feat(heating-can): read the One Base per-room telemetry over CAN

The Einzelraumsteuerung (8 radiator valves, 9 climate sensors, 9 underfloor
actuators, 3 floor thermostats) runs on Viessmann's One Base ZigBee system.
Its room and device registries and its live per-device values sit on ECU 0x6c3
(BACKENDGATEWAY) and are readable in plaintext over the E3 bus -- room
temperature, the active target temperature, humidity, valve opening, demand,
battery and RSSI. That replaces the ViCare cloud room sensors with a local
source.

0x6c3 had never been enumerated: only 0x680, 0x6a1 and 0x68c ever had a full
scan. A full read of 0x6c3 returns 155 decodable datapoints plus 35 that exist
but fail the stock codec.

Those 35 are the reason for the overlay. open3e declares
ZigBee<N>DeviceCurrentValues as 57 bytes; a PAIRED slot answers with 68 -- the
known 57 plus the parent device serial and three trailing bytes. udsoncan reads
only the declared length and then treats the next two bytes, the first half of
that serial, as a foreign data identifier, so every paired slot fails with
"Server returned values for data identifier 0x.... that was not requested". The
bogus identifier is stable per device and differs between devices because the
serial does, which is why this previously read as an encrypted channel. It is
not encrypted.

The overlay re-declares the 29 paired slots at 68 bytes and inherits upstream's
sub-type list, so the per-device-type switch -- including
DeviceTemperatureSetpoint -- comes from upstream rather than being copied.
Empty slots answer with 57, decode against the stock codec and are not polled.

Only CurrentValues are polled. The registries are static configuration and are
read on demand.

Verified against payloads captured from 0x6c3 on 2026-09-17, decoded with
open3e 0.7.5 (the commit pinned in the heating-can image): all 29 slots are 68
bytes, and a radiator valve yields ActualTemperature 19.3 °C, ValveOpening 0 %,
DeviceTemperatureSetpoint 8.0 °C, battery 38 %, RSSI -69 dBm. The setpoint
field was confirmed by changing one room in the ViCare app three times and
re-reading: 8.0 -> 15.0 -> 13.0.

Read-only. No write path to the per-room setpoint is known; writes to the
CurrentValues DID were attempted and had no effect.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ansible/roles/heating-can/defaults/main.yml

@@ -26,8 +26,16 @@ edge_open3e_poll_seconds: 30
 # entries when added), so the multi-frame read is cheap at a 30 s poll.
 # Records faults/info events only (NormalOperation, LagDeviceDtcReported,
 # LegionellaProtectionTemperatureReached) — NOT setpoint or program changes.
+# onebase.*: the 29 paired ZigBee slots on the One Base gateway (ECU 0x6c3) --
+# 8 radiator valves, 9 climate sensors, 9 underfloor actuators, 3 floor
+# thermostats. Per-device room temperature, active setpoint, humidity, valve
+# opening/demand, battery and RSSI; the local replacement for the ViCare cloud
+# room sensors. Needs the onebase overlay (files/open3e-onebase.py) -- the stock
+# codec declares 57 bytes and a paired slot answers with 68.
+# Only CurrentValues are polled. The room and device registries (1884.., 2084..)
+# are static configuration and are read on demand, not every 30 s.
 edge_open3e_datapoints: >-
-  vitocal.259,vitocal.260,vitocal.268,vitocal.269,vitocal.271,vitocal.274,vitocal.286,vitocal.288,vitocal.318,vitocal.321,vitocal.324,vitocal.335,vitocal.336,vitocal.396,vitocal.402,vitocal.403,vitocal.476,vitocal.477,vitocal.543,vitocal.548,vitocal.565,vitocal.1007,vitocal.1043,vitocal.1190,vitocal.1211,vitocal.1391,vitocal.1416,vitocal.1417,vitocal.2320,vitocal.2346,vitocal.2350,vitocal.2351,vitocal.2352,vitocal.2369,vitocal.2370,vitocal.2486,vitocal.2487,vitocal.2488,vitocal.2543,vitocal.2560,vitocal.2622,vitocal.2624,vitocal.2625,vitocal.2735,vitocal.3016,vx3.266,vx3.378,vx3.379,vx3.380,vx3.535,vx3.1603,vx3.1664,vx3.1690,vx3.1801,vx3.1802,vx3.1810,vx3.1828,vx3.1830,vx3.1577,vx3.1578,vx3.1579,vx3.1580,vx3.1581,vx3.1582,vx3.1834,vx3.1836,vx3.2214,vx3.2240,vx3.3085,vx3.3086,vx3.3087,vx3.3088,vx3.3089,vx3.3090,vcmu.320,vcmu.322,vcmu.325,vcmu.355,vcmu.389,vcmu.391,vcmu.1772,vcmu.1773,vcmu.1775,vcmu.1776,vcmu.2256,vcmu.2259,vcmu.2333,vcmu.2334,vcmu.2569,vcmu.2571,vitocal.2791
+  vitocal.259,vitocal.260,vitocal.268,vitocal.269,vitocal.271,vitocal.274,vitocal.286,vitocal.288,vitocal.318,vitocal.321,vitocal.324,vitocal.335,vitocal.336,vitocal.396,vitocal.402,vitocal.403,vitocal.476,vitocal.477,vitocal.543,vitocal.548,vitocal.565,vitocal.1007,vitocal.1043,vitocal.1190,vitocal.1211,vitocal.1391,vitocal.1416,vitocal.1417,vitocal.2320,vitocal.2346,vitocal.2350,vitocal.2351,vitocal.2352,vitocal.2369,vitocal.2370,vitocal.2486,vitocal.2487,vitocal.2488,vitocal.2543,vitocal.2560,vitocal.2622,vitocal.2624,vitocal.2625,vitocal.2735,vitocal.3016,vx3.266,vx3.378,vx3.379,vx3.380,vx3.535,vx3.1603,vx3.1664,vx3.1690,vx3.1801,vx3.1802,vx3.1810,vx3.1828,vx3.1830,vx3.1577,vx3.1578,vx3.1579,vx3.1580,vx3.1581,vx3.1582,vx3.1834,vx3.1836,vx3.2214,vx3.2240,vx3.3085,vx3.3086,vx3.3087,vx3.3088,vx3.3089,vx3.3090,vcmu.320,vcmu.322,vcmu.325,vcmu.355,vcmu.389,vcmu.391,vcmu.1772,vcmu.1773,vcmu.1775,vcmu.1776,vcmu.2256,vcmu.2259,vcmu.2333,vcmu.2334,vcmu.2569,vcmu.2571,vitocal.2791,onebase.2086,onebase.2089,onebase.2092,onebase.2095,onebase.2098,onebase.2101,onebase.2104,onebase.2107,onebase.2110,onebase.2113,onebase.2116,onebase.2119,onebase.2122,onebase.2125,onebase.2128,onebase.2131,onebase.2134,onebase.2137,onebase.2140,onebase.2143,onebase.2262,onebase.2265,onebase.2268,onebase.2271,onebase.2274,onebase.2277,onebase.2280,onebase.2283,onebase.2286
 # ECU addresses; -dev selects codec set, tx selects the UDS address.
 # vcmu (refrigerant-circuit controller) has no dedicated codec set —
 # omitting dpList makes open3e fall back to the generic datapoint list,
@@ -38,6 +46,9 @@ edge_open3e_devices:
   # files/open3e-vx3plus.py) — die Stock-vx3-Liste filtert sie sonst weg.
   vx3: { tx: "0x6a1", dpList: "/config/vx3plus.py" }
   vcmu: { tx: "0x68c" }
+  # One Base ZigBee gateway. Overlay re-declares the paired ZigBee slots at
+  # their real 68-byte length (see files/open3e-onebase.py).
+  onebase: { tx: "0x6c3", dpList: "/config/onebase.py" }
 
 edge_e3oncan_gap_seconds: 10
 edge_e3oncan_mqtt_format: "{device}_{didNumber:04d}_{didName}"

ansible/roles/heating-can/files/open3e-onebase.py

@@ -0,0 +1,54 @@
+# Managed by ansible (roles/heating-can). Datapoint overlay for the One Base
+# ZigBee gateway on ECU 0x6c3 (BACKENDGATEWAY).
+#
+# Upstream declares ZigBee<N>DeviceCurrentValues as 57 bytes. A PAIRED device
+# slot on this gateway answers with 68: the 57 known bytes plus the parent
+# device serial and three trailing bytes. udsoncan reads only the declared
+# length and then treats the next two bytes -- the first half of that serial --
+# as a foreign data identifier, so every paired slot fails to decode with
+# "Server returned values for data identifier 0x.... that was not requested".
+# The bogus identifier differs per device because the serial does.
+#
+# This overlay re-declares the 29 paired slots at 68 bytes, reusing upstream's
+# sub-type list so the per-device-type O3ESwitch (climate sensor / TRV / floor
+# thermostat / actuator, incl. DeviceTemperatureSetpoint) is inherited rather
+# than copied.
+#
+# EMPTY slots answer with 57 and decode against the stock codec, so they are
+# left alone and are not polled. A slot that is later unpaired therefore starts
+# reporting a decode error on its topic instead of a value.
+#
+# Verified on ECU 0x6c3, 2026-09-17: 29 paired slots, all 68 bytes.
+from open3e.Open3Ecodecs import O3EComplexType, RawCodec
+from open3e.Open3Edatapoints import dataIdentifiers as _master
+
+# ZigBee<N>DeviceCurrentValues of the paired slots: devices 1-20 run 2086..2143
+# in steps of 3, devices 21-29 continue at 2262..2286.
+_PAIRED_CURRENT_VALUES = [2086 + 3 * n for n in range(20)] + [
+    2262 + 3 * n for n in range(9)
+]
+
+
+def _with_parent_serial(did):
+    stock = _master["dids"][did]
+    return O3EComplexType(
+        68,
+        stock.id,
+        list(stock.subTypes)
+        + [
+            RawCodec(8, "ParentDeviceSerialnumber"),
+            RawCodec(2, "Unknown_65_66"),
+            RawCodec(1, "Unknown_67"),
+        ],
+        desc=stock.desc,
+        info=stock.info,
+        acc=stock.acc,
+    )
+
+
+dataIdentifiers = {
+    "dids": {
+        **_master["dids"],
+        **{did: _with_parent_serial(did) for did in _PAIRED_CURRENT_VALUES},
+    }
+}

ansible/roles/heating-can/tasks/main.yml

@@ -129,6 +129,13 @@
     mode: "0644"
   notify: Restart heating-can
 
+- name: Deploy open3e One Base datapoint overlay (68-byte ZigBee slots)
+  ansible.builtin.copy:
+    src: open3e-onebase.py
+    dest: "{{ heating_can_base_dir }}/onebase.py"
+    mode: "0644"
+  notify: Restart heating-can
+
 # --- Compose project ---------------------------------------------------------
 - name: Deploy the broker credential env file
   ansible.builtin.template:

ansible/roles/heating-can/templates/docker-compose.yml.j2

@@ -17,6 +17,7 @@ services:
     volumes:
       - ./devices.json:/config/devices.json:ro
       - ./vx3plus.py:/config/vx3plus.py:ro
+      - ./onebase.py:/config/onebase.py:ro
     env_file:
       # Broker credential, 0600 -- see heating-can.env.j2.
       - heating-can.env

kubernetes/apps/audiobookshelf/deployment.yaml

@@ -70,7 +70,7 @@ spec:
               mountPath: /ca
       containers:
         - name: audiobookshelf
-          image: ghcr.io/advplyr/audiobookshelf:2.36.0 # {"$imagepolicy": "flux-system:audiobookshelf"}
+          image: ghcr.io/advplyr/audiobookshelf:2.36.1 # {"$imagepolicy": "flux-system:audiobookshelf"}
           ports:
             - name: http
               containerPort: 80

kubernetes/apps/libation/cronjob.yaml

@@ -42,9 +42,11 @@ spec:
               type: RuntimeDefault
           initContainers:
             # Seed the libation-config PVC from the bootstrap secret on
-            # first run only — sentinel file gates re-runs so token
-            # refreshes in AccountsSettings.json and DB updates from
-            # subsequent liberate passes are preserved.
+            # first run only — sentinel file gates re-runs so DB updates
+            # from subsequent liberate passes are preserved. Refreshed
+            # Audible tokens are preserved by the container args, not by
+            # this sentinel: the entrypoint copies AccountsSettings.json
+            # into ephemeral /config-internal rather than symlinking it.
             - name: seed-config
               image: busybox:1.37.0
               command: ["/bin/sh", "-eu", "-c"]
@@ -66,6 +68,11 @@ spec:
                   install -m 660 /bootstrap/AccountsSettings.json /libation-state/AccountsSettings.json
                   install -m 660 /bootstrap/Settings.json          /libation-state/Settings.json
                   install -m 660 /bootstrap/LibationContext.db     /libation-state/LibationContext.db
+                  # Without this key the seeded tokens cannot be decrypted:
+                  # TokenStorageMethod is Encrypted and the container has no
+                  # OS secret store, so a missing key file makes the
+                  # entrypoint mint a throwaway one on every run.
+                  install -m 660 /bootstrap/libation-master.key   /libation-state/libation-master.key
                   touch /libation-state/.bootstrapped
                   ls -la /libation-state
               volumeMounts:
@@ -85,7 +92,23 @@ spec:
                   type: RuntimeDefault
           containers:
             - name: libation
-              image: docker.io/rmcrackan/libation:latest
+              # Pinned by digest: Spegel caches mutable tag resolutions, so
+              # :latest stayed on 13.7.11 despite imagePullPolicy Always.
+              image: docker.io/rmcrackan/libation:14.2.1@sha256:6f9d8ba19dc3803dd6ba295ab5a7abfb6ff3bc06286eebf4ecd8ccbe43245888
+              # The entrypoint stages config into ephemeral /config-internal
+              # by copy (only the DB is symlinked to the PVC), so Audible
+              # tokens refreshed during a run are lost at container exit.
+              # Passing args makes the entrypoint set up the environment and
+              # then exec this instead of its own loop; the trap copies the
+              # refreshed file back to the PVC on every exit path.
+              args:
+                - /bin/sh
+                - -c
+                - |
+                  trap 'cp /config-internal/AccountsSettings.json /libation-state/AccountsSettings.json' EXIT
+                  set -e
+                  /libation/LibationCli scan
+                  /libation/LibationCli liberate
               env:
                 - name: LIBATION_CONFIG_DIR
                   value: /libation-state

kubernetes/apps/paperless/ftp-scanner.yaml

@@ -43,7 +43,7 @@ spec:
               mountPath: /consume
       containers:
         - name: vsftpd
-          image: gitea.renner.uno/k.renner/vsftpd:build.1784731469 # {"$imagepolicy": "flux-system:vsftpd"}
+          image: gitea.renner.uno/k.renner/vsftpd:build.1789630783 # {"$imagepolicy": "flux-system:vsftpd"}
           ports:
             - name: ftp-ctrl
               containerPort: 21
@@ -70,24 +70,19 @@ spec:
             - name: consume
               mountPath: /home/scanner
               subPath: scanner
-          # FTP has no health verb, so the control port accepting a connection
-          # is what can be asserted. It is enough for the failure that matters:
-          # if vsftpd dies the scanner cannot deposit anything and nothing else
-          # in the chain notices, because paperless only ever sees an empty
-          # consume directory — which is indistinguishable from nobody having
-          # scanned.
-          #
-          # Only the control port is probed. The passive range is negotiated
-          # per transfer and is not listening at rest.
+          # Asserts the control socket is listening without opening an FTP
+          # connection: vsftpd 3.0.5 segfaults its listener on a fraction of
+          # the connections it accepts. The passive range is negotiated per
+          # transfer and is not listening at rest, so it is not probed.
           livenessProbe:
-            tcpSocket:
-              port: ftp-ctrl
+            exec:
+              command: ["sh", "-c", "netstat -lnt | grep -q ':21 '"]
             initialDelaySeconds: 15
             periodSeconds: 30
             timeoutSeconds: 5
           readinessProbe:
-            tcpSocket:
-              port: ftp-ctrl
+            exec:
+              command: ["sh", "-c", "netstat -lnt | grep -q ':21 '"]
             initialDelaySeconds: 5
             periodSeconds: 10
             timeoutSeconds: 5

kubernetes/apps/paperless/kustomization.yaml

@@ -25,18 +25,15 @@ resources:
 configMapGenerator:
   # vsftpd config for the ftp-scanner deployment. The content-hash name
   # suffix is intentionally LEFT ENABLED (unlike home-assistant's nginx
-  # config): vsftpd templates pasv_address from PASV_ADDRESS at container
-  # start, so a changed value must roll the pod. With the hash suffix,
-  # editing any value here renames the generated ConfigMap, which mutates
-  # the Deployment's pod template and triggers an automatic rolling
-  # restart. Without it, an IP change (e.g. an LB re-allocation) silently
-  # leaves the running pod advertising the stale PASV address, which
-  # breaks classic-PASV clients (older Brother scanners) while EPSV
-  # clients keep working.
+  # config): vsftpd reads these into vsftpd.conf at container start, so a
+  # changed value must roll the pod, which the renamed ConfigMap does.
+  #
+  # No PASV_ADDRESS: the LB address is declared once, on the Service
+  # (io.cilium/lb-ipam-ips). The image default 0.0.0.0 tells PASV clients
+  # to reuse the control-connection address.
   - name: ftp-scanner-config
     namespace: paperless
     literals:
-      - PASV_ADDRESS=10.2.99.82
       - PASV_MIN_PORT=21100
       - PASV_MAX_PORT=21104
       - FTP_USER=scanner

kubernetes/apps/trmnl/terminus.yaml

@@ -134,7 +134,7 @@ spec:
         # is a device-bricking class of risk. Bumps are a reviewed, manual
         # act — see kubernetes/infrastructure/image-automation/README.md.
         - name: terminus
-          image: ghcr.io/usetrmnl/terminus:0.73.0 # {"$imagepolicy": "flux-system:terminus"}
+          image: ghcr.io/usetrmnl/terminus:0.74.0 # {"$imagepolicy": "flux-system:terminus"}
           ports:
             - name: http
               containerPort: 2345
@@ -197,7 +197,7 @@ spec:
             capabilities:
               drop: ["ALL"]
         - name: sidekiq
-          image: ghcr.io/usetrmnl/terminus:0.73.0 # {"$imagepolicy": "flux-system:terminus"}
+          image: ghcr.io/usetrmnl/terminus:0.74.0 # {"$imagepolicy": "flux-system:terminus"}
           command: ["bundle", "exec", "sidekiq", "-r", "./config/sidekiq.rb"]
           envFrom:
             - configMapRef: