp_sysctl:
 
 # Realtek NIC on the Wyse 3040 has no hardware timestamping.
 chrony_hwtimestamp: false
+
+# --- Local MQTT contract -------------------------------------------------
+# Shared between the broker and its clients, so it belongs to the inventory
+# rather than to either side's role. mqtt-bridge listens here; heating-can and
+# power-meter-sml publish here; and the bridge authenticates to the cluster
+# broker AS the open3e user, so it needs that identity too.
+#
+# Keeping these in one role's defaults only worked while a single play loaded
+# every role at once. Splitting the plays by capability exposed it: the bridge
+# could not render without a heating-can default, and the CAN services could
+# not render without an mqtt-bridge default.
+edge_mqtt_host: 127.0.0.1
+edge_mqtt_port: 1883
+edge_open3e_mqtt_user: open3e
+edge_open3e_mqtt_topic: open3e

ansible/inventory/group_vars/ntp_cluster.yml

@@ -0,0 +1,18 @@
+---
+# Shared configuration for every NTP server (see plays/install-ntp-ha.yml).
+
+# IPv6 service address -- what ntp.srv.renner.uno resolves to, and the path
+# clients actually use. The IPv4 VIP is legacy.
+#
+# Defined at group level rather than in the play because install-ntp-ha.yml runs
+# two plays over this group -- withdraw the static assignments fleet-wide, then
+# hand the address to keepalived -- and both need the same value. Duplicating a
+# service address across plays is exactly the sort of thing that drifts.
+ntp_vip6: "fd40::123/128"
+
+# Link-local address carried as the FIRST virtual_ipaddress of the IPv6 VRRP
+# instance. RFC 5798 gives an IPv6 virtual router a link-local primary, and
+# keepalived warns "the first IPv6 VIP address should be link local" without
+# one. fe80::123 mirrors the service address and cannot collide with a real
+# NIC's EUI-64 link-local.
+ntp_vip6_linklocal: "fe80::123/64"

ansible/inventory/pve_hosts.yml

@@ -1,7 +1,19 @@
+# Reached by name, like every other host in this file. These three were the last
+# entries still addressed by IPv4 literal; authentik, netbird, proxy, nas-1,
+# grafana and edge-1 have always used their FQDN.
+#
+# An address in an inventory is allocator state standing in for identity, and it
+# pins access to the legacy family -- the names resolve IPv6-first, which is the
+# primary path on this network. DNS is the authoritative source for where a host
+# is; this file should say which host, not where it currently sits.
+#
+# The short inventory_hostname is kept deliberately: plays key on it
+# (ntp_servers[inventory_hostname] in install-ntp-ha.yml, node names in opentofu,
+# the prometheus targets), so only ansible_host changes.
 [pve_cluster]
-jupiter ansible_host=10.2.40.201 ansible_user=root
-neptune ansible_host=10.2.40.202 ansible_user=root
-saturn ansible_host=10.2.40.203 ansible_user=root
+jupiter ansible_host=jupiter.renner.uno ansible_user=root
+neptune ansible_host=neptune.renner.uno ansible_user=root
+saturn ansible_host=saturn.renner.uno ansible_user=root
 
 [authentik_db]
 authentik-db-1.srv.renner.uno ansible_user=root
@@ -29,9 +41,36 @@ nas-1.renner.uno ansible_user=ladmin ansible_python_interpreter=/usr/bin/python3
 [grafana]
 grafana.srv.renner.uno ansible_user=ladmin
 
+# Every bare-metal edge thin client. Gets the host-generic roles only:
+# flash-wear handling, the log shipper, the MQTT bridge, the VLAN
+# sub-interface. Nothing here assumes any peripheral is attached.
 [edge_host]
 edge-1.iot.renner.uno ansible_user=root
 
+# Capability groups. Membership states which hardware a host physically has,
+# and each service playbook targets the group for its own concern. No flags and
+# no `when:` on the roles -- moving a stick to another box is a one-line change
+# here, which is what it should be.
+#
+# These are children of [edge_host], declared below: a peripheral is added to an
+# edge client, it does not replace the base. Making that a :children relation
+# rather than a comment means a host added only to a capability group still
+# resolves group_vars/edge_host -- where the local MQTT contract lives -- so it
+# cannot silently come up without edge_mqtt_host and friends.
+[zwave_gateway]
+edge-1.iot.renner.uno
+
+[heating_can]
+edge-1.iot.renner.uno
+
+[power_meter]
+edge-1.iot.renner.uno
+
+[edge_host:children]
+zwave_gateway
+heating_can
+power_meter
+
 # NTP servers. Includes edge-1 so the role survives the PVE hosts being
 # retired for bare-metal Talos, which cannot run chrony or keepalived itself.
 # See plays/install-ntp-ha.yml for why keepalived is scoped more narrowly

ansible/plays/install-edge-host.yml

@@ -1,13 +1,41 @@
 ---
-# Bare-metal Arch Linux edge host (Dell Wyse 3040, internal eMMC) — replaces
-# the k8s-edge Talos VM
-# (opentofu vm_153) as the home for hardware-bound services:
-#   - zwave-js-ui  (ZWA-2 Z-Wave USB radio, docker compose)
-#   - sml2mqtt     (FTDI power-meter reader, docker compose)
-#   - open3e       (Innomaker USB2CAN -> Vitocal/VX3, native venv + systemd)
-# Base install procedure and cutover checklist: ansible/roles/edge-host/README.md
-- name: Install Arch edge host
+# Bare-metal Arch edge hosts (Dell Wyse 3040 and similar) — the home for
+# hardware-bound services, because Talos supports neither SocketCAN nor USB
+# passthrough.
+#
+# This play is the BASE only: what every edge thin client gets regardless of
+# what is plugged into it. The peripherals live in their own playbooks against
+# their own inventory groups:
+#
+#   plays/install-zwave-gateway.yml   [zwave_gateway]   ZWA-2 radio
+#   plays/install-heating-can.yml     [heating_can]     Innomaker USB2CAN
+#   plays/install-power-meter.yml     [power_meter]     FTDI meter head
+#
+# Splitting the roles without splitting the plays would have kept the coupling:
+# one play applying every role to one group is the monolith again, a layer up.
+# A host with no peripherals is simply absent from those groups -- no flags, no
+# `when:` on the roles.
+#
+# Self-contained: `certificates` and `common` are the parts of plays/common.yml
+# that apply to an edge host, carried here so bootstrapping one is a single
+# unrestricted run over the group. Not carried over: qemu-guest-agent (bare
+# metal, not VMs) and monitoring-agent (Debian-oriented; these hosts ship logs
+# via edge-log-shipper).
+#
+# Order is dependency order: edge-flash-wear before docker, so the journal is
+# volatile before containers start logging into it.
+- name: Install Arch edge host (base)
   hosts: edge_host
+  # Connection is already root (ansible_user=root), so this is a root-to-root
+  # no-op today. Kept explicit, matching plays/common.yml, so the roles below
+  # do not silently depend on the connection user staying privileged.
+  become: true
+
   roles:
+    - certificates
+    - common
+    - edge-flash-wear
     - docker-install
-    - edge-host
+    - edge-log-shipper
+    - mqtt-bridge
+    - edge-vlan

ansible/plays/install-heating-can.yml

@@ -0,0 +1,18 @@
+---
+# Heating system over the Viessmann E3 CAN bus, for hosts with the Innomaker
+# USB2CAN adapter attached.
+#
+# Targets [heating_can]: membership means the adapter is physically present.
+# Two roles because they are two concerns -- the interface is host network
+# state, the services consume it -- but one group, because both need the same
+# hardware.
+#
+# Requires the base play (plays/install-edge-host.yml) to have run: these
+# services publish to the local MQTT bridge it sets up.
+- name: Install heating CAN services
+  hosts: heating_can
+  become: true
+
+  roles:
+    - socketcan
+    - heating-can

ansible/plays/install-ntp-ha.yml

@@ -22,12 +22,54 @@
 # so it stays BACKUP while the PVE nodes exist and wins the VIP by default once
 # they are gone -- no config change required at cutover.
 
-- name: Install NTP Server (HA)
+# Phase 1. Every static assignment of the IPv6 service address must be gone
+# fleet-wide before ANY host claims it via VRRP.
+#
+# DAD is enabled on the VRRP address (deliberately -- under single-master VRRP a
+# duplicate is a real fault worth detecting). So a static copy on one host and a
+# VRRP-managed copy on another cannot coexist: the kernel marks the newcomer
+# `dadfailed deprecated`, and its master then believes it is serving while
+# carrying an unusable address. That is not hypothetical -- it is what edge-1
+# did on 2026-08-07 when it took the address while three PVE nodes still held it
+# statically.
+#
+# Deliberately NOT serial: this play must complete everywhere before phase 2
+# starts anywhere. Doing the withdrawal per host inside phase 2 cannot avoid the
+# overlap, because with serial: 1 the first host claims the address while the
+# rest are still static.
+#
+# There is a gap between the phases where no host holds the address. It is
+# bounded by one play's run time and clients simply retry.
+- name: Withdraw static assignments of the NTP service address
   hosts: ntp_cluster
   become: true
 
+  vars:
+    keepalived_ntp_vip6: "{{ ntp_vip6 }}"
+    keepalived_ntp_interface: "{{ ntp_keepalived_interface }}"
+
+  tasks:
+    - name: Withdraw any static assignment of the service address
+      ansible.builtin.include_role:
+        name: keepalived-ntp
+        tasks_from: withdraw-static.yml
+      when: ntp_keepalived_enabled | default(false)
+
+# Phase 2. Configure chrony and hand the address to keepalived.
+- name: Install NTP Server (HA)
+  hosts: ntp_cluster
+  become: true
+  # One node at a time. The keepalived role withdraws the statically assigned
+  # IPv6 service address and restarts keepalived so the address is re-taken
+  # under VRRP control; doing that across every NTP server at once would leave
+  # the whole fleet with nobody holding fd40::123 until the elections settle.
+  # Serialised, the remaining members keep answering throughout.
+  serial: 1
+
   vars:
     ntp_vip: "10.2.40.4"
+    # ntp_vip6 / ntp_vip6_linklocal come from group_vars/ntp_cluster.yml, so
+    # both plays in this file see one definition.
     ntp_servers:
       jupiter:
         priority: 100
@@ -49,6 +91,8 @@
       when: ntp_keepalived_enabled | default(false)
       vars:
         keepalived_ntp_vip: "{{ ntp_vip }}"
+        keepalived_ntp_vip6: "{{ ntp_vip6 }}"
+        keepalived_ntp_vip6_linklocal: "{{ ntp_vip6_linklocal }}"
         keepalived_ntp_state: "{{ ntp_servers[inventory_hostname].state }}"
         keepalived_ntp_priority: "{{ ntp_servers[inventory_hostname].priority }}"
         keepalived_ntp_interface: "{{ ntp_keepalived_interface }}"
@@ -90,6 +134,49 @@
           {% endif %}
       when: ntp_keepalived_enabled | default(false)
 
+    # The v6 address is the path clients actually use, so it gets the same
+    # check as the v4 VIP. Without this a broken v6 rollout -- the address
+    # never claimed, or -nodad not behaving as expected on a given kernel --
+    # would not surface here at all, only later by reading
+    # /var/log/keepalived-state.log by hand.
+    #
+    # `ip -6 addr show ... to <addr>` prints the address when present and
+    # nothing when absent, so emptiness is the test.
+    #
+    # Presence cannot itself distinguish a VRRP-held address from a static
+    # leftover -- they look identical. It is only meaningful because the
+    # keepalived-ntp role asserts, on both distros, that no static assignment
+    # survives: the play fails before reaching here if one does.
+    - name: Check if this server holds the IPv6 service address
+      ansible.builtin.command:
+        argv:
+          - ip
+          - -6
+          - addr
+          - show
+          - dev
+          - "{{ ntp_keepalived_interface }}"
+          - to
+          - "{{ ntp_vip6 }}"
+      register: vip6_check
+      failed_when: false
+      changed_when: false
+      when: ntp_keepalived_enabled | default(false)
+
+    - name: Display IPv6 service address status
+      ansible.builtin.debug:
+        msg: >
+          {% if vip6_check.stdout | default('') | length > 0 %}
+          This server ({{ inventory_hostname }}) holds the IPv6 service address
+          {{ ntp_vip6 }} -- it is the v6 MASTER and is serving ntp.srv.renner.uno
+          {% else %}
+          This server ({{ inventory_hostname }}) does not hold {{ ntp_vip6 }}.
+          Expected on a v6 BACKUP. If NO host holds it, check_ntp is failing
+          everywhere -- inspect `chronyc tracking` and
+          /var/log/keepalived-ntp-health.log
+          {% endif %}
+      when: ntp_keepalived_enabled | default(false)
+
     - name: Report hosts serving NTP without participating in the VIP
       ansible.builtin.debug:
         msg: >

ansible/plays/install-power-meter.yml

@@ -0,0 +1,14 @@
+---
+# Power-meter reader (sml2mqtt) for hosts with the FTDI serial meter head
+# attached.
+#
+# Targets [power_meter]: membership means the meter head is physically present.
+#
+# Requires the base play (plays/install-edge-host.yml) to have run: it needs
+# docker and publishes to the local MQTT bridge.
+- name: Install power-meter reader
+  hosts: power_meter
+  become: true
+
+  roles:
+    - power-meter-sml

ansible/plays/install-zwave-gateway.yml

@@ -0,0 +1,15 @@
+---
+# Z-Wave gateway (zwave-js-ui) for hosts with the ZWA-2 USB radio attached.
+#
+# Targets [zwave_gateway]: membership means the radio is physically present.
+# Moving the stick to another edge host is a one-line inventory change.
+#
+# Requires the base play (plays/install-edge-host.yml) to have run: it needs
+# docker, and the flash-wear handling that the libeatmydata preload exists to
+# complement.
+- name: Install Z-Wave gateway
+  hosts: zwave_gateway
+  become: true
+
+  roles:
+    - zwave-gateway

ansible/roles/chrony-ntp-server/defaults/main.yml

@@ -1,9 +1,25 @@
 ---
 # Chrony NTP Server Role Defaults
 
-# Networks allowed to use this server as NTP source
+# Networks allowed to use this server as NTP source.
+#
+# BOTH families are required. IPv6 is the primary address family here -- the
+# service address ntp.srv.renner.uno resolves to fd40::123 -- so an IPv4-only
+# allow list refuses every client that uses the documented name.
+#
+# The hosts carried `allow fd00::/8` for a long time without it ever being in
+# this file. Applying the role on 2026-08-07 rendered the template over it and
+# dropped the line on all four NTP servers at once, which took internal NTP
+# down over IPv6 until it was added here. Same class of untracked host state as
+# the anycast service address, and the same failure: config that exists only on
+# the box survives right up until something re-renders it.
 chrony_allowed_networks:
   - "10.2.0.0/16"
+  - "fd00::/8"
+  # Link-local. A client on the same segment may source its query from fe80::,
+  # and without this chrony refuses it -- the request arrives and is dropped,
+  # which looks like the server being unreachable rather than a policy refusal.
+  - "fe80::/10"
 
 # Primary NTP servers (PTB - Physikalisch-Technische Bundesanstalt, Stratum 1)
 chrony_upstream_servers:

ansible/roles/claude-workstation/RUNBOOK.md

@@ -118,8 +118,11 @@ After the `kubernetes/apps/claude-workstation/` PR merges and Flux reconciles:
 NS=apps
 TOKEN=$(kubectl -n $NS get secret claude-workstation-token -o jsonpath='{.data.token}' | base64 -d)
 kubectl -n $NS get secret claude-workstation-token -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt
-# server = the API endpoint reachable over the site-to-site route (a CP node or VIP):
-kubectl config set-cluster homelab --server=https://10.2.40.201:6443 \
+# server = the cluster's stable API endpoint (kubernetes/talos/patches/cluster.yaml).
+# Use the name, not an address: it is what the API server certificate carries as a
+# SAN, so an IP here fails TLS verification even when it is reachable. It must
+# resolve from the workstation over the site-to-site route.
+kubectl config set-cluster homelab --server=https://k8s.renner.uno:6443 \
   --certificate-authority=/tmp/ca.crt --embed-certs=true --kubeconfig=/tmp/claude-ws.kubeconfig
 kubectl config set-credentials claude-workstation --token="$TOKEN" --kubeconfig=/tmp/claude-ws.kubeconfig
 kubectl config set-context homelab --cluster=homelab --user=claude-workstation --kubeconfig=/tmp/claude-ws.kubeconfig

ansible/roles/edge-flash-wear/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+# Flash-wear mitigation.
+
+# --- Logging & eMMC wear mitigation ------------------------------------
+# edge-1 runs on a small internal eMMC (Dell Wyse 3040, 7.3 GB), so logs are
+# kept off local flash: containers + native services log to a RAM-only
+# journal and Grafana Alloy ships it to Loki. TRIM, noatime and a weekly
+# wear check round out the flash-longevity measures. See README "Logging &
+# eMMC".
+edge_journald_runtime_max: "128M"     # cap the volatile (RAM) journal
+
+# Container stdout -> journal, no json log files on the flash. The journal
+# itself is volatile (see the tasks above), so container logs land in RAM and
+# are shipped off the box by edge-log-shipper.
+docker_log_driver: journald

ansible/roles/edge-flash-wear/files/edge-emmc-health

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# edge-1 eMMC wear/health check. Managed by roles/edge-host.
+# edge-1 eMMC wear/health check. Managed by roles/edge-flash-wear.
 #
 # Reads the JEDEC eMMC 5.x life-time and pre-EOL estimators exposed via sysfs
 # and emits a warning-priority journal message when the flash leaves the

ansible/roles/edge-flash-wear/handlers/main.yml

@@ -0,0 +1,17 @@
+---
+- name: Restart journald
+  ansible.builtin.service:
+    name: systemd-journald
+    state: restarted
+
+# Handlers run in definition order, so this fires after 'Restart journald':
+# once the journal is volatile, the on-disk store is dead weight on the flash.
+- name: Purge persistent journal store
+  ansible.builtin.file:
+    path: /var/log/journal
+    state: absent
+
+- name: Restart docker
+  ansible.builtin.service:
+    name: docker
+    state: restarted

ansible/roles/edge-flash-wear/tasks/main.yml

@@ -0,0 +1,100 @@
+---
+# Flash-wear mitigation for hosts on small eMMC (Dell Wyse 3040 and similar).
+#
+# journald -> volatile (RAM) and size-capped, root mounted noatime+lazytime,
+# periodic TRIM, and a weekly wear check. Shipping the volatile journal off the
+# box is a separate concern -- see the edge-log-shipper role.
+- name: Install mmc-utils
+  ansible.builtin.package:
+    name: mmc-utils      # eMMC lifetime/EOL introspection (mmc extcsd read)
+    state: present
+
+- name: Ensure journald drop-in directory exists
+  ansible.builtin.file:
+    path: /etc/systemd/journald.conf.d
+    state: directory
+    mode: "0755"
+
+- name: Switch the systemd journal to volatile (RAM) storage
+  ansible.builtin.template:
+    src: journald-edge.conf.j2
+    dest: /etc/systemd/journald.conf.d/00-edge-emmc.conf
+    mode: "0644"
+  notify:
+    - Restart journald
+    - Purge persistent journal store
+
+- name: Resolve root filesystem facts (for noatime)
+  ansible.builtin.set_fact:
+    edge_root_fs: "{{ ansible_facts.mounts | selectattr('mount', 'equalto', '/') | first }}"
+
+- name: Refuse to touch fstab without a stable root UUID
+  ansible.builtin.assert:
+    that:
+      - edge_root_fs.uuid | default('') | length > 0
+    fail_msg: "Could not determine root UUID from facts; not rewriting fstab."
+
+# lazytime batches inode-timestamp writeback (e.g. the zwave-js lockfile
+# heartbeat that otherwise dirties the journal every couple seconds); noatime
+# drops access-time writes. Neither weakens data durability.
+- name: Mount root with noatime + lazytime (persisted in fstab)
+  ansible.posix.mount:
+    path: /
+    src: "UUID={{ edge_root_fs.uuid }}"
+    fstype: "{{ edge_root_fs.fstype }}"
+    opts: "{{ ((edge_root_fs.options.split(',') | reject('in', ['atime', 'noatime', 'relatime', 'diratime', 'lazytime', 'nolazytime']) | list) + ['noatime', 'lazytime']) | unique | join(',') }}"
+    dump: "0"
+    passno: "1"   # root fs — keep boot-time fsck ordering
+    backup: true
+    state: mounted
+
+- name: Enable periodic TRIM (helps eMMC wear-leveling)
+  ansible.builtin.systemd:
+    name: fstrim.timer
+    enabled: true
+    state: started
+
+- name: Install eMMC health-check script
+  ansible.builtin.copy:
+    src: edge-emmc-health
+    dest: /usr/local/bin/edge-emmc-health
+    mode: "0755"
+
+- name: Install eMMC health-check service + timer
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/etc/systemd/system/{{ item }}"
+    mode: "0644"
+  loop:
+    - edge-emmc-health.service
+    - edge-emmc-health.timer
+
+- name: Enable eMMC health-check timer
+  ansible.builtin.systemd:
+    name: edge-emmc-health.timer
+    enabled: true
+    state: started
+    daemon_reload: true
+
+# Container stdout into the journal instead of json files on disk. This lives
+# here, with the rest of the flash-wear handling, rather than in docker-install:
+# that role is shared by ten other plays (authentik, n8n, owncloud, grist,
+# netbird, gatus, music-assistant, ical-proxy), none of which have a
+# daemon.json today. Adding it there would have created one on the next run of
+# any of those plays and restarted every container on those hosts.
+#
+# /etc/docker is created explicitly because this role runs before
+# docker-install on a first bootstrap, so the directory may not exist yet. The
+# handler runs at the end of the play, by which time docker is installed.
+- name: Ensure the docker config directory exists
+  ansible.builtin.file:
+    path: /etc/docker
+    state: directory
+    mode: "0755"
+
+- name: Route container logs to the journal (keeps json logs off the flash)
+  ansible.builtin.template:
+    src: docker-daemon.json.j2
+    dest: /etc/docker/daemon.json
+    mode: "0644"
+  notify: Restart docker

ansible/roles/edge-flash-wear/templates/docker-daemon.json.j2

@@ -0,0 +1,3 @@
+{
+  "log-driver": "{{ docker_log_driver }}"
+}

ansible/roles/edge-flash-wear/templates/journald-edge.conf.j2

@@ -1,4 +1,4 @@
-# Managed by roles/edge-host. edge-1 boots off a small internal eMMC, so the
+# Managed by roles/edge-flash-wear. edge-1 boots off a small internal eMMC, so the
 # journal must not persist to flash: keep it in RAM (/run/log/journal) and cap
 # its size. Grafana Alloy (edge-alloy.service) ships this journal to Loki
 # before it rotates out of RAM — nothing durable lives here.

ansible/roles/edge-host/defaults/main.yml

@@ -1,118 +0,0 @@
----
-edge_base_dir: /opt/edge-host
-edge_tz: Europe/Berlin
-
-# --- Logging & eMMC wear mitigation ------------------------------------
-# edge-1 runs on a small internal eMMC (Dell Wyse 3040, 7.3 GB), so logs are
-# kept off local flash: containers + native services log to a RAM-only
-# journal and Grafana Alloy ships it to Loki. TRIM, noatime and a weekly
-# wear check round out the flash-longevity measures. See README "Logging &
-# eMMC".
-edge_journald_runtime_max: "128M"     # cap the volatile (RAM) journal
-edge_docker_log_driver: journald      # container stdout -> journal, no json logs on eMMC
-
-# Grafana Alloy log shipper. The srv-network Loki (loki.srv.renner.uno:3100,
-# no auth) is firewalled off the IoT VLAN; the only endpoint edge-1 can reach
-# is the authenticated cluster ingress (Traefik basic-auth).
-edge_alloy_config_file: /etc/alloy/edge.alloy
-edge_alloy_http_port: 12345
-edge_alloy_bin: /usr/bin/grafana-alloy   # Arch `grafana-alloy` pkg names the binary this, not `alloy`
-edge_loki_push_url: "https://loki.renner.uno/loki/api/v1/push"
-edge_loki_username: edge-1
-edge_alloy_labels:
-  environment: production
-  datacenter: homelab
-
-# --- MQTT: edge clients (open3e, e3oncan, sml2mqtt) publish to a LOCAL
-# mosquitto on loopback, which bridges to the central cluster broker over TLS
-# (open3e/e3oncan have no native MQTTS). This keeps plaintext on loopback only
-# — off the untrusted IoT VLAN — and buffers telemetry in RAM during cluster
-# blips. The local broker writes nothing to the eMMC (persistence off, logs to
-# the volatile journal). See edge-mqtt-bridge.conf.j2 and README "MQTT bridge".
-edge_mqtt_host: 127.0.0.1
-edge_mqtt_port: 1883
-# Upstream cluster broker the local bridge connects to (TLS; the public
-# Let's Encrypt cert is validated against the system CA bundle).
-edge_mqtt_cluster_host: mqtt.renner.uno
-edge_mqtt_cluster_tls_port: 8883
-edge_mqtt_bridge_cafile: /etc/ssl/certs/ca-certificates.crt
-
-# --- USB devices (stable by-id symlinks). After physically moving the
-# sticks to edge-1, verify with `ls -l /dev/serial/by-id/` — the by-id
-# names travel with the device, not the host, so these should not change.
-edge_zwave_device: /dev/serial/by-id/usb-Nabu_Casa_ZWA-2_80B54EE15720-if00
-edge_stromzaehler_device: /dev/serial/by-id/usb-FTDI_FT230X_Basic_UART_DK0E1GP5-if00-port0
-
-# --- Images. Versions mirror the k8s manifests at migration time.
-# sml2mqtt stays hand-pinned (critical meter bridge — was deliberately
-# excluded from image-automation in k8s, keep that property here).
-edge_zwavejs_image: ghcr.io/zwave-js/zwave-js-ui:11.21.1
-edge_sml2mqtt_image: spacemanspiff2007/sml2mqtt:3.6.0
-# Alpine version the zwave-js-ui image is built on — the source for the musl
-# libeatmydata.so preloaded into that container (see tasks "Extract musl
-# libeatmydata.so"). Keep in sync with the base if edge_zwavejs_image bumps
-# its Alpine major (check: docker exec zwave-js cat /etc/os-release).
-edge_zwave_alpine_base: alpine:3.22
-
-# --- CAN / open3e (Viessmann E3 external bus) ---
-edge_can_interface: can0
-edge_can_bitrate: 250000
-edge_open3e_pkg: git+https://github.com/open3e/open3e.git
-edge_open3e_mqtt_user: open3e
-edge_open3e_mqtt_topic: open3e
-edge_open3e_mqtt_format: "{device}_{didNumber:04d}_{didName}"
-edge_open3e_poll_seconds: 30
-# Read-only datapoint set (Phase 1 extended set, established 2026-07-02 on
-# the commissioning workstation; see vican repo CLAUDE.md for the rationale).
-# NO -w / write DIDs here — live heating + battery, writes are Phase 3.
-# vx3.266 = ErrorDtcHistory (O3EList) — the VX3 fault log; polled to catch
-# recurrences of FailureCommunicationEnergyMeter (the E380 energy-meter link
-# the internal PV-surplus EMS depends on). Decodes via the master O3EList
-# codec inherited through the vx3plus overlay.
-# vitocal.543/2350/2543/2560: SmartGrid-/EMS-Status-Beobachtung (2026-07-06)
-# — klärt, ob die Eigenstromoptimierung (EMS) bei PV-Überschuss von selbst
-# den WW-Boost auslöst (2543.2 steht laut Scan bereits auf +10 K), bevor
-# SG-Ready-Verdrahtung oder andere Trigger gebaut werden. Alle vier ro.
-# vitocal.259/260 = InfoDtcList/InfoDtcHistory (O3EList) — the HPMU event log,
-# the Vitocal-side counterpart to vx3.266. Both are capped lists (2 and 9
-# entries when added), so the multi-frame read is cheap at a 30 s poll.
-# Records faults/info events only (NormalOperation, LagDeviceDtcReported,
-# LegionellaProtectionTemperatureReached) — NOT setpoint or program changes.
-edge_open3e_datapoints: >-
-  vitocal.259,vitocal.260,vitocal.268,vitocal.269,vitocal.271,vitocal.274,vitocal.286,vitocal.288,vitocal.318,vitocal.321,vitocal.324,vitocal.335,vitocal.336,vitocal.396,vitocal.402,vitocal.403,vitocal.476,vitocal.477,vitocal.543,vitocal.548,vitocal.565,vitocal.1007,vitocal.1043,vitocal.1190,vitocal.1211,vitocal.1391,vitocal.1416,vitocal.1417,vitocal.2320,vitocal.2346,vitocal.2350,vitocal.2351,vitocal.2352,vitocal.2369,vitocal.2370,vitocal.2486,vitocal.2487,vitocal.2488,vitocal.2543,vitocal.2560,vitocal.2622,vitocal.2624,vitocal.2625,vitocal.2735,vitocal.3016,vx3.266,vx3.378,vx3.379,vx3.380,vx3.535,vx3.1603,vx3.1664,vx3.1690,vx3.1801,vx3.1802,vx3.1810,vx3.1828,vx3.1830,vx3.1577,vx3.1578,vx3.1579,vx3.1580,vx3.1581,vx3.1582,vx3.1834,vx3.1836,vx3.2214,vx3.2240,vx3.3085,vx3.3086,vx3.3087,vx3.3088,vx3.3089,vx3.3090,vcmu.320,vcmu.322,vcmu.325,vcmu.355,vcmu.389,vcmu.391,vcmu.1772,vcmu.1773,vcmu.1775,vcmu.1776,vcmu.2256,vcmu.2259,vcmu.2333,vcmu.2334,vcmu.2569,vcmu.2571,vitocal.2791
-# ECU addresses; -dev selects codec set, tx selects the UDS address.
-# vcmu (refrigerant-circuit controller) has no dedicated codec set —
-# omitting dpList makes open3e fall back to the generic datapoint list,
-# which decodes all polled VCMU DIDs.
-edge_open3e_devices:
-  vitocal: { tx: "0x680", dpList: "vcal" }
-  # dpList als Pfad: Overlay-Datei mit den Batteriemodul-DIDs (siehe
-  # files/open3e-vx3plus.py) — die Stock-vx3-Liste filtert sie sonst weg.
-  vx3: { tx: "0x6a1", dpList: "/opt/edge-host/open3e/vx3plus.py" }
-  vcmu: { tx: "0x68c" }
-
-# --- E3onCAN: passive E380 energy-meter listener (no bus writes, so it
-# coexists with the single open3e instance). The meter broadcasts at
-# ~5 Hz; the gap throttles MQTT to one update per DID per interval.
-edge_e3oncan_repo: https://github.com/MyHomeMyData/E3onCAN.git
-edge_e3oncan_version: 461dcbdf97e8d72d2edb9929c63b39382af6c3a1  # V0.5.2
-edge_e3oncan_gap_seconds: 10
-edge_e3oncan_mqtt_format: "{device}_{didNumber:04d}_{didName}"
-
-# --- Secrets: define these in inventory/group_vars/edge_host/vault.yml
-# (ansible-vault). See README.md for the kubectl one-liners that read the
-# current values out of the cluster during migration.
-# edge_sml2mqtt_mqtt_password: "{{ vault_edge_sml2mqtt_mqtt_password }}"
-# edge_open3e_mqtt_password: "{{ vault_edge_open3e_mqtt_password }}"
-# edge_zwavejs_session_secret: "{{ vault_edge_zwavejs_session_secret }}"
-
-# --- Tagged VLAN 40 sub-interface. Off by default; enabled in
-# inventory/group_vars/edge_host. Exists so edge-1 can join the NTP keepalived
-# VRRP group, which needs layer-2 adjacency with the other members on the
-# service VLAN. The untagged VLAN 30 lease stays this host's only default
-# route -- see templates/10-vlan40.network.j2.
-edge_vlan40_enabled: false
-edge_vlan40_parent: enp1s0
-edge_vlan40_id: 40
-edge_vlan40_name: enp1s0.40
-edge_vlan40_parent_network: 20-wired.network

ansible/roles/edge-host/handlers/main.yml

@@ -1,66 +0,0 @@
----
-# reload alone only re-reads config files; existing links keep their old
-# state until reconfigured.
-- name: Reload networkd
-  ansible.builtin.shell:
-    cmd: networkctl reload && networkctl reconfigure {{ edge_can_interface }}
-  changed_when: true
-
-# Reconfiguring the parent is what actually materialises the VLAN child -- a
-# bare reload leaves the existing link as-is (see above). This re-runs DHCP on
-# enp1s0, which is this headless host's only path to the network, so it is the
-# one genuinely risky step in the VLAN change.
-- name: Reload networkd for VLAN
-  ansible.builtin.shell:
-    cmd: networkctl reload && networkctl reconfigure {{ edge_vlan40_parent }}
-  changed_when: true
-
-# Ordered before 'Restart edge compose services': the daemon must pick up the
-# new default log driver before the containers are recreated onto it.
-- name: Restart docker
-  ansible.builtin.service:
-    name: docker
-    state: restarted
-
-- name: Restart journald
-  ansible.builtin.service:
-    name: systemd-journald
-    state: restarted
-
-# Handlers run in definition order, so this fires after 'Restart journald':
-# once the journal is volatile, the on-disk store is dead weight on the eMMC.
-- name: Purge persistent journal store
-  ansible.builtin.file:
-    path: /var/log/journal
-    state: absent
-
-- name: Restart alloy
-  ansible.builtin.systemd:
-    name: edge-alloy
-    state: restarted
-    daemon_reload: true
-
-# Ordered before the MQTT clients (compose/open3e/e3oncan) so they reconnect
-# to a freshly-configured local broker.
-- name: Restart mosquitto
-  ansible.builtin.service:
-    name: mosquitto
-    state: restarted
-
-- name: Restart edge compose services
-  ansible.builtin.command:
-    cmd: docker compose up -d --force-recreate
-    chdir: "{{ edge_base_dir }}"
-  changed_when: true
-
-- name: Restart open3e
-  ansible.builtin.systemd:
-    name: open3e
-    state: restarted
-    daemon_reload: true
-
-- name: Restart e3oncan
-  ansible.builtin.systemd:
-    name: e3oncan
-    state: restarted
-    daemon_reload: true

