docs(trmnl): note the expected Google drops from the renderer's Chromium

About 43k POLICY_DENIED a day from trmnl-renderer to Google update and account hosts. Source (OCI label): usetrmnl/trmnl-home-assistant dd556e6; the Chromium flags are a fixed list in screenshot.ts:78 with no env or option override, and --disable-background-networking is not among them. Nothing on our side can switch it off; the denies are correct. S28-4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge pull request 'fix(mdns-relay): turn off RA on net1 so the IPv6 forward uses eth0' (#1598 ) from fix/mdns-relay-no-ra into main
2026-11-07 21:00:44 +01:00 · 2026-11-07 19:43:47 +00:00 · 2026-11-07 20:41:46 +01:00 · 2026-11-07 19:29:05 +00:00 · 2026-11-07 20:28:18 +01:00 · 2026-11-07 20:25:25 +01:00
175 changed files with 5830 additions and 1859 deletions
@@ -41,13 +41,14 @@ when:
      - "ci/images/**"
      - "secret-rotator/**"
      - "review-bot/**"
+      - "wlan-setup/**"
      - ".woodpecker/build-ci-images.yml"
  - event: deployment
    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "build-ci-images"'

 steps:
  - name: build-ansible
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/ansible
    # Only rebuild when THIS image's source (or the pipeline file) changed, or
    # on a manual run. Without this every step ran on any matching push, so a
@@ -74,7 +75,7 @@ steps:
          --destination gitea.renner.uno/gitea_admin/ci-ansible:latest

  - name: build-k8s
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/k8s
    when:
      - event: deployment
@@ -97,7 +98,7 @@ steps:
          --destination gitea.renner.uno/gitea_admin/ci-k8s:latest

  - name: build-vmtest
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/vmtest
    when:
      - event: deployment
@@ -120,7 +121,7 @@ steps:
          --destination gitea.renner.uno/gitea_admin/ci-vmtest:latest

  - name: build-tofu
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/tofu
    when:
      - event: deployment
@@ -150,7 +151,7 @@ steps:
  # Runtime image, not CI tooling: a static musl binary in a FROM-scratch image,
  # used as the base for secret-rotation CronJobs. Replaces per-job inline Python.
  - name: build-secret-rotator
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: secret-rotator
    when:
      - event: deployment
@@ -175,7 +176,7 @@ steps:
  # review-bot: the Go service that reviews pull requests with a Mistral agent (webhook plus sweep).
  # Runs after Gitea is up, so no ghcr mirror.
  - name: build-review-bot
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: review-bot
    when:
      - event: deployment
@@ -197,6 +198,31 @@ steps:
          --destination gitea.renner.uno/gitea_admin/review-bot:$TAG \
          --destination gitea.renner.uno/gitea_admin/review-bot:latest

+  # wlan-setup: the Go service behind wlan.renner.uno (802.1X/Passpoint setup page with per-device
+  # authentik app passwords). Runs after Gitea is up, so no ghcr mirror.
+  - name: build-wlan-setup
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    directory: wlan-setup
+    when:
+      - event: deployment
+      - event: push
+        path: ["wlan-setup/**", ".woodpecker/build-ci-images.yml"]
+    environment:
+      GITEA_USER: gitea_admin
+      GITEA_TOKEN:
+        from_secret: ci_images_token
+    commands:
+      - mkdir -p /kaniko/.docker
+      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
+      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
+      - TAG=$(date +%Y-%m-%d-%H%M)
+      - |
+        /kaniko/executor \
+          --context . \
+          --dockerfile Containerfile \
+          --destination gitea.renner.uno/gitea_admin/wlan-setup:$TAG \
+          --destination gitea.renner.uno/gitea_admin/wlan-setup:latest
+
  # Runtime image, not CI tooling: a general-purpose alpine + jq base for
  # workloads that need to read JSON from a shell script. Named for what it IS,
  # not for who uses it — its first consumer is the zigbee2mqtt seed-data init
@@ -225,7 +251,7 @@ steps:
  #
  # The gitea_admin/ copy stays until nothing references it any more.
  - name: build-alpine-jq
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/alpine-jq
    when:
      - event: deployment
@@ -276,7 +302,7 @@ steps:
  # note on build-alpine-jq. Anything an app needs while the cluster is still
  # being built cannot live only in that cluster's own registry.
  - name: build-cni-plugins
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/cni-plugins
    when:
      - event: deployment
@@ -316,7 +342,7 @@ steps:
  # gitea.renner.uno is not there to serve it. A cold-rebuild rehearsal left
  # paperless in Init:ErrImagePull on exactly this image.
  - name: build-alpine-openssl
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/alpine-openssl
    when:
      - event: deployment
@@ -351,7 +377,7 @@ steps:
  # Ansible converge. Not a ci-* image -- it is a runtime artifact -- but it
  # builds the same way and lands in the same registry so the audit sees it.
  - name: build-heating-can
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/heating-can
    when:
      - event: deployment
@@ -377,7 +403,7 @@ steps:
  # services (public Ingress hosts -> TLS passthrough -> Traefik ClusterIP).
  # Runtime artifact like heating-can; same registry so the audit tracks it.
  - name: build-netbird-service-sync
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/netbird-service-sync
    when:
      - event: deployment
@@ -402,7 +428,7 @@ steps:
  # authentik-gate-sync: the authentik-gate ingress class (Ingress -> Authentik
  # proxy gate + Traefik route). Its unit tests run as a stage of the image build.
  - name: build-authentik-gate-sync
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/authentik-gate-sync
    when:
      - event: deployment
@@ -428,7 +454,7 @@ steps:
  # kuma-sync: reconciles KumaMonitor resources into Uptime Kuma. Its unit
  # tests run as a stage of the image build.
  - name: build-kuma-sync
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/kuma-sync
    when:
      - event: deployment
@@ -454,7 +480,7 @@ steps:
  # cloudflare-lb-sync: reconciles CloudflareLoadBalancer resources into
  # Cloudflare. Its unit tests run as a stage of the image build.
  - name: build-cloudflare-lb-sync
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/cloudflare-lb-sync
    when:
      - event: deployment
@@ -480,7 +506,7 @@ steps:
  # bird: BGP daemon for the pod-network mesh over pod0 (#576). Runtime
  # artifact like heating-can; same registry so the audit tracks it.
  - name: build-bird
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/bird
    when:
      - event: deployment
@@ -504,7 +530,7 @@ steps:

  # Orchestrator for the monthly backup-verify CronJob (velero ns).
  - name: build-backup-verify
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/backup-verify
    when:
      - event: deployment
@@ -131,7 +131,7 @@ steps:
  #    --build-arg to the resolved version (not "latest") guarantees the tag and
  #    the image content agree even if a new release lands mid-run.
  - name: build
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/claude
    depends_on: [decide]
    environment:
@@ -172,7 +172,7 @@ steps:
  # whenever it trails the deployed server. If you bump the server, bump here.
  - name: woodpecker-lint
    depends_on: [] # see note above `steps:`
-    image: woodpeckerci/woodpecker-cli:v3.19.0-alpine@sha256:27a77117e38d7bbdc380f0e90ff3ee4871ab1eefa78b5d9136a2c969fbecd9f4
+    image: woodpeckerci/woodpecker-cli:v3.20.1-alpine@sha256:74c576faf49cce699825d11c7d7bd38ab5f007dd4f57cdbdd55099d2c0f2621a
    commands:
      - |
        set -eu
@@ -35,25 +35,25 @@ when:
 steps:
  - name: model-selection-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    commands:
      - sh scripts/ci/test-model-selection.sh

  - name: pr-review-mistral-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    commands:
      - sh scripts/ci/test-pr-review-mistral.sh

  - name: promtool-rules-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    commands:
      - sh scripts/ci/test-promtool-rules.sh

  - name: yaml-citations-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    commands:
      - sh scripts/ci/test-yaml-citations.sh

@@ -63,7 +63,7 @@ steps:
  # bridge, and the secret guard.
  - name: hermes-skill-tests
    depends_on: []
-    image: python:3.15-alpine@sha256:d44b1254cb92329418d164b22b20d86bbd3869d48e80e09e476531a409a728bb
+    image: python:3.15-alpine@sha256:20a82dbc2783112ddb91d1534603f802d222a3e63e593cd002eb2ac534e70211
    environment:
      PYTHONDONTWRITEBYTECODE: "1"
    commands:
@@ -26,7 +26,7 @@ steps:
    # fetch-models.sh response mapping. No cluster, no secrets, no network — the
    # ci-claude image just provides sh + jq. Keeps the flag-injection regression
    # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    commands:
      - sh scripts/ci/test-model-selection.sh

@@ -10,7 +10,7 @@ when:

 steps:
  - name: build
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
    directory: ci/images/hermes
    environment:
      # registry-bot write:package PAT (konairius org secret).
@@ -6,7 +6,7 @@ when:

 steps:
  - name: go-test
-    image: golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
+    image: golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9
    commands:
      - test -z "$(gofmt -l review-bot)"
      - go -C review-bot vet ./...
@@ -70,7 +70,7 @@ steps:
    # this step is skipped — otherwise we'd fork-bomb PRs.
    when:
      - branch: main
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -30,7 +30,7 @@ when:

 steps:
  - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -0,0 +1,13 @@
+# Tests for the wlan-setup Go service (wlan-setup/). Offline: the tests run against a fake
+# authentik server, so the step needs no secret and no network beyond the module cache.
+when:
+  - event: pull_request
+    path: ["wlan-setup/**", ".woodpecker/wlan-setup-test.yml"]
+
+steps:
+  - name: go-test
+    image: golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9
+    commands:
+      - test -z "$(gofmt -l wlan-setup)"
+      - go -C wlan-setup vet ./...
+      - go -C wlan-setup test -race ./...
@@ -1,13 +1,17 @@
 # edge-host — bare-metal Arch thin client (replaces the k8s-edge Talos VM)

 Runs the hardware-bound services that used to be pinned to the `k8s-edge`
-Talos node (opentofu `vm_153_k8s_edge.tf`), plus the new CAN bridge:
+Talos node (opentofu `vm_153_k8s_edge.tf`):

 | Service | How it runs | Hardware | Talks to |
 |---|---|---|---|
 | zwave-js-ui | docker compose | ZWA-2 Z-Wave USB radio | HA `zwave_js` via ws://:3000, UI :8091 |
 | sml2mqtt | docker compose | FTDI FT230X meter reader | Mosquitto (`sml2mqtt` user) |
-| open3e | venv + systemd | Innomaker USB2CAN (gs_usb) | Mosquitto (`open3e` user) |
+
+The Viessmann E3 CAN bus is not read by an edge host: the ESP32 gateway
+`vitocal-can` (open3e-esp32) at the Vitocal publishes `open3e/#` directly to
+the cluster broker. `plays/install-edge-host.yml` removes the former
+heating-can stack and the can0 configuration from edge hosts.

 Everything else that once lived on k8s-edge (HA core, matter-server, OTBR,
 music-assistant) already moved to the general node pool and stays in the
@@ -19,17 +23,13 @@ The deployed unit is a **Dell Wyse 3040** (Atom x5-Z8350, 2 GB RAM) on a
 flash-wear handling that hardware implies. The installer also supports an
 N100/NVMe box; it autodetects the target disk, so either works.

-Rationale for leaving Kubernetes for the CAN part: the stock Talos kernel
-ships with `CONFIG_CAN` unset (siderolabs/talos#7686), so SocketCAN cannot
-work in any pod without a custom kernel image per Talos release.
-
 ## Base install (once, from the edge-host installer ISO)

 Build and boot the dedicated installer image — see
 `images/edge-host-iso/README.md`. Short version:

 1. `sudo pacman -S archiso && sudo images/edge-host-iso/build.sh`
-2. Write ISO to a USB stick, boot the target box from it, run `edge-install`
+2. Write ISO to a USB stick, boot the target box from it, run `edge-install <hostname>`
   (partitions the internal disk — NVMe if present, else the eMMC; the
   installer autodetects — installs the ansible-ready base system with SSH
   keys, DHCP, docker — asks for confirmation before wiping).
@@ -58,24 +58,18 @@ inventory change.

 | device | group | playbook |
 |---|---|---|
-| Innomaker USB2CAN (Vitocal/VX3 + E380) | `heating_can` | `plays/install-heating-can.yml` |
 | Nabu Casa ZWA-2 Z-Wave radio | `zwave_gateway` | `plays/install-zwave-gateway.yml` |

-Add the host to the matching group, then run that playbook. They depend on
-the base play having run: all three need the local MQTT bridge, and two of
-them need docker.
+Add the host to the matching group, then run that playbook. It depends on
+the base play having run: it needs docker.

-A host with nothing attached is simply absent from all three groups and needs
+A host with nothing attached is simply absent from these groups and needs
 none of these commands.

 ## Secrets (before first play run)

 Create `inventory/group_vars/edge_host/vault.yml` with ansible-vault. The
-cluster broker has no `open3e` user: edge-1 logs in only as the register
-account `edge-1` (see "MQTT bridge" below), so
-`vault_edge_open3e_mqtt_password` reaches only the loopback broker, which
-allows anonymous clients; any random value works (`openssl rand -hex 24`).
-The zwave-js value comes out of the cluster:
+zwave-js value comes out of the cluster:

 ```
 # zwave-js session secret
@@ -84,7 +78,6 @@ kubectl -n home-assistant get secret zwave-js-session -o jsonpath='{.data.sessio

 ```yaml
 # vault.yml
-vault_edge_open3e_mqtt_password: "..."
 vault_edge_zwavejs_session_secret: "..."
 vault_edge_loki_password: "..."   # dedicated edge-1 Loki push cred (see "Logging & eMMC")
 ```
@@ -102,9 +95,6 @@ The Z-Wave network keys do NOT need separate handling — they live in

 Preparation:
 - [ ] `vault.yml` populated (above), play runs green against edge-1
- [ ] CAN: Innomaker adapter connected to the VX3 external CAN port,
-      `ip -details link show can0` shows `state ERROR-ACTIVE bitrate 250000`,
-      `candump can0 -n 5` shows frames

 zwave-js (order matters — never two servers on one radio):
 - [ ] Copy the store out of the PVC while the pod still runs:
@@ -122,11 +112,6 @@ sml2mqtt:
      port, Wh stays Wh) → remove sml2mqtt from the home-assistant
      kustomization in the follow-up PR

-open3e:
- [ ] Stop any workstation listener (ONE instance per bus, hard rule)
- [ ] Move the USB2CAN adapter, `systemctl start open3e`
- [ ] Topics under `open3e/#` update on the broker
-
 Afterwards:
 - [ ] Retire VM 153: remove `vm_153_k8s_edge.tf`, `talos/patches/k8s-edge.yaml`,
      node from the cluster (`kubectl delete node k8s-edge`, tofu apply)
@@ -134,22 +119,13 @@ Afterwards:

 ## Day-2 notes

- Image bumps: edit `edge_zwavejs_image` / `edge_sml2mqtt_image` in
-  defaults and re-run the play (no flux image-automation out here —
-  deliberate for sml2mqtt, acceptable for zwave-js). If a zwave-js bump
-  changes its Alpine major, also update `edge_zwave_alpine_base` and refresh
-  the preloaded `.so` (see "Logging & eMMC" → zwave-js).
- open3e / E3onCAN updates: both are pinned to commits in
-  `roles/heating-can/defaults/main.yml`, so re-running the play does NOT pick
-  up upstream changes -- that is deliberate, these drive the heat pump. The
-  weekly update-audit reports when either falls behind (see
-  `ci/agents/update-audit/prompt.md`); bump the pin and re-run.
-  Pinning to a tag is not an option for open3e: it publishes none.
- Ad-hoc CAN scans: `systemctl stop open3e` first (single-instance rule),
-  restart afterwards.
- can-utils (`candump`) is AUR-only on Arch — install manually via
-  `pamac build can-utils` if needed for debugging; the role deliberately
-  doesn't manage AUR packages.
+- Image bumps: Renovate opens a PR for `edge_*_image` in
+  `roles/*/defaults/main.yml` (tag + digest, `customManagers` in
+  `renovate.json`). No pipeline deploys to edge-1, so after the merge run
+  `ansible-playbook plays/install-zwave-gateway.yml` from `ansible/` on a
+  mesh-connected workstation. The play reads the image's Alpine release
+  itself and rebuilds the preloaded `.so` when it changes (see
+  "Logging & eMMC" → zwave-js).

 ## Logging & eMMC

@@ -162,7 +138,9 @@ role keeps logs off local flash and monitors wear:
 - **Docker logs to journald** (`docker-daemon.json`, `log-driver: journald`)
  instead of unbounded json files under `/var/lib/docker/containers`. Both
  compose services inherit it; `docker logs` still works.
- **Grafana Alloy ships the journal to Loki** (`edge-alloy.service`). Its
+- **Grafana Alloy ships the journal to Loki** (`edge-alloy.service`, which
+  runs the upstream `grafana/alloy` image with `/run/log/journal` mounted
+  read-only; Arch's `grafana-alloy` package has no `loki.source.journal`). Its
  WAL/positions sit on `/run/alloy` (tmpfs), so the agent writes nothing to
  the eMMC either. Net effect: no log writes hit local flash — the trade-off
  is that logs are RAM-only and lost on reboot unless already shipped.
@@ -190,7 +168,7 @@ journal commit).

 - **Fix:** the `zwave-js` container preloads **`libeatmydata`**
  (`LD_PRELOAD=/usr/lib/libeatmydata.so`, mounted read-only from
-  `zwave-js/libeatmydata.so`). This makes `fsync`/`fdatasync` no-ops *for that
+  `zwave-js/libeatmydata-alpine<X.Y>.so`). This makes `fsync`/`fdatasync` no-ops *for that
  one process*, so the kernel batches the writes via normal writeback (~30 s)
  instead of forcing each one. The WS/MQTT value stream to Home Assistant and
  the on-disk cache are **unchanged** — full data resolution, no re-interview
@@ -199,9 +177,9 @@ journal commit).
  batch it); the only mount-level alternative is putting the cache on tmpfs,
  which makes the *whole* store volatile → re-interview on every restart.
 - **The `.so` is musl** (the image is Alpine-based), extracted from
-  `edge_zwave_alpine_base` — keep that var in sync with the image's Alpine
-  version; to refresh after a major bump, `rm zwave-js/libeatmydata.so` and
-  re-run.
+  `alpine:<X.Y>`, where `X.Y` is read from the image's `/etc/alpine-release`
+  on every run. A new Alpine release gives a new file name, so the play
+  extracts it, recreates the container and deletes the old file.
 - **Durability guard:** because `fsync` is neutralized, a hard power-loss
  during the (rare) settings write could truncate `settings.json`, which holds
  the **Z-Wave network keys**. `edge-zwave-settings-backup.timer` keeps a
@@ -211,47 +189,3 @@ journal commit).
 - Verify the drop with the eMMC-write sampling described above; roll back by
  removing the `LD_PRELOAD` env + `.so` mount from the compose file.

-## MQTT bridge (TLS to the cluster broker)
-
-open3e, e3oncan and sml2mqtt do **not** publish to the cluster broker directly.
-They connect to a **local mosquitto on loopback** (`127.0.0.1:1883`,
-`edge_mqtt_host`), which **bridges to the cluster broker over TLS**
-(`mqtt.renner.uno:8883`). Two reasons:
-
- **Security:** open3e and e3oncan have no native MQTTS support (their MQTT
-  code does a plain `connect()`), so they can't use the broker's 8883 TLS
-  listener. Terminating TLS in the local broker keeps their plaintext MQTT on
-  loopback only — off the untrusted IoT VLAN — while the actual network hop is
-  encrypted. The public Let's Encrypt cert is validated against the system CA
-  bundle (`edge_mqtt_bridge_cafile`); no cert distribution needed.
- **Availability:** the local broker buffers telemetry (in RAM) if the cluster
-  broker is briefly unreachable, and flushes on reconnect — edge-1 no longer
-  hard-depends on cluster/network uptime for every publish.
-
-The local broker is `allow_anonymous` on loopback — the trust boundary is the
-host; nothing off-host can reach it.
-
-**Bridge credential (REN-1307).** One bridge `connection` logs in as the
-register account `edge-1` (`kubernetes/apps/home-assistant/mqtt-accounts.yaml`)
-and carries `open3e/#` out and `open3e/cmnd` back. The cluster broker does not
-accept the vault-password bridges in `bridge.d/legacy.conf`, which exists only
-until the first push. Its password is pushed
-by mqtt-account-controller to `edge-mqtt-cred` (`:8443`, the controller's
-esp32 API over HTTPS). That endpoint accepts only a client certificate from
-the MQTT CA with CN `mqtt-account-controller`; edge-1 holds the public CA and
-its own server key, nothing else. On a push it writes
-`/etc/mosquitto/bridge.d/edge-1.conf`, deletes `bridge.d/legacy.conf` and
-restarts the local mosquitto. The controller sets a new password whenever the
-bridge reports "not connected" (also after a reinstall), so no play run is
-needed for a rotation. Diagnosis: `journalctl -u
-edge-mqtt-cred`, and `mosquitto_sub -t '$SYS/broker/connection/edge-1/state'`
-(retained `1` = connected).
-
-**eMMC:** the local broker writes **nothing** to flash — `persistence false`
-(retained/queued messages in RAM) and `log_dest stdout` (to the volatile
-journal → Loki). Do not add persistence or log-file settings to
-`edge-mqtt-bridge.conf.j2`.
-
-Rollback: point `edge_mqtt_host` back to `mqtt.renner.uno` and re-run (clients
-reconnect directly on 1883). Config: `edge-mqtt-bridge.conf.j2` →
-`/etc/mosquitto/mosquitto.conf`.
@@ -2,7 +2,6 @@
 # Secret indirection — real values live in vault.yml (ansible-vault) next
 # to this file; see docs/edge-host.md for how to populate it from
 # the cluster secrets.
-edge_open3e_mqtt_password: "{{ vault_edge_open3e_mqtt_password }}"
 edge_zwavejs_session_secret: "{{ vault_edge_zwavejs_session_secret }}"
 # Loki push credential (dedicated 'edge-1' user, Traefik basic-auth on the
 # loki.renner.uno ingress; the matching htpasswd line lives in the cluster
@@ -36,25 +35,8 @@ keepalived_ntp_sysctl:
 # Realtek NIC on the Wyse 3040 has no hardware timestamping.
 chrony_hwtimestamp: false

-# --- Local MQTT contract -------------------------------------------------
-# Shared between the broker and its clients, so it belongs to the inventory
-# rather than to either side's role. mqtt-bridge listens here; heating-can
-# publishes here; and the bridge authenticates to the cluster
-# broker AS the open3e user, so it needs that identity too.
-#
-# Keeping these in one role's defaults only worked while a single play loaded
-# every role at once. Splitting the plays by capability exposed it: the bridge
-# could not render without a heating-can default, and the CAN services could
-# not render without an mqtt-bridge default.
-edge_mqtt_host: 127.0.0.1
-edge_mqtt_port: 1883
-edge_open3e_mqtt_user: open3e
-edge_open3e_mqtt_topic: open3e
-
 # Units claude-bot may restart (ssh-ca role); the containers go through docker.
 ssh_ca_claude_sudo_units:
-  - mosquitto
-  - edge-mqtt-cred
  - edge-alloy
  - keepalived
  - chronyd
@@ -18,10 +18,11 @@ proxy-1.renner.uno ansible_host=proxy-1.nb.renner.uno ansible_user=root
 proxy-2.renner.uno ansible_host=proxy-2.nb.renner.uno ansible_user=root

 # Every bare-metal edge thin client. Gets the host-generic roles only:
-# flash-wear handling, the log shipper, the MQTT bridge, the VLAN
-# sub-interface. Nothing here assumes any peripheral is attached.
+# flash-wear handling, the log shipper, the VLAN sub-interface. Nothing here
+# assumes any peripheral is attached.
 [edge_host]
 edge-1.iot.renner.uno ansible_user=root
+edge-2.iot.renner.uno ansible_user=root

 # Synology NAS (DSM): nas-1 RS1221+ on site, nas-2 DS1522+ off site.
 [synology_nas]
@@ -36,32 +37,18 @@ nas-2.renner.uno ansible_user=root
 # These are children of [edge_host], declared below: a peripheral is added to an
 # edge client, it does not replace the base. Making that a :children relation
 # rather than a comment means a host added only to a capability group still
-# resolves group_vars/edge_host -- where the local MQTT contract lives -- so it
-# cannot silently come up without edge_mqtt_host and friends.
+# resolves group_vars/edge_host.
 [zwave_gateway]
 edge-1.iot.renner.uno

-[heating_can]
-edge-1.iot.renner.uno
-
 [edge_host:children]
 zwave_gateway
-heating_can

-# NTP servers. edge-1 was added here so the role would survive the PVE hosts
-# being retired for bare-metal Talos, which cannot run chrony or keepalived
-# itself. That retirement has now happened, so edge-1 is the ONLY member.
-#
-# THIS IS NO LONGER HIGHLY AVAILABLE. The group was jupiter (MASTER, prio 100),
-# saturn (90), neptune (80) and edge-1 (BACKUP, 70); the first three are gone.
-# A single VRRP member takes the address regardless of its configured state, so
-# the service address is still served, but by one thin client with
-# no failover behind it. install-ntp-ha.yml still carries the four-host
-# ntp_servers priority map, which now describes hosts that do not exist.
-#
-# Restoring redundancy needs a second chrony host that is not a Talos node.
-# See plays/install-ntp-ha.yml for why keepalived is scoped more narrowly than
-# chrony within this group.
+# NTP servers: every edge host (edge-1 BACKUP prio 70, edge-2 BACKUP prio 60;
+# see the ntp_servers map in plays/install-ntp-ha.yml). Talos nodes cannot run
+# chrony or keepalived. The jupiter/saturn/neptune entries in that map
+# describe retired PVE hosts. See plays/install-ntp-ha.yml for why keepalived
+# is scoped more narrowly than chrony within this group.
 [ntp_cluster:children]
 edge_host

@@ -73,6 +60,7 @@ proxy-1.renner.uno
 proxy-2.renner.uno
 netbird.renner.uno
 edge-1.iot.renner.uno
+edge-2.iot.renner.uno
 nas-1.renner.uno
 nas-2.renner.uno

@@ -1,70 +0,0 @@
---
-# Configure VMs to use host time sync via kvm-clock
-# Disables systemd-timesyncd to prevent NTP conflicts
-#
-# VMs get time from Proxmox host via kvm-clock paravirtualized clock
-# This is more accurate and reliable than network NTP for VMs
-
- name: Configure VM time synchronization from host
-  hosts: all
-  become: yes
-  gather_facts: yes
-
-  tasks:
-    - name: Check if running as VM (not LXC)
-      stat:
-        path: /sys/devices/system/clocksource/clocksource0/current_clocksource
-      register: clocksource_file
-
-    - name: Get current clock source
-      slurp:
-        src: /sys/devices/system/clocksource/clocksource0/current_clocksource
-      register: clocksource
-      when: clocksource_file.stat.exists
-
-    - name: Display clock source
-      debug:
-        msg: "Clock source: {{ (clocksource.content | b64decode | trim) if clocksource_file.stat.exists else 'N/A (LXC)' }}"
-
-    - name: Check if systemd-timesyncd is installed
-      command: systemctl list-unit-files systemd-timesyncd.service
-      register: timesyncd_installed
-      check_mode: false
-      failed_when: false
-      changed_when: false
-
-    - name: Stop and disable systemd-timesyncd on VMs using kvm-clock
-      systemd:
-        name: systemd-timesyncd
-        state: stopped
-        enabled: no
-      when:
-        - clocksource_file.stat.exists
-        - clocksource.content is defined
-        - "'kvm-clock' in (clocksource.content | b64decode)"
-        - "'systemd-timesyncd.service' in timesyncd_installed.stdout"
-
-    - name: Mask systemd-timesyncd to prevent re-enabling
-      systemd:
-        name: systemd-timesyncd
-        masked: yes
-      when:
-        - clocksource_file.stat.exists
-        - clocksource.content is defined
-        - "'kvm-clock' in (clocksource.content | b64decode)"
-        - "'systemd-timesyncd.service' in timesyncd_installed.stdout"
-
-    - name: Verify time sync status
-      command: timedatectl show --property=NTPSynchronized
-      register: timesync_status
-      check_mode: false
-      changed_when: false
-      failed_when: false
-
-    - name: Display final status
-      debug:
-        msg: |
-          Host: {{ inventory_hostname }}
-          Type: {{ 'VM (kvm-clock)' if (clocksource_file.stat.exists and 'kvm-clock' in (clocksource.content | b64decode | default(''))) else 'LXC/Other' }}
-          Time sync: {{ timesync_status.stdout | default('unknown') }}
-          Note: VMs sync time from Proxmox host, LXCs inherit host time automatically
@@ -8,7 +8,6 @@
 # their own inventory groups:
 #
 #   plays/install-zwave-gateway.yml   [zwave_gateway]   ZWA-2 radio
-#   plays/install-heating-can.yml     [heating_can]     Innomaker USB2CAN
 #
 # Splitting the roles without splitting the plays would have kept the coupling:
 # one play applying every role to one group is the monolith again, a layer up.
@@ -31,11 +30,96 @@
  # do not silently depend on the connection user staying privileged.
  become: true

+  # The Viessmann E3 CAN bus is read by vitocal-can (open3e-esp32 at the
+  # Vitocal), which publishes to the cluster broker itself, not by an edge
+  # host. These remove the former heating-can stack, the can0 configuration
+  # and the open3e MQTT bridge (loopback mosquitto + edge-mqtt-cred); each is
+  # a no-op where they are absent.
+  pre_tasks:
+    - name: Read the service list
+      ansible.builtin.service_facts:
+
+    - name: Stop and disable the retired MQTT bridge services
+      ansible.builtin.systemd:
+        name: "{{ item }}"
+        state: stopped
+        enabled: false
+      loop:
+        - edge-mqtt-cred
+        - mosquitto
+      when: (item ~ '.service') in ansible_facts.services
+
+    - name: Remove the retired MQTT bridge files
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: absent
+      loop:
+        - /etc/systemd/system/edge-mqtt-cred.service
+        - /usr/local/sbin/edge-mqtt-cred
+        - /etc/edge-mqtt-cred
+        - /etc/mosquitto
+      register: edge_mqtt_bridge_files
+
+    - name: Reload systemd without the edge-mqtt-cred unit
+      ansible.builtin.systemd:
+        daemon_reload: true
+      when: edge_mqtt_bridge_files.changed
+
+    - name: Uninstall mosquitto
+      ansible.builtin.package:
+        name: mosquitto
+        state: absent
+
+    - name: Check for the retired heating-can compose project
+      ansible.builtin.stat:
+        path: /opt/edge-host/heating-can/docker-compose.yml
+      register: edge_heating_can_compose
+
+    - name: Stop and remove the retired heating-can containers and image
+      ansible.builtin.command:
+        cmd: docker compose down --remove-orphans --rmi all
+        chdir: /opt/edge-host/heating-can
+      when: edge_heating_can_compose.stat.exists
+      changed_when: true
+
+    - name: Remove the retired heating-can directory
+      ansible.builtin.file:
+        path: /opt/edge-host/heating-can
+        state: absent
+
+    - name: Remove the can0 networkd configuration
+      ansible.builtin.file:
+        path: /etc/systemd/network/80-can0.network
+        state: absent
+      register: edge_can0_network
+
+    - name: Reload networkd without the can0 configuration
+      ansible.builtin.command:
+        cmd: networkctl reload
+      when: edge_can0_network.changed
+      changed_when: true
+
+    - name: Read the can0 link flags
+      ansible.builtin.command:
+        cmd: ip -o link show can0
+      register: edge_can0_link
+      check_mode: false
+      changed_when: false
+      failed_when: false
+
+    - name: Take can0 down
+      ansible.builtin.command:
+        cmd: ip link set can0 down
+      when:
+        - edge_can0_link.rc == 0
+        - edge_can0_link.stdout is search('[<,]UP[,>]')
+      changed_when: true
+
  roles:
    - certificates
    - common
+    - pacman-cache
    - edge-flash-wear
    - docker-install
    - edge-log-shipper
-    - mqtt-bridge
    - edge-vlan
@@ -1,18 +0,0 @@
---
-# Heating system over the Viessmann E3 CAN bus, for hosts with the Innomaker
-# USB2CAN adapter attached.
-#
-# Targets [heating_can]: membership means the adapter is physically present.
-# Two roles because they are two concerns -- the interface is host network
-# state, the services consume it -- but one group, because both need the same
-# hardware.
-#
-# Requires the base play (plays/install-edge-host.yml) to have run: these
-# services publish to the local MQTT bridge it sets up.
- name: Install heating CAN services
-  hosts: heating_can
-  become: true
-
-  roles:
-    - socketcan
-    - heating-can
@@ -22,6 +22,7 @@
  become: true
  roles:
    - common
+    - timesyncd
    - docker-install
    - netbird-proxy
    - netbird-proxy-watchdog
@@ -16,5 +16,6 @@
  become: true
  roles:
    - common
+    - timesyncd
    - docker-install
    - netbird-server
@@ -83,6 +83,9 @@
      edge-1.iot.renner.uno:
        priority: 70
        state: "BACKUP"
+      edge-2.iot.renner.uno:
+        priority: 60
+        state: "BACKUP"

  roles:
    - role: chrony-ntp-server
@@ -54,18 +54,9 @@
 # via plays/configure-ssh-ca.yml.

 # -------------------------------------------------------
-# 5. Disable NTP on VMs/LXC (use host time)
+# 5. Time sync
 # -------------------------------------------------------
- name: Stop and disable systemd-timesyncd on VMs/LXC
-  systemd:
-    name: systemd-timesyncd
-    state: stopped
-    enabled: no
-    masked: yes
-  when:
-    - ansible_facts['virtualization_role'] == 'guest'
-    - ansible_facts['virtualization_type'] in ['kvm', 'lxc']
-  ignore_errors: yes
+# Moved to separate roles: timesyncd (internet VPS), chrony-ntp-server (edge).

 # -------------------------------------------------------
 # 6. Certificates
@@ -7,7 +7,9 @@

 edge_alloy_config_file: /etc/alloy/edge.alloy
 edge_alloy_http_port: 12345
-edge_alloy_bin: /usr/bin/grafana-alloy   # Arch `grafana-alloy` pkg names the binary this, not `alloy`
+# Upstream image: Arch's grafana-alloy 1.21 is built without
+# loki.source.journal. Renovate-tracked (customManagers in renovate.json).
+edge_alloy_image: grafana/alloy:v1.21.3@sha256:8ab871206bd2d8f89277f53abffee5f452a293980788d52f85fa183a87a505a4
 edge_loki_push_url: "https://loki.renner.uno/loki/api/v1/push"
 edge_loki_username: edge-1
 edge_alloy_labels:
@@ -6,15 +6,18 @@
 # directly, so one journal source covers everything. Alloy s storage/WAL sits
 # on /run (tmpfs) so it does not write to flash either.

- name: Install grafana-alloy
+# Alloy runs from the upstream image (see edge-alloy.service); the Arch package
+# lacks journal support.
+- name: Remove the grafana-alloy package
  ansible.builtin.package:
    name: grafana-alloy
-    state: present
+    state: absent

 - name: Create alloy system group
  ansible.builtin.group:
    name: alloy
    system: true
+  register: edge_alloy_group

 - name: Create alloy system user
  ansible.builtin.user:
@@ -24,6 +27,25 @@
    system: true
    create_home: false
    shell: /usr/bin/nologin
+  register: edge_alloy_user
+
+- name: Look up the systemd-journal group
+  ansible.builtin.getent:
+    database: group
+    key: systemd-journal
+
+- name: Set the container identity
+  ansible.builtin.set_fact:
+    edge_alloy_uid: "{{ edge_alloy_user.uid }}"
+    edge_alloy_gid: "{{ edge_alloy_group.gid }}"
+    edge_alloy_journal_gid: "{{ ansible_facts.getent_group['systemd-journal'][1] }}"
+
+- name: Pull the alloy image
+  ansible.builtin.command:
+    argv: [docker, pull, "{{ edge_alloy_image }}"]
+  register: edge_alloy_pull
+  changed_when: "'Downloaded newer image' in edge_alloy_pull.stdout"
+  notify: Restart alloy

 - name: Create alloy config directory
  ansible.builtin.file:
@@ -1,32 +1,35 @@
 [Unit]
-Description=Grafana Alloy (edge-1 log shipper -> Loki)
+Description=Grafana Alloy (journal -> Loki)
 Documentation=https://grafana.com/docs/alloy/
-After=network-online.target
+After=docker.service network-online.target
+Requires=docker.service
 Wants=network-online.target

 [Service]
 Type=simple
-User=alloy
-Group=alloy
-# Read the (volatile) systemd journal.
-SupplementaryGroups=systemd-journal
-# WAL + positions on tmpfs so the agent never writes to the eMMC. %t is the
-# runtime dir root (/run); RuntimeDirectory creates /run/alloy owned by us.
-RuntimeDirectory=alloy
-ExecStart={{ edge_alloy_bin }} run \
+# WAL + positions on tmpfs so the agent never writes to the eMMC.
+ExecStartPre=/usr/bin/install -d -o alloy -g alloy -m 0750 /run/alloy
+ExecStartPre=-/usr/bin/docker rm -f edge-alloy
+# Attached run with --log-driver none: the container's output reaches the
+# journal once, through this unit.
+ExecStart=/usr/bin/docker run --rm --name edge-alloy \
+  --log-driver none \
+  --network host \
+  --user {{ edge_alloy_uid }}:{{ edge_alloy_gid }} \
+  --group-add {{ edge_alloy_journal_gid }} \
+  --read-only --tmpfs /tmp \
+  --cap-drop ALL --security-opt no-new-privileges \
+  -v /run/log/journal:/run/log/journal:ro \
+  -v /etc/machine-id:/etc/machine-id:ro \
+  -v {{ edge_alloy_config_file }}:/etc/alloy/config.alloy:ro \
+  -v /run/alloy:/var/lib/alloy \
+  {{ edge_alloy_image }} run \
  --server.http.listen-addr=127.0.0.1:{{ edge_alloy_http_port }} \
-  --storage.path=%t/alloy \
-  {{ edge_alloy_config_file }}
-ExecReload=/bin/kill -HUP $MAINPID
-Restart=on-failure
+  --storage.path=/var/lib/alloy \
+  /etc/alloy/config.alloy
+ExecStop=/usr/bin/docker stop edge-alloy
+Restart=always
 RestartSec=10s
-LimitNOFILE=65536
-
-# Hardening (bare metal, no LXC namespace limits here).
-NoNewPrivileges=yes
-ProtectSystem=strict
-ProtectHome=yes
-PrivateTmp=yes

 [Install]
 WantedBy=multi-user.target
@@ -1,71 +0,0 @@
---
-# Heating system over the Viessmann E3 CAN bus: open3e (heat pump) and
-# e3oncan (E380 energy meter). The can0 interface itself is the socketcan
-# role.
-
-# Service root. Kept per-role so the role is usable on its own.
-edge_base_dir: /opt/edge-host
-
-edge_open3e_mqtt_user: open3e
-edge_open3e_mqtt_topic: open3e
-edge_open3e_mqtt_format: "{device}_{didNumber:04d}_{didName}"
-edge_open3e_poll_seconds: 30
-# Read-only datapoint set (Phase 1 extended set, established 2026-07-02 on
-# the commissioning workstation; see vican repo CLAUDE.md for the rationale).
-# NO -w / write DIDs here — live heating + battery, writes are Phase 3.
-# vx3.266 = ErrorDtcHistory (O3EList) — the VX3 fault log; polled to catch
-# recurrences of FailureCommunicationEnergyMeter (the E380 energy-meter link
-# the internal PV-surplus EMS depends on). Decodes via the master O3EList
-# codec inherited through the vx3plus overlay.
-# vitocal.543/2350/2543/2560: SmartGrid-/EMS-Status-Beobachtung (2026-07-06)
-# — klärt, ob die Eigenstromoptimierung (EMS) bei PV-Überschuss von selbst
-# den WW-Boost auslöst (2543.2 steht laut Scan bereits auf +10 K), bevor
-# SG-Ready-Verdrahtung oder andere Trigger gebaut werden. Alle vier ro.
-# vitocal.259/260 = InfoDtcList/InfoDtcHistory (O3EList) — the HPMU event log,
-# the Vitocal-side counterpart to vx3.266. Both are capped lists (2 and 9
-# entries when added), so the multi-frame read is cheap at a 30 s poll.
-# Records faults/info events only (NormalOperation, LagDeviceDtcReported,
-# LegionellaProtectionTemperatureReached) — NOT setpoint or program changes.
-# onebase.*: the 29 paired ZigBee slots on the One Base gateway (ECU 0x6c3) --
-# 8 radiator valves, 9 climate sensors, 9 underfloor actuators, 3 floor
-# thermostats. Per-device room temperature, active setpoint, humidity, valve
-# opening/demand, battery and RSSI; the local replacement for the ViCare cloud
-# room sensors. Needs the onebase overlay (files/open3e-onebase.py) -- the stock
-# codec declares 57 bytes and a paired slot answers with 68.
-# Only CurrentValues are polled. The room and device registries (1884.., 2084..)
-# are static configuration and are read on demand, not every 30 s.
-edge_open3e_datapoints: >-
-  vitocal.259,vitocal.260,vitocal.268,vitocal.269,vitocal.271,vitocal.274,vitocal.286,vitocal.288,vitocal.318,vitocal.321,vitocal.324,vitocal.335,vitocal.336,vitocal.396,vitocal.402,vitocal.403,vitocal.476,vitocal.477,vitocal.543,vitocal.548,vitocal.565,vitocal.1007,vitocal.1043,vitocal.1190,vitocal.1211,vitocal.1391,vitocal.1416,vitocal.1417,vitocal.2320,vitocal.2346,vitocal.2350,vitocal.2351,vitocal.2352,vitocal.2369,vitocal.2370,vitocal.2486,vitocal.2487,vitocal.2488,vitocal.2543,vitocal.2560,vitocal.2622,vitocal.2624,vitocal.2625,vitocal.2735,vitocal.3016,vx3.266,vx3.378,vx3.379,vx3.380,vx3.535,vx3.1603,vx3.1664,vx3.1690,vx3.1801,vx3.1802,vx3.1810,vx3.1828,vx3.1830,vx3.1577,vx3.1578,vx3.1579,vx3.1580,vx3.1581,vx3.1582,vx3.1834,vx3.1836,vx3.2214,vx3.2240,vx3.3085,vx3.3086,vx3.3087,vx3.3088,vx3.3089,vx3.3090,vcmu.320,vcmu.322,vcmu.325,vcmu.355,vcmu.389,vcmu.391,vcmu.1772,vcmu.1773,vcmu.1775,vcmu.1776,vcmu.2256,vcmu.2259,vcmu.2333,vcmu.2334,vcmu.2569,vcmu.2571,vitocal.2791,onebase.2086,onebase.2089,onebase.2092,onebase.2095,onebase.2098,onebase.2101,onebase.2104,onebase.2107,onebase.2110,onebase.2113,onebase.2116,onebase.2119,onebase.2122,onebase.2125,onebase.2128,onebase.2131,onebase.2134,onebase.2137,onebase.2140,onebase.2143,onebase.2262,onebase.2265,onebase.2268,onebase.2271,onebase.2274,onebase.2277,onebase.2280,onebase.2283,onebase.2286
-# ECU addresses; -dev selects codec set, tx selects the UDS address.
-# vcmu (refrigerant-circuit controller) has no dedicated codec set —
-# omitting dpList makes open3e fall back to the generic datapoint list,
-# which decodes all polled VCMU DIDs.
-edge_open3e_devices:
-  vitocal: { tx: "0x680", dpList: "vcal" }
-  # dpList als Pfad: Overlay-Datei mit den Batteriemodul-DIDs (siehe
-  # files/open3e-vx3plus.py) — die Stock-vx3-Liste filtert sie sonst weg.
-  vx3: { tx: "0x6a1", dpList: "/config/vx3plus.py" }
-  vcmu: { tx: "0x68c" }
-  # One Base ZigBee gateway. Overlay re-declares the paired ZigBee slots at
-  # their real 68-byte length (see files/open3e-onebase.py).
-  onebase: { tx: "0x6c3", dpList: "/config/onebase.py" }
-
-edge_e3oncan_gap_seconds: 10
-edge_e3oncan_mqtt_format: "{device}_{didNumber:04d}_{didName}"
-
-# Secrets come from inventory/group_vars/edge_host/vault.yml:
-#   edge_open3e_mqtt_password
-
-# The image carrying both readers, built and pinned in CI
-# (ci/images/heating-can/Containerfile). The source pins live in the
-# Containerfile, in the artifact -- not here -- so what is deployed is a tag,
-# and `docker compose up -d` on an unchanged tag is a genuine no-op.
-#
-# Tracked by the weekly update-audit as an ordinary image, which is why this is
-# simpler to keep current than the two git refs it replaced: one publishes no
-# tags at all, the other was pinned to an untagged commit between releases.
-heating_can_image: gitea.renner.uno/gitea_admin/heating-can:latest
-
-# Compose project directory. Separate from the old native layout under
-# {{ edge_base_dir }}/open3e, which this role removes.
-heating_can_base_dir: "{{ edge_base_dir }}/heating-can"
@@ -1,54 +0,0 @@
-# Managed by ansible (roles/heating-can). Datapoint overlay for the One Base
-# ZigBee gateway on ECU 0x6c3 (BACKENDGATEWAY).
-#
-# Upstream declares ZigBee<N>DeviceCurrentValues as 57 bytes. A PAIRED device
-# slot on this gateway answers with 68: the 57 known bytes plus the parent
-# device serial and three trailing bytes. udsoncan reads only the declared
-# length and then treats the next two bytes -- the first half of that serial --
-# as a foreign data identifier, so every paired slot fails to decode with
-# "Server returned values for data identifier 0x.... that was not requested".
-# The bogus identifier differs per device because the serial does.
-#
-# This overlay re-declares the 29 paired slots at 68 bytes, reusing upstream's
-# sub-type list so the per-device-type O3ESwitch (climate sensor / TRV / floor
-# thermostat / actuator, incl. DeviceTemperatureSetpoint) is inherited rather
-# than copied.
-#
-# EMPTY slots answer with 57 and decode against the stock codec, so they are
-# left alone and are not polled. A slot that is later unpaired therefore starts
-# reporting a decode error on its topic instead of a value.
-#
-# Verified on ECU 0x6c3, 2026-09-17: 29 paired slots, all 68 bytes.
-from open3e.Open3Ecodecs import O3EComplexType, RawCodec
-from open3e.Open3Edatapoints import dataIdentifiers as _master
-
-# ZigBee<N>DeviceCurrentValues of the paired slots: devices 1-20 run 2086..2143
-# in steps of 3, devices 21-29 continue at 2262..2286.
-_PAIRED_CURRENT_VALUES = [2086 + 3 * n for n in range(20)] + [
-    2262 + 3 * n for n in range(9)
-]
-
-
-def _with_parent_serial(did):
-    stock = _master["dids"][did]
-    return O3EComplexType(
-        68,
-        stock.id,
-        list(stock.subTypes)
-        + [
-            RawCodec(8, "ParentDeviceSerialnumber"),
-            RawCodec(2, "Unknown_65_66"),
-            RawCodec(1, "Unknown_67"),
-        ],
-        desc=stock.desc,
-        info=stock.info,
-        acc=stock.acc,
-    )
-
-
-dataIdentifiers = {
-    "dids": {
-        **_master["dids"],
-        **{did: _with_parent_serial(did) for did in _PAIRED_CURRENT_VALUES},
-    }
-}
@@ -1,20 +0,0 @@
-# Managed by ansible (roles/heating-can). Datapoint overlay for the VX3:
-# the stock vx3 list acts as a FILTER (DIDs missing from it are popped
-# from the master table, Open3Eclass.py), so the per-battery-module DIDs
-# were never pollable with dpList "vx3". This overlay re-adds them with
-# codec None (= keep the master/general codec, RawCodec hex strings).
-#
-# Module DIDs (verified answering on ECU 0x6a1, 2026-07-03):
-#   1577-1582  ElectricalEnergyStorageModule{One..Six}OperatingData
-#              (139 B: 8x temperature 0.1 °C + 15x cell voltage mV)
-#   3085-3090  ElectricalEnergyStorageModule{One..Six}Information
-#              (18 B: module voltage 0.01 V, SoH?, counters)
-from open3e.Open3EdatapointsVx3 import dataIdentifiers as _vx3
-
-dataIdentifiers = {
-    "dids": {
-        **_vx3["dids"],
-        1577: None, 1578: None, 1579: None, 1580: None, 1581: None, 1582: None,
-        3085: None, 3086: None, 3087: None, 3088: None, 3089: None, 3090: None,
-    }
-}
@@ -1,10 +0,0 @@
---
- name: Reload systemd
-  ansible.builtin.systemd:
-    daemon_reload: true
-
- name: Restart heating-can
-  ansible.builtin.command:
-    cmd: docker compose up -d --force-recreate
-    chdir: "{{ heating_can_base_dir }}"
-  changed_when: true
@@ -1,172 +0,0 @@
---
-# Heating system over the Viessmann E3 CAN bus.
-#
-# Two readers of the same heating installation, supervised inside one container
-# from one image (ci/images/heating-can):
-#   open3e    UDS request/response to the Vitocal heat pump and Vitocharge VX3
-#   e3oncan   passive CANopen listener for the E380 grid energy meter, which
-#             feeds the heat pump's own energy management
-#
-# They coexist because e3oncan issues no bus writes.
-#
-# Nothing is installed here. The image is built in CI with both sources pinned,
-# published to the registry, and this host only pulls and runs it. That is what
-# removes the churn: these were pip-installed into venvs on the node, and pip
-# re-cloned and rebuilt a VCS requirement on every converge -- restarting the
-# heating bridge each time -- which pinning the SHA did not fix.
-#
-# network_mode: host is required, not incidental: SocketCAN interfaces live in
-# the host network namespace, so can0 is only reachable that way. It is also how
-# the local MQTT broker on 127.0.0.1 is reached. CAN_RAW needs no capabilities,
-# so both run unprivileged.
-#
-# The can0 interface itself belongs to the socketcan role; this role consumes it.
-
- name: Create heating-can directory
-  ansible.builtin.file:
-    path: "{{ heating_can_base_dir }}"
-    state: directory
-    mode: "0755"
-
-# --- Migration off the native install ---------------------------------------
-# Must happen before the containers start. Two open3e instances issuing UDS
-# requests on one CAN bus is the failure mode to avoid, so the old units are
-# stopped and masked rather than merely disabled -- masked so a stray
-# `systemctl start` or a leftover dependency cannot bring them back alongside
-# the containers.
- name: Find which native CAN units still exist
-  ansible.builtin.stat:
-    path: "/etc/systemd/system/{{ item }}.service"
-  loop:
-    - open3e
-    - e3oncan
-  register: heating_can_native_units
-
-# Stop and disable BEFORE anything else, and do NOT swallow the result.
-#
-# The first version did stop + disable + mask in one call with
-# failed_when: false, then deleted the unit files. Masking a unit whose file
-# still exists conflicts, so the call failed, failed_when hid it, nothing was
-# stopped -- and the next task deleted the unit files out from under two
-# running processes. systemctl is-enabled then reported "not-found" and looked
-# clean while is-active still said "active".
-#
-# The result on 2026-08-10 was two open3e instances issuing UDS requests on the
-# same CAN bus for nine minutes, fighting over the open3e-edge client ID and
-# kicking each other off the broker.
-#
-# Only units that actually exist are touched, so a fresh host does not need an
-# error swallowed to get through this.
- name: Stop and disable the native CAN services
-  ansible.builtin.systemd:
-    name: "{{ item.item }}"
-    state: stopped
-    enabled: false
-  loop: "{{ heating_can_native_units.results }}"
-  loop_control:
-    label: "{{ item.item }}"
-  when: item.stat.exists
-
-# Masking is deliberately NOT used. It writes a symlink at the same path the
-# next task removes, so the two cancel out -- which is half of how the original
-# failed. With the unit files gone there is nothing left to start.
- name: Remove the native unit files
-  ansible.builtin.file:
-    path: "/etc/systemd/system/{{ item }}.service"
-    state: absent
-  loop:
-    - open3e
-    - e3oncan
-  notify: Reload systemd
-
-# The invariant that actually matters is "no native process is on the CAN bus",
-# and systemd reporting success is not the same claim. Two open3e instances
-# polling one bus is the failure this whole block exists to prevent, so it is
-# asserted directly rather than inferred from the calls above.
- name: Check for surviving native CAN processes
-  ansible.builtin.command:
-    argv: [pgrep, -af, "edge-host/(open3e|e3oncan)"]
-  register: heating_can_survivors
-  check_mode: false
-  changed_when: false
-  failed_when: false
-
- name: Assert no native CAN process survived
-  ansible.builtin.assert:
-    that:
-      - heating_can_survivors.stdout | default('') | length == 0
-    fail_msg: >-
-      A native open3e/e3oncan process is still running after the units were
-      stopped and removed:
-      {{ heating_can_survivors.stdout_lines | default([]) | join('; ') }}.
-      Starting the container now would put two readers on the same CAN bus --
-      two open3e instances issue competing UDS requests and take over each
-      other's MQTT session. Kill the survivors, then re-run.
-    success_msg: No native CAN processes remain; safe to start the container.
-
- name: Remove the native venvs
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: absent
-  loop:
-    - "{{ edge_base_dir }}/open3e/venv"
-    - "{{ edge_base_dir }}/e3oncan/venv"
-    - "{{ edge_base_dir }}/e3oncan/src"
-    - "{{ edge_base_dir }}/open3e"
-    - "{{ edge_base_dir }}/e3oncan"
-
-# --- Configuration (bind-mounted into the containers) ------------------------
- name: Deploy open3e devices.json
-  ansible.builtin.copy:
-    content: "{{ edge_open3e_devices | to_nice_json }}\n"
-    dest: "{{ heating_can_base_dir }}/devices.json"
-    mode: "0644"
-  notify: Restart heating-can
-
- name: Deploy open3e vx3 datapoint overlay (battery-module DIDs)
-  ansible.builtin.copy:
-    src: open3e-vx3plus.py
-    dest: "{{ heating_can_base_dir }}/vx3plus.py"
-    mode: "0644"
-  notify: Restart heating-can
-
- name: Deploy open3e One Base datapoint overlay (68-byte ZigBee slots)
-  ansible.builtin.copy:
-    src: open3e-onebase.py
-    dest: "{{ heating_can_base_dir }}/onebase.py"
-    mode: "0644"
-  notify: Restart heating-can
-
-# --- Compose project ---------------------------------------------------------
- name: Deploy the broker credential env file
-  ansible.builtin.template:
-    src: heating-can.env.j2
-    dest: "{{ heating_can_base_dir }}/heating-can.env"
-    mode: "0600"
-  notify: Restart heating-can
-
- name: Deploy heating-can compose project
-  ansible.builtin.template:
-    src: docker-compose.yml.j2
-    dest: "{{ heating_can_base_dir }}/docker-compose.yml"
-    mode: "0644"
-  notify: Restart heating-can
-
- name: Pull the heating-can image
-  ansible.builtin.command:
-    cmd: docker compose pull
-    chdir: "{{ heating_can_base_dir }}"
-  changed_when: false
-
-# Unlike the zwave and meter services there is no missing-device tolerance here:
-# can0 is created by the socketcan role from a USB adapter that is part of this
-# host's purpose. If it is absent the heating telemetry is down and the run
-# should say so rather than pass quietly.
- name: Start heating-can services
-  ansible.builtin.command:
-    cmd: docker compose up -d
-    chdir: "{{ heating_can_base_dir }}"
-  register: heating_can_up
-  changed_when: >-
-    'Started' in heating_can_up.stderr or 'Created' in heating_can_up.stderr
-    or 'Started' in heating_can_up.stdout or 'Creating' in heating_can_up.stdout
@@ -1,36 +0,0 @@
-# Managed by ansible (roles/heating-can).
-#
-# One container. Both CAN readers live in the image and are supervised inside
-# it -- this file supplies configuration and nothing else. It does not know
-# open3e's or E3onCAN's command line.
-#
-# network_mode: host is required: SocketCAN interfaces live in the host network
-# namespace, so {{ edge_can_interface }} is only reachable this way, and it is
-# also how the local MQTT broker is reached. CAN_RAW needs no capabilities, so
-# the image runs unprivileged.
-services:
-  heating-can:
-    image: {{ heating_can_image }}
-    container_name: heating-can
-    restart: unless-stopped
-    network_mode: host
-    volumes:
-      - ./devices.json:/config/devices.json:ro
-      - ./vx3plus.py:/config/vx3plus.py:ro
-      - ./onebase.py:/config/onebase.py:ro
-    env_file:
-      # Broker credential, 0600 -- see heating-can.env.j2.
-      - heating-can.env
-    environment:
-      CAN_INTERFACE: "{{ edge_can_interface }}"
-      MQTT_HOST: "{{ edge_mqtt_host }}"
-      MQTT_PORT: "{{ edge_mqtt_port }}"
-      MQTT_TOPIC: "{{ edge_open3e_mqtt_topic }}"
-      MQTT_FORMAT: "{{ edge_open3e_mqtt_format }}"
-      E3ONCAN_MQTT_FORMAT: "{{ edge_e3oncan_mqtt_format }}"
-      OPEN3E_CONFIG: /config/devices.json
-      OPEN3E_CLIENT_ID: open3e-edge
-      OPEN3E_POLL_SECONDS: "{{ edge_open3e_poll_seconds }}"
-      OPEN3E_DATAPOINTS: "{{ edge_open3e_datapoints }}"
-      E3ONCAN_DEVICE: e380
-      E3ONCAN_GAP_SECONDS: "{{ edge_e3oncan_gap_seconds }}"
@@ -1,8 +0,0 @@
-# Managed by ansible (roles/heating-can). 0600 -- carries the broker credential.
-#
-# Kept out of docker-compose.yml, which is 0644: the sibling roles on this host
-# do the same (power-meter-sml renders its config at 0600 while its compose file
-# stays world-readable), and the native unit this replaced used a 0600 env file
-# for exactly this value.
-MQTT_USER={{ edge_open3e_mqtt_user }}
-MQTT_PASSWORD={{ edge_open3e_mqtt_password }}
@@ -1,23 +0,0 @@
---
-# --- MQTT: edge clients (open3e, e3oncan, sml2mqtt) publish to a LOCAL
-# mosquitto on loopback, which bridges to the central cluster broker over TLS
-# (open3e/e3oncan have no native MQTTS). This keeps plaintext on loopback only
-# — off the untrusted IoT VLAN — and buffers telemetry in RAM during cluster
-# blips. The local broker writes nothing to the eMMC (persistence off, logs to
-# the volatile journal). See edge-mqtt-bridge.conf.j2 and README "MQTT bridge".
-# Upstream cluster broker the local bridge connects to (TLS; the public
-# Let's Encrypt cert is validated against the system CA bundle).
-edge_mqtt_cluster_host: mqtt.renner.uno
-edge_mqtt_cluster_tls_port: 8883
-edge_mqtt_bridge_cafile: /etc/ssl/certs/ca-certificates.crt
-
-# --- Bridge credential from mqtt-account-controller (REN-1307) ------------
-# The cluster account the bridge logs in as (register entry in
-# kubernetes/apps/home-assistant/mqtt-accounts.yaml). The controller pushes
-# its password to edge-mqtt-cred and rotates it when the bridge reports
-# "not connected"; there is no copy in ansible-vault.
-edge_mqtt_bridge_account: edge-1
-# HTTPS port of edge-mqtt-cred (esp32 device API, mTLS). Only a client
-# certificate from the MQTT CA with this CN is accepted.
-edge_mqtt_cred_port: 8443
-edge_mqtt_cred_allowed_cn: mqtt-account-controller
@@ -1,141 +0,0 @@
-#!/usr/bin/env python3
-# Managed by ansible (roles/mqtt-bridge). Receives the cluster bridge password
-# from mqtt-account-controller (REN-1307) so no plaintext copy lives in
-# ansible-vault and no play run is needed to rotate it.
-#
-# Speaks the controller's esp32 device API over HTTPS:
-#   GET /api/status   -> {"mqtt": {"connected": bool}}
-#   PUT /api/settings <- {"mqtt": {"user": "...", "pass": "..."}}
-# A client certificate from the MQTT CA with CN mqtt-account-controller is
-# required; nothing else may call it. The server key is generated on this
-# host and never leaves it (the controller pins it on first contact).
-#
-# PUT writes the bridge file (template + credentials), removes the legacy
-# vault-password bridges and restarts the local mosquitto. The password is
-# kept only in that 0640 root:mosquitto file.
-import grp
-import json
-import os
-import socket
-import ssl
-import subprocess
-import sys
-import tempfile
-import threading
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-
-CONF = json.load(open(sys.argv[1]))
-WRITE = threading.Lock()
-
-
-def connected():
-    try:
-        out = subprocess.run(
-            ["mosquitto_sub", "-h", "127.0.0.1", "-p", str(CONF["local_port"]),
-             "-t", CONF["state_topic"], "-C", "1", "-W", "3"],
-            capture_output=True, text=True, timeout=10).stdout
-    except (OSError, subprocess.TimeoutExpired):
-        return False
-    return out.strip() == "1"
-
-
-def write_bridge(user, password):
-    with open(CONF["template"]) as f:
-        body = f.read()
-    body += f"remote_username {user}\nremote_password {password}\n"
-    d = os.path.dirname(CONF["bridge_file"])
-    fd, tmp = tempfile.mkstemp(dir=d, prefix=".edge-mqtt-cred.")
-    with os.fdopen(fd, "w") as f:
-        f.write(body)
-    os.chown(tmp, 0, grp.getgrnam("mosquitto").gr_gid)
-    os.chmod(tmp, 0o640)
-    os.replace(tmp, CONF["bridge_file"])
-    for legacy in CONF["legacy_files"]:
-        if os.path.exists(legacy):
-            os.remove(legacy)
-    subprocess.run(["systemctl", "restart", "mosquitto"], check=True, timeout=60)
-
-
-def valid(s):
-    # Controller passwords are random URL-safe tokens; anything with
-    # whitespace or a control character would break the config line.
-    return isinstance(s, str) and 0 < len(s) <= 256 and s.isprintable() and not any(c.isspace() for c in s)
-
-
-class Handler(BaseHTTPRequestHandler):
-    def authorized(self):
-        cert = self.connection.getpeercert() or {}
-        cns = [v for rdn in cert.get("subject", ()) for k, v in rdn if k == "commonName"]
-        if cns != [CONF["allowed_cn"]]:
-            self.send_error(403)
-            return False
-        return True
-
-    def reply(self, code, obj=None):
-        data = b"" if obj is None else json.dumps(obj).encode()
-        self.send_response(code)
-        if data:
-            self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(data)))
-        self.end_headers()
-        self.wfile.write(data)
-
-    def do_GET(self):
-        if not self.authorized():
-            return
-        if self.path != "/api/status":
-            return self.send_error(404)
-        self.reply(200, {"mqtt": {"connected": connected()}})
-
-    def do_PUT(self):
-        if not self.authorized():
-            return
-        if self.path != "/api/settings":
-            return self.send_error(404)
-        try:
-            n = int(self.headers.get("Content-Length", "0"))
-            if not 0 < n <= 4096:
-                raise ValueError("body size")
-            m = json.loads(self.rfile.read(n))["mqtt"]
-            user, password = m["user"], m["pass"]
-        except (ValueError, KeyError, TypeError):
-            return self.send_error(400)
-        if user != CONF["user"] or not valid(password):
-            return self.send_error(400)
-        with WRITE:
-            write_bridge(user, password)
-        self.log_message("bridge credentials for %s replaced, mosquitto restarted", user)
-        self.reply(204)
-
-    def log_message(self, fmt, *args):
-        sys.stderr.write("%s %s\n" % (self.address_string(), fmt % args))
-
-
-class Server(ThreadingHTTPServer):
-    address_family = socket.AF_INET6
-
-    def server_bind(self):
-        self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
-        super().server_bind()
-
-    def get_request(self):
-        # The TLS handshake runs in the request thread, with a timeout, so a
-        # stalled peer cannot block the accept loop.
-        sock, addr = self.socket.accept()
-        sock.settimeout(10)
-        return self.ctx.wrap_socket(sock, server_side=True, do_handshake_on_connect=False), addr
-
-
-def main():
-    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-    ctx.minimum_version = ssl.TLSVersion.TLSv1_2
-    ctx.load_cert_chain(CONF["cert"], CONF["key"])
-    ctx.load_verify_locations(CONF["ca"])
-    ctx.verify_mode = ssl.CERT_REQUIRED
-    srv = Server(("::", CONF["port"]), Handler)
-    srv.ctx = ctx
-    srv.serve_forever()
-
-
-if __name__ == "__main__":
-    main()
@@ -1,10 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIBdTCCARygAwIBAgIUN8ne4k4Wif9O83GDyKiBP0Ma7EIwCgYIKoZIzj0EAwIw
-GTEXMBUGA1UEAxMOUmVubmVyIE1RVFQgQ0EwHhcNMjYxMDA2MTUzMDE1WhcNMzYx
-MDAzMTUzMDE1WjAZMRcwFQYDVQQDEw5SZW5uZXIgTVFUVCBDQTBZMBMGByqGSM49
-AgEGCCqGSM49AwEHA0IABOZhZF2JDoyvVg2oIXSbJAuAWDcoG22RxPA4oMKRMA/b
-XzIY566D2k6cVnWqbil9s/q4O2mj+Epo7plBw8NwuOOjQjBAMA4GA1UdDwEB/wQE
-AwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQcqSDDiLZzhrvqq9f16Y08
-CO7QfzAKBggqhkjOPQQDAgNHADBEAiBFkxd9pXnqIcjReEcOTvCBZ3HxKu2jNQGL
-/le7gunTGgIgZapWAcu4awa+wmZcR/z2luOjD2GhIT15um14Z+sstJk=
-----END CERTIFICATE-----
@@ -1,13 +0,0 @@
---
-# The MQTT clients (zwave-js, sml2mqtt, open3e, e3oncan) reconnect on their
-# own once the local broker is back.
- name: Restart mosquitto
-  ansible.builtin.service:
-    name: mosquitto
-    state: restarted
-
- name: Restart edge-mqtt-cred
-  ansible.builtin.systemd:
-    name: edge-mqtt-cred
-    state: restarted
-    daemon_reload: true
@@ -1,109 +0,0 @@
---
-# Local MQTT bridge broker.
-#
-# Edge clients (open3e, e3oncan, sml2mqtt) publish here over loopback; this
-# broker bridges to the cluster broker over TLS, because those clients have no
-# native MQTTS. Persistence is off and logging goes to stdout so it writes
-# nothing to local flash.
-
- name: Install mosquitto
-  ansible.builtin.package:
-    name: mosquitto
-    state: present
-
- name: Create the bridge directory
-  ansible.builtin.file:
-    path: /etc/mosquitto/bridge.d
-    state: directory
-    owner: root
-    group: mosquitto
-    mode: "0750"
-
- name: Check for the controller-managed bridge file
-  ansible.builtin.stat:
-    path: "/etc/mosquitto/bridge.d/{{ edge_mqtt_bridge_account }}.conf"
-  register: edge_mqtt_bridge_managed
-
-# Until mqtt-account-controller has pushed the first password, keep the
-# vault-password bridges so the cluster never loses edge-1's data. Once the
-# managed file exists, never render them again (edge-mqtt-cred removed them).
- name: Deploy legacy vault-password bridges
-  ansible.builtin.template:
-    src: edge-mqtt-bridge-legacy.conf.j2
-    dest: /etc/mosquitto/bridge.d/legacy.conf
-    owner: root
-    group: mosquitto
-    mode: "0640"   # carries the legacy cluster bridge credentials
-  when: not edge_mqtt_bridge_managed.stat.exists
-  notify: Restart mosquitto
-
- name: Deploy local mosquitto config
-  ansible.builtin.template:
-    src: edge-mqtt-bridge.conf.j2
-    dest: /etc/mosquitto/mosquitto.conf
-    owner: root
-    group: mosquitto
-    mode: "0640"
-  notify: Restart mosquitto
-
- name: Enable local mosquitto bridge
-  ansible.builtin.systemd:
-    name: mosquitto
-    enabled: true
-    state: started
-
-# --- edge-mqtt-cred (REN-1307): receives the bridge password from
-# mqtt-account-controller. edge-1 holds only the public MQTT CA and its own
-# server key, generated here and never copied off the host.
- name: Create edge-mqtt-cred config directory
-  ansible.builtin.file:
-    path: /etc/edge-mqtt-cred
-    state: directory
-    owner: root
-    group: root
-    mode: "0700"
-
- name: Generate edge-mqtt-cred server key and certificate
-  ansible.builtin.command:
-    cmd: >-
-      openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1
-      -nodes -days 36500 -subj "/CN={{ inventory_hostname }}"
-      -keyout /etc/edge-mqtt-cred/tls.key -out /etc/edge-mqtt-cred/tls.crt
-    creates: /etc/edge-mqtt-cred/tls.key
-  notify: Restart edge-mqtt-cred
-
- name: Deploy edge-mqtt-cred files
-  ansible.builtin.copy:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    owner: root
-    group: root
-    mode: "{{ item.mode }}"
-  loop:
-    - {src: edge-mqtt-cred.py, dest: /usr/local/sbin/edge-mqtt-cred, mode: "0755"}
-    # Public CA of the cluster's MQTT client certificates
-    # (kubernetes/infrastructure/post-crds/mqtt-ca.yaml), valid until 2036-10-03.
-    - {src: mqtt-ca.crt, dest: /etc/edge-mqtt-cred/mqtt-ca.crt, mode: "0644"}
-  notify: Restart edge-mqtt-cred
-
- name: Deploy edge-mqtt-cred config and bridge template
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    owner: root
-    group: root
-    mode: "{{ item.mode }}"
-  loop:
-    - {src: edge-mqtt-cred.json.j2, dest: /etc/edge-mqtt-cred/config.json, mode: "0600"}
-    # Read only on the controller's next push: a change here reaches the
-    # running bridge when the password is next set.
-    - {src: edge-1-bridge.conf.in.j2, dest: /etc/edge-mqtt-cred/bridge.conf.in, mode: "0600"}
-    - {src: edge-mqtt-cred.service.j2, dest: /etc/systemd/system/edge-mqtt-cred.service, mode: "0644"}
-  notify: Restart edge-mqtt-cred
-
- name: Enable edge-mqtt-cred
-  ansible.builtin.systemd:
-    name: edge-mqtt-cred
-    enabled: true
-    state: started
-    daemon_reload: true
@@ -1,21 +0,0 @@
-# Managed by roles/mqtt-bridge (REN-1307). edge-mqtt-cred appends
-# remote_username/remote_password to this and writes the result to
-# /etc/mosquitto/bridge.d/{{ edge_mqtt_bridge_account }}.conf. One bridge for
-# open3e, as the register account `{{ edge_mqtt_bridge_account }}`
-# (ACL readwrite open3e/#). sml2mqtt is retired (SML reader, 2026-09-19).
-connection {{ edge_mqtt_bridge_account }}
-address {{ edge_mqtt_cluster_host }}:{{ edge_mqtt_cluster_tls_port }}
-bridge_cafile {{ edge_mqtt_bridge_cafile }}
-bridge_insecure false
-remote_clientid edge1-bridge
-cleansession false
-try_private true
-restart_timeout 5 30
-queue_qos0_messages true
-# The bridge state goes to the LOCAL broker only (retained 1/0); edge-mqtt-cred
-# reads it to answer the controller's "connected?".
-notifications true
-notifications_local_only true
-notification_topic $SYS/broker/connection/{{ edge_mqtt_bridge_account }}/state
-topic open3e/# out 0
-topic open3e/cmnd in 0
@@ -1,21 +0,0 @@
-# Managed by roles/mqtt-bridge. Legacy vault-password bridges, rendered only
-# while /etc/mosquitto/bridge.d/{{ edge_mqtt_bridge_account }}.conf does not
-# exist; edge-mqtt-cred deletes this file on the controller's first push
-# (REN-1307). Remove with the vault keys once edge-1 is on the register account.
-# --- Bridge 1: open3e datapoints + command topic, as the cluster `open3e`
-# user (its ACL is `readwrite open3e/#`, which covers publishing datapoints
-# and subscribing to open3e/cmnd). e3oncan also publishes under open3e/#.
-connection edge1-open3e
-address {{ edge_mqtt_cluster_host }}:{{ edge_mqtt_cluster_tls_port }}
-bridge_cafile {{ edge_mqtt_bridge_cafile }}
-bridge_insecure false
-remote_username {{ edge_open3e_mqtt_user }}
-remote_password {{ edge_open3e_mqtt_password }}
-remote_clientid edge1-bridge-open3e
-cleansession false
-try_private true
-notifications false
-restart_timeout 5 30
-queue_qos0_messages true
-topic open3e/# out 0
-topic open3e/cmnd in 0
@@ -1,30 +0,0 @@
-# Managed by roles/mqtt-bridge. Local mosquitto that the edge clients (open3e,
-# e3oncan, sml2mqtt) publish to over loopback; it bridges to the central
-# cluster broker over TLS. open3e/e3oncan have no native MQTTS, so this is how
-# edge-1's MQTT gets off plaintext on the untrusted IoT VLAN, and it buffers
-# telemetry in RAM if the cluster broker is briefly unreachable.
-#
-# eMMC: this host runs on a small internal eMMC, so the local broker writes
-# NOTHING to flash — `persistence false` keeps retained/queued messages in RAM
-# only, and `log_dest stdout` goes to the (volatile, RAM) journal that Alloy
-# ships to Loki. Do not add persistence/log-file settings here.
-persistence false
-log_dest stdout
-log_type error
-log_type warning
-log_type notice
-
-# Loopback only — the trust boundary is the host itself. Any process on edge-1
-# may publish here (same trust as the bridged services); nothing off-host can
-# reach it. Real authentication to the cluster happens on the bridge below.
-# Single v4-loopback listener: all edge clients dial 127.0.0.1 (edge_mqtt_host),
-# and a second same-port listener can make some builds refuse to start.
-listener 1883 127.0.0.1
-allow_anonymous true
-
-# --- Bridges to the cluster broker (REN-1307). bridge.d holds either
-# {{ edge_mqtt_bridge_account }}.conf, written by edge-mqtt-cred with the password
-# mqtt-account-controller pushed, or, until that first push, legacy.conf with
-# the two vault-password bridges. edge-mqtt-cred deletes legacy.conf when it
-# writes the new file.
-include_dir /etc/mosquitto/bridge.d
@@ -1,13 +0,0 @@
-{{ {
-  "port": edge_mqtt_cred_port,
-  "allowed_cn": edge_mqtt_cred_allowed_cn,
-  "user": edge_mqtt_bridge_account,
-  "cert": "/etc/edge-mqtt-cred/tls.crt",
-  "key": "/etc/edge-mqtt-cred/tls.key",
-  "ca": "/etc/edge-mqtt-cred/mqtt-ca.crt",
-  "template": "/etc/edge-mqtt-cred/bridge.conf.in",
-  "bridge_file": "/etc/mosquitto/bridge.d/" ~ edge_mqtt_bridge_account ~ ".conf",
-  "legacy_files": ["/etc/mosquitto/bridge.d/legacy.conf"],
-  "local_port": edge_mqtt_port,
-  "state_topic": "$SYS/broker/connection/" ~ edge_mqtt_bridge_account ~ "/state",
-} | to_nice_json }}
@@ -1,19 +0,0 @@
-# Managed by roles/mqtt-bridge (REN-1307). See /usr/local/sbin/edge-mqtt-cred.
-[Unit]
-Description=Receives the MQTT bridge credential from mqtt-account-controller
-After=network-online.target mosquitto.service
-Wants=network-online.target
-
-[Service]
-ExecStart=/usr/bin/python3 /usr/local/sbin/edge-mqtt-cred /etc/edge-mqtt-cred/config.json
-Restart=always
-RestartSec=5
-# Root only to write the bridge file and restart mosquitto.
-ProtectSystem=strict
-ReadWritePaths=/etc/mosquitto/bridge.d
-ProtectHome=true
-PrivateTmp=true
-NoNewPrivileges=true
-
-[Install]
-WantedBy=multi-user.target
@@ -0,0 +1,14 @@
+# Managed by ansible (roles/pacman-cache).
+# Downloaded packages are not kept; older versions come from the Arch Linux
+# Archive.
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Removing downloaded packages from the cache...
+When = PostTransaction
+Exec = /usr/bin/find /var/cache/pacman/pkg -mindepth 1 -delete
@@ -0,0 +1,21 @@
+---
+# Keep the pacman package cache empty. pacman keeps every downloaded package;
+# on a 7 GB eMMC root the cache grows to gigabytes. Arch hosts only.
+
+- name: Ensure the pacman hook directory exists
+  ansible.builtin.file:
+    path: /etc/pacman.d/hooks
+    state: directory
+    mode: "0755"
+
+- name: Empty the package cache after every transaction
+  ansible.builtin.copy:
+    src: pacman-cache.hook
+    dest: /etc/pacman.d/hooks/pacman-cache.hook
+    mode: "0644"
+
+- name: Empty the package cache
+  ansible.builtin.command:
+    argv: [find, /var/cache/pacman/pkg, -mindepth, "1", -delete, -print]
+  register: pacman_cache_clean
+  changed_when: pacman_cache_clean.stdout | length > 0
@@ -1,5 +0,0 @@
---
-# SocketCAN interface. Consumed by heating-can.
-# --- CAN / open3e (Viessmann E3 external bus) ---
-edge_can_interface: can0
-edge_can_bitrate: 250000
@@ -1,7 +0,0 @@
---
-# reload alone only re-reads config files; existing links keep their old state
-# until reconfigured.
- name: Reload networkd
-  ansible.builtin.shell:
-    cmd: networkctl reload && networkctl reconfigure {{ edge_can_interface }}
-  changed_when: true
@@ -1,20 +0,0 @@
---
-# SocketCAN interface, owned by systemd-networkd.
-#
-# gs_usb is an in-tree module and autoloads when the adapter enumerates;
-# networkd then matches the interface and applies bitrate + up. Separate from
-# the services that consume the bus (heating-can, e380-can-meter) because the
-# interface is host network state shared by both.
-
- name: Configure can0 via systemd-networkd
-  ansible.builtin.template:
-    src: 80-can0.network.j2
-    dest: /etc/systemd/network/80-can0.network
-    mode: "0644"
-  notify: Reload networkd
-
- name: Enable systemd-networkd
-  ansible.builtin.service:
-    name: systemd-networkd
-    state: started
-    enabled: true
@@ -1,17 +0,0 @@
-# Managed by ansible (roles/socketcan).
-# Viessmann E3 external CAN bus via Innomaker USB2CAN (gs_usb).
-# The adapter is a stub tap on an already-terminated bus (120R jumper OFF).
-[Match]
-Name={{ edge_can_interface }}
-
-[Link]
-# networkd applies [CAN] settings but does not raise a CAN link on its
-# own (observed on edge-1); force it up, and back up after any down.
-ActivationPolicy=always-up
-
-[CAN]
-BitRate={{ edge_can_bitrate }}
-# NO RestartSec here: gs_usb does not support hardware bus-off restart,
-# and networkd fails the ENTIRE link configuration on the unsupported
-# option ("off (failed)", link never raised — found by reboot test).
-# Bus-off recovery falls to the open3e service restart loop.
@@ -143,6 +143,12 @@
    group: root
    mode: "0644"

+- name: Install sudo
+  ansible.builtin.package:
+    name: sudo
+    state: present
+  when: not ssh_ca_synouser.stat.exists
+
 - name: Install the Claude sudo rules
  ansible.builtin.template:
    src: sudoers-claude.j2
@@ -0,0 +1,26 @@
+---
+# Keep the system clock on NTP with systemd-timesyncd, on hosts that run no
+# chrony. A KVM guest's clocksource does not steer wall-clock time; without an
+# NTP client the clock drifts until JWT iat/exp checks fail.
+
+- name: Install systemd-timesyncd
+  ansible.builtin.apt:
+    name: systemd-timesyncd
+    state: present
+  when: ansible_facts['os_family'] == 'Debian'
+
+- name: Run systemd-timesyncd
+  ansible.builtin.systemd_service:
+    name: systemd-timesyncd
+    masked: false
+    enabled: true
+    state: started
+
+- name: Wait for the clock to synchronize
+  ansible.builtin.command:
+    argv: [timedatectl, show, --property=NTPSynchronized, --value]
+  register: timesyncd_synchronized
+  changed_when: false
+  until: timesyncd_synchronized.stdout == "yes"
+  retries: 12
+  delay: 5
@@ -13,12 +13,8 @@ zwave_base_dir: "{{ edge_base_dir }}/zwave-js"
 # survives moving the stick between machines.
 edge_zwave_device: /dev/serial/by-id/usb-Nabu_Casa_ZWA-2_80B54EE15720-if00

-edge_zwavejs_image: ghcr.io/zwave-js/zwave-js-ui:11.21.1
-
-# Alpine version the zwave-js-ui image is built on -- the source for the musl
-# libeatmydata.so preloaded into that container. Keep in sync if the image
-# bumps its Alpine major (check: docker exec zwave-js cat /etc/os-release).
-edge_zwave_alpine_base: alpine:3.22
+# Renovate-tracked (customManagers in renovate.json).
+edge_zwavejs_image: ghcr.io/zwave-js/zwave-js-ui:11.25.2@sha256:ac4874a3cbea61c0c60002a8fd8ae05104cc8eb2eae91aa05bd184972aa06853

 # Secret from inventory/group_vars/edge_host/vault.yml:
 #   edge_zwavejs_session_secret
@@ -15,17 +15,31 @@
    - "{{ zwave_base_dir }}"
    - "{{ zwave_base_dir }}/store"

+# The preloaded .so is musl and must come from the image's own Alpine release.
+- name: Read the Alpine release of the zwave-js-ui image
+  ansible.builtin.command:
+    cmd: docker run --rm --entrypoint cat {{ edge_zwavejs_image }} /etc/alpine-release
+  register: zwave_alpine_release
+  changed_when: false
+  check_mode: false
+
+- name: Name libeatmydata.so after that Alpine release
+  ansible.builtin.set_fact:
+    zwave_alpine_minor: "{{ zwave_alpine_release.stdout.split('.')[:2] | join('.') }}"
+    zwave_libeatmydata: "libeatmydata-alpine{{ zwave_alpine_release.stdout.split('.')[:2] | join('.') }}.so"
+
 - name: Extract musl libeatmydata.so (matches the zwave-js-ui Alpine base)
  ansible.builtin.shell:
    cmd: |
      set -euo pipefail
      tmp="$(mktemp)"
      trap 'rm -f "$tmp"' EXIT
-      docker run --rm --network=host {{ edge_zwave_alpine_base }} \
+      docker run --rm --network=host alpine:{{ zwave_alpine_minor }} \
        sh -c 'apk add --no-cache libeatmydata >/dev/null 2>&1 && cat /usr/lib/libeatmydata.so' > "$tmp"
      test "$(stat -c%s "$tmp")" -ge 8000   # sanity: real .so is ~14 KB, guards against a failed/empty pull
-      install -m 0644 "$tmp" {{ zwave_base_dir }}/libeatmydata.so
-    creates: "{{ zwave_base_dir }}/libeatmydata.so"
+      install -m 0644 "$tmp" {{ zwave_base_dir }}/{{ zwave_libeatmydata }}
+    creates: "{{ zwave_base_dir }}/{{ zwave_libeatmydata }}"
+    executable: /bin/bash
  notify: Restart zwave-js

 # Because fsync is neutralized, a hard power-loss during the (rare) settings
@@ -93,3 +107,18 @@
      zwave-js could not start -- the ZWA-2 radio is not present:
      {{ zwave_compose_up.stderr_lines | select('search', 'device') | list }}
  when: zwave_compose_up.rc != 0
+
+- name: Find libeatmydata.so builds of other Alpine releases
+  ansible.builtin.find:
+    paths: "{{ zwave_base_dir }}"
+    patterns: "libeatmydata*.so"
+    excludes: "{{ zwave_libeatmydata }}"
+  register: zwave_stale_libeatmydata
+
+- name: Remove libeatmydata.so builds of other Alpine releases
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: absent
+  loop: "{{ zwave_stale_libeatmydata.files }}"
+  loop_control:
+    label: "{{ item.path }}"
@@ -31,7 +31,7 @@ services:
      - "{{ edge_zwave_device }}:/dev/zwave"
    volumes:
      # musl libeatmydata.so extracted from the image's Alpine base (ro)
-      - ./libeatmydata.so:/usr/lib/libeatmydata.so:ro
+      - ./{{ zwave_libeatmydata }}:/usr/lib/libeatmydata.so:ro
      # Persistent store: settings.json, device DB, network keys. Path is
      # unchanged from the previous shared project, so nothing is migrated.
      - ./store:/usr/src/app/store
@@ -12,8 +12,6 @@
  ansible.builtin.import_playbook: plays/configure-synology-python.yml
 - name: Base system
  ansible.builtin.import_playbook: plays/common.yml
- name: VM time sync
-  ansible.builtin.import_playbook: plays/configure-vm-time-sync.yml

 - name: SSH user CA
  ansible.builtin.import_playbook: plays/configure-ssh-ca.yml
@@ -33,8 +31,6 @@
  ansible.builtin.import_playbook: plays/install-edge-host.yml
 - name: Z-Wave gateway
  ansible.builtin.import_playbook: plays/install-zwave-gateway.yml
- name: Heating CAN
-  ansible.builtin.import_playbook: plays/install-heating-can.yml
 - name: NTP service
  ansible.builtin.import_playbook: plays/install-ntp-ha.yml

@@ -5,12 +5,12 @@

 # The unit tests gate the image: the final stage copies the controller out of
 # this stage, so a failing test fails the build.
-FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 AS test
+FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 AS test
 WORKDIR /src
 COPY controller.py test_controller.py ./
 RUN python3 -B -m unittest -v

-FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51
+FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913

 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY --from=test /src/controller.py /opt/controller.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""authentik-gate-sync: the Authentik side of the gate Middleware and of OIDC clients.
+"""authentik-gate-sync: the Authentik side of the gate Middleware.

 An Ingress is gated when its traefik.ingress.kubernetes.io/router.middlewares
 annotation names the gate Middleware (authentik/gate, a ForwardAuth against the
@@ -18,16 +18,6 @@ Annotations (all optional):
  auth.renner.uno/authorization-flow  authorization flow slug (default below)
  auth.renner.uno/skip-path           provider skip_path_regex

-OIDC clients: each OIDCClient (auth.renner.uno/v1alpha1, CRD in
-infrastructure/authentik-gate-sync-crds) gets a confidential OAuth2/OpenID
-provider oidc-<slug> (client ID = slug, secret generated by Authentik) and an
-application with that slug, so the issuer is <authentik>/application/o/<slug>/;
-with spec.group the same group policy as gates. Its status carries Ready and
-the issuer. OIDC slugs and gate names are kept apart: a slug that is a gate's
-name, or an existing application without this controller's OAuth2 provider,
-is refused. An unassigned provider named oidc-<slug> is adopted (the remains
-of an interrupted teardown, which deletes the application first).
-
 Fail closed: until the provider exists, or after it is removed (e.g. the named
 group is gone), the embedded outpost has no provider for the host and rejects
 the request; Traefik answers 500 when the outpost is unreachable.
@@ -40,7 +30,6 @@ import hashlib
 import json
 import logging
 import os
-import re
 import sys
 import time
 import urllib.error
@@ -57,10 +46,6 @@ DEFAULT_AUTHZ_FLOW = os.environ.get("DEFAULT_AUTHORIZATION_FLOW", "default-provi
 INVALIDATION_FLOW = os.environ.get("INVALIDATION_FLOW", "default-provider-invalidation-flow")
 COOKIE_DOMAIN = os.environ.get("COOKIE_DOMAIN", "renner.uno")
 AK_BROWSER_URL = os.environ.get("AUTHENTIK_HOST_BROWSER", "https://auth.renner.uno/")
-SIGNING_KEY = os.environ.get("OIDC_SIGNING_KEY", "authentik Self-signed Certificate")
-OIDC_SCOPES = tuple(f"goauthentik.io/providers/oauth2/scope-{s}" for s in ("openid", "profile", "email"))
-OIDC_GRANTS = ["authorization_code", "refresh_token"]
-SLUG_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,48}[a-z0-9])?$")
 INTERVAL = int(os.environ.get("INTERVAL_SECONDS", "60"))
 HTTP_TIMEOUT = 20

@@ -249,74 +234,6 @@ def provider_body(gate, flows):
    }


-OIDC_API = "/apis/auth.renner.uno/v1alpha1"
-
-
-def oidc_slug(cr):
-    return ((cr.get("spec") or {}).get("slug") or cr["metadata"]["name"]).strip()
-
-
-def oidc_spec(cr):
-    """Translate an OIDCClient into the client it asks for. Raises GateError."""
-    meta, spec = cr["metadata"], cr.get("spec") or {}
-    slug = oidc_slug(cr)
-    if not SLUG_RE.match(slug):
-        raise GateError(f"slug {slug!r} is not a slug (a-z, 0-9, -; max 50)")
-    launch = spec.get("launchURL", "")
-    if not launch.startswith(("https://", "http://")):
-        raise GateError(f"launchURL {launch!r} is not an http(s) URL")
-    redirects = [{"matching_mode": r.get("matchingMode", "strict"), "url": r.get("url", ""),
-                  "redirect_uri_type": "authorization"}
-                 for r in spec.get("redirectURIs") or []]
-    if not redirects or any(not r["url"] or r["matching_mode"] not in ("strict", "regex") for r in redirects):
-        raise GateError("redirectURIs needs at least one entry with url and matchingMode strict|regex")
-    for r in redirects:
-        if r["matching_mode"] == "regex":
-            try:
-                re.compile(r["url"])
-            except re.error as e:
-                raise GateError(f"redirect regex {r['url']!r}: {e}") from None
-    return {
-        # name: provider and policy name; slug: application slug and client ID.
-        "name": f"oidc-{slug}",
-        "slug": slug,
-        "namespace": meta["namespace"],
-        "resource": meta["name"],
-        "launch_url": launch,
-        "group": spec.get("group") or None,
-        "authorization_flow": spec.get("authorizationFlow") or DEFAULT_AUTHZ_FLOW,
-        "redirect_uris": redirects,
-    }
-
-
-def oidc_status(cr, ok, message):
-    cond = {"type": "Ready", "status": "True" if ok else "False",
-            "reason": "Reconciled" if ok else "Failed", "message": message[:1000],
-            "observedGeneration": cr["metadata"].get("generation", 0)}
-    old = next((c for c in (cr.get("status") or {}).get("conditions") or [] if c.get("type") == "Ready"), {})
-    same = all(old.get(k) == cond[k] for k in ("status", "reason", "message", "observedGeneration"))
-    cond["lastTransitionTime"] = old.get("lastTransitionTime") if same and old.get("lastTransitionTime") \
-        else time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-    status = {"conditions": [cond], "observedGeneration": cond["observedGeneration"]}
-    if ok:
-        status["issuer"] = f"{AK_BROWSER_URL}application/o/{oidc_slug(cr)}/"
-    return status
-
-
-def oauth2_body(spec, flows, refs):
-    return {
-        "name": spec["name"],
-        "authorization_flow": flows[spec["authorization_flow"]],
-        "invalidation_flow": flows[INVALIDATION_FLOW],
-        "client_type": "confidential",
-        "client_id": spec["slug"],
-        "grant_types": OIDC_GRANTS,
-        "signing_key": refs["signing_key"],
-        "property_mappings": sorted(refs["scopes"]),
-        "redirect_uris": spec["redirect_uris"],
-    }
-
-
 def drift(current, desired):
    return {k: v for k, v in desired.items() if current.get(k) != v}

@@ -347,18 +264,6 @@ class K8s:
        return http("PATCH", K8S_API + path, obj, headers=self._h(), cafile=K8S_CA_FILE,
                    content_type="application/apply-patch+yaml")

-    def patch_status(self, path, status):
-        return http("PATCH", K8S_API + path + "/status", {"status": status}, headers=self._h(),
-                    cafile=K8S_CA_FILE, content_type="application/merge-patch+json")
-
-    def oidc_clients(self):
-        try:
-            return self.get(f"{OIDC_API}/oidcclients").get("items", [])
-        except ApiError as e:
-            if e.code == 404:  # CRD not installed: no clients, gates unaffected
-                return []
-            raise
-
    def delete(self, obj):
        try:
            http("DELETE", K8S_API + object_path(obj), headers=self._h(), cafile=K8S_CA_FILE)
@@ -542,111 +447,42 @@ def ensure_access(ak, gate, target):
            ak.req("DELETE", f"policies/expression/{stale['pk']}/")


-def oidc_refs(ak):
-    """Signing key and scope mappings every OIDC client uses; matched here, not
-    by server-side filters, so an ignored filter cannot pick another object."""
-    keys = [k["pk"] for k in ak.list("crypto/certificatekeypairs/") if k.get("name") == SIGNING_KEY]
-    if len(keys) != 1:
-        raise ApiError(f"expected one certificate {SIGNING_KEY!r}, found {len(keys)}")
-    scopes = {m.get("managed"): m["pk"] for m in ak.list("propertymappings/provider/scope/")
-              if m.get("managed") in OIDC_SCOPES}
-    missing = [s for s in OIDC_SCOPES if s not in scopes]
-    if missing:
-        raise ApiError(f"scope mappings not found: {missing}")
-    return {"signing_key": keys[0], "scopes": list(scopes.values())}
-
-
-def ensure_oidc(ak, spec, flows, refs):
-    name, slug = spec["name"], spec["slug"]
-    if spec["group"] and ak.one("core/groups/", name=spec["group"]) is None:
-        raise GateError(f"group {spec['group']!r} not found in Authentik")
-
-    app = get_application(ak, slug)
-    if app is not None and app.get("meta_publisher") != MANAGER:
-        raise GateError(f"application {slug} exists and is not managed by {MANAGER}")
-
-    want = oauth2_body(spec, flows, refs)
-    provider = next((p for p in ak.list("providers/oauth2/") if p.get("name", "").lower() == name), None)
-    if app is not None and (provider is None or app.get("provider") != provider["pk"]):
-        # E.g. a gate's application: never re-point it at an OAuth2 provider.
-        raise GateError(f"application {slug} exists without OAuth2 provider {name}")
-    if provider is None:
-        # No client_secret: Authentik generates it (generate_client_secret).
-        provider = ak.req("POST", "providers/oauth2/", want)
-        LOG.info("%s: created OAuth2 provider %s", name, provider["pk"])
-    elif provider.get("assigned_application_slug") not in (None, slug) or \
-            (app is not None and app.get("provider") != provider["pk"]):
-        raise GateError(f"OAuth2 provider {name} belongs to another application")
-    else:
-        current = dict(provider, property_mappings=sorted(provider.get("property_mappings") or []))
-        if drift(current, want):
-            ak.req("PATCH", f"providers/oauth2/{provider['pk']}/", drift(current, want))
-            LOG.info("%s: updated OAuth2 provider %s", name, sorted(drift(current, want)))
-
-    want_app = {"name": f"{slug} (oidc)", "slug": slug, "provider": provider["pk"],
-                "meta_launch_url": spec["launch_url"], "meta_publisher": MANAGER,
-                "meta_description": f"OIDCClient {spec['namespace']}/{spec['resource']}"}
-    if app is None:
-        app = ak.req("POST", "core/applications/", want_app)
-        LOG.info("%s: created application %s", name, slug)
-    elif drift(app, want_app):
-        ak.req("PATCH", f"core/applications/{slug}/", drift(app, want_app))
-        LOG.info("%s: updated application %s", name, sorted(drift(app, want_app)))
-
-    ensure_access(ak, spec, app["pbm_uuid"])
-
-
-PROVIDER_PATHS = ("providers/proxy/", "providers/oauth2/")
-
-
-def policy_name(app):
-    return f"oidc-{app['slug']}" if app.get("_provider_path") == "providers/oauth2/" else app["slug"]
-
-
 def remove_gate(ak, app):
-    """Delete an owned gate or OIDC client: the application (bindings cascade;
-    its provider is PROTECTed while referenced), then the provider (a proxy
-    provider leaves the embedded outpost with it), the policy. Ownership is
-    found through the application, so until it is gone a failed step is
-    retried on the next pass."""
+    """Delete an owned gate: the application (bindings cascade; its provider is
+    PROTECTed while referenced), then the provider (which leaves the embedded
+    outpost with it), the policy. Ownership is found through the application,
+    so until it is gone a failed step is retried on the next pass."""
    name, provider = app["slug"], app.get("provider")
-    path = app.get("_provider_path", "providers/proxy/")
-    if path == "providers/proxy/":
-        remove_dedicated_outposts(ak, name, provider)
+    remove_dedicated_outposts(ak, name, provider)
    ak.req("DELETE", f"core/applications/{name}/")
    if provider:
-        ak.req("DELETE", f"{path}{provider}/")
-    policy = ak.one("policies/expression/", name=policy_name(app))
+        ak.req("DELETE", f"providers/proxy/{provider}/")
+    policy = ak.one("policies/expression/", name=name)
    if policy is not None:
        ak.req("DELETE", f"policies/expression/{policy['pk']}/")
-    LOG.info("%s: removed %s from Authentik", name,
-             "OIDC client" if path == "providers/oauth2/" else "gate")
+    LOG.info("%s: removed gate from Authentik", name)


 def owned_applications(ak):
    """Applications this controller owns, found through the (unfiltered) proxy
-    and OAuth2 provider lists and confirmed one by one."""
-    for path in PROVIDER_PATHS:
-        for p in ak.list(path):
-            slug = p.get("assigned_application_slug")
-            if not slug:
-                continue
-            app = get_application(ak, slug)
-            if app and app.get("meta_publisher") == MANAGER and app.get("provider") == p["pk"]:
-                yield dict(app, _provider_path=path)
+    provider list and confirmed one by one."""
+    for p in ak.list("providers/proxy/"):
+        slug = p.get("assigned_application_slug")
+        if not slug:
+            continue
+        app = get_application(ak, slug)
+        if app and app.get("meta_publisher") == MANAGER and app.get("provider") == p["pk"]:
+            yield app


 # --- reconcile --------------------------------------------------------------

-def reconcile(k8s=None, ak=None):
-    k8s = k8s or K8s()
-    if ak is None:
-        with open(AK_TOKEN_FILE) as f:
-            ak = Authentik(f.read().strip())
+def reconcile():
+    k8s = K8s()
+    with open(AK_TOKEN_FILE) as f:
+        ak = Authentik(f.read().strip())

-    ingresses = k8s.get("/apis/networking.k8s.io/v1/ingresses").get("items", [])
-    sources = [i for i in ingresses if is_gated(i)]
-    clients = k8s.oidc_clients()
+    sources = [i for i in k8s.get("/apis/networking.k8s.io/v1/ingresses").get("items", []) if is_gated(i)]
    shared = shared_hosts(sources)
    flows = {f["slug"]: f["pk"] for f in ak.list("flows/instances/")}
    ensure_embedded_config(ak)
@@ -690,44 +526,6 @@ def reconcile(k8s=None, ak=None):
            held.add(gate_name(ing))
            failed += 1

-    gate_names = {gate_name(i) for i in sources}
-    keep_clients = set()  # OIDC slugs whose Authentik side should exist
-    slugs = [oidc_slug(i) for i in clients]
-    refs = None
-    for cr in sorted(clients, key=oidc_slug):
-        ref, slug = f'{cr["metadata"]["namespace"]}/{cr["metadata"]["name"]}', oidc_slug(cr)
-        ok, message = False, ""
-        try:
-            spec = oidc_spec(cr)
-            if slugs.count(slug) > 1:
-                raise GateError(f"slug {slug} is claimed by more than one OIDCClient")
-            if slug in gate_names:
-                raise GateError(f"slug {slug} is the name of a gate")
-            for flow in (spec["authorization_flow"], INVALIDATION_FLOW):
-                if flow not in flows:
-                    raise GateError(f"flow {flow!r} not found in Authentik")
-            keep_clients.add(slug)
-            refs = refs or oidc_refs(ak)
-            ensure_oidc(ak, spec, flows, refs)
-            ok, message = True, f"provider {spec['name']}, application {slug}"
-        except GateError as e:
-            LOG.error("OIDCClient %s: %s", ref, e)
-            failed += 1
-            keep_clients.discard(slug)
-            message = str(e)
-        except Exception as e:
-            LOG.error("OIDCClient %s: %s", ref, e)
-            keep_clients.add(slug)
-            failed += 1
-            message = f"transient: {e}"
-        try:
-            path = f'{OIDC_API}/namespaces/{cr["metadata"]["namespace"]}/oidcclients/{cr["metadata"]["name"]}'
-            status = oidc_status(cr, ok, message)
-            if status != cr.get("status"):
-                k8s.patch_status(path, status)
-        except ApiError as e:
-            LOG.error("OIDCClient %s: status: %s", ref, e)
-
    removed = 0
    for obj in managed_objects(k8s):
        key = (obj["kind"], obj["metadata"]["namespace"], obj["metadata"]["name"])
@@ -738,13 +536,11 @@ def reconcile(k8s=None, ak=None):
            removed += 1

    for app in list(owned_applications(ak)):
-        keep = keep_clients if app["_provider_path"] == "providers/oauth2/" else gates
-        if app["slug"] not in keep:
+        if app["slug"] not in gates:
            remove_gate(ak, app)
            removed += 1

-    LOG.info("reconciled: %d gates, %d OIDC clients, %d failed, %d objects removed",
-             len(sources), len(clients), failed, removed)
+    LOG.info("reconciled: %d gates, %d failed, %d objects removed", len(sources), failed, removed)


 def main():
@@ -176,10 +176,8 @@ class FakeAuthentik:
    """In-memory stand-in for the endpoints the controller uses; records calls."""

    def __init__(self):
-        self.db = {"providers/proxy/": {}, "providers/oauth2/": {}, "core/applications/": {},
-                   "outposts/instances/": {}, "policies/bindings/": {}, "policies/expression/": {},
-                   "core/groups/": {}, "crypto/certificatekeypairs/": {},
-                   "propertymappings/provider/scope/": {}}
+        self.db = {"providers/proxy/": {}, "core/applications/": {}, "outposts/instances/": {},
+                   "policies/bindings/": {}, "policies/expression/": {}, "core/groups/": {}}
        self.calls = []
        self.next = 1

@@ -196,9 +194,6 @@ class FakeAuthentik:
                return coll, rest or None
        raise AssertionError(path)

-    def _provider(self, pk):
-        return self.db["providers/proxy/"].get(pk) or self.db["providers/oauth2/"][pk]
-
    def _find(self, coll, key):
        if coll == "core/applications/":
            return next((a for a in self.db[coll].values() if a["slug"] == key), None)
@@ -231,7 +226,7 @@ class FakeAuthentik:
            obj = self.add(coll, dict(body))
            if coll == "core/applications/":
                obj["pbm_uuid"] = f"pbm-{obj['pk']}"
-                self._provider(obj["provider"])["assigned_application_slug"] = obj["slug"]
+                self.db["providers/proxy/"][obj["provider"]]["assigned_application_slug"] = obj["slug"]
            return copy.deepcopy(obj)
        obj = self._find(coll, key)
        if method == "PATCH":
@@ -244,7 +239,7 @@ class FakeAuthentik:
        if method == "DELETE":
            del self.db[coll][obj["pk"]]
            if coll == "core/applications/":
-                self._provider(obj["provider"])["assigned_application_slug"] = None
+                self.db["providers/proxy/"][obj["provider"]]["assigned_application_slug"] = None
                for b in [b for b in self.db["policies/bindings/"].values() if b["target"] == obj["pbm_uuid"]]:
                    del self.db["policies/bindings/"][b["pk"]]
            return None
@@ -387,234 +382,5 @@ class Reconcile(unittest.TestCase):
        self.assertEqual(self.ak.get(f"core/applications/{self.g['name']}/")["provider"], app["provider"])


-YOUTRACK = {
-    "metadata": {"name": "youtrack", "namespace": "youtrack", "generation": 3},
-    "spec": {
-        "launchURL": "https://youtrack.renner.uno",
-        "group": "YouTrack Users",
-        "redirectURIs": [{"matchingMode": "regex", "url": r"^https://youtrack\.renner\.uno/.*$"}],
-    },
-}
-
-
-class OidcSpec(unittest.TestCase):
-    def test_youtrack(self):
-        s = c.oidc_spec(YOUTRACK)
-        self.assertEqual((s["name"], s["slug"], s["launch_url"], s["group"]),
-                         ("oidc-youtrack", "youtrack", "https://youtrack.renner.uno", "YouTrack Users"))
-        self.assertEqual(s["redirect_uris"],
-                         [{"matching_mode": "regex", "url": r"^https://youtrack\.renner\.uno/.*$",
-                           "redirect_uri_type": "authorization"}])
-
-    def test_slug_overrides_name(self):
-        cr = copy.deepcopy(YOUTRACK)
-        cr["spec"]["slug"] = "yt"
-        self.assertEqual(c.oidc_spec(cr)["slug"], "yt")
-
-    def test_strict_is_default(self):
-        cr = copy.deepcopy(YOUTRACK)
-        cr["spec"]["redirectURIs"] = [{"url": "https://youtrack.renner.uno/cb"}]
-        self.assertEqual(c.oidc_spec(cr)["redirect_uris"][0]["matching_mode"], "strict")
-
-    def test_rejects_bad_slug(self):
-        cr = copy.deepcopy(YOUTRACK)
-        cr["spec"]["slug"] = "You Track"
-        with self.assertRaises(c.GateError):
-            c.oidc_spec(cr)
-
-    def test_rejects_missing_redirects(self):
-        cr = copy.deepcopy(YOUTRACK)
-        cr["spec"]["redirectURIs"] = []
-        with self.assertRaises(c.GateError):
-            c.oidc_spec(cr)
-
-    def test_rejects_bad_regex(self):
-        cr = copy.deepcopy(YOUTRACK)
-        cr["spec"]["redirectURIs"] = [{"matchingMode": "regex", "url": "("}]
-        with self.assertRaises(c.GateError):
-            c.oidc_spec(cr)
-
-    def test_status(self):
-        st = c.oidc_status(YOUTRACK, True, "ok")
-        self.assertEqual(st["issuer"], c.AK_BROWSER_URL + "application/o/youtrack/")
-        self.assertEqual((st["conditions"][0]["status"], st["observedGeneration"]), ("True", 3))
-        cr = dict(YOUTRACK, status=st)
-        self.assertEqual(c.oidc_status(cr, True, "ok")["conditions"][0]["lastTransitionTime"],
-                         st["conditions"][0]["lastTransitionTime"])
-        self.assertNotIn("issuer", c.oidc_status(cr, False, "group missing"))
-
-
-class ReconcileOidc(unittest.TestCase):
-    def setUp(self):
-        self.ak = FakeAuthentik()
-        self.ak.add("crypto/certificatekeypairs/", {"name": c.SIGNING_KEY, "pk": "key-1"})
-        self.ak.add("crypto/certificatekeypairs/", {"name": "other", "pk": "key-2"})
-        for i, scope in enumerate(c.OIDC_SCOPES):
-            self.ak.add("propertymappings/provider/scope/", {"pk": f"m{i}", "managed": scope})
-        self.ak.add("propertymappings/provider/scope/", {"pk": "m9", "managed": "goauthentik.io/x"})
-        self.ak.add("core/groups/", {"name": "YouTrack Users"})
-        self.s = c.oidc_spec(YOUTRACK)
-
-    def run_once(self):
-        c.ensure_oidc(self.ak, self.s, FLOWS, c.oidc_refs(self.ak))
-
-    def test_creates_owned_client(self):
-        self.run_once()
-        app = self.ak.get("core/applications/youtrack/")
-        self.assertEqual(app["meta_publisher"], c.MANAGER)
-        p = self.ak.db["providers/oauth2/"][app["provider"]]
-        self.assertEqual((p["name"], p["client_id"], p["client_type"], p["signing_key"]),
-                         ("oidc-youtrack", "youtrack", "confidential", "key-1"))
-        self.assertNotIn("client_secret", p)
-        self.assertEqual(p["grant_types"], ["authorization_code", "refresh_token"])
-        self.assertEqual(p["property_mappings"], ["m0", "m1", "m2"])
-        policy = self.ak.one("policies/expression/", name="oidc-youtrack")
-        self.assertIn("'YouTrack Users'", policy["expression"])
-        self.assertEqual([b["target"] for b in self.ak.list("policies/bindings/")], [app["pbm_uuid"]])
-
-    def test_second_pass_is_a_noop(self):
-        self.run_once()
-        before = len(self.ak.calls)
-        self.run_once()
-        self.assertEqual(self.ak.calls[before:], [])
-
-    def test_missing_group_is_a_gate_error(self):
-        self.ak.db["core/groups/"].clear()
-        with self.assertRaises(c.GateError):
-            self.run_once()
-        self.assertEqual(self.ak.list("providers/oauth2/"), [])
-
-    def test_refuses_unowned_application(self):
-        self.ak.add("core/applications/", {"slug": "youtrack", "meta_publisher": "", "provider": None})
-        with self.assertRaises(c.GateError):
-            self.run_once()
-
-    def test_redirect_change_patches_provider(self):
-        self.run_once()
-        self.s = dict(self.s, redirect_uris=[{"matching_mode": "strict", "url": "https://youtrack.renner.uno/cb",
-                                              "redirect_uri_type": "authorization"}])
-        self.run_once()
-        p = next(iter(self.ak.db["providers/oauth2/"].values()))
-        self.assertEqual(p["redirect_uris"], self.s["redirect_uris"])
-
-    def test_missing_signing_key_is_transient(self):
-        self.ak.db["crypto/certificatekeypairs/"].clear()
-        with self.assertRaises(c.ApiError):
-            c.oidc_refs(self.ak)
-
-    def test_ownership_scan_and_removal(self):
-        foreign = self.ak.add("providers/oauth2/", {"name": "gitea", "assigned_application_slug": "gitea"})
-        self.ak.add("core/applications/", {"slug": "gitea", "meta_publisher": "", "provider": foreign["pk"]})
-        self.run_once()
-        owned = list(c.owned_applications(self.ak))
-        self.assertEqual([a["slug"] for a in owned], ["youtrack"])
-        c.remove_gate(self.ak, owned[0])
-        self.assertIsNone(self.ak.get("core/applications/youtrack/"))
-        self.assertEqual([p["name"] for p in self.ak.list("providers/oauth2/")], ["gitea"])
-        self.assertIsNone(self.ak.one("policies/expression/", name="oidc-youtrack"))
-
-
-    def test_refuses_application_without_its_provider(self):
-        gate_provider = self.ak.add("providers/proxy/", {"name": "g", "assigned_application_slug": "youtrack"})
-        self.ak.add("core/applications/", {"slug": "youtrack", "meta_publisher": c.MANAGER,
-                                           "provider": gate_provider["pk"], "pbm_uuid": "pbm-x"})
-        with self.assertRaises(c.GateError):
-            self.run_once()
-        self.assertEqual(self.ak.list("providers/oauth2/"), [])
-        self.assertEqual(self.ak.get("core/applications/youtrack/")["provider"], gate_provider["pk"])
-
-
-class FakeK8s:
-    def __init__(self, ingresses=(), clients=(), services=None):
-        self.ingresses, self.clients = list(ingresses), list(clients)
-        self.services = services or {}
-        self.status, self.applied = {}, []
-
-    def get(self, path):
-        if path == "/apis/networking.k8s.io/v1/ingresses":
-            return {"items": copy.deepcopy(self.ingresses)}
-        if "labelSelector=" in path:
-            return {"items": []}
-        if path.startswith("/api/v1/namespaces/") and "/services/" in path:
-            return copy.deepcopy(self.services[path.rsplit("/", 1)[1]])
-        raise AssertionError(path)
-
-    def oidc_clients(self):
-        return copy.deepcopy(self.clients)
-
-    def apply(self, obj):
-        self.applied.append(obj)
-
-    def patch_status(self, path, status):
-        self.status[path.rsplit("/", 1)[1]] = status
-        for cr in self.clients:
-            if cr["metadata"]["name"] == path.rsplit("/", 1)[1]:
-                cr["status"] = status
-
-
-class ReconcileLoop(unittest.TestCase):
-    def setUp(self):
-        self.ak = FakeAuthentik()
-        self.ak.db["flows/instances/"] = {}
-        for slug, pk in FLOWS.items():
-            self.ak.add("flows/instances/", {"slug": slug, "pk": pk})
-        self.ak.add("outposts/instances/", {"name": "authentik Embedded Outpost", "managed": c.EMBEDDED_OUTPOST,
-                                            "providers": [], "config": {}})
-        self.ak.add("crypto/certificatekeypairs/", {"name": c.SIGNING_KEY, "pk": "key-1"})
-        for i, scope in enumerate(c.OIDC_SCOPES):
-            self.ak.add("propertymappings/provider/scope/", {"pk": f"m{i}", "managed": scope})
-        self.ak.add("core/groups/", {"name": "YouTrack Users"})
-
-    def client(self, name="youtrack", **spec):
-        cr = copy.deepcopy(YOUTRACK)
-        cr["metadata"]["name"] = name
-        cr["spec"].update(spec)
-        return cr
-
-    def test_creates_then_quiet(self):
-        k8s = FakeK8s(clients=[self.client()])
-        c.reconcile(k8s, self.ak)
-        self.assertEqual(k8s.status["youtrack"]["conditions"][0]["status"], "True")
-        self.assertIsNotNone(self.ak.get("core/applications/youtrack/"))
-        before, k8s.status = len(self.ak.calls), {}
-        c.reconcile(k8s, self.ak)
-        self.assertEqual(self.ak.calls[before:], [])
-        self.assertEqual(k8s.status, {})  # unchanged status is not re-written
-
-    def test_duplicate_slug_withholds_both(self):
-        k8s = FakeK8s(clients=[self.client(), self.client("other", slug="youtrack")])
-        c.reconcile(k8s, self.ak)
-        self.assertIsNone(self.ak.get("core/applications/youtrack/"))
-        self.assertEqual({k: v["conditions"][0]["status"] for k, v in k8s.status.items()},
-                         {"youtrack": "False", "other": "False"})
-
-    def test_transient_error_keeps_client(self):
-        k8s = FakeK8s(clients=[self.client()])
-        c.reconcile(k8s, self.ak)
-        self.ak.db["crypto/certificatekeypairs/"].clear()
-        c.reconcile(k8s, self.ak)
-        self.assertIsNotNone(self.ak.get("core/applications/youtrack/"))
-        self.assertIn("transient", k8s.status["youtrack"]["conditions"][0]["message"])
-
-    def test_sweeps_client_whose_resource_is_gone(self):
-        k8s = FakeK8s(clients=[self.client()])
-        c.reconcile(k8s, self.ak)
-        k8s.clients = []
-        c.reconcile(k8s, self.ak)
-        self.assertIsNone(self.ak.get("core/applications/youtrack/"))
-        self.assertEqual(self.ak.list("providers/oauth2/"), [])
-
-    def test_slug_equal_to_gate_name_leaves_gate_alone(self):
-        k8s = FakeK8s(ingresses=[LLAMA], services={"llama-server": SERVICE})
-        c.reconcile(k8s, self.ak)
-        gate = c.gate_name(LLAMA)
-        app = self.ak.get(f"core/applications/{gate}/")
-        k8s.clients = [self.client("evil", slug=gate)]
-        c.reconcile(k8s, self.ak)
-        self.assertEqual(self.ak.get(f"core/applications/{gate}/")["provider"], app["provider"])
-        self.assertEqual(self.ak.list("providers/oauth2/"), [])
-        self.assertEqual(k8s.status["evil"]["conditions"][0]["status"], "False")
-
-
 if __name__ == "__main__":
    unittest.main()
@@ -1,4 +1,4 @@
-FROM node:24-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+FROM node:26-alpine@sha256:c6ad9e9c1d80f6eb607c26b4b0a132ff7a2344fad1c78ea3baa2a7d4c8de6d94

 # Default to the latest Claude Code. Pinning a fixed version is the wrong
 # default here: old releases eventually stop working against the API, so a
@@ -2,7 +2,7 @@
 # Cloudflare. The unit tests (no tags, so no envtest) gate the image: the
 # final stage copies the binary out of this stage, so a failing test fails the
 # build.
-FROM golang:1.27@sha256:f20d83a83e18dbd2a4714b8ffd4b30b287b6243962dd75608e86abcc63ba4efc AS build
+FROM golang:1.27@sha256:2920bb124f1a2e12a1d39f0cab756ae0068441ee1da7655dec7f5e374944095b AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -10,7 +10,7 @@ COPY . .
 RUN go test ./...
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/cloudflare-lb-sync ./cmd/cloudflare-lb-sync

-FROM gcr.io/distroless/static:nonroot@sha256:18f4cc26c9ffa7f20a359298be7deadac5c607c8e03a02b8119f1a5fc2f82c99
+FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329
 COPY --from=build /out/cloudflare-lb-sync /cloudflare-lb-sync
 USER 65532
 ENTRYPOINT ["/cloudflare-lb-sync"]
@@ -23,7 +23,7 @@
 # namespace, so can0 is only reachable with network_mode: host. That is also
 # how the local MQTT broker on 127.0.0.1:1883 is reached. CAN_RAW sockets need
 # no capabilities, so both run unprivileged.
-FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 AS build
+FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 AS build

 # Pins live here, in the artifact, rather than in Ansible variables.
 #
@@ -56,7 +56,7 @@ RUN git clone --quiet https://github.com/MyHomeMyData/E3onCAN.git /opt/e3oncan \
 && rm -rf /opt/e3oncan/.git


-FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51
+FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913

 ARG OPEN3E_REF=6553c10453a6bae1210908f38a5af2481a46a3e5
 ARG E3ONCAN_REF=461dcbdf97e8d72d2edb9929c63b39382af6c3a1
@@ -6,10 +6,10 @@ RUN apt-get update \
 && apt-get install -y --no-install-recommends jq \
 && rm -rf /var/lib/apt/lists/*

-COPY --from=ghcr.io/siderolabs/talosctl:v1.14.4@sha256:b3233234327350f20ed194f3fad83d90a64344c1940f839c7b0c0abef50c8c33 /talosctl /usr/local/bin/talosctl
-COPY --from=alpine/kubectl:1.37.1@sha256:a5d0fbecab3f7b6c2ab7398f1daa73a3e0ed6ece18556d21698233e9e3759cc7 /usr/local/bin/kubectl /usr/local/bin/kubectl
-COPY --from=ghcr.io/fluxcd/flux-cli:v2.9.6@sha256:b1ac18156f227af9a524b842a96f2c20986c7a779ef721df3ba4e4540f449d76 /usr/local/bin/flux /usr/local/bin/flux
-COPY --from=quay.io/openbao/openbao:2.7.1@sha256:6d2b93856e3fcf7b18ad855a0b51eaba474dc8b79cf554379ea32034797d2acf /usr/bin/bao /usr/local/bin/bao
+COPY --from=ghcr.io/siderolabs/talosctl:v1.14.5@sha256:0b852e35c1f513ee5eacc22183d6193486012420569fde39fcd5260c51938443 /talosctl /usr/local/bin/talosctl
+COPY --from=alpine/kubectl:1.37.2@sha256:5e2de75d37e811ba6eb92e06890b1b3263eae4f0a1c17b49269edec589b1352a /usr/local/bin/kubectl /usr/local/bin/kubectl
+COPY --from=ghcr.io/fluxcd/flux-cli:v2.10.0@sha256:1a5178b1770052d6e88ab1c7c8434c5ac9bca8a8ab984dcaf6b9df31814ce9f2 /usr/local/bin/flux /usr/local/bin/flux
+COPY --from=quay.io/openbao/openbao:2.7.2@sha256:5046911075e137e154ce49ab051502f4ec7cf367d484ae4a4dce665d9b90561f /usr/bin/bao /usr/local/bin/bao
 COPY --from=gitea/tea:0.16.0@sha256:af50a2060ce4d8fd76b7ebe75a3d6db4bb0c615c5bc8f2bdfd8ea83207c4752d /usr/bin/tea /usr/local/bin/tea

 RUN talosctl version --client \
@@ -1,7 +1,7 @@
 # kuma-sync: reconciles KumaMonitor resources into Uptime Kuma. The unit tests
 # (no tags, so no Docker and no envtest) gate the image: the final stage copies
 # the binary out of this stage, so a failing test fails the build.
-FROM golang:1.27@sha256:f20d83a83e18dbd2a4714b8ffd4b30b287b6243962dd75608e86abcc63ba4efc AS build
+FROM golang:1.27@sha256:2920bb124f1a2e12a1d39f0cab756ae0068441ee1da7655dec7f5e374944095b AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -9,7 +9,7 @@ COPY . .
 RUN go test ./...
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/kuma-sync ./cmd/kuma-sync

-FROM gcr.io/distroless/static:nonroot@sha256:18f4cc26c9ffa7f20a359298be7deadac5c607c8e03a02b8119f1a5fc2f82c99
+FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329
 COPY --from=build /out/kuma-sync /kuma-sync
 USER 65532
 ENTRYPOINT ["/kuma-sync"]
@@ -2,7 +2,7 @@
 # domains -> TLS passthrough -> Traefik ClusterIP) from Ingresses carrying the
 # public label. Standard library only, so the image is the interpreter plus one
 # file; runs unprivileged as its own user.
-FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51
+FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913

 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY controller.py /opt/controller.py
@@ -0,0 +1,268 @@
+# 802.1X via authentik
+
+FreeRADIUS terminates EAP-TTLS and proxies the inner PAP request to the
+authentik RADIUS outpost `802.1X Radius`. authentik checks the password and
+the access policy and returns the VLAN.
+
+## Routing by outer identity
+
+FreeRADIUS decides on the outer EAP identity (`User-Name`) of each request,
+before any local EAP processing:
+
+| Outer identity | Path |
+|---|---|
+| `anonymous` or `anonymous@<anything>` (any case) | EAP-TTLS terminated in FreeRADIUS, inner PAP to authentik |
+| anything else | whole EAP conversation (all rounds, `State` included) proxied to the UDM RADIUS for UniFi Endpoint accounts |
+
+UniFi Endpoint clients send their real account name as outer identity; their
+names look like ordinary usernames, so the rule cannot match on name patterns.
+The UDM's Access-Accept/Reject/Challenge goes to the NAS unchanged, including
+its Tunnel-* VLAN and MS-MPPE keys. The "Accept without VLAN is rejected" rule
+applies to the authentik path only. Accounting is answered locally on both
+paths.
+
+The anonymous outer identity is mandatory for authentik clients: without it
+the login goes to the UDM and fails.
+
+UDM target: home server `udm`, `10.2.11.1` UDP 1812 (the UDM on VLAN 11,
+UniFi network "(11) RADIUS"), shared secret `UDM_RADIUS_SECRET` from OpenBao
+`apps/radius`. The UDM RADIUS accepts clients from `10.2.11.0/24` only, not
+from the pod CIDR.
+
+### Path to the UDM
+
+Each FreeRADIUS pod has a second interface `net1` on VLAN 11
+(NetworkAttachmentDefinition `freeradius-udm`,
+`kubernetes/apps/authentik/freeradius-network-attachment.yaml`):
+
+- macvlan on the node link `radius0` (VLAN 11 on `uplink`, no host addresses;
+  VLANConfig in `kubernetes/talos/patches/k8s-{1,2,3}.yaml`). VLAN 11 is in
+  Cilium's `bpf.vlanBypass`, otherwise the tagged frames are dropped on
+  `uplink`.
+- IPv4 leased from the UDM DHCP server (cni-dhcp-daemon), requested without
+  the routers option: `net1` holds only the connected `10.2.11.0/24`, no
+  default route. The proxy socket is not bound to an address; the kernel's
+  route lookup for `10.2.11.1` picks `net1` and its leased address as source.
+- IPv6 disabled on `net1` (VLAN 11 sends router advertisements).
+- The NAS listeners are bound to `eth0` (`interface = eth0`); nothing listens
+  on `net1`.
+- Traffic on `net1` bypasses Cilium; there is no CNP for the UDM hop.
+
+`radius0` must exist on every node before FreeRADIUS pods are scheduled
+there: without it the macvlan ADD fails and the pod stays in
+`ContainerCreating`.
+
+## authentik objects
+
+Defined in `kubernetes/apps/authentik/blueprints-configmap.yaml`, key
+`dot1x-radius.yaml`:
+
+| Object | Name | Purpose |
+|---|---|---|
+| Flow | `dot1x-authentication-flow` | identification, password, login; no MFA, no enrollment |
+| Expression policy | `dot1x-has-vlan` | admits users with a valid `dot1x_vlan` group |
+| RADIUS property mapping | `dot1x-vlan` | puts the VLAN into the Access-Accept |
+| RADIUS provider | `802.1X Radius` | shared secret `DOT1X_OUTPOST_SECRET`, clients = cluster pod CIDRs |
+| Application | `dot1x` | bound to `dot1x-has-vlan` |
+| Outpost | `802.1X Radius` | radius, 2 replicas, ClusterIP, namespace `authentik` |
+
+The outpost's Kubernetes objects are named from the slugified outpost name:
+Service/Deployment `ak-outpost-8021x-radius`, pod label
+`goauthentik.io/outpost-name: 8021x-radius`.
+
+The shared secret is key `DOT1X_OUTPOST_SECRET` of Secret `radius-secrets`
+(ExternalSecret from OpenBao `apps/radius`), passed to the authentik worker
+only (it applies the blueprints) as env `DOT1X_OUTPOST_SECRET`, with
+`optional: true`: a missing Secret fails only the dot1x blueprint, not
+authentik. Reloader restarts the worker when `radius-secrets` changes.
+
+On the FreeRADIUS → outpost hop the shared secret is the only guard: the
+authentik namespace baseline admits all same-namespace pods, and the
+provider's client_networks is the pod CIDR.
+
+FreeRADIUS resolves the outpost Service name at startup; a re-created
+outpost Service needs the FreeRADIUS pods restarted.
+
+## VLAN convention
+
+- A group carries the VLAN as attribute `dot1x_vlan`, an integer VLAN id
+  (1–4094), e.g. `dot1x_vlan: 50`. It must be an unquoted integer: a string
+  such as `"50"` is ignored and the user is denied.
+- Membership counts through group inheritance (`User.all_groups()`).
+- A user without any such group is rejected (policy `dot1x-has-vlan`).
+- A user in several such groups gets the lowest `dot1x_vlan`.
+- The same attribute applies to WiFi and wired 802.1X.
+
+Groups and memberships are managed by the owner in authentik, not in
+blueprints.
+
+## Reply format
+
+The mapping sets both:
+
+- RFC 3580 `Tunnel-Type = VLAN`, `Tunnel-Medium-Type = IEEE-802`,
+  `Tunnel-Private-Group-Id = "<id>"` (raw attribute codes 64, 65, 81; the
+  dictionary bundled with authentik does not define them).
+- `Cisco-AV-Pair = "dot1x-vlan=<id>"`.
+
+Contract for FreeRADIUS: if the outpost reply carries the standard Tunnel-*
+attributes, use them; otherwise translate `Cisco-AV-Pair = "dot1x-vlan=<id>"`
+into `Tunnel-Type = VLAN`, `Tunnel-Medium-Type = IEEE-802`,
+`Tunnel-Private-Group-Id = "<id>"`. An Access-Accept without a VLAN is
+rejected.
+
+## Test-phase entries
+
+The FreeRADIUS clients `test` (10.2.50.0/24) and `test6` (fd02:50::/64) and
+their CIDRs in `freeradius-cnp.yaml` are for the test phase only and must be
+removed after the test.
+
+## UniFi objects
+
+Created through the UniFi Network API (site `default`):
+
+| Object | ID | Settings |
+|---|---|---|
+| Firewall policy "Allow APs RADIUS" | `62c21e63-8c15-4720-adf8-b2333c090e2f` | zone Isolated `10.2.10.0/24` → zone External `10.2.99.91`, UDP `1812-1813`, ALLOW, IPv4 |
+| RADIUS profile "Cluster 802.1X" | `3e5fcfed-63dc-4e7d-ad51-17cbc074e4bb` | auth `10.2.99.91:1812`, acct `10.2.99.91:1813`, secret `DOT1X_NAS_SECRET`, VLAN assignment on (`vlan_wlan_mode: optional`) |
+| WLAN "Renner UniFi" | `ef4122f2-4a83-4dca-9ef3-468d29f39a6b` | WPA3 Enterprise (no transition), PMF required, fast roaming, BSS transition, client isolation off, RADIUS profile "Cluster 802.1X"; Application Hotspot, type Passpoint (set in the UniFi UI: the API format differs from the UI's) |
+
+Passpoint on "Renner UniFi" (UniFi offers Passpoint only with WPA3 Enterprise):
+venue "Renner", Residential / Private Residence, network type Private with
+Guest Access, IPv4 single NATed private, IPv6 available, NAI realm
+`renner.uno` with EAP-TTLS, sub-methods PAP and username/password, domain
+`renner.uno`, operator friendly name "Renner", connection capability ICMP
+allow. The AKMs on air are `FT/802.1X` and `802.1X/SHA-256`; plain `802.1X`
+is not offered.
+
+## Live login check
+
+`tests/radius/live.sh` runs EAP-TTLS/PAP logins with `eapol_test` against the
+deployed FreeRADIUS from a test client range and prints result, duration and
+the VLAN attributes of the Access-Accept (hex) per login; secrets are read from
+files and never printed:
+
+```
+LIVE_PASSWORD_VAR=CLAUDE_BOT_PASSWORD tests/radius/live.sh 10.2.99.91 claude-bot \
+  ~/.config/claude-bot/authentik ~/.config/claude-bot/radius-secret 20
+```
+
+For IPv6 set `LIVE_SOURCE` to the workstation's `fd02:50::` address and use
+`fd99::91`. `group-id=[3530]` is VLAN `50`, `tunnel-type=[0000000d]` VLAN,
+`medium=[00000006]` IEEE-802.
+
+## Client setup (SSID "Renner UniFi")
+
+Setup page: `https://wlan.renner.uno` (behind the Authentik gate, any
+authentik user), served by the Go service `wlan-setup/`
+(`kubernetes/apps/authentik/wlan-setup*.yaml`). Android, Apple and Windows get
+Passpoint profiles with their own app password; Linux an `nmcli` command
+(NetworkManager has no Passpoint support) that carries no password.
+
+Passpoint: `/<platform>/install` (`android`, `apple` or `windows`) signs the
+user in through the authentik OAuth2 application `wlan-setup` (scope
+`goauthentik.io/api`). On `/<platform>/callback`, the service exchanges the
+code, creates an app password (`wlan-<platform>-<user>-<timestamp>-<random>`)
+with the user's own access token, and hands out the profile:
+
+- Android: `application/x-wifi-config` in the response to that GET, as its
+  installer requires.
+- Apple: a `.mobileconfig` download.
+- Windows: a CarrierProvisioning XML signed with XML-DSig (enveloped, C14N
+  1.0, rsa-sha1, chain in KeyInfo) by the Let's Encrypt certificate
+  `wlan-setup-signing`; kept for 5 minutes under a single-use token. The
+  browser is sent to `ms-settings:wifi-provisioning?uri=https://wlan.renner.uno/windows/profile/<token>`;
+  Windows Settings fetches it (Ingress `wlan-setup-provisioning`, without the
+  gate) and offers "Add".
+
+The service stores nothing else. Deleting the app password in authentik removes
+that device from the WLAN. The profiles match WLANs that advertise Hotspot 2.0
+with domain and NAI realm `renner.uno` (EAP-TTLS/PAP), i.e. "Renner UniFi".
+Creating the app password needs no admin rights.
+
+App passwords expire when unused. The page creates them with 29 days (the API
+caps new tokens at 30 days unless the group attribute
+`goauthentik.io/user/token-maximum-lifetime` allows more). Every 802.1X login
+with an app password renews it to 60 days: the policy
+`dot1x-app-password-renew` on the `dot1x-login` binding (at most one write per
+day). authentik rejects expired app passwords and deletes them in its
+`clean_expired_models` task. A device that has not connected for 60 days, or a
+profile that was never installed, loses its app password and needs a new
+profile from the page.
+
+All clients use EAP-TTLS with inner PAP. The server certificate is a public
+Let's Encrypt certificate for `radius.renner.uno`, so no CA needs to be
+installed. The 802.1X password stage (`dot1x-password`) accepts the authentik
+password and app passwords. PAP runs inside the TLS tunnel to FreeRADIUS and
+is never sent in clear over the air.
+
+### Android
+
+Passpoint profile from the setup page ("Auf Android installieren").
+
+### Linux (NetworkManager)
+
+- Security: WPA & WPA2/3 Enterprise
+- Authentication: Tunneled TLS (TTLS)
+- Inner authentication: PAP
+- CA certificate: system bundle (e.g. `/etc/ssl/certs/ca-certificates.crt`)
+- Domain: `radius.renner.uno`
+- Anonymous identity: `anonymous` (mandatory)
+- Username / password: authentik credentials
+
+### Windows 11
+
+Passpoint profile from the setup page ("Auf Windows installieren"). Manual
+setup without the page: Settings > Network & Internet > Wi-Fi > Manage known
+networks > Add network:
+
+- Network name: `Renner UniFi`
+- Security type: WPA3-Enterprise AES
+- EAP method: EAP-TTLS
+- Authentication method: Unencrypted password (PAP)
+- Server validation: where offered ("Verify server identity" / trusted
+  server name), set `radius.renner.uno`
+- Do not use Windows sign-in credentials; enter the authentik credentials
+
+On the first join, check the certificate details before connecting: it must
+be issued to `radius.renner.uno` by Let's Encrypt. Otherwise cancel.
+
+If EAP-TTLS is not offered, use Control Panel > "Manually connect to a
+wireless network" instead.
+
+### Apple (iOS, iPadOS, macOS)
+
+Passpoint configuration profile from the setup page ("Profil laden"),
+installed via Settings (Profile Downloaded) or, on a Mac, System Settings >
+General > Device Management. It sets `IsHotspot` with domain and NAI realm
+`renner.uno` (no SSID), security type Any, outer identity `anonymous`,
+trusted server name `radius.renner.uno`, username and app password; it
+contains no certificate. Its PayloadIdentifier is fixed, so installing it
+replaces an earlier profile. Apple devices may show a one-time "trust
+certificate" prompt for `radius.renner.uno` on the first join.
+
+## Measurement: authentication latency per SSID
+
+The UniFi access points log station events (`stahtd`) to Loki. The field
+`radius_auth_delta` (microseconds) is in a JSON payload after
+`stahtd_dump_event(): `.
+
+VAP names per SSID are looked up through the UniFi API: `stat/device`,
+`vap_table`, map `essid` to `name`.
+
+The JSON mixes `"key":"v"` and `"key": "v"`, so the filters tolerate an
+optional space. Values are microseconds. Run once per VAP of "Renner Test" and
+of "Renner UniFi" and compare avg and max:
+
+```
+logcli instant-query --quiet \
+  'avg_over_time({source="unifi-syslog",app="stahtd"} |~ "\"vap\": ?\"<vap>\"" | regexp "radius_auth_delta\": ?\"?(?P<d>[0-9]+)" | unwrap d [24h])'
+
+logcli instant-query --quiet \
+  'max_over_time({source="unifi-syslog",app="stahtd"} |~ "\"vap\": ?\"<vap>\"" | regexp "radius_auth_delta\": ?\"?(?P<d>[0-9]+)" | unwrap d [24h])'
+```
+
+| SSID | VAP(s) | Events | avg radius_auth_delta (us) | max radius_auth_delta (us) |
+|---|---|---|---|---|
+| Renner Test | | | | |
+| Renner UniFi | | | | |
@@ -0,0 +1,123 @@
+# 802.1X RADIUS via authentik — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** In-cluster FreeRADIUS that terminates EAP-TTLS/PAP for 802.1X and checks the password against a dedicated authentik RADIUS outpost, live behind a test SSID "Renner Test".
+
+**Architecture:** FreeRADIUS (own Deployment, 2 replicas, LB `10.2.99.91`/`fd99::91`, Let's Encrypt cert `radius.renner.uno`) terminates EAP-TTLS, proxies the inner PAP request to a new blueprint-managed authentik RADIUS outpost "802.1X Radius" (2 replicas) whose provider returns the VLAN from the group attribute `dot1x_vlan`. UniFi gets a RADIUS profile, a test WLAN and a firewall policy via the UDM API.
+
+**Tech Stack:** Flux/Kustomize manifests, authentik 2026.8 blueprints, `freeradius/freeradius-server:3.2.10-alpine`, cert-manager, External Secrets (OpenBao), Cilium LB-IPAM/BGP + CNP, UniFi Network API, `eapol_test` (workstation `/usr/bin/eapol_test`).
+
+**Spec:** `docs/superpowers/specs/2026-11-03-wifi-radius-authentik-design.md`
+
+## Global Constraints
+
+- Work only in this worktree; commits as `git -c user.name='Claude Bot' -c user.email='claude-bot@renner.uno' commit …`; never push to `main`, open a PR, never self-merge.
+- Never read Kubernetes Secret data; never print secret values; credentials only via env var on the local command (`VAR="$SECRET" tool`), never inside a string another program interprets.
+- authentik users/groups are created by the owner, not in blueprints.
+- Group attribute name: `dot1x_vlan` (integer). Test VLAN: `50`.
+- LB: `lbipam.cilium.io/ips: "10.2.99.91,fd99::91"`, label `lb-pool: bgp`, `externalTrafficPolicy: Local`, `ipFamilyPolicy: PreferDualStack`.
+- Hostname/cert: `radius.renner.uno`, ClusterIssuer `letsencrypt-cluster`.
+- RADIUS clients: `10.2.10.0/24` (APs/switches). Test client: workstation network `10.2.50.0/24` with its own secret (test phase only).
+- Existing "Unifi Radius" provider and "Local Radius" outpost: untouched.
+- Main WLANs "Renner UniFi", "Renner IoT", "Renner Gast": untouched.
+- Resource convention: requests set, memory limit only, no CPU limit; `allowPrivilegeEscalation: false`, `capabilities.drop: [ALL]`.
+- New manifests must be listed in `kubernetes/apps/authentik/kustomization.yaml`.
+
+## Review Focus
+
+- User not in any `dot1x_vlan` group → must get Access-Reject, never an Accept without VLAN (would land in the Guest fallback).
+- Wrong password → Access-Reject within < 1 s, no retry storm between FreeRADIUS and outpost.
+- Outpost reject packets lack `Message-Authenticator` (upstream behaviour) → FreeRADIUS must still forward a Reject to the AP, not time out.
+- One FreeRADIUS replica or one outpost replica down → logins keep working (Service routes to the other).
+- Accounting packets from APs (UDP 1813) → answered locally, never forwarded to the outpost (which has no 1813).
+
+---
+
+### Task 1: Secrets and server certificate
+
+**Files:**
+- Create: `kubernetes/apps/authentik/radius-cert.yaml`
+- Modify: `kubernetes/apps/authentik/kustomization.yaml`
+
+**Interfaces:**
+- Produces: Secret `radius-tls` (keys `tls.crt`, `tls.key`); OpenBao `apps/authentik` keys `DOT1X_OUTPOST_SECRET`, `DOT1X_NAS_SECRET`, `DOT1X_TEST_SECRET` (reach the cluster as keys of the existing Secret `authentik-secrets` via `externalsecret.yaml`).
+
+- [ ] **Step 1:** Generate three secrets (`openssl rand -base64 48`, piped straight into `bao kv patch apps/authentik DOT1X_OUTPOST_SECRET=- …` without echoing) — if claude-bot's OpenBao policy cannot write `apps/authentik`, stop and hand the exact `bao kv patch` command to the owner.
+- [ ] **Step 2:** Verify key names only: `bao kv get -format=json apps/authentik | jq -r '.data.data | keys[]' | grep DOT1X` → three names.
+- [ ] **Step 3:** Write `radius-cert.yaml` (Certificate `radius-tls`, secretName `radius-tls`, dnsNames `[radius.renner.uno]`, issuerRef `letsencrypt-cluster`/ClusterIssuer), add to kustomization.
+- [ ] **Step 4:** `kubectl kustomize kubernetes/apps/authentik >/dev/null` → exit 0; `kubectl apply --dry-run=server -f kubernetes/apps/authentik/radius-cert.yaml` → `created (server dry run)`.
+- [ ] **Step 5:** Commit `feat(radius): server certificate for radius.renner.uno`.
+
+### Task 2: authentik provider, VLAN mapping and outpost
+
+**Files:**
+- Modify: `kubernetes/apps/authentik/blueprints-configmap.yaml` (new key `dot1x-radius.yaml`)
+- Modify: `kubernetes/apps/authentik/helmrelease.yaml` (worker env `DOT1X_OUTPOST_SECRET` from `authentik-secrets`, only if blueprints cannot already read it via `!Env`)
+- Create: `docs/radius/dot1x.md` (owner steps + conventions)
+
+**Interfaces:**
+- Consumes: `DOT1X_OUTPOST_SECRET` (Task 1).
+- Produces: outpost "802.1X Radius" → operator Service `ak-outpost-802-1x-radius` (ClusterIP, UDP 1812), pod labels `goauthentik.io/outpost-name: 802-1x-radius`; provider "802.1X Radius" with `client_networks` = cluster pod CIDRs (read from `kubectl get nodes -o jsonpath` podCIDRs / Cilium config, not guessed); reply carries the VLAN either as standard `Tunnel-Type`/`Tunnel-Medium-Type`/`Tunnel-Private-Group-Id` or, fallback, as `Cisco-AV-Pair = "dot1x-vlan=<id>"`.
+
+- [ ] **Step 1: Blueprint objects** — expression policy `dot1x-has-vlan` (`return any(g.attributes.get("dot1x_vlan") for g in request.user.ak_groups.all())`), RADIUS property mapping `dot1x-vlan` (lowest numeric `dot1x_vlan` across the user's groups wins), provider "802.1X Radius" (`authorization_flow: ldap-authentication-flow` after Step 2 confirms it is non-interactive, `invalidation_flow: default-invalidation-flow`, `mfa_support: false`, `shared_secret: !Env DOT1X_OUTPOST_SECRET`, `property_mappings: [dot1x-vlan]`), application slug `dot1x` bound to `dot1x-has-vlan`, outpost "802.1X Radius" (type radius, `k8s-conn`, namespace `authentik`, `kubernetes_replicas: 2`, `kubernetes_service_type: ClusterIP`, providers: only "802.1X Radius").
+- [ ] **Step 2:** Confirm `ldap-authentication-flow` contains only identification + password stages (authentik API/UI read); if not, add a blueprint flow `dot1x-authentication-flow` with exactly those two stages and use it.
+- [ ] **Step 3:** Owner step (documented in `docs/radius/dot1x.md`, asked of the owner during execution): create group `802.1X Privat` with attribute `dot1x_vlan: 50`, add the owner and a test user `dot1x-test`.
+- [ ] **Step 4:** After merge + reconcile: `kubectl -n authentik get deploy ak-outpost-802-1x-radius -o json | jq .status.readyReplicas` → `2`.
+- [ ] **Step 5: VLAN attribute spike** — from a throwaway pod in `authentik` (`kubectl run radtest --rm -i --image=freeradius/freeradius-server:3.2.10-alpine --command -- radtest dot1x-test "$PW" ak-outpost-802-1x-radius 0 "$SECRET"` with values passed via `--env`, not in the string) expect `Access-Accept` containing `Tunnel-Private-Group-Id = "50"`. If the outpost cannot emit standard Tunnel attributes, switch the mapping to the `Cisco-AV-Pair` fallback and expect `Cisco-AV-Pair = "dot1x-vlan=50"`. Record which one in `docs/radius/dot1x.md`.
+- [ ] **Step 6:** Same with a user outside any `dot1x_vlan` group and with a wrong password → `Access-Reject` (< 1 s).
+- [ ] **Step 7:** Commit `feat(authentik): 802.1X RADIUS provider, VLAN mapping and outpost`.
+
+### Task 3: FreeRADIUS service
+
+**Files:**
+- Create: `kubernetes/apps/authentik/freeradius-config.yaml` (ConfigMap: `radiusd.conf`, `clients.conf`, `proxy.conf`, `mods-enabled/eap`, `sites-enabled/default`, `sites-enabled/inner-tunnel`)
+- Create: `kubernetes/apps/authentik/freeradius.yaml` (Deployment + Service `radius-lb`)
+- Create: `kubernetes/apps/authentik/freeradius-cnp.yaml`
+- Create: `kubernetes/infrastructure/image-automation/freeradius.yaml`; modify its `kustomization.yaml`
+- Modify: `kubernetes/apps/authentik/kustomization.yaml`
+
+**Interfaces:**
+- Consumes: `radius-tls`, `authentik-secrets` keys `DOT1X_NAS_SECRET`, `DOT1X_TEST_SECRET`, `DOT1X_OUTPOST_SECRET`; outpost Service `ak-outpost-802-1x-radius:1812/UDP`; reply VLAN format from Task 2.
+- Produces: `radius.renner.uno` → `10.2.99.91`/`fd99::91`, UDP 1812/1813.
+
+- [ ] **Step 1: Config** — `clients.conf`: client `aps` `10.2.10.0/24` secret `$ENV{DOT1X_NAS_SECRET}`, client `test` `10.2.50.0/24` secret `$ENV{DOT1X_TEST_SECRET}`, both `require_message_authenticator = yes`. `eap`: `default_eap_type = ttls`, TLS from `/etc/raddb/certs/radius-tls/{tls.crt,tls.key}`, `ttls { virtual_server = inner-tunnel, use_tunneled_reply = yes }`; no PEAP/MSCHAP. `inner-tunnel`: PAP proxied to home server `authentik` (`ak-outpost-802-1x-radius.authentik.svc.cluster.local:1812`, secret `$ENV{DOT1X_OUTPOST_SECRET}`, `response_window = 3`, do not require Message-Authenticator on its rejects). `default` post-auth: if the Cisco-AV-Pair fallback is in use, translate `dot1x-vlan=<id>` into `Tunnel-Type := VLAN`, `Tunnel-Medium-Type := IEEE-802`, `Tunnel-Private-Group-Id := <id>`; reject an Accept that carries no VLAN. Accounting: answer locally, `detail`-free.
+- [ ] **Step 2: Deployment** — image `freeradius/freeradius-server:3.2.10-alpine # {"$imagepolicy": "flux-system:freeradius"}`, args `-f -l stdout`, 2 replicas, `podAntiAffinity` required on `kubernetes.io/hostname`, env from the three secret keys (`secretKeyRef`, not `envFrom`), mounts ConfigMap + `radius-tls`, readiness/liveness via `radclient` Status-Server on 127.0.0.1 or a TCP-less exec check, requests `cpu 20m / memory 64Mi`, limit `memory 256Mi`, `stakater.com/auto: "true"` like other apps. Service `radius-lb` per Global Constraints, ports 1812/1813 UDP, annotation `external-dns.kubernetes.io/hostname: radius.renner.uno`.
+- [ ] **Step 3: CNPs** — ingress to FreeRADIUS pods from `10.2.10.0/24` and `10.2.50.0/24` UDP 1812/1813; ingress to pods `goauthentik.io/outpost-name: 802-1x-radius` UDP 1812 only from FreeRADIUS pods (model on `ldap-outpost-cnp.yaml`, use container ports).
+- [ ] **Step 4: Image automation** — `ImageRepository freeradius` (`docker.io/freeradius/freeradius-server`), `ImagePolicy freeradius` with `filterTags.pattern: '^(?P<v>3\.2\.\d+)-alpine$'`, `extract: '$v'`, `semver.range: "3.2.x"`.
+- [ ] **Step 5:** `kubectl kustomize kubernetes/apps/authentik >/dev/null` and `kubectl apply --dry-run=server` on the new files → no errors.
+- [ ] **Step 6:** After merge + reconcile: `kubectl -n authentik get deploy freeradius -o json | jq .status.readyReplicas` → `2`; `kubectl -n authentik get svc radius-lb -o json | jq -r '.status.loadBalancer.ingress[].ip'` → `10.2.99.91` and `fd99::91`.
+- [ ] **Step 7: End-to-end from the workstation** — `eapol_test` config (TTLS, phase2 `auth=PAP`, `ca_cert` system bundle, `domain_suffix_match="radius.renner.uno"`, identity `dot1x-test`) run as `DOT1X_TEST_SECRET=… eapol_test -c ttls.conf -a 10.2.99.91 -s "$DOT1X_TEST_SECRET"` with the password supplied from an env var into the config file in the scratchpad (file deleted afterwards) → `SUCCESS`, `Tunnel-Private-Group-Id` `50` in the output; same with wrong password → `FAILURE` in < 1 s; user without group → `FAILURE`.
+- [ ] **Step 8: Redundancy check without touching live pods** — confirm both FreeRADIUS replicas and both outpost replicas serve: `kubectl -n authentik get pods -l app.kubernetes.io/name=freeradius -o wide` shows two different nodes; loop `eapol_test` 20× → 20× `SUCCESS` and both pods log requests (`kubectl logs`). No rollout restart or pod deletion (house rule).
+- [ ] **Step 9: Alert** — add rules to `kubernetes/apps/monitoring-rules/` (follow the existing rule files there): `kube_deployment_status_replicas_available{namespace="authentik",deployment=~"freeradius|ak-outpost-802-1x-radius"} < 1` for 2m → critical; `< 2` for 15m → warning. Verify `kubectl kustomize kubernetes/apps/monitoring-rules >/dev/null`.
+- [ ] **Step 10:** Commit `feat(radius): FreeRADIUS EAP-TTLS frontend for authentik`.
+
+### Task 4: UniFi RADIUS profile, test WLAN, firewall policy
+
+**Files:**
+- Modify: `docs/radius/dot1x.md` (record created objects, IDs, settings)
+
+**Interfaces:**
+- Consumes: `radius.renner.uno`/`10.2.99.91`, `DOT1X_NAS_SECRET`.
+- Produces: UniFi RADIUS profile "Cluster 802.1X" (auth `10.2.99.91:1812`, acct `10.2.99.91:1813`, VLAN assignment enabled), WLAN "Renner Test", firewall policy "Allow APs RADIUS".
+
+- [ ] **Step 1:** POST firewall policy (clone of "Allow APs syslog to Loki": source zone Isolated IP `10.2.10.0/24`, destination zone External IP `10.2.99.91`, UDP, ports `1812-1813`, ALLOW) via `/proxy/network/v2/api/site/default/firewall-policies`; verify it is listed.
+- [ ] **Step 2:** Create RADIUS profile via `/proxy/network/api/s/default/rest/radiusprofile` (secret passed from env into a JSON file in the scratchpad, never on the command line); verify listed.
+- [ ] **Step 3:** Create WLAN "Renner Test" via `/rest/wlanconf` cloned from "Renner UniFi" settings (security `wpaeap`, `wpa3_support`/`wpa3_transition` as main, `fast_roaming_enabled: true`, `bss_transition: true`, same `ap_group_ids`, `networkconf_id` (90) Guest as fallback) with the new `radiusprofile_id`; verify all APs broadcast it (`stat/device` vap_table essid).
+- [ ] **Step 4:** Owner joins one Android device; verify in Loki stahtd `success` with `radius_auth_delta` and `vlan 50` in `stat/sta`.
+- [ ] **Step 5:** Commit `docs(radius): document UniFi objects for the 802.1X test`.
+
+### Task 5: Client configuration aids and measurement
+
+**Files:**
+- Create: `docs/radius/clients/renner-test.mobileconfig` (no password; EAP-TTLS, `TTLSInnerAuthentication: PAP`, `TLSTrustedServerNames: [radius.renner.uno]`)
+- Modify: `docs/radius/dot1x.md` (Android/Linux/Windows steps; LogQL for `radius_auth_delta` per SSID; result table)
+
+- [ ] **Step 1:** Write the profile; validate `plutil -lint`-equivalent: `xmllint --noout docs/radius/clients/renner-test.mobileconfig` → no output.
+- [ ] **Step 2:** Document the comparison query (stahtd events, `radius_auth_delta`, grouped by VAP of "Renner Test" vs. "Renner UniFi") and run it once the owner's devices have joined; record avg/max.
+- [ ] **Step 3:** Commit `docs(radius): client setup and measurement for the 802.1X test`.
+
+### Task 6: PR
+
+- [ ] **Step 1:** Push branch with claude-bot credentials; open PR via `tea pr create --login claude-bot` (description = the change; no session status).
+- [ ] **Step 2:** Verify with `tea pr list --login claude-bot --state open`.
@@ -0,0 +1,228 @@
+# 802.1X via authentik: in-cluster RADIUS (first test on a test SSID)
+
+Date: 2026-11-03
+
+## Intent
+
+Full 802.1X logins on the main WLAN "Renner UniFi" spend 1.3–6 s in RADIUS
+(avg ~2 s, every login >1 s; 0.23–0.43 s per RADIUS round trip). The RADIUS
+server is the UDM's built-in FreeRADIUS, which runs Ubiquiti's
+`/usr/sbin/pyauth_log.py` in authorize/authenticate/post-auth and spawns
+`mca-ctrl` synchronously for every RADIUS packet. Every failed fast roam,
+every arrival at home and every band change pays that cost. The owner has
+been unhappy with the UDM RADIUS performance for a while.
+
+This project stands up an in-cluster RADIUS whose password check and group
+membership come from authentik, and puts it behind a **separate test SSID**.
+The owner moves some of his own devices to it. If RADIUS time per login is
+significantly better, a solution for the rest of the household follows in a
+later project.
+
+## Goals
+
+- In-cluster RADIUS for **802.1X in general** (WiFi and wired switch ports;
+  owner: "802.1x ist das was relevant ist") that authenticates users with
+  their **authentik username and password** (central credentials; a password
+  change in authentik applies immediately).
+- Password verification **by authentik itself** via the authentik RADIUS
+  outpost (owner decision).
+- **VLAN per user from authentik groups.**
+- Must work with **every client OS** (Android, iOS/iPadOS, macOS, Windows,
+  Linux).
+- Client setup as automatic as possible; no client certificates, no private
+  CA. A device configured once should carry the credentials to new devices
+  through platform sync where the platform does so.
+- A test SSID that points only at the new RADIUS; measurable result.
+
+## Non-goals
+
+- Migrating "Renner UniFi" or the UniFi Endpoint-provisioned accounts. The main
+  WLAN keeps using the UDM RADIUS unchanged.
+- VPN authentication (OpenVPN "Renner SSL VPN" also uses the UDM RADIUS
+  profile; out of scope).
+- Enabling 802.1X on switch ports in this project (no port has it today); the
+  server must be ready for it (switches as RADIUS clients); the first test is
+  the test SSID.
+- An onboarding page that hands out Apple/Windows profiles — owner: leave it
+  out for the test (likely follow-up).
+- RADIUS accounting (authentik supports authentication requests only).
+- MFA for 802.1X.
+
+## Anti-goals (a failure even if it technically works)
+
+- Anything that changes behaviour of the existing "Renner UniFi", "Renner IoT"
+  or "Renner Gast" WLANs or breaks the UniFi Endpoint app.
+- Client certificates (EAP-TLS) — owner: without central device management
+  unacceptable fiddling.
+- NT hashes (PEAP-MSCHAPv2 via `sambaNTPassword` from authentik-samba-bridge)
+  — rejected by the owner: weak password-equivalent MD4 hash stored and
+  exposed, and dependency on the samba-bridge fork.
+- A private CA that every client has to trust.
+- Copying Ubiquiti's RADIUS certificate/private key off the UDM.
+
+## Constraints and facts
+
+- authentik RADIUS provider (outpost image `ghcr.io/goauthentik/radius:2026.8.4`)
+  supports **PAP** and **EAP-TLS** only (no PEAP/MSCHAPv2, no EAP-TTLS);
+  custom reply attributes via RADIUS property mappings (since 2024.8);
+  authentication requests only (docs.goauthentik.io, RADIUS provider). It
+  speaks plain RADIUS (no RadSec).
+- APs/switches speak EAP, so an EAP server must terminate the outer method:
+  FreeRADIUS terminates **EAP-TTLS** and forwards the **inner PAP** request to
+  the authentik RADIUS outpost.
+- Client OS support for EAP-TTLS/PAP (vendor docs: IronWiFi, JumpCloud,
+  Fortinet, Meraki; no Apple statement found):
+  - Android, Linux: normal join dialog (EAP method TTLS, phase 2 PAP,
+    identity/password, CA "system certificates", domain).
+  - Windows 11: no file needed, but via "add network manually": EAP-TTLS,
+    "Unencrypted password (PAP)" (Control Panel route if Settings lacks it).
+  - iOS/iPadOS/macOS: requires a configuration profile (inner auth PAP is
+    only selectable in a profile). For the test the profile is built and
+    installed by hand.
+- authentik does not support EAP (maintainer, goauthentik/authentik#15498);
+  MSCHAPv2/PEAP will not be implemented (reversible password storage);
+  EAP-TLS needs the MTLS stage (enterprise-licensed per community project
+  wus-technik/authentik-freeradius). FreeRADIUS in front of the outpost is
+  the established pattern. Owner decision (2026-11-03): **FreeRADIUS as its
+  own service** — the alternatives (FreeRADIUS as sidecar in the outpost pod,
+  keeping the UDM RADIUS, another IdP) were rejected.
+- Known outpost issues with `Message-Authenticator` (goauthentik/authentik
+  #17901, #22931: packets dropped as "invalid message authenticator"). The
+  builder must test the FreeRADIUS → outpost hop with Message-Authenticator
+  early and document the working combination.
+- **The FreeRADIUS → authentik outpost hop is plain RADIUS**: the password is
+  only obfuscated with the shared secret (RFC 2865 MD5 hiding). Cilium has no
+  transparent encryption enabled (no WireGuard/IPsec in `cilium-config`).
+  The owner chose this path over LDAPS bind (2026-11-03). Mitigations below.
+- Existing objects: RADIUS provider "Unifi Radius" (exists in the authentik
+  DB, only referenced by `!Find` in
+  `kubernetes/apps/authentik/blueprints-configmap.yaml`) and outpost
+  "Local Radius" (`ak-outpost-local-radius`, ClusterIP, 1 replica, namespace
+  `authentik`). What currently uses "Unifi Radius" is unknown; it must not
+  break.
+- authentik users and groups