ansible/roles/edge-host/tasks/main.yml

@@ -1,440 +0,0 @@
----
-# Arch edge host: zwave-js-ui + sml2mqtt as docker compose services,
-# open3e natively (venv + systemd) because it needs a SocketCAN interface,
-# which is host network state, not something to hide in a container.
-# Docker itself comes from the docker-install role (Arch-aware).
-
-- name: Install base packages
-  ansible.builtin.package:
-    name:
-      - python
-      - python-packaging  # ansible's pip module imports it on the target
-      - git
-      - mmc-utils      # eMMC lifetime/EOL introspection (mmc extcsd read)
-      - grafana-alloy  # log shipper -> Loki (see Alloy section below)
-      - mosquitto      # local MQTT bridge broker -> cluster over TLS
-    state: present
-
-# --- Local MQTT bridge broker. Edge clients publish to this over loopback;
-# it bridges to the cluster broker over TLS (open3e/e3oncan can't do MQTTS).
-# Configured with persistence off + stdout logging so it writes nothing to the
-# eMMC. Deployed before the clients so they have somewhere to connect.
-# See edge-mqtt-bridge.conf.j2 / README "MQTT bridge".
-- name: Deploy local mosquitto bridge config
-  ansible.builtin.template:
-    src: edge-mqtt-bridge.conf.j2
-    dest: /etc/mosquitto/mosquitto.conf
-    owner: root
-    group: mosquitto
-    mode: "0640"   # carries the cluster bridge credentials
-  notify: Restart mosquitto
-
-- name: Enable local mosquitto bridge
-  ansible.builtin.systemd:
-    name: mosquitto
-    enabled: true
-    state: started
-
-# ======================================================================
-# eMMC wear mitigation + log shipping. edge-1 (Dell Wyse 3040) runs on a
-# small internal eMMC, so logs must not churn local flash. Strategy:
-#   - journald -> volatile (RAM), size-capped        (journald-edge.conf)
-#   - docker   -> journald log driver, no json files (docker-daemon.json)
-#   - Grafana Alloy tails the RAM journal -> Loki, WAL on tmpfs
-# plus TRIM, noatime and a weekly wear check for flash longevity.
-# See roles/edge-host/README.md "Logging & eMMC".
-# ======================================================================
-
-- name: Ensure journald drop-in directory exists
-  ansible.builtin.file:
-    path: /etc/systemd/journald.conf.d
-    state: directory
-    mode: "0755"
-
-- name: Switch the systemd journal to volatile (RAM) storage
-  ansible.builtin.template:
-    src: journald-edge.conf.j2
-    dest: /etc/systemd/journald.conf.d/00-edge-emmc.conf
-    mode: "0644"
-  notify:
-    - Restart journald
-    - Purge persistent journal store
-
-- name: Resolve root filesystem facts (for noatime)
-  ansible.builtin.set_fact:
-    edge_root_fs: "{{ ansible_facts.mounts | selectattr('mount', 'equalto', '/') | first }}"
-
-- name: Refuse to touch fstab without a stable root UUID
-  ansible.builtin.assert:
-    that:
-      - edge_root_fs.uuid | default('') | length > 0
-    fail_msg: "Could not determine root UUID from facts; not rewriting fstab."
-
-# lazytime batches inode-timestamp writeback (e.g. the zwave-js lockfile
-# heartbeat that otherwise dirties the journal every couple seconds); noatime
-# drops access-time writes. Neither weakens data durability.
-- name: Mount root with noatime + lazytime (persisted in fstab)
-  ansible.posix.mount:
-    path: /
-    src: "UUID={{ edge_root_fs.uuid }}"
-    fstype: "{{ edge_root_fs.fstype }}"
-    opts: "{{ ((edge_root_fs.options.split(',') | reject('in', ['atime', 'noatime', 'relatime', 'diratime', 'lazytime', 'nolazytime']) | list) + ['noatime', 'lazytime']) | unique | join(',') }}"
-    dump: "0"
-    passno: "1"   # root fs — keep boot-time fsck ordering
-    backup: true
-    state: mounted
-
-- name: Enable periodic TRIM (helps eMMC wear-leveling)
-  ansible.builtin.systemd:
-    name: fstrim.timer
-    enabled: true
-    state: started
-
-- name: Install eMMC health-check script
-  ansible.builtin.copy:
-    src: edge-emmc-health
-    dest: /usr/local/bin/edge-emmc-health
-    mode: "0755"
-
-- name: Install eMMC health-check service + timer
-  ansible.builtin.copy:
-    src: "{{ item }}"
-    dest: "/etc/systemd/system/{{ item }}"
-    mode: "0644"
-  loop:
-    - edge-emmc-health.service
-    - edge-emmc-health.timer
-
-- name: Enable eMMC health-check timer
-  ansible.builtin.systemd:
-    name: edge-emmc-health.timer
-    enabled: true
-    state: started
-    daemon_reload: true
-
-# --- Grafana Alloy: ship the volatile journal to Loki. Container logs reach
-# the journal via docker's journald driver (configured below), native
-# services log to the journal directly, so a single journal source covers
-# everything. Storage/WAL sits on /run (tmpfs) — see edge-alloy.service.
-- name: Create alloy system group
-  ansible.builtin.group:
-    name: alloy
-    system: true
-
-- name: Create alloy system user
-  ansible.builtin.user:
-    name: alloy
-    group: alloy
-    groups: systemd-journal
-    system: true
-    create_home: false
-    shell: /usr/bin/nologin
-
-- name: Create alloy config directory
-  ansible.builtin.file:
-    path: /etc/alloy
-    state: directory
-    owner: alloy
-    group: alloy
-    mode: "0750"
-
-- name: Deploy alloy config (journal -> Loki)
-  ansible.builtin.template:
-    src: edge-alloy.alloy.j2
-    dest: "{{ edge_alloy_config_file }}"
-    owner: alloy
-    group: alloy
-    mode: "0600"   # carries the Loki basic-auth password
-  notify: Restart alloy
-
-- name: Deploy alloy systemd unit
-  ansible.builtin.template:
-    src: edge-alloy.service.j2
-    dest: /etc/systemd/system/edge-alloy.service
-    mode: "0644"
-  notify: Restart alloy
-
-- name: Enable edge-alloy
-  ansible.builtin.systemd:
-    name: edge-alloy
-    enabled: true
-    state: started
-    daemon_reload: true
-
-# --- SocketCAN: systemd-networkd owns can0. gs_usb is an in-tree module
-# and autoloads when the Innomaker adapter enumerates; networkd then
-# matches the interface and applies bitrate + up. RestartSec recovers the
-# link after bus-off without manual intervention.
-- name: Configure can0 via systemd-networkd
-  ansible.builtin.template:
-    src: 80-can0.network.j2
-    dest: /etc/systemd/network/80-can0.network
-    mode: "0644"
-  notify: Reload networkd
-
-# --- Tagged VLAN 40. Additive by construction: the parent link keeps its own
-# .network file untouched and gains the VLAN via a drop-in, so reverting is a
-# matter of deleting these three paths. This host is headless and enp1s0 is its
-# only route to the network, hence the caution.
-- name: Create VLAN sub-interface netdev
-  ansible.builtin.template:
-    src: 10-vlan40.netdev.j2
-    dest: "/etc/systemd/network/10-{{ edge_vlan40_name }}.netdev"
-    mode: "0644"
-  when: edge_vlan40_enabled
-  notify: Reload networkd for VLAN
-  tags: [vlan40]
-
-- name: Configure VLAN sub-interface addressing
-  ansible.builtin.template:
-    src: 10-vlan40.network.j2
-    dest: "/etc/systemd/network/10-{{ edge_vlan40_name }}.network"
-    mode: "0644"
-  when: edge_vlan40_enabled
-  notify: Reload networkd for VLAN
-  tags: [vlan40]
-
-- name: Ensure parent network drop-in directory exists
-  ansible.builtin.file:
-    path: "/etc/systemd/network/{{ edge_vlan40_parent_network }}.d"
-    state: directory
-    mode: "0755"
-  when: edge_vlan40_enabled
-  tags: [vlan40]
-
-- name: Attach VLAN to parent link via drop-in
-  ansible.builtin.template:
-    src: vlan40-parent-dropin.conf.j2
-    dest: "/etc/systemd/network/{{ edge_vlan40_parent_network }}.d/10-vlan40.conf"
-    mode: "0644"
-  when: edge_vlan40_enabled
-  notify: Reload networkd for VLAN
-  tags: [vlan40]
-
-- name: Enable systemd-networkd
-  ansible.builtin.service:
-    name: systemd-networkd
-    state: started
-    enabled: true
-
-# Docker networking needs no daemon.json (both services use network_mode:
-# host — real addresses, v4+v6, no bridge/NAT). The daemon.json below exists
-# only to route container stdout into the journald log driver so json logs
-# never touch the eMMC; the journal itself is volatile (RAM) and shipped to
-# Loki by edge-alloy. Both compose services inherit this default driver.
-- name: Configure docker daemon (journald log driver, eMMC-friendly)
-  ansible.builtin.template:
-    src: docker-daemon.json.j2
-    dest: /etc/docker/daemon.json
-    mode: "0644"
-  notify:
-    - Restart docker
-    - Restart edge compose services
-
-# --- Directory layout ---
-- name: Create service directories
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-    mode: "0755"
-  loop:
-    - "{{ edge_base_dir }}"
-    - "{{ edge_base_dir }}/zwave-js/store"
-    - "{{ edge_base_dir }}/sml2mqtt"
-
-# --- zwave-js eMMC write reduction: batch fsync via libeatmydata ---------
-# zwave-js persists its value DB with an fsync on *every* value change
-# (jsonl-db, throttleFS unset by zwave-js-ui). On a chatty network that
-# fsync storm churns the eMMC (~2.6 GiB/day for ~0.1 KiB/s of real data).
-# Preloading libeatmydata makes fsync a no-op so the kernel batches the
-# writes via normal writeback — full HA data resolution and cache
-# persistence are untouched (see docker-compose.yml.j2 for the mount + env).
-# The .so must match the zwave-js-ui image's musl/Alpine base, so extract it
-# from that exact Alpine version (bridge networking is broken on this host,
-# hence --network=host). Refresh by deleting the .so if the base ever bumps
-# its Alpine major version.
-- name: Extract musl libeatmydata.so (matches the zwave-js-ui Alpine base)
-  ansible.builtin.shell:
-    cmd: |
-      set -euo pipefail
-      tmp="$(mktemp)"
-      trap 'rm -f "$tmp"' EXIT
-      docker run --rm --network=host {{ edge_zwave_alpine_base }} \
-        sh -c 'apk add --no-cache libeatmydata >/dev/null 2>&1 && cat /usr/lib/libeatmydata.so' > "$tmp"
-      test "$(stat -c%s "$tmp")" -ge 8000   # sanity: real .so is ~14 KB, guards against a failed/empty pull
-      install -m 0644 "$tmp" {{ edge_base_dir }}/zwave-js/libeatmydata.so
-    creates: "{{ edge_base_dir }}/zwave-js/libeatmydata.so"
-  notify: Restart edge compose services
-
-# Because fsync is neutralized, a hard power-loss during the (rare) settings
-# write could truncate settings.json — which holds the Z-Wave network keys.
-# Keep a validated rolling backup on the eMMC so the keys stay recoverable.
-- name: Install zwave-js settings.json backup script
-  ansible.builtin.template:
-    src: edge-zwave-settings-backup.j2
-    dest: /usr/local/bin/edge-zwave-settings-backup
-    mode: "0755"
-
-- name: Install zwave-js settings backup service + timer
-  ansible.builtin.copy:
-    src: "{{ item }}"
-    dest: "/etc/systemd/system/{{ item }}"
-    mode: "0644"
-  loop:
-    - edge-zwave-settings-backup.service
-    - edge-zwave-settings-backup.timer
-
-- name: Enable zwave-js settings backup timer
-  ansible.builtin.systemd:
-    name: edge-zwave-settings-backup.timer
-    enabled: true
-    state: started
-    daemon_reload: true
-
-# --- Compose services: zwave-js-ui + sml2mqtt ---
-- name: Deploy docker-compose.yml
-  ansible.builtin.template:
-    src: docker-compose.yml.j2
-    dest: "{{ edge_base_dir }}/docker-compose.yml"
-    mode: "0644"
-  notify: Restart edge compose services
-
-- name: Deploy zwave-js env (session secret)
-  ansible.builtin.template:
-    src: zwavejs.env.j2
-    dest: "{{ edge_base_dir }}/zwavejs.env"
-    mode: "0600"
-  notify: Restart edge compose services
-
-# sml2mqtt reads only a config file and has no env override for the
-# password, so the rendered config carries it — 0600, root-owned, same
-# trust boundary as the k8s init-container approach it replaces.
-- name: Deploy sml2mqtt config
-  ansible.builtin.template:
-    src: sml2mqtt-config.yml.j2
-    dest: "{{ edge_base_dir }}/sml2mqtt/config.yml"
-    mode: "0600"
-  notify: Restart edge compose services
-
-- name: Pull compose images
-  ansible.builtin.command:
-    cmd: docker compose pull
-    chdir: "{{ edge_base_dir }}"
-  changed_when: false
-
-# Tolerates missing USB devices: before the physical cutover the ZWA-2 /
-# FTDI sticks are still on the old k8s-edge VM, and a container whose
-# device is absent must not block the rest of the role (open3e/CAN moves
-# first). Re-run the play — or `docker compose up -d` — after each stick
-# arrives.
-- name: Start compose services
-  ansible.builtin.command:
-    cmd: docker compose up -d
-    chdir: "{{ edge_base_dir }}"
-  register: compose_up
-  failed_when: >-
-    compose_up.rc != 0
-    and 'error gathering device information' not in compose_up.stderr
-  changed_when: >-
-    'Started' in compose_up.stderr or 'Created' in compose_up.stderr
-    or 'Started' in compose_up.stdout or 'Creating' in compose_up.stdout
-
-- name: Warn about containers waiting for their USB device
-  ansible.builtin.debug:
-    msg: >-
-      docker compose could not start every service (USB device not present
-      yet — expected before cutover): {{ compose_up.stderr_lines | select('search', 'device') | list }}
-  when: compose_up.rc != 0
-
-# --- open3e: native install. CAN_RAW sockets need no capabilities, so
-# the service runs as an unprivileged system user.
-- name: Create open3e system user
-  ansible.builtin.user:
-    name: open3e
-    system: true
-    create_home: false
-    shell: /usr/bin/nologin
-
-# Owned by the service user: udsoncan writes its log file into the
-# working directory.
-- name: Create open3e directory
-  ansible.builtin.file:
-    path: "{{ edge_base_dir }}/open3e"
-    state: directory
-    owner: open3e
-    group: open3e
-    mode: "0755"
-
-- name: Install open3e into a venv
-  ansible.builtin.pip:
-    name: "{{ edge_open3e_pkg }}"
-    virtualenv: "{{ edge_base_dir }}/open3e/venv"
-    virtualenv_command: python -m venv
-  notify: Restart open3e
-
-- name: Deploy open3e vx3 datapoint overlay (battery-module DIDs)
-  ansible.builtin.copy:
-    src: open3e-vx3plus.py
-    dest: "{{ edge_base_dir }}/open3e/vx3plus.py"
-    mode: "0644"
-  notify: Restart open3e
-
-- name: Deploy open3e devices.json
-  ansible.builtin.copy:
-    content: "{{ edge_open3e_devices | to_nice_json }}\n"
-    dest: "{{ edge_base_dir }}/open3e/devices.json"
-    mode: "0644"
-  notify: Restart open3e
-
-- name: Deploy open3e environment (broker credential)
-  ansible.builtin.template:
-    src: open3e.env.j2
-    dest: "{{ edge_base_dir }}/open3e/open3e.env"
-    owner: open3e
-    mode: "0600"
-  notify: Restart open3e
-
-- name: Deploy open3e systemd unit
-  ansible.builtin.template:
-    src: open3e.service.j2
-    dest: /etc/systemd/system/open3e.service
-    mode: "0644"
-  notify: Restart open3e
-
-- name: Enable open3e
-  ansible.builtin.systemd:
-    name: open3e
-    enabled: true
-    state: started
-    daemon_reload: true
-
-# --- E3onCAN: direct E380 meter reads (passive; per-review decision not
-# to trust the VX3's relayed meter values). Same broker user as open3e;
-# topics land under the same open3e/ prefix as e380_<did>_<name>.
-- name: Check out E3onCAN (pinned)
-  ansible.builtin.git:
-    repo: "{{ edge_e3oncan_repo }}"
-    dest: "{{ edge_base_dir }}/e3oncan/src"
-    version: "{{ edge_e3oncan_version }}"
-  notify: Restart e3oncan
-
-- name: Create E3onCAN venv with requirements
-  ansible.builtin.pip:
-    requirements: "{{ edge_base_dir }}/e3oncan/src/requirements.txt"
-    virtualenv: "{{ edge_base_dir }}/e3oncan/venv"
-    virtualenv_command: python -m venv
-  notify: Restart e3oncan
-
-- name: Deploy e3oncan systemd unit
-  ansible.builtin.template:
-    src: e3oncan.service.j2
-    dest: /etc/systemd/system/e3oncan.service
-    mode: "0644"
-  notify: Restart e3oncan
-
-- name: Enable e3oncan
-  ansible.builtin.systemd:
-    name: e3oncan
-    enabled: true
-    state: started
-    daemon_reload: true

ansible/roles/edge-host/templates/docker-compose.yml.j2

@@ -1,56 +0,0 @@
-# Managed by ansible (roles/edge-host). Mirrors the former k8s manifests:
-# kubernetes/apps/home-assistant-zwavejs/deployment.yaml and
-# kubernetes/apps/home-assistant/sml2mqtt-deployment.yaml.
-#
-# No `privileged` needed here: docker's --device handles the device-cgroup
-# grant that hostPath in k8s could not (that was the only reason the pods
-# ran privileged).
-# Both services use host networking: real host addresses (v4+v6), no
-# bridge, no NAT. The broker LB is IPv6-first and docker bridge NAT66 is
-# a tarpit (unmasqueraded SYNs die silently); the host stack just works.
-services:
-  zwave-js:
-    image: {{ edge_zwavejs_image }}
-    container_name: zwave-js
-    restart: unless-stopped
-    stop_signal: SIGINT
-    tty: true
-    environment:
-      - TZ={{ edge_tz }}
-      # Batch the value-DB fsync storm to spare the eMMC (see role tasks /
-      # README "Logging & eMMC"). Neutralizes fsync only for this container;
-      # the WS/MQTT value stream to HA and cache persistence are unchanged.
-      - LD_PRELOAD=/usr/lib/libeatmydata.so
-    env_file:
-      - zwavejs.env
-    devices:
-      - "{{ edge_zwave_device }}:/dev/zwave"
-    volumes:
-      # musl libeatmydata.so extracted from the image's Alpine base (ro)
-      - ./zwave-js/libeatmydata.so:/usr/lib/libeatmydata.so:ro
-      # Persistent store: settings.json, device DB, network keys. Seeded
-      # from the k8s PVC `zwavejs-store` at cutover (see README). Since
-      # this host is stateful there is no init-container merge step —
-      # settings.json is edited via the UI and persists here; zwave.port
-      # stays /dev/zwave.
-      - ./zwave-js/store:/usr/src/app/store
-    # Host networking: binds 3000 (Z-Wave JS websocket for HA) and 8091
-    # (web UI) directly on the host.
-    network_mode: host
-
-  sml2mqtt:
-    image: {{ edge_sml2mqtt_image }}
-    container_name: sml2mqtt
-    restart: unless-stopped
-    # Outbound-only (serial in, MQTT out) — host networking sidesteps the
-    # docker NAT66 gap: the broker LB is IPv6-first and bridge-network v6
-    # SYNs leave unmasqueraded and die. The host stack reaches fd99::81
-    # fine (open3e proves it continuously).
-    network_mode: host
-    # Serial exclusivity: this is the ONLY reader of the meter port —
-    # HA's edl21 integration stays disabled (see sml2mqtt-config comment
-    # history in the k8s repo).
-    devices:
-      - "{{ edge_stromzaehler_device }}:/dev/stromzaehler"
-    volumes:
-      - ./sml2mqtt/config.yml:/sml2mqtt/config.yml:ro

ansible/roles/edge-host/templates/docker-daemon.json.j2

@@ -1,3 +0,0 @@
-{
-  "log-driver": "{{ edge_docker_log_driver }}"
-}

ansible/roles/edge-host/templates/e3oncan.service.j2

@@ -1,32 +0,0 @@
-# Managed by ansible (roles/edge-host).
-# PASSIVE listener for the E380 energy meter's CANopen broadcasts — no
-# writes on the bus, so it may run alongside the (single) open3e
-# instance. Reads the meter directly instead of trusting the VX3's
-# relayed values.
-[Unit]
-Description=E3onCAN E380 energy-meter CAN listener (read-only)
-BindsTo=sys-subsystem-net-devices-{{ edge_can_interface }}.device
-# mosquitto.service = the local MQTT bridge broker e3oncan publishes to (loopback).
-After=sys-subsystem-net-devices-{{ edge_can_interface }}.device network-online.target mosquitto.service
-Wants=network-online.target mosquitto.service
-
-[Service]
-User=open3e
-EnvironmentFile={{ edge_base_dir }}/open3e/open3e.env
-WorkingDirectory={{ edge_base_dir }}/e3oncan
-# Journald-friendly (python block-buffers pipes; lost on restarts).
-Environment=PYTHONUNBUFFERED=1
-ExecStart={{ edge_base_dir }}/e3oncan/venv/bin/python {{ edge_base_dir }}/e3oncan/src/E3onCANcollect.py \
-  -c {{ edge_can_interface }} \
-  -dev e380 \
-  -g {{ edge_e3oncan_gap_seconds }} \
-  -m {{ edge_mqtt_host }}:{{ edge_mqtt_port }}:{{ edge_open3e_mqtt_topic }} \
-  -muser {{ edge_open3e_mqtt_user }} \
-  -mpass ${OPEN3E_MQTT_PASSWORD} \
-  -mfstr "{{ edge_e3oncan_mqtt_format }}" \
-  -j
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target

ansible/roles/edge-host/templates/open3e.env.j2

@@ -1,7 +0,0 @@
-# Managed by ansible (roles/edge-host). Read by open3e.service and
-# e3oncan.service.
-# Full user:password pair as one variable so the open3e unit can pass it
-# as a single -muser argument without exposing it in the unit file;
-# e3oncan takes user and password separately (-muser/-mpass).
-OPEN3E_MUSER={{ edge_open3e_mqtt_user }}:{{ edge_open3e_mqtt_password }}
-OPEN3E_MQTT_PASSWORD={{ edge_open3e_mqtt_password }}

ansible/roles/edge-host/templates/open3e.service.j2

@@ -1,39 +0,0 @@
-# Managed by ansible (roles/edge-host).
-# Read-mostly listener — no -w flag, no service 0x77. The ONE sanctioned
-# write path is the MQTT command topic (-l): HA publishes the DHW
-# one-time-charge command there (scope decision 2026-07-02, see vican
-# CLAUDE.md). Anything beyond that single write gets its own review.
-# -j is load-bearing: without it open3e flattens JSON payloads into
-# per-key subtopics and the HA package (homeassistant repo,
-# packages/open3e.yaml) receives nothing.
-# Exactly ONE open3e instance may be on the bus at a time (CAN collisions
-# stop open3e) — stop this service before running ad-hoc scans.
-[Unit]
-Description=open3e Viessmann E3 CAN-to-MQTT bridge (read-only)
-# Tie the service to the CAN device: stops on unplug, starts on plug via
-# the device unit rather than polling.
-BindsTo=sys-subsystem-net-devices-{{ edge_can_interface }}.device
-# mosquitto.service = the local MQTT bridge broker open3e publishes to (loopback).
-After=sys-subsystem-net-devices-{{ edge_can_interface }}.device network-online.target mosquitto.service
-Wants=network-online.target mosquitto.service
-
-[Service]
-User=open3e
-EnvironmentFile={{ edge_base_dir }}/open3e/open3e.env
-WorkingDirectory={{ edge_base_dir }}/open3e
-ExecStart={{ edge_base_dir }}/open3e/venv/bin/open3e \
-  -c {{ edge_can_interface }} \
-  -cnfg {{ edge_base_dir }}/open3e/devices.json \
-  -m {{ edge_mqtt_host }}:{{ edge_mqtt_port }}:{{ edge_open3e_mqtt_topic }} \
-  -muser ${OPEN3E_MUSER} \
-  -mcid open3e-edge \
-  -mfstr "{{ edge_open3e_mqtt_format }}" \
-  -r {{ edge_open3e_datapoints }} \
-  -t {{ edge_open3e_poll_seconds }} \
-  -l {{ edge_open3e_mqtt_topic }}/cmnd \
-  -j
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target

ansible/roles/edge-log-shipper/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+# Journal -> Loki shipping.
+#
+# The srv-network Loki (loki.srv.renner.uno:3100, no auth) is firewalled off
+# the IoT VLAN; the only endpoint these hosts can reach is the authenticated
+# cluster ingress. edge_loki_password comes from the vault.
+
+edge_alloy_config_file: /etc/alloy/edge.alloy
+edge_alloy_http_port: 12345
+edge_alloy_bin: /usr/bin/grafana-alloy   # Arch `grafana-alloy` pkg names the binary this, not `alloy`
+edge_loki_push_url: "https://loki.renner.uno/loki/api/v1/push"
+edge_loki_username: edge-1
+edge_alloy_labels:
+  environment: production
+  datacenter: homelab

ansible/roles/edge-log-shipper/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart alloy
+  ansible.builtin.systemd:
+    name: edge-alloy
+    state: restarted
+    daemon_reload: true

ansible/roles/edge-log-shipper/tasks/main.yml

@@ -0,0 +1,57 @@
+---
+# Ship the systemd journal to Loki with Grafana Alloy.
+#
+# Pairs with edge-flash-wear, which makes the journal volatile: container logs
+# reach the journal via docker s journald driver and native services log to it
+# directly, so one journal source covers everything. Alloy s storage/WAL sits
+# on /run (tmpfs) so it does not write to flash either.
+
+- name: Install grafana-alloy
+  ansible.builtin.package:
+    name: grafana-alloy
+    state: present
+
+- name: Create alloy system group
+  ansible.builtin.group:
+    name: alloy
+    system: true
+
+- name: Create alloy system user
+  ansible.builtin.user:
+    name: alloy
+    group: alloy
+    groups: systemd-journal
+    system: true
+    create_home: false
+    shell: /usr/bin/nologin
+
+- name: Create alloy config directory
+  ansible.builtin.file:
+    path: /etc/alloy
+    state: directory
+    owner: alloy
+    group: alloy
+    mode: "0750"
+
+- name: Deploy alloy config (journal -> Loki)
+  ansible.builtin.template:
+    src: edge-alloy.alloy.j2
+    dest: "{{ edge_alloy_config_file }}"
+    owner: alloy
+    group: alloy
+    mode: "0600"   # carries the Loki basic-auth password
+  notify: Restart alloy
+
+- name: Deploy alloy systemd unit
+  ansible.builtin.template:
+    src: edge-alloy.service.j2
+    dest: /etc/systemd/system/edge-alloy.service
+    mode: "0644"
+  notify: Restart alloy
+
+- name: Enable edge-alloy
+  ansible.builtin.systemd:
+    name: edge-alloy
+    enabled: true
+    state: started
+    daemon_reload: true

ansible/roles/edge-log-shipper/templates/edge-alloy.alloy.j2

@@ -1,4 +1,4 @@
-// Grafana Alloy — edge-1 log shipper. Managed by roles/edge-host.
+// Grafana Alloy — edge-1 log shipper. Managed by roles/edge-log-shipper.
 //
 // edge-1 runs on internal eMMC, so logs are kept out of local flash: the
 // systemd journal is volatile (RAM, see journald-edge.conf) and container

ansible/roles/edge-vlan/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+# --- Tagged VLAN 40 sub-interface. Off by default; enabled in
+# inventory/group_vars/edge_host. Exists so edge-1 can join the NTP keepalived
+# VRRP group, which needs layer-2 adjacency with the other members on the
+# service VLAN. The untagged VLAN 30 lease stays this host's only default
+# route -- see templates/10-vlan40.network.j2.
+edge_vlan40_enabled: false
+edge_vlan40_parent: enp1s0
+edge_vlan40_id: 40
+edge_vlan40_name: enp1s0.40
+edge_vlan40_parent_network: 20-wired.network

ansible/roles/edge-vlan/handlers/main.yml

@@ -0,0 +1,9 @@
+---
+# Reconfiguring the parent is what actually materialises the VLAN child -- a
+# bare reload leaves the existing link as-is. This re-runs DHCP on the parent,
+# which is a headless host's only path to the network, so it is the one
+# genuinely risky step in the VLAN change.
+- name: Reload networkd for VLAN
+  ansible.builtin.shell:
+    cmd: networkctl reload && networkctl reconfigure {{ edge_vlan40_parent }}
+  changed_when: true

ansible/roles/edge-vlan/tasks/main.yml

@@ -0,0 +1,48 @@
+---
+# Tagged VLAN sub-interface via systemd-networkd.
+#
+# Additive by construction: the parent link keeps its own .network file and
+# gains the VLAN through a drop-in, so reverting is deleting three paths. These
+# hosts are headless and the parent is their only route to the network, hence
+# the caution.
+
+- name: Create VLAN sub-interface netdev
+  ansible.builtin.template:
+    src: 10-vlan40.netdev.j2
+    dest: "/etc/systemd/network/10-{{ edge_vlan40_name }}.netdev"
+    mode: "0644"
+  when: edge_vlan40_enabled
+  notify: Reload networkd for VLAN
+  tags: [vlan40]
+
+- name: Configure VLAN sub-interface addressing
+  ansible.builtin.template:
+    src: 10-vlan40.network.j2
+    dest: "/etc/systemd/network/10-{{ edge_vlan40_name }}.network"
+    mode: "0644"
+  when: edge_vlan40_enabled
+  notify: Reload networkd for VLAN
+  tags: [vlan40]
+
+- name: Ensure parent network drop-in directory exists
+  ansible.builtin.file:
+    path: "/etc/systemd/network/{{ edge_vlan40_parent_network }}.d"
+    state: directory
+    mode: "0755"
+  when: edge_vlan40_enabled
+  tags: [vlan40]
+
+- name: Attach VLAN to parent link via drop-in
+  ansible.builtin.template:
+    src: vlan40-parent-dropin.conf.j2
+    dest: "/etc/systemd/network/{{ edge_vlan40_parent_network }}.d/10-vlan40.conf"
+    mode: "0644"
+  when: edge_vlan40_enabled
+  notify: Reload networkd for VLAN
+  tags: [vlan40]
+
+- name: Enable systemd-networkd
+  ansible.builtin.service:
+    name: systemd-networkd
+    state: started
+    enabled: true

ansible/roles/heating-can/defaults/main.yml

@@ -0,0 +1,60 @@
+---
+# Heating system over the Viessmann E3 CAN bus: open3e (heat pump) and
+# e3oncan (E380 energy meter). The can0 interface itself is the socketcan
+# role.
+
+# Service root. Kept per-role so the role is usable on its own.
+edge_base_dir: /opt/edge-host
+
+edge_open3e_mqtt_user: open3e
+edge_open3e_mqtt_topic: open3e
+edge_open3e_mqtt_format: "{device}_{didNumber:04d}_{didName}"
+edge_open3e_poll_seconds: 30
+# Read-only datapoint set (Phase 1 extended set, established 2026-07-02 on
+# the commissioning workstation; see vican repo CLAUDE.md for the rationale).
+# NO -w / write DIDs here — live heating + battery, writes are Phase 3.
+# vx3.266 = ErrorDtcHistory (O3EList) — the VX3 fault log; polled to catch
+# recurrences of FailureCommunicationEnergyMeter (the E380 energy-meter link
+# the internal PV-surplus EMS depends on). Decodes via the master O3EList
+# codec inherited through the vx3plus overlay.
+# vitocal.543/2350/2543/2560: SmartGrid-/EMS-Status-Beobachtung (2026-07-06)
+# — klärt, ob die Eigenstromoptimierung (EMS) bei PV-Überschuss von selbst
+# den WW-Boost auslöst (2543.2 steht laut Scan bereits auf +10 K), bevor
+# SG-Ready-Verdrahtung oder andere Trigger gebaut werden. Alle vier ro.
+# vitocal.259/260 = InfoDtcList/InfoDtcHistory (O3EList) — the HPMU event log,
+# the Vitocal-side counterpart to vx3.266. Both are capped lists (2 and 9
+# entries when added), so the multi-frame read is cheap at a 30 s poll.
+# Records faults/info events only (NormalOperation, LagDeviceDtcReported,
+# LegionellaProtectionTemperatureReached) — NOT setpoint or program changes.
+edge_open3e_datapoints: >-
+  vitocal.259,vitocal.260,vitocal.268,vitocal.269,vitocal.271,vitocal.274,vitocal.286,vitocal.288,vitocal.318,vitocal.321,vitocal.324,vitocal.335,vitocal.336,vitocal.396,vitocal.402,vitocal.403,vitocal.476,vitocal.477,vitocal.543,vitocal.548,vitocal.565,vitocal.1007,vitocal.1043,vitocal.1190,vitocal.1211,vitocal.1391,vitocal.1416,vitocal.1417,vitocal.2320,vitocal.2346,vitocal.2350,vitocal.2351,vitocal.2352,vitocal.2369,vitocal.2370,vitocal.2486,vitocal.2487,vitocal.2488,vitocal.2543,vitocal.2560,vitocal.2622,vitocal.2624,vitocal.2625,vitocal.2735,vitocal.3016,vx3.266,vx3.378,vx3.379,vx3.380,vx3.535,vx3.1603,vx3.1664,vx3.1690,vx3.1801,vx3.1802,vx3.1810,vx3.1828,vx3.1830,vx3.1577,vx3.1578,vx3.1579,vx3.1580,vx3.1581,vx3.1582,vx3.1834,vx3.1836,vx3.2214,vx3.2240,vx3.3085,vx3.3086,vx3.3087,vx3.3088,vx3.3089,vx3.3090,vcmu.320,vcmu.322,vcmu.325,vcmu.355,vcmu.389,vcmu.391,vcmu.1772,vcmu.1773,vcmu.1775,vcmu.1776,vcmu.2256,vcmu.2259,vcmu.2333,vcmu.2334,vcmu.2569,vcmu.2571,vitocal.2791
+# ECU addresses; -dev selects codec set, tx selects the UDS address.
+# vcmu (refrigerant-circuit controller) has no dedicated codec set —
+# omitting dpList makes open3e fall back to the generic datapoint list,
+# which decodes all polled VCMU DIDs.
+edge_open3e_devices:
+  vitocal: { tx: "0x680", dpList: "vcal" }
+  # dpList als Pfad: Overlay-Datei mit den Batteriemodul-DIDs (siehe
+  # files/open3e-vx3plus.py) — die Stock-vx3-Liste filtert sie sonst weg.
+  vx3: { tx: "0x6a1", dpList: "/config/vx3plus.py" }
+  vcmu: { tx: "0x68c" }
+
+edge_e3oncan_gap_seconds: 10
+edge_e3oncan_mqtt_format: "{device}_{didNumber:04d}_{didName}"
+
+# Secrets come from inventory/group_vars/edge_host/vault.yml:
+#   edge_open3e_mqtt_password
+
+# The image carrying both readers, built and pinned in CI
+# (ci/images/heating-can/Containerfile). The source pins live in the
+# Containerfile, in the artifact -- not here -- so what is deployed is a tag,
+# and `docker compose up -d` on an unchanged tag is a genuine no-op.
+#
+# Tracked by the weekly update-audit as an ordinary image, which is why this is
+# simpler to keep current than the two git refs it replaced: one publishes no
+# tags at all, the other was pinned to an untagged commit between releases.
+heating_can_image: gitea.renner.uno/gitea_admin/heating-can:latest
+
+# Compose project directory. Separate from the old native layout under
+# {{ edge_base_dir }}/open3e, which this role removes.
+heating_can_base_dir: "{{ edge_base_dir }}/heating-can"

ansible/roles/heating-can/files/open3e-vx3plus.py

@@ -1,4 +1,4 @@
-# Managed by ansible (roles/edge-host). Datapoint overlay for the VX3:
+# Managed by ansible (roles/heating-can). Datapoint overlay for the VX3:
 # the stock vx3 list acts as a FILTER (DIDs missing from it are popped
 # from the master table, Open3Eclass.py), so the per-battery-module DIDs
 # were never pollable with dpList "vx3". This overlay re-adds them with

ansible/roles/heating-can/handlers/main.yml

@@ -0,0 +1,10 @@
+---
+- name: Reload systemd
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Restart heating-can
+  ansible.builtin.command:
+    cmd: docker compose up -d --force-recreate
+    chdir: "{{ heating_can_base_dir }}"
+  changed_when: true

ansible/roles/heating-can/tasks/main.yml

@@ -0,0 +1,119 @@
+---
+# Heating system over the Viessmann E3 CAN bus.
+#
+# Two readers of the same heating installation, supervised inside one container
+# from one image (ci/images/heating-can):
+#   open3e    UDS request/response to the Vitocal heat pump and Vitocharge VX3
+#   e3oncan   passive CANopen listener for the E380 grid energy meter, which
+#             feeds the heat pump's own energy management
+#
+# They coexist because e3oncan issues no bus writes.
+#
+# Nothing is installed here. The image is built in CI with both sources pinned,
+# published to the registry, and this host only pulls and runs it. That is what
+# removes the churn: these were pip-installed into venvs on the node, and pip
+# re-cloned and rebuilt a VCS requirement on every converge -- restarting the
+# heating bridge each time -- which pinning the SHA did not fix.
+#
+# network_mode: host is required, not incidental: SocketCAN interfaces live in
+# the host network namespace, so can0 is only reachable that way. It is also how
+# the local MQTT broker on 127.0.0.1 is reached. CAN_RAW needs no capabilities,
+# so both run unprivileged.
+#
+# The can0 interface itself belongs to the socketcan role; this role consumes it.
+
+- name: Create heating-can directory
+  ansible.builtin.file:
+    path: "{{ heating_can_base_dir }}"
+    state: directory
+    mode: "0755"
+
+# --- Migration off the native install ---------------------------------------
+# Must happen before the containers start. Two open3e instances issuing UDS
+# requests on one CAN bus is the failure mode to avoid, so the old units are
+# stopped and masked rather than merely disabled -- masked so a stray
+# `systemctl start` or a leftover dependency cannot bring them back alongside
+# the containers.
+- name: Stop and mask the native CAN services
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    state: stopped
+    enabled: false
+    masked: true
+  loop:
+    - open3e
+    - e3oncan
+  failed_when: false
+
+- name: Remove the native unit files
+  ansible.builtin.file:
+    path: "/etc/systemd/system/{{ item }}.service"
+    state: absent
+  loop:
+    - open3e
+    - e3oncan
+  notify: Reload systemd
+
+# The venvs are the point of this change -- leaving them would leave the thing
+# that churned. Their configuration is NOT removed: devices.json, the overlay
+# and the env file are still rendered below and bind-mounted into the
+# containers.
+- name: Remove the native venvs
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - "{{ edge_base_dir }}/open3e/venv"
+    - "{{ edge_base_dir }}/e3oncan/venv"
+    - "{{ edge_base_dir }}/e3oncan/src"
+    - "{{ edge_base_dir }}/open3e"
+    - "{{ edge_base_dir }}/e3oncan"
+
+# --- Configuration (bind-mounted into the containers) ------------------------
+- name: Deploy open3e devices.json
+  ansible.builtin.copy:
+    content: "{{ edge_open3e_devices | to_nice_json }}\n"
+    dest: "{{ heating_can_base_dir }}/devices.json"
+    mode: "0644"
+  notify: Restart heating-can
+
+- name: Deploy open3e vx3 datapoint overlay (battery-module DIDs)
+  ansible.builtin.copy:
+    src: open3e-vx3plus.py
+    dest: "{{ heating_can_base_dir }}/vx3plus.py"
+    mode: "0644"
+  notify: Restart heating-can
+
+# --- Compose project ---------------------------------------------------------
+- name: Deploy the broker credential env file
+  ansible.builtin.template:
+    src: heating-can.env.j2
+    dest: "{{ heating_can_base_dir }}/heating-can.env"
+    mode: "0600"
+  notify: Restart heating-can
+
+- name: Deploy heating-can compose project
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ heating_can_base_dir }}/docker-compose.yml"
+    mode: "0644"
+  notify: Restart heating-can
+
+- name: Pull the heating-can image
+  ansible.builtin.command:
+    cmd: docker compose pull
+    chdir: "{{ heating_can_base_dir }}"
+  changed_when: false
+
+# Unlike the zwave and meter services there is no missing-device tolerance here:
+# can0 is created by the socketcan role from a USB adapter that is part of this
+# host's purpose. If it is absent the heating telemetry is down and the run
+# should say so rather than pass quietly.
+- name: Start heating-can services
+  ansible.builtin.command:
+    cmd: docker compose up -d
+    chdir: "{{ heating_can_base_dir }}"
+  register: heating_can_up
+  changed_when: >-
+    'Started' in heating_can_up.stderr or 'Created' in heating_can_up.stderr
+    or 'Started' in heating_can_up.stdout or 'Creating' in heating_can_up.stdout

ansible/roles/heating-can/templates/docker-compose.yml.j2

@@ -0,0 +1,35 @@
+# Managed by ansible (roles/heating-can).
+#
+# One container. Both CAN readers live in the image and are supervised inside
+# it -- this file supplies configuration and nothing else. It does not know
+# open3e's or E3onCAN's command line.
+#
+# network_mode: host is required: SocketCAN interfaces live in the host network
+# namespace, so {{ edge_can_interface }} is only reachable this way, and it is
+# also how the local MQTT broker is reached. CAN_RAW needs no capabilities, so
+# the image runs unprivileged.
+services:
+  heating-can:
+    image: {{ heating_can_image }}
+    container_name: heating-can
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - ./devices.json:/config/devices.json:ro
+      - ./vx3plus.py:/config/vx3plus.py:ro
+    env_file:
+      # Broker credential, 0600 -- see heating-can.env.j2.
+      - heating-can.env
+    environment:
+      CAN_INTERFACE: "{{ edge_can_interface }}"
+      MQTT_HOST: "{{ edge_mqtt_host }}"
+      MQTT_PORT: "{{ edge_mqtt_port }}"
+      MQTT_TOPIC: "{{ edge_open3e_mqtt_topic }}"
+      MQTT_FORMAT: "{{ edge_open3e_mqtt_format }}"
+      E3ONCAN_MQTT_FORMAT: "{{ edge_e3oncan_mqtt_format }}"
+      OPEN3E_CONFIG: /config/devices.json
+      OPEN3E_CLIENT_ID: open3e-edge
+      OPEN3E_POLL_SECONDS: "{{ edge_open3e_poll_seconds }}"
+      OPEN3E_DATAPOINTS: "{{ edge_open3e_datapoints }}"
+      E3ONCAN_DEVICE: e380
+      E3ONCAN_GAP_SECONDS: "{{ edge_e3oncan_gap_seconds }}"

ansible/roles/heating-can/templates/heating-can.env.j2

@@ -0,0 +1,8 @@
+# Managed by ansible (roles/heating-can). 0600 -- carries the broker credential.
+#
+# Kept out of docker-compose.yml, which is 0644: the sibling roles on this host
+# do the same (power-meter-sml renders its config at 0600 while its compose file
+# stays world-readable), and the native unit this replaced used a 0600 env file
+# for exactly this value.
+MQTT_USER={{ edge_open3e_mqtt_user }}
+MQTT_PASSWORD={{ edge_open3e_mqtt_password }}

ansible/roles/keepalived-ntp/defaults/main.yml

@@ -4,6 +4,29 @@
 keepalived_ntp_router_id: 4
 keepalived_ntp_vip: "10.2.40.4"
 keepalived_ntp_interface: "vmbr1.40"
+
+# IPv6 service address for NTP (ntp.srv.renner.uno). Empty disables the v6
+# instance entirely. IPv6 is the primary address family on this network, so
+# this is the path that actually matters -- the v4 VIP above is legacy.
+#
+# Held by keepalived rather than assigned statically by networkd so that it is
+# gated on check_ntp: present only while this host is fit to serve time, and
+# withdrawn the moment it is not. A statically configured address is carried
+# unconditionally from boot, which is how edge-1 came to answer NTP queries on
+# 2026-08-04 while its clock was ~16 days in the past.
+#
+# Needs its own virtual_router_id: it is a distinct VRRP instance, and a VRID
+# collision with the IPv4 instance on the same interface would have the two
+# fighting over a single election.
+keepalived_ntp_vip6: ""
+keepalived_ntp_router_id6: 6
+
+# Link-local address for the IPv6 VRRP instance, carried as its FIRST
+# virtual_ipaddress. RFC 5798 gives an IPv6 virtual router a link-local primary,
+# and keepalived warns "the first IPv6 VIP address should be link local" without
+# one. Chosen to mirror the service address rather than derived from the virtual
+# MAC, since no real NIC generates fe80::123 so there is nothing to collide with.
+keepalived_ntp_vip6_linklocal: "fe80::123/64"
 # NOTE: plaintext VRRP auth, unvaulted. Carried over as-is from the original
 # role; VRRP PASS auth is weak regardless (sent in the clear on the segment),
 # so this is a documented weakness rather than a secret worth vaulting.
@@ -18,6 +41,17 @@ keepalived_ntp_check_script: "/usr/local/bin/check-ntp-health.sh"
 keepalived_ntp_check_interval: 2
 keepalived_ntp_check_weight: -20
 
+# Maximum |system clock offset| in seconds before the host refuses to hold the
+# VIP. chronyd reports this as "System time : <n> seconds slow/fast of NTP
+# time". Anything above this means the host knows its clock is wrong and must
+# not serve time to clients -- see the reasoning in check-ntp-health.sh.j2.
+#
+# A serving NTP host should be within milliseconds of real time, so 1s is
+# already several orders of magnitude beyond normal. It is deliberately not
+# tighter: a brief excursion at boot, before makestep lands, should not flap
+# the VIP (fall 2 at a 2s interval also requires the failure to persist).
+keepalived_ntp_max_offset: 1.0
+
 # sysctl applied for VRRP. Default preserves the PVE hosts' existing behaviour
 # exactly. ip_forward is NOT appropriate everywhere -- on a host with legs in
 # two VLANs it turns the box into a router between them, bypassing the gateway's

ansible/roles/keepalived-ntp/files/keepalived-notify.sh

@@ -1,22 +1,39 @@
 #!/bin/bash
 # Keepalived State Change Notification Script
+#
+# Two VRRP instances call this: NTP_VIP (IPv4, legacy) passes MASTER/BACKUP/
+# FAULT, and NTP_VIP6 (IPv6, the primary path) passes the same suffixed with
+# '6'. They are logged distinctly because the two can legitimately diverge --
+# a host can hold one family and not the other -- and a log line that does not
+# say which family it means is useless during an incident.
 
 TYPE=$1
 NAME=$(hostname)
 TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
 
+log() {
+    echo "$TIMESTAMP: $NAME $1" >> /var/log/keepalived-state.log
+    logger -t keepalived "$NAME $1"
+}
+
 case $TYPE in
     MASTER)
-        echo "$TIMESTAMP: $NAME transitioned to MASTER state (NTP)" >> /var/log/keepalived-state.log
-        logger -t keepalived "$NAME is now NTP MASTER"
+        log "transitioned to MASTER state (NTP, IPv4)"
         ;;
     BACKUP)
-        echo "$TIMESTAMP: $NAME transitioned to BACKUP state (NTP)" >> /var/log/keepalived-state.log
-        logger -t keepalived "$NAME is now NTP BACKUP"
+        log "transitioned to BACKUP state (NTP, IPv4)"
         ;;
     FAULT)
-        echo "$TIMESTAMP: $NAME transitioned to FAULT state (NTP)" >> /var/log/keepalived-state.log
-        logger -t keepalived "$NAME is now in NTP FAULT state"
+        log "transitioned to FAULT state (NTP, IPv4)"
+        ;;
+    MASTER6)
+        log "transitioned to MASTER state (NTP, IPv6) - now serving ntp.srv.renner.uno"
+        ;;
+    BACKUP6)
+        log "transitioned to BACKUP state (NTP, IPv6) - released ntp.srv.renner.uno"
+        ;;
+    FAULT6)
+        log "transitioned to FAULT state (NTP, IPv6) - withdrew ntp.srv.renner.uno, unfit to serve time"
         ;;
     *)
         echo "$TIMESTAMP: $NAME unknown state: $TYPE" >> /var/log/keepalived-state.log

ansible/roles/keepalived-ntp/tasks/main.yml

@@ -35,6 +35,121 @@
     state: present
   when: ansible_facts['os_family'] == 'Archlinux'
 
+# --- Verify nothing else is assigning the IPv6 service address ---------------
+#
+# The removal itself lives in withdraw-static.yml, run as a separate fleet-wide
+# play before any host reaches this role (see install-ntp-ha.yml). It has to
+# complete everywhere first: DAD is enabled on the VRRP address, so a static
+# copy on one host and a VRRP-managed copy on another cannot coexist -- the
+# kernel marks the newcomer `dadfailed` and its master serves nothing.
+#
+# What remains here are the guards. They run on every execution, not just the
+# migration, and fail the play if any static assignment survives -- which would
+# both defeat the health gating (a static copy does not disappear when
+# keepalived decides the host is unfit) and break the VRRP copy via DAD.
+#
+# The config file is what gets checked, not the running address, and that is
+# what makes it safe to run every time: keepalived never writes to these files,
+# so anything found is by definition static, whereas the live address is
+# legitimately present on whichever host is master.
+#
+# Prefix-agnostic and \b-anchored on purpose. Matching the full
+# address/prefixlen would fail open against a hand-written assignment using any
+# other mask.
+- name: Detect any remaining static assignment of the service address (ifupdown)
+  ansible.builtin.command:
+    argv:
+      - grep
+      - -rlE
+      - "{{ keepalived_ntp_vip6.split('/')[0] }}\\b"
+      - /etc/network/interfaces
+      - /etc/network/interfaces.d/
+  register: keepalived_ntp_static6_ifupdown
+  changed_when: false
+  failed_when: false
+  when:
+    - keepalived_ntp_vip6 | length > 0
+    - ansible_facts['os_family'] == 'Debian'
+
+- name: Assert ifupdown is not also assigning the service address
+  ansible.builtin.assert:
+    that:
+      - keepalived_ntp_static6_ifupdown.stdout | default('') | length == 0
+    fail_msg: >-
+      {{ keepalived_ntp_vip6 }} is still assigned statically by ifupdown on
+      this host
+      ({{ keepalived_ntp_static6_ifupdown.stdout_lines | default([]) | join(', ') }}).
+      The automatic removal only matches the exact form
+      `up ip -6 addr replace {{ keepalived_ntp_vip6 }} dev <if> nodad`, so a
+      different prefix length or layout is left in place. Handing the address
+      to keepalived while ifupdown also assigns it means it would NOT be
+      withdrawn when check_ntp fails -- the host would keep serving time on an
+      address VRRP believes it has released. Remove the assignment from the
+      file(s) above, then re-run.
+    success_msg: >-
+      No static ifupdown assignment of {{ keepalived_ntp_vip6 }}; safe for
+      keepalived to own it.
+  when:
+    - keepalived_ntp_vip6 | length > 0
+    - ansible_facts['os_family'] == 'Debian'
+
+# On Arch (edge-1) the static assignment lives in a systemd-networkd file owned
+# by the edge-vlan role, so this role must not rewrite it -- but it must not
+# quietly proceed either. install-edge-host.yml is a separate play with no
+# ordering relationship to this one, so nothing guarantees it has been re-run
+# to drop the [Address] block. If it has not, edge-1 would end up holding
+# fd40::123 statically AND running a VRRP instance for the same address:
+# keepalived would believe it had withdrawn the address while networkd kept it
+# assigned, and the host would go on answering NTP with a clock the health
+# check had already rejected.
+#
+# That is the precise failure of 2026-08-04, on the host it happened to, so it
+# fails fast rather than being left to inspection.
+# Matched on the bare address, not the full address/prefixlen, and anchored
+# with \b so it cannot also hit a longer address sharing the prefix (fd40::1234).
+#
+# Searching for the literal "fd40::123/128" would fail open: a hand-written
+# [Address] using any other mask -- /64, say -- would not match, the assert
+# below would pass, and keepalived would be handed an address networkd is
+# still assigning. Since this check is detect-only, with no delete afterwards
+# to catch the mistake, a miss here is silent. The Debian path does not share
+# the problem: `ip -6 addr show ... to <prefix>` matches by range regardless of
+# the assigned prefix length, and its delete is re-verified by assert.
+- name: Detect a static assignment of the service address (systemd-networkd)
+  ansible.builtin.command:
+    argv:
+      - grep
+      - -rlE
+      - "{{ keepalived_ntp_vip6.split('/')[0] }}\\b"
+      - /etc/systemd/network/
+  register: keepalived_ntp_static6_networkd
+  changed_when: false
+  failed_when: false
+  when:
+    - keepalived_ntp_vip6 | length > 0
+    - ansible_facts['os_family'] == 'Archlinux'
+
+- name: Assert networkd is not also assigning the service address
+  ansible.builtin.assert:
+    that:
+      - keepalived_ntp_static6_networkd.stdout | default('') | length == 0
+    fail_msg: >-
+      {{ keepalived_ntp_vip6 }} is still assigned statically by
+      systemd-networkd on this host
+      ({{ keepalived_ntp_static6_networkd.stdout_lines | default([]) | join(', ') }}).
+      Handing the address to keepalived while networkd also assigns it means
+      it would NOT be withdrawn when check_ntp fails -- the host would keep
+      serving time on an address VRRP believes it has released.
+      Re-apply the edge-vlan role first, whose template no longer carries the
+      [Address] block:
+      ansible-playbook -i inventory/pve_hosts.yml plays/install-edge-host.yml
+    success_msg: >-
+      No static networkd assignment of {{ keepalived_ntp_vip6 }}; safe for
+      keepalived to own it.
+  when:
+    - keepalived_ntp_vip6 | length > 0
+    - ansible_facts['os_family'] == 'Archlinux'
+
 - name: Create keepalived configuration
   ansible.builtin.template:
     src: keepalived.conf.j2

ansible/roles/keepalived-ntp/tasks/withdraw-static.yml

@@ -0,0 +1,134 @@
+---
+# Withdraw a static assignment of the IPv6 NTP service address.
+#
+# Included by install-ntp-ha.yml as a FIRST play across the whole ntp_cluster,
+# before any host is given the NTP_VIP6 instance. That ordering is the point of
+# splitting it out.
+#
+# DAD is enabled on the VRRP address (see keepalived.conf.j2), so a static copy
+# on any host and a VRRP-managed copy on another cannot coexist: the kernel sees
+# the duplicate and marks the newcomer `dadfailed`, leaving a master that
+# believes it is serving while carrying an unusable address. Observed on edge-1
+# on 2026-08-07, where keepalived reported MASTER while the address sat
+# `dadfailed deprecated tentative` because three PVE nodes still held it
+# statically.
+#
+# Doing the withdrawal per host inside the main role could not avoid that: with
+# serial: 1 the first host would claim the address via VRRP while the rest were
+# still static. Fleet-wide first, then claim.
+#
+# fd40::123 was assigned by hand on all four servers, in two different ways,
+# none of it in version control:
+#
+#   PVE nodes  an `up ip -6 addr replace ... nodad` hook in
+#              /etc/network/interfaces
+#   edge-1     an [Address] block in /etc/systemd/network/, owned by the
+#              edge-vlan role and removed by re-applying it -- not touched
+#              here, since this role must not rewrite another role's file
+#
+# There is a service gap between this play and the next, while no host holds
+# the address. It is bounded by the run time of one play and clients simply
+# retry; the alternative is the dadfailed state above, which does not resolve
+# on its own.
+
+- name: Remove static assignment of the NTP service address (ifupdown)
+  ansible.builtin.lineinfile:
+    path: /etc/network/interfaces
+    regexp: '^\s*up\s+ip\s+-6\s+addr\s+(replace|add)\s+{{ keepalived_ntp_vip6 | regex_escape }}\b'
+    state: absent
+  when:
+    - keepalived_ntp_vip6 | length > 0
+    - ansible_facts['os_family'] == 'Debian'
+  register: keepalived_ntp_static6_removed
+
+# Everything below is gated on the config line having just been removed, so the
+# runtime delete happens once -- on the migration -- and never again.
+#
+# The gate is load-bearing. Once this has landed, the address is legitimately
+# present on whichever host is the elected v6 master, placed there by
+# keepalived, and a delete cannot tell that apart from a static assignment (the
+# address looks identical either way). Ungated, every later run would delete the
+# master's address and restart keepalived, dropping the service address and
+# forcing a re-election each time -- the flapping this whole change exists to
+# prevent.
+- name: Check whether the service address is still assigned statically
+  ansible.builtin.command:
+    argv:
+      - ip
+      - -6
+      - addr
+      - show
+      - dev
+      - "{{ keepalived_ntp_interface }}"
+      - to
+      - "{{ keepalived_ntp_vip6 }}"
+  register: keepalived_ntp_vip6_present
+  changed_when: false
+  failed_when: false
+  when:
+    - keepalived_ntp_vip6 | length > 0
+    - keepalived_ntp_static6_removed.changed | default(false)
+
+# failed_when: false because the desired end state is "address absent". An
+# `ip addr del` against an address that has already gone is the outcome this
+# task wants, not a reason to abort the play for that host.
+- name: Withdraw the statically assigned service address
+  ansible.builtin.command:
+    argv:
+      - ip
+      - -6
+      - addr
+      - del
+      - "{{ keepalived_ntp_vip6 }}"
+      - dev
+      - "{{ keepalived_ntp_interface }}"
+  when:
+    - keepalived_ntp_vip6 | length > 0
+    - keepalived_ntp_static6_removed.changed | default(false)
+    - keepalived_ntp_vip6_present.stdout | default('') | length > 0
+  failed_when: false
+
+# The withdrawal gets exactly one attempt -- the gate that makes it idempotent
+# also means it never retries -- and the delete swallows its own errors. So the
+# result is asserted rather than assumed.
+#
+# `ip addr del` matches on address AND prefix length: if a host's static
+# assignment used a different mask or interface than ntp_vip6 /
+# keepalived_ntp_interface, the delete is a silent no-op and the address stays
+# outside VRRP control permanently, with the play reporting success.
+- name: Confirm the static service address was actually withdrawn
+  ansible.builtin.command:
+    argv:
+      - ip
+      - -6
+      - addr
+      - show
+      - dev
+      - "{{ keepalived_ntp_interface }}"
+      - to
+      - "{{ keepalived_ntp_vip6 }}"
+  register: keepalived_ntp_vip6_after
+  changed_when: false
+  failed_when: false
+  when:
+    - keepalived_ntp_vip6 | length > 0
+    - keepalived_ntp_static6_removed.changed | default(false)
+
+- name: Assert the service address is no longer assigned outside keepalived
+  ansible.builtin.assert:
+    that:
+      - keepalived_ntp_vip6_after.stdout | default('') | length == 0
+    fail_msg: >-
+      {{ keepalived_ntp_vip6 }} is still assigned on
+      {{ keepalived_ntp_interface }} after the static assignment was removed.
+      `ip -6 addr del` matches address AND prefix length, so this usually means
+      the on-host assignment differs from ntp_vip6 or uses another interface.
+      Leaving it would both keep the address outside VRRP control and make the
+      VRRP-managed copy fail DAD elsewhere. Inspect with
+      `ip -6 addr show dev {{ keepalived_ntp_interface }}` and
+      `grep -rn {{ keepalived_ntp_vip6 }} /etc/network/ /etc/systemd/network/`.
+    success_msg: >-
+      {{ keepalived_ntp_vip6 }} withdrawn; safe for keepalived to claim it.
+  when:
+    - keepalived_ntp_vip6 | length > 0
+    - keepalived_ntp_static6_removed.changed | default(false)

ansible/roles/keepalived-ntp/templates/check-ntp-health.sh.j2

@@ -6,23 +6,80 @@
 # The chrony unit is named 'chrony' on Debian and 'chronyd' on Arch. This is
 # templated rather than hardcoded: a wrong name here fails every check, which
 # parks the host in permanent FAULT so it never takes the VIP.
+#
+# This check must answer "is it safe for clients to take time from this host",
+# NOT merely "is chronyd alive". Those came apart on 2026-08-04: edge-1's dead
+# CMOS battery left its clock ~16 days in the past, chronyd was running,
+# answering queries and listening on 123, and the `local stratum` directive made
+# it advertise itself to clients as a valid reference. Every liveness check
+# passed for ~18h while the host stood ready to serve a clock from July. The
+# earlier version of this script ran `chronyc tracking` and discarded its
+# output -- the one command that knew the answer.
+#
+# Deliberate distinction, because these must not be conflated:
+#   * "provably wrong"  -> chronyd HAS upstream measurements and they say the
+#                          clock is far off. Fail: drop the VIP so a host with a
+#                          sane clock serves instead.
+#   * "no upstream yet" -> nothing reachable / not yet measured. Also fail, but
+#                          note that when the WAN is down every host fails
+#                          together, they all lose the same weight, relative
+#                          priority is unchanged and the VIP stays put. So the
+#                          local-reference fallback still works; what this
+#                          prevents is one host with a broken clock winning.
+
+LOG=/var/log/keepalived-ntp-health.log
+MAX_OFFSET={{ keepalived_ntp_max_offset }}
+
+fail() {
+    echo "$(date): $1" >> "$LOG"
+    exit 1
+}
 
 # Check 1: Is chrony service running?
 if ! systemctl is-active --quiet {{ chrony_service_name }}; then
-    echo "$(date): {{ chrony_service_name }} service not active" >> /var/log/keepalived-ntp-health.log
-    exit 1
+    fail "{{ chrony_service_name }} service not active"
 fi
 
-# Check 2: Is chrony synchronized or at least running?
-if ! chronyc tracking >/dev/null 2>&1; then
-    echo "$(date): Chrony not responding to tracking query" >> /var/log/keepalived-ntp-health.log
-    exit 1
+# Check 2: Is chrony responding, and what does it actually say?
+# Captured, not discarded -- the offset below is the whole point of this script.
+if ! TRACKING=$(chronyc tracking 2>/dev/null); then
+    fail "Chrony not responding to tracking query"
 fi
 
 # Check 3: Is NTP serving clients (port 123)?
 if ! ss -lun | grep -q ':123 '; then
-    echo "$(date): NTP port 123 not listening" >> /var/log/keepalived-ntp-health.log
-    exit 1
+    fail "NTP port 123 not listening"
+fi
+
+# Check 4: Is the clock provably wrong?
+#
+# "System time : <n> seconds (slow|fast) of NTP time" is chronyd's own estimate
+# of how far the system clock is from real time, derived from upstream
+# measurements. On edge-1 during the incident this line read
+# "1376235.375000000 seconds slow of NTP time" while every other check passed.
+OFFSET=$(echo "$TRACKING" | awk '/^System time/ {print $4}')
+if [ -n "$OFFSET" ]; then
+    if awk -v o="$OFFSET" -v m="$MAX_OFFSET" 'BEGIN {exit !(o > m)}'; then
+        fail "System clock off by ${OFFSET}s (max ${MAX_OFFSET}s) - refusing to serve time"
+    fi
+fi
+
+# Check 5: Has chronyd ever validated its clock against a real source?
+#
+# With `local stratum N` configured, chronyd advertises itself as a usable
+# reference even when it has never synchronised to anything -- the upstream
+# chrony documentation is explicit that the local reference activates
+# immediately in that case. So a host that has never reached an upstream still
+# looks authoritative to clients. Refuse the VIP until a real source has been
+# selected.
+#
+# `chronyc sources` marks the selected source with '*' (best) or '+' (combined)
+# in the second column. Neither present means nothing upstream is accepted.
+if ! SOURCES=$(chronyc sources 2>/dev/null); then
+    fail "Chrony not responding to sources query"
+fi
+if ! echo "$SOURCES" | grep -qE '^.\*|^.\+'; then
+    fail "No upstream source selected - clock not validated, refusing to serve time"
 fi
 
 # All checks passed

ansible/roles/keepalived-ntp/templates/keepalived.conf.j2

@@ -39,3 +39,72 @@ vrrp_instance NTP_VIP {
     notify_backup "/usr/local/bin/keepalived-notify.sh BACKUP"
     notify_fault "/usr/local/bin/keepalived-notify.sh FAULT"
 }
+{% if keepalived_ntp_vip6 %}
+
+# IPv6 service address for NTP (ntp.srv.renner.uno). IPv6 is the primary
+# address family here, so this instance -- not the IPv4 one above -- is the
+# path that matters.
+#
+# A separate instance is mandatory, not stylistic: keepalived requires that
+# "all addresses in virtual_ipaddress must be of the same family", so the v6
+# address cannot be added to NTP_VIP.
+#
+# No authentication block: VRRPv3 removed authentication (RFC 5798), and
+# keepalived always uses version 3 for IPv6 instances. Configuring auth here
+# is rejected rather than ignored.
+#
+# The first address is link-local, and must be. RFC 5798 gives an IPv6 virtual
+# router a link-local address as its primary, and keepalived warns
+# "the first IPv6 VIP address should be link local" otherwise. It carries on,
+# but the instance is then sourcing VRRPv3 from something the protocol does not
+# expect.
+#
+# DAD is deliberately left ON (no -nodad). The flag was inherited from the
+# previous design, where every NTP server carried fd40::123 simultaneously and
+# duplicate detection had to be suppressed for that to work at all. Under
+# single-master VRRP the opposite is true: exactly one host should hold the
+# address, so a duplicate is a genuine fault and detecting it is the point.
+#
+# This does mean the migration cannot leave a static copy anywhere while a
+# VRRP-managed one exists -- DAD sees the two and marks the newcomer
+# `dadfailed`, leaving a master that believes it is serving while carrying an
+# unusable address. Observed on edge-1 on 2026-08-07. install-ntp-ha.yml
+# therefore withdraws every static assignment fleet-wide in a first play
+# before any host configures this instance.
+#
+# track_script is what makes this health-gated: the address is only held while
+# check_ntp passes, and is withdrawn as soon as it fails. On withdrawal
+# keepalived sends unsolicited Neighbour Advertisements so client neighbour
+# caches are updated immediately -- a statically assigned address cannot do
+# this, and clients would keep sending to the dead holder until their own
+# neighbour unreachability detection expired.
+vrrp_instance NTP_VIP6 {
+    state {{ keepalived_ntp_state }}
+    interface {{ keepalived_ntp_interface }}
+    virtual_router_id {{ keepalived_ntp_router_id6 }}
+    priority {{ keepalived_ntp_priority }}
+    advert_int 1
+
+    virtual_ipaddress {
+        {{ keepalived_ntp_vip6_linklocal }} dev {{ keepalived_ntp_interface }}
+        {{ keepalived_ntp_vip6 }} dev {{ keepalived_ntp_interface }}
+    }
+
+    # weight 0 overrides the script's own weight, and the distinction decides
+    # whether this works at all. A non-zero weight only SUBTRACTS from priority
+    # on failure -- so the last remaining host, having no one to lose the
+    # election to, stays MASTER and keeps serving time with a clock it has
+    # already reported as wrong. Weight 0 instead transitions the instance to
+    # FAULT after <fall> failures, which releases the address unconditionally.
+    #
+    # That is the required behaviour here: a host unfit to serve time must stop
+    # answering, whether or not a replacement exists.
+    track_script {
+        check_ntp weight 0
+    }
+
+    notify_master "/usr/local/bin/keepalived-notify.sh MASTER6"
+    notify_backup "/usr/local/bin/keepalived-notify.sh BACKUP6"
+    notify_fault "/usr/local/bin/keepalived-notify.sh FAULT6"
+}
+{% endif %}

ansible/roles/mqtt-bridge/defaults/main.yml

@@ -0,0 +1,12 @@
+---
+# --- MQTT: edge clients (open3e, e3oncan, sml2mqtt) publish to a LOCAL
+# mosquitto on loopback, which bridges to the central cluster broker over TLS
+# (open3e/e3oncan have no native MQTTS). This keeps plaintext on loopback only
+# — off the untrusted IoT VLAN — and buffers telemetry in RAM during cluster
+# blips. The local broker writes nothing to the eMMC (persistence off, logs to
+# the volatile journal). See edge-mqtt-bridge.conf.j2 and README "MQTT bridge".
+# Upstream cluster broker the local bridge connects to (TLS; the public
+# Let's Encrypt cert is validated against the system CA bundle).
+edge_mqtt_cluster_host: mqtt.renner.uno
+edge_mqtt_cluster_tls_port: 8883
+edge_mqtt_bridge_cafile: /etc/ssl/certs/ca-certificates.crt

ansible/roles/mqtt-bridge/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+# The MQTT clients (zwave-js, sml2mqtt, open3e, e3oncan) reconnect on their
+# own once the local broker is back.
+- name: Restart mosquitto
+  ansible.builtin.service:
+    name: mosquitto
+    state: restarted

ansible/roles/mqtt-bridge/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+# Local MQTT bridge broker.
+#
+# Edge clients (open3e, e3oncan, sml2mqtt) publish here over loopback; this
+# broker bridges to the cluster broker over TLS, because those clients have no
+# native MQTTS. Persistence is off and logging goes to stdout so it writes
+# nothing to local flash.
+
+- name: Install mosquitto
+  ansible.builtin.package:
+    name: mosquitto
+    state: present
+
+- name: Deploy local mosquitto bridge config
+  ansible.builtin.template:
+    src: edge-mqtt-bridge.conf.j2
+    dest: /etc/mosquitto/mosquitto.conf
+    owner: root
+    group: mosquitto
+    mode: "0640"   # carries the cluster bridge credentials
+  notify: Restart mosquitto
+
+- name: Enable local mosquitto bridge
+  ansible.builtin.systemd:
+    name: mosquitto
+    enabled: true
+    state: started

ansible/roles/mqtt-bridge/templates/edge-mqtt-bridge.conf.j2

@@ -1,4 +1,4 @@
-# Managed by roles/edge-host. Local mosquitto that the edge clients (open3e,
+# Managed by roles/mqtt-bridge. Local mosquitto that the edge clients (open3e,
 # e3oncan, sml2mqtt) publish to over loopback; it bridges to the central
 # cluster broker over TLS. open3e/e3oncan have no native MQTTS, so this is how
 # edge-1's MQTT gets off plaintext on the untrusted IoT VLAN, and it buffers

ansible/roles/power-meter-sml/defaults/main.yml

@@ -0,0 +1,23 @@
+---
+# Power-meter reader: sml2mqtt against the FTDI serial meter head.
+
+# Service root. Kept per-role so the role is usable on its own.
+edge_base_dir: /opt/edge-host
+
+# Own compose project directory. Unchanged from the path used under the
+# previous shared project.
+sml_base_dir: "{{ edge_base_dir }}/sml2mqtt"
+
+# The compose file that used to hold both this service and zwave-js. Removed
+# once, so the fixed container_name is released for the new projects.
+edge_legacy_compose: "{{ edge_base_dir }}/docker-compose.yml"
+
+# Stable by-id symlink -- see the zwave-gateway role.
+edge_stromzaehler_device: /dev/serial/by-id/usb-FTDI_FT230X_Basic_UART_DK0E1GP5-if00-port0
+
+# Hand-pinned on purpose: critical meter bridge, deliberately excluded from
+# image automation.
+edge_sml2mqtt_image: spacemanspiff2007/sml2mqtt:3.6.0
+
+# Secret from inventory/group_vars/edge_host/vault.yml:
+#   edge_sml2mqtt_mqtt_password

ansible/roles/power-meter-sml/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart sml2mqtt
+  ansible.builtin.command:
+    cmd: docker compose up -d --force-recreate
+    chdir: "{{ sml_base_dir }}"
+  changed_when: true

ansible/roles/power-meter-sml/tasks/main.yml

@@ -0,0 +1,55 @@
+---
+# Power-meter reader: sml2mqtt against the FTDI serial meter head.
+#
+# Its own compose project. It shared a compose file with the Z-Wave gateway,
+# which meant a change to either recreated both -- two unrelated services bound
+# to different USB devices. Data paths are unchanged.
+
+- name: Create sml2mqtt directory
+  ansible.builtin.file:
+    path: "{{ sml_base_dir }}"
+    state: directory
+    mode: "0755"
+
+# sml2mqtt reads only a config file and has no env override for the password,
+# so the rendered config carries it -- 0600, root-owned, same trust boundary as
+# the k8s init-container approach it replaced.
+- name: Deploy sml2mqtt config
+  ansible.builtin.template:
+    src: sml2mqtt-config.yml.j2
+    dest: "{{ sml_base_dir }}/config.yml"
+    mode: "0600"
+  notify: Restart sml2mqtt
+
+- name: Deploy sml2mqtt compose project
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ sml_base_dir }}/docker-compose.yml"
+    mode: "0644"
+  notify: Restart sml2mqtt
+
+- name: Pull sml2mqtt image
+  ansible.builtin.command:
+    cmd: docker compose pull
+    chdir: "{{ sml_base_dir }}"
+  changed_when: false
+
+# Tolerates a missing USB device, as for the Z-Wave gateway.
+- name: Start sml2mqtt
+  ansible.builtin.command:
+    cmd: docker compose up -d
+    chdir: "{{ sml_base_dir }}"
+  register: sml_compose_up
+  failed_when: >-
+    sml_compose_up.rc != 0
+    and 'error gathering device information' not in sml_compose_up.stderr
+  changed_when: >-
+    'Started' in sml_compose_up.stderr or 'Created' in sml_compose_up.stderr
+    or 'Started' in sml_compose_up.stdout or 'Creating' in sml_compose_up.stdout
+
+- name: Warn if sml2mqtt is waiting for its USB device
+  ansible.builtin.debug:
+    msg: >-
+      sml2mqtt could not start -- the FTDI meter head is not present:
+      {{ sml_compose_up.stderr_lines | select('search', 'device') | list }}
+  when: sml_compose_up.rc != 0

ansible/roles/power-meter-sml/templates/docker-compose.yml.j2

@@ -0,0 +1,21 @@
+# Managed by ansible (roles/power-meter-sml).
+#
+# Its own compose project -- see the role tasks for why it no longer shares a
+# file with the Z-Wave gateway.
+#
+# Outbound-only (serial in, MQTT out). Host networking sidesteps the docker
+# NAT66 gap: the broker LB is IPv6-first and bridge-network v6 SYNs leave
+# unmasqueraded and die. The host stack reaches it fine (open3e proves it
+# continuously).
+services:
+  sml2mqtt:
+    image: {{ edge_sml2mqtt_image }}
+    container_name: sml2mqtt
+    restart: unless-stopped
+    network_mode: host
+    # Serial exclusivity: this is the ONLY reader of the meter port --
+    # HA's edl21 integration stays disabled.
+    devices:
+      - "{{ edge_stromzaehler_device }}:/dev/stromzaehler"
+    volumes:
+      - ./config.yml:/sml2mqtt/config.yml:ro

ansible/roles/power-meter-sml/templates/sml2mqtt-config.yml.j2

@@ -1,4 +1,4 @@
-# Managed by ansible (roles/edge-host). Ported 1:1 from the k8s ConfigMap
+# Managed by ansible (roles/power-meter-sml). Ported 1:1 from the k8s ConfigMap
 # sml2mqtt-config; only host and password delivery differ (broker is now
 # reached via its LoadBalancer hostname, password rendered by ansible
 # instead of an init container).

ansible/roles/prometheus-server/templates/nodes.yml.j2

@@ -7,19 +7,19 @@
 
 # PVE cluster nodes - need direct scraping (no Alloy agent)
 - targets:
-    - '10.2.40.201:9100'
+    - 'jupiter.renner.uno:9100'
   labels:
     job: 'node'
     group: 'pve_cluster'
     hostname: 'jupiter'
 - targets:
-    - '10.2.40.202:9100'
+    - 'neptune.renner.uno:9100'
   labels:
     job: 'node'
     group: 'pve_cluster'
     hostname: 'neptune'
 - targets:
-    - '10.2.40.203:9100'
+    - 'saturn.renner.uno:9100'
   labels:
     job: 'node'
     group: 'pve_cluster'

ansible/roles/prometheus-server/templates/prometheus.yml.j2

@@ -51,9 +51,9 @@ scrape_configs:
     scrape_timeout: 55s
     static_configs:
       - targets:
-          - '10.2.40.201'  # jupiter
-          - '10.2.40.202'  # neptune
-          - '10.2.40.203'  # saturn
+          - 'jupiter.renner.uno'
+          - 'neptune.renner.uno'
+          - 'saturn.renner.uno'
     metrics_path: /pve
     params:
       module: [default]
@@ -132,28 +132,29 @@ scrape_configs:
         refresh_interval: 60s
 
   # Chrony Exporter - NTP metrics from PVE cluster
+  # One static_config per host so each carries its own hostname label. The
+  # previous form listed all three targets together and recovered the hostname
+  # in relabel_configs by regex-matching __address__ against the node's IP --
+  # which silently coupled the labels to the addressing. Changing a target
+  # would have left the regex unmatched and the hostname label simply absent,
+  # with the scrape still succeeding.
   - job_name: 'chrony'
     static_configs:
-      - targets:
-          - '10.2.40.201:9123'
-          - '10.2.40.202:9123'
-          - '10.2.40.203:9123'
+      - targets: ['jupiter.renner.uno:9123']
         labels:
           group: 'ntp'
           type: 'time-server'
-    relabel_configs:
-      - source_labels: [__address__]
-        regex: '10\.2\.40\.201:.*'
-        target_label: hostname
-        replacement: 'jupiter'
-      - source_labels: [__address__]
-        regex: '10\.2\.40\.202:.*'
-        target_label: hostname
-        replacement: 'neptune'
-      - source_labels: [__address__]
-        regex: '10\.2\.40\.203:.*'
-        target_label: hostname
-        replacement: 'saturn'
+          hostname: 'jupiter'
+      - targets: ['neptune.renner.uno:9123']
+        labels:
+          group: 'ntp'
+          type: 'time-server'
+          hostname: 'neptune'
+      - targets: ['saturn.renner.uno:9123']
+        labels:
+          group: 'ntp'
+          type: 'time-server'
+          hostname: 'saturn'
 
   # Immich photo management metrics
   - job_name: 'immich'

ansible/roles/socketcan/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+# SocketCAN interface. Consumed by heating-can.
+# --- CAN / open3e (Viessmann E3 external bus) ---
+edge_can_interface: can0
+edge_can_bitrate: 250000

ansible/roles/socketcan/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+# reload alone only re-reads config files; existing links keep their old state
+# until reconfigured.
+- name: Reload networkd
+  ansible.builtin.shell:
+    cmd: networkctl reload && networkctl reconfigure {{ edge_can_interface }}
+  changed_when: true

ansible/roles/socketcan/tasks/main.yml

@@ -0,0 +1,20 @@
+---
+# SocketCAN interface, owned by systemd-networkd.
+#
+# gs_usb is an in-tree module and autoloads when the adapter enumerates;
+# networkd then matches the interface and applies bitrate + up. Separate from
+# the services that consume the bus (heating-can, e380-can-meter) because the
+# interface is host network state shared by both.
+
+- name: Configure can0 via systemd-networkd
+  ansible.builtin.template:
+    src: 80-can0.network.j2
+    dest: /etc/systemd/network/80-can0.network
+    mode: "0644"
+  notify: Reload networkd
+
+- name: Enable systemd-networkd
+  ansible.builtin.service:
+    name: systemd-networkd
+    state: started
+    enabled: true

ansible/roles/socketcan/templates/80-can0.network.j2

@@ -1,4 +1,4 @@
-# Managed by ansible (roles/edge-host).
+# Managed by ansible (roles/socketcan).
 # Viessmann E3 external CAN bus via Innomaker USB2CAN (gs_usb).
 # The adapter is a stub tap on an already-terminated bus (120R jumper OFF).
 [Match]

ansible/roles/zwave-gateway/defaults/main.yml

@@ -0,0 +1,24 @@
+---
+# Z-Wave gateway: zwave-js-ui against the ZWA-2 USB radio.
+
+# Service root. Kept per-role so the role is usable on its own.
+edge_base_dir: /opt/edge-host
+edge_tz: Europe/Berlin
+
+# Own compose project directory. Unchanged from the path used under the
+# previous shared project, so the store is not migrated.
+zwave_base_dir: "{{ edge_base_dir }}/zwave-js"
+
+# Stable by-id symlink: the name travels with the device, not the host, so it
+# survives moving the stick between machines.
+edge_zwave_device: /dev/serial/by-id/usb-Nabu_Casa_ZWA-2_80B54EE15720-if00
+
+edge_zwavejs_image: ghcr.io/zwave-js/zwave-js-ui:11.21.1
+
+# Alpine version the zwave-js-ui image is built on -- the source for the musl
+# libeatmydata.so preloaded into that container. Keep in sync if the image
+# bumps its Alpine major (check: docker exec zwave-js cat /etc/os-release).
+edge_zwave_alpine_base: alpine:3.22
+
+# Secret from inventory/group_vars/edge_host/vault.yml:
+#   edge_zwavejs_session_secret

ansible/roles/zwave-gateway/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart zwave-js
+  ansible.builtin.command:
+    cmd: docker compose up -d --force-recreate
+    chdir: "{{ zwave_base_dir }}"
+  changed_when: true

ansible/roles/zwave-gateway/tasks/main.yml

@@ -0,0 +1,95 @@
+---
+# Z-Wave gateway: zwave-js-ui against the ZWA-2 USB radio.
+#
+# Its own compose project, in its own directory, so the Z-Wave gateway and the
+# power-meter reader are not coupled through a shared compose file. Data paths
+# are unchanged -- the store stays at {{ zwave_base_dir }}/store -- so this is a
+# project boundary change, not a data migration.
+
+- name: Create zwave-js directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+  loop:
+    - "{{ zwave_base_dir }}"
+    - "{{ zwave_base_dir }}/store"
+
+- name: Extract musl libeatmydata.so (matches the zwave-js-ui Alpine base)
+  ansible.builtin.shell:
+    cmd: |
+      set -euo pipefail
+      tmp="$(mktemp)"
+      trap 'rm -f "$tmp"' EXIT
+      docker run --rm --network=host {{ edge_zwave_alpine_base }} \
+        sh -c 'apk add --no-cache libeatmydata >/dev/null 2>&1 && cat /usr/lib/libeatmydata.so' > "$tmp"
+      test "$(stat -c%s "$tmp")" -ge 8000   # sanity: real .so is ~14 KB, guards against a failed/empty pull
+      install -m 0644 "$tmp" {{ zwave_base_dir }}/libeatmydata.so
+    creates: "{{ zwave_base_dir }}/libeatmydata.so"
+  notify: Restart zwave-js
+
+# Because fsync is neutralized, a hard power-loss during the (rare) settings
+# write could truncate settings.json — which holds the Z-Wave network keys.
+# Keep a validated rolling backup on the eMMC so the keys stay recoverable.
+- name: Install zwave-js settings.json backup script
+  ansible.builtin.template:
+    src: edge-zwave-settings-backup.j2
+    dest: /usr/local/bin/edge-zwave-settings-backup
+    mode: "0755"
+
+- name: Install zwave-js settings backup service + timer
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/etc/systemd/system/{{ item }}"
+    mode: "0644"
+  loop:
+    - edge-zwave-settings-backup.service
+    - edge-zwave-settings-backup.timer
+
+- name: Enable zwave-js settings backup timer
+  ansible.builtin.systemd:
+    name: edge-zwave-settings-backup.timer
+    enabled: true
+    state: started
+    daemon_reload: true
+
+- name: Deploy zwave-js env (session secret)
+  ansible.builtin.template:
+    src: zwavejs.env.j2
+    dest: "{{ zwave_base_dir }}/zwavejs.env"
+    mode: "0600"
+  notify: Restart zwave-js
+
+- name: Deploy zwave-js compose project
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ zwave_base_dir }}/docker-compose.yml"
+    mode: "0644"
+  notify: Restart zwave-js
+
+- name: Pull zwave-js image
+  ansible.builtin.command:
+    cmd: docker compose pull
+    chdir: "{{ zwave_base_dir }}"
+  changed_when: false
+
+# Tolerates a missing USB device: if the ZWA-2 is absent the container cannot
+# start, and that must not fail the run for everything else on the host.
+- name: Start zwave-js
+  ansible.builtin.command:
+    cmd: docker compose up -d
+    chdir: "{{ zwave_base_dir }}"
+  register: zwave_compose_up
+  failed_when: >-
+    zwave_compose_up.rc != 0
+    and 'error gathering device information' not in zwave_compose_up.stderr
+  changed_when: >-
+    'Started' in zwave_compose_up.stderr or 'Created' in zwave_compose_up.stderr
+    or 'Started' in zwave_compose_up.stdout or 'Creating' in zwave_compose_up.stdout
+
+- name: Warn if zwave-js is waiting for its USB device
+  ansible.builtin.debug:
+    msg: >-
+      zwave-js could not start -- the ZWA-2 radio is not present:
+      {{ zwave_compose_up.stderr_lines | select('search', 'device') | list }}
+  when: zwave_compose_up.rc != 0

ansible/roles/zwave-gateway/templates/docker-compose.yml.j2

@@ -0,0 +1,39 @@
+# Managed by ansible (roles/zwave-gateway).
+#
+# Its own compose project. zwave-js and the power-meter reader used to share
+# one file under {{ edge_base_dir | default('/opt/edge-host') }}; they are
+# unrelated services bound to different USB devices, so a change to one had no
+# business recreating the other.
+#
+# No `privileged` needed: docker's --device handles the device-cgroup grant
+# that hostPath in k8s could not (that was the only reason the pod ran
+# privileged).
+#
+# Host networking: real host addresses (v4+v6), no bridge, no NAT. The broker
+# LB is IPv6-first and docker bridge NAT66 is a tarpit (unmasqueraded SYNs die
+# silently); the host stack just works.
+services:
+  zwave-js:
+    image: {{ edge_zwavejs_image }}
+    container_name: zwave-js
+    restart: unless-stopped
+    stop_signal: SIGINT
+    tty: true
+    environment:
+      - TZ={{ edge_tz }}
+      # Batch the value-DB fsync storm to spare the eMMC (see the edge-flash-wear
+      # role). Neutralizes fsync only for this container; the WS/MQTT value
+      # stream to HA and cache persistence are unchanged.
+      - LD_PRELOAD=/usr/lib/libeatmydata.so
+    env_file:
+      - zwavejs.env
+    devices:
+      - "{{ edge_zwave_device }}:/dev/zwave"
+    volumes:
+      # musl libeatmydata.so extracted from the image's Alpine base (ro)
+      - ./libeatmydata.so:/usr/lib/libeatmydata.so:ro
+      # Persistent store: settings.json, device DB, network keys. Path is
+      # unchanged from the previous shared project, so nothing is migrated.
+      - ./store:/usr/src/app/store
+    # Binds 3000 (Z-Wave JS websocket for HA) and 8091 (web UI) on the host.
+    network_mode: host

ansible/roles/zwave-gateway/templates/edge-zwave-settings-backup.j2

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Rolling backup of zwave-js settings.json (holds the Z-Wave network keys).
-# Managed by roles/edge-host. edge-1 runs zwave-js under libeatmydata (fsync
+# Managed by roles/zwave-gateway. edge-1 runs zwave-js under libeatmydata (fsync
 # neutralized to spare the eMMC), so a hard power-loss during the rare
 # settings write could truncate settings.json. Keep a validated backup on the
 # eMMC so the keys are always recoverable. Runs hourly via a systemd timer.

ci/agents/update-audit/prompt.md

@@ -78,6 +78,29 @@ For each, find the **current pin in the repo** (Read/Glob/Grep), then look up th
 6. **Ansible roles & OpenTofu providers** — `ansible/requirements.yml` (Galaxy
    roles/collections) and `opentofu/providers.tf` + `opentofu/.terraform.lock.hcl`.
    Report any with a newer published version.
+7. **Edge heating CAN services** — open3e (Vitocal heat pump, Vitocharge VX3)
+   and E3onCAN (E380 grid energy meter), shipped as one image built from
+   `ci/images/heating-can/Containerfile` and deployed by
+   `ansible/roles/heating-can`. Nothing else tracks them. They read and (for two
+   datapoints) write the heat pump over its CAN bus, so silent drift here
+   matters more than most.
+
+   Both upstream pins are `ARG`s in the Containerfile -- `OPEN3E_REF` and
+   `E3ONCAN_REF` -- not Ansible variables. Read them there, and note the
+   awkward bits so normal states are not reported as problems:
+   - open3e publishes **no tags at all** (its tags API returns an empty array),
+     so compare `OPEN3E_REF` against the default branch:
+     `https://api.github.com/repos/open3e/open3e/commits?per_page=1`. Report how
+     many commits behind and the dates. "No release found" is normal here.
+   - E3onCAN tags, but sparsely, and `E3ONCAN_REF` is an untagged commit later
+     than the newest tag. Compare against both
+     `https://api.github.com/repos/MyHomeMyData/E3onCAN/tags` and the default
+     branch, and say which the pin sits between.
+
+   The deployed image tag is `heating_can_image` in
+   `ansible/roles/heating-can/defaults/main.yml`. It is `:latest` today, so the
+   node follows whatever CI last built -- the pins above are what actually fix
+   the versions, and bumping them is what requires a rebuild.
 
 ## Method & rigor
 

ci/images/heating-can/Containerfile

@@ -0,0 +1,120 @@
+# Heating system over the Viessmann E3 CAN bus: open3e (Vitocal heat pump and
+# Vitocharge VX3) and E3onCAN (E380 grid energy meter).
+#
+# One image, two services. They read the same physical installation over the
+# same bus and are versioned together, so they are one artifact -- but they run
+# as two containers from this image so either can crash and restart on its own
+# without a supervisor as PID 1.
+#
+# Why an image at all: both were pip-installed into venvs on the host, open3e
+# straight from a git URL. pip cannot compare an installed VCS dist against a
+# requested one without fetching it, so `pip install` re-cloned and rebuilt on
+# every Ansible converge -- reporting changed, restarting the service, and
+# putting a gap in heating telemetry each time. Pinning the SHA did not fix
+# that (verified: pip still clones and rebuilds a pinned VCS requirement). A
+# tagged image does: `docker compose up -d` on an unchanged tag is a genuine
+# no-op.
+#
+# It also gives the weekly update-audit a normal artifact to track instead of
+# two awkward special cases -- open3e publishes no tags at all, and E3onCAN is
+# pinned to an untagged commit between releases.
+#
+# Runtime needs host networking: SocketCAN interfaces live in the host network
+# namespace, so can0 is only reachable with network_mode: host. That is also
+# how the local MQTT broker on 127.0.0.1:1883 is reached. CAN_RAW sockets need
+# no capabilities, so both run unprivileged.
+FROM python:3.13-slim AS build
+
+# Pins live here, in the artifact, rather than in Ansible variables.
+#
+# open3e: a commit, because the project publishes NO tags (its tags API returns
+# an empty array). Self-reported package version at this commit: 0.7.5.
+ARG OPEN3E_REF=6553c10453a6bae1210908f38a5af2481a46a3e5
+# E3onCAN: an untagged commit on the default branch (2026-06-21, "Fixed: MQTT
+# client ID collision caused stale retained values"). Later than the repo's
+# only tag, v0.5.1.
+ARG E3ONCAN_REF=461dcbdf97e8d72d2edb9929c63b39382af6c3a1
+
+# git is needed to FETCH the sources and exists only in this stage. The runtime
+# stage below copies the built venv and the E3onCAN source out, so neither git
+# nor the apt cache ends up in the published image.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends git ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+
+RUN python -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+RUN pip install --no-cache-dir supervisor \
+ && pip install --no-cache-dir "git+https://github.com/open3e/open3e.git@${OPEN3E_REF}"
+
+# E3onCAN is not packaged -- it is run as a script out of its checkout, so the
+# source has to travel into the runtime image alongside its dependencies.
+RUN git clone --quiet https://github.com/MyHomeMyData/E3onCAN.git /opt/e3oncan \
+ && git -C /opt/e3oncan checkout --quiet "${E3ONCAN_REF}" \
+ && pip install --no-cache-dir -r /opt/e3oncan/requirements.txt \
+ && rm -rf /opt/e3oncan/.git
+
+
+FROM python:3.13-slim
+
+ARG OPEN3E_REF=6553c10453a6bae1210908f38a5af2481a46a3e5
+ARG E3ONCAN_REF=461dcbdf97e8d72d2edb9929c63b39382af6c3a1
+
+LABEL org.opencontainers.image.title="heating-can" \
+      org.opencontainers.image.description="open3e + E3onCAN, Viessmann E3 CAN bus readers" \
+      org.opencontainers.image.source="https://gitea.renner.uno/k.renner/homelab" \
+      uno.renner.open3e.ref="${OPEN3E_REF}" \
+      uno.renner.e3oncan.ref="${E3ONCAN_REF}"
+
+# Everything is installed at build time. The runtime image carries the finished
+# venv and source only -- no git, no compiler, no package index.
+COPY --from=build /opt/venv /opt/venv
+COPY --from=build /opt/e3oncan /opt/e3oncan
+ENV PATH="/opt/venv/bin:$PATH"
+
+# Both services log to stdout, which docker's journald driver forwards to the
+# journal and edge-log-shipper ships to Loki. open3e's systemd unit did NOT set
+# this, so its output was block-buffered and effectively never reached the
+# journal -- a long-standing blind spot that this fixes for both.
+ENV PYTHONUNBUFFERED=1
+
+# One container, two services, so PID 1 is a supervisor. It restarts either
+# reader on its own if it dies, reaps children and forwards shutdown -- which a
+# bare process as PID 1 cannot do for a sibling.
+#
+# Configuration arrives as environment variables and supervisord expands them,
+# so nothing outside this image constructs open3e's or E3onCAN's argv. Those
+# CLIs are an implementation detail here; a compose file spelling them out
+# would break whenever either upstream renamed a flag.
+COPY supervisord.conf /etc/supervisord.conf
+
+# Build-time self-test. Fails the build if either service cannot actually run,
+# which is exactly what shipped before: supervisord pointed at
+# /opt/e3oncan/src/E3onCANcollect.py, a path that does not exist -- the file is
+# at the repo root. The image built green and would have run open3e while
+# e3oncan crash-looped, the E380 meter silently absent.
+#
+# Done here rather than as a CI step because this needs no registry
+# credentials and no runner able to pull a private image -- and because a
+# broken image should never be published in the first place.
+RUN open3e --help > /dev/null \
+ && python /opt/e3oncan/E3onCANcollect.py --help > /dev/null \
+ && supervisord --help > /dev/null \
+ && grep -q '^\[program:open3e\]' /etc/supervisord.conf \
+ && grep -q '^\[program:e3oncan\]' /etc/supervisord.conf \
+ && echo "self-test OK: both services execute; supervisord has both programs"
+
+# CAN_RAW needs no capabilities, so nothing here runs as root.
+RUN useradd --system --no-create-home --shell /usr/sbin/nologin open3e
+
+# A writable working directory, owned by the service user. udsoncan writes its
+# log file into the CWD, and the native install this replaces gave open3e's
+# directory `owner: open3e` for exactly that reason. /opt is root-owned from the
+# COPY layers, so running there would fail that write.
+RUN install -d -o open3e -g open3e -m 0755 /var/lib/open3e
+
+USER open3e
+WORKDIR /var/lib/open3e
+
+ENTRYPOINT ["supervisord", "-c", "/etc/supervisord.conf"]

ci/images/heating-can/supervisord.conf

@@ -0,0 +1,62 @@
+# Both CAN readers, supervised in one container.
+#
+# They read the same heating installation over the same bus and are versioned
+# and deployed together, so they are one container. A container runs one PID 1;
+# with two processes that PID 1 is a supervisor, which is what this is --
+# supervisord restarts either service on its own if it dies, reaps children,
+# and forwards shutdown.
+#
+# Configuration comes from the environment (see the compose file). supervisord
+# expands %(ENV_NAME)s at start, so neither the compose file nor a wrapper
+# script constructs open3e's or E3onCAN's argv -- those CLIs stay an
+# implementation detail of this image.
+[supervisord]
+nodaemon=true
+user=open3e
+logfile=/dev/null
+logfile_maxbytes=0
+pidfile=/tmp/supervisord.pid
+
+# open3e: UDS request/response to the Vitocal heat pump and Vitocharge VX3.
+[program:open3e]
+command=open3e
+    -c %(ENV_CAN_INTERFACE)s
+    -cnfg %(ENV_OPEN3E_CONFIG)s
+    -m %(ENV_MQTT_HOST)s:%(ENV_MQTT_PORT)s:%(ENV_MQTT_TOPIC)s
+    -muser %(ENV_MQTT_USER)s:%(ENV_MQTT_PASSWORD)s
+    -mcid %(ENV_OPEN3E_CLIENT_ID)s
+    -mfstr %(ENV_MQTT_FORMAT)s
+    -r %(ENV_OPEN3E_DATAPOINTS)s
+    -t %(ENV_OPEN3E_POLL_SECONDS)s
+    -l %(ENV_MQTT_TOPIC)s/cmnd
+    -j
+autostart=true
+autorestart=true
+startsecs=10
+stopsignal=INT
+# Straight to the container's stdout/stderr, so docker's journald driver picks
+# them up and edge-log-shipper ships them to Loki.
+stdout_logfile=/dev/fd/1
+stdout_logfile_maxbytes=0
+redirect_stderr=true
+
+# e3oncan: passive CANopen listener for the E380 grid energy meter, which feeds
+# the heat pump's own energy management. Issues no bus writes, which is why the
+# two can share the bus.
+[program:e3oncan]
+command=python /opt/e3oncan/E3onCANcollect.py
+    -c %(ENV_CAN_INTERFACE)s
+    -dev %(ENV_E3ONCAN_DEVICE)s
+    -g %(ENV_E3ONCAN_GAP_SECONDS)s
+    -m %(ENV_MQTT_HOST)s:%(ENV_MQTT_PORT)s:%(ENV_MQTT_TOPIC)s
+    -muser %(ENV_MQTT_USER)s
+    -mpass %(ENV_MQTT_PASSWORD)s
+    -mfstr %(ENV_E3ONCAN_MQTT_FORMAT)s
+    -j
+autostart=true
+autorestart=true
+startsecs=10
+stopsignal=INT
+stdout_logfile=/dev/fd/1
+stdout_logfile_maxbytes=0
+redirect_stderr=true

images/edge-host-iso/README.md

@@ -1,7 +1,12 @@
 # edge-host installer ISO
 
-Bootable Arch installer image for `edge-1.srv.renner.uno` (the bare-metal
-N100 that replaces the k8s-edge VM — see `ansible/roles/edge-host`).
+Bootable Arch installer image for the bare-metal edge hosts — the machines
+that replaced the k8s-edge VM, because Talos cannot do CAN or USB
+passthrough. See `ansible/docs/edge-host.md`.
+
+Not tied to one box or one model: the installer autodetects the target disk
+(NVMe, else eMMC, else the first non-USB disk), which covers both the Wyse
+3040 thin clients and larger hardware.
 
 The image is the official archiso **releng** profile plus:
 - `edge-install` in the live environment — partitions the NVMe
@@ -12,7 +17,7 @@ The image is the official archiso **releng** profile plus:
 
 Division of labour: the ISO produces an **ansible-ready base system**;
 all service configuration (zwave-js-ui, sml2mqtt, open3e/CAN) stays in
-`ansible/roles/edge-host` as the single source of truth. Rebuilding the
+`ansible/docs/edge-host.md` as the single source of truth. Rebuilding the
 box is: boot ISO → `edge-install` → run the play.
 
 ## Build
@@ -38,10 +43,16 @@ archiso updates flow in automatically.
    (NVMe, else eMMC — covers the Wyse 3040 — else first non-USB disk),
    shows the target and requires typing the hostname before wiping
    anything. Override with `edge-install /dev/sdY`.
-4. Reboot, then from the workstation:
+4. Reboot. Confirm the box is reachable by name — `ssh root@<host>` — before
+   going further; it is identified by name everywhere and its address is
+   never recorded. Then add it to `[edge_host]` in
+   `ansible/inventory/pve_hosts.yml` and, from the workstation:
    ```
    cd ansible
-   ansible-playbook -i inventory/pve_hosts.yml plays/common.yml -l edge_host
    ansible-playbook -i inventory/pve_hosts.yml plays/install-edge-host.yml
    ```
-5. Continue with the cutover checklist in `ansible/roles/edge-host/README.md`.
+   One run over the whole group, no `--limit`: the play carries
+   `certificates` and `common` itself, so there is no separate `common.yml`
+   step. Running it converges every edge host, which is the point — a run
+   that touches only the new box tells you nothing about the others.
+5. Continue with the cutover checklist in `ansible/docs/edge-host.md`.

images/edge-host-iso/airootfs/usr/local/bin/edge-install

@@ -50,7 +50,7 @@ mount "$(part 2)" /mnt
 mount --mkdir "$(part 1)" /mnt/boot
 
 # Everything the edge-host ansible role expects to find; the role itself
-# is applied over SSH after first boot (see ansible/roles/edge-host).
+# is applied over SSH after first boot (see ansible/docs/edge-host.md).
 pacstrap -K /mnt base linux linux-firmware intel-ucode openssh python git \
   docker docker-compose
 
@@ -99,7 +99,13 @@ EOF
 
 umount -R /mnt
 echo
-echo "${HOST} installed. Remove the USB stick, reboot, then from the"
-echo "workstation:  cd ansible &&"
-echo "  ansible-playbook -i inventory/pve_hosts.yml plays/common.yml -l edge_host"
-echo "  ansible-playbook -i inventory/pve_hosts.yml plays/install-edge-host.yml"
+echo "${HOST} installed. Remove the USB stick and reboot."
+echo
+echo "Then, from the workstation:"
+echo "  1. confirm 'ssh root@${HOST}' works (it must be reachable by name)"
+echo "  2. add ${HOST} to [edge_host] in ansible/inventory/pve_hosts.yml"
+echo "  3. cd ansible && ansible-playbook -i inventory/pve_hosts.yml \\"
+echo "       plays/install-edge-host.yml"
+echo
+echo "One run, whole group, no --limit: the play carries certificates and"
+echo "common itself, so there is no separate common.yml step."

kubernetes/apps/home-assistant/deployment.yaml

@@ -38,7 +38,7 @@ spec:
       # gets the heavy HA pod (8Gi) off the soon-to-be-tiny edge box.
       containers:
         - name: home-assistant
-          image: ghcr.io/home-assistant/home-assistant:2026.7.4 # {"$imagepolicy": "flux-system:home-assistant"}
+          image: ghcr.io/home-assistant/home-assistant:2026.8.1 # {"$imagepolicy": "flux-system:home-assistant"}
           env:
             - name: TZ
               value: Europe/Berlin

kubernetes/apps/monitoring/pve-exporter-deployment.yaml

@@ -27,7 +27,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: pve-exporter
-          image: prompve/prometheus-pve-exporter:3.9.0 # {"$imagepolicy": "flux-system:pve-exporter"}
+          image: prompve/prometheus-pve-exporter:3.10.0 # {"$imagepolicy": "flux-system:pve-exporter"}
           # Image ENTRYPOINT is already `pve_exporter`; pass flags only.
           args:
             - --config.file=/etc/pve-exporter/pve.yml

kubernetes/apps/music-assistant/deployment.yaml

@@ -52,7 +52,7 @@ spec:
         # stdlib only; Flux keeps the tag in lockstep via the shared image
         # policy) — no extra dependency.
         - name: reconcile-publish-ip
-          image: ghcr.io/music-assistant/server:2.9.10 # {"$imagepolicy": "flux-system:music-assistant"}
+          image: ghcr.io/music-assistant/server:2.9.11 # {"$imagepolicy": "flux-system:music-assistant"}
           command: ["/app/venv/bin/python", "/scripts/reconcile.py"]
           volumeMounts:
             - name: data
@@ -62,7 +62,7 @@ spec:
               readOnly: true
       containers:
         - name: music-assistant
-          image: ghcr.io/music-assistant/server:2.9.10 # {"$imagepolicy": "flux-system:music-assistant"}
+          image: ghcr.io/music-assistant/server:2.9.11 # {"$imagepolicy": "flux-system:music-assistant"}
           env:
             - name: LOG_LEVEL
               value: info

kubernetes/apps/paperless/gotenberg.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: gotenberg
-          image: gotenberg/gotenberg:8.34.0 # {"$imagepolicy": "flux-system:gotenberg"}
+          image: gotenberg/gotenberg:8.35.0 # {"$imagepolicy": "flux-system:gotenberg"}
           args:
             - "gotenberg"
             - "--chromium-disable-javascript=true"

kubernetes/bootstrap.sh

@@ -25,7 +25,7 @@ ACCESS_STAGING="$REPO_ROOT/kubernetes/access-staging"
 NODES=(k8s-1 k8s-2 k8s-3)
 # No dedicated workers since the k8s-edge VM was retired (2026-07-02) —
 # hardware-bound services live on the bare-metal edge-1 Arch host
-# (ansible/roles/edge-host).
+# (ansible/docs/edge-host.md).
 WORKERS=()
 ALL_NODES=("${NODES[@]}" "${WORKERS[@]}")
 DOMAIN="srv.renner.uno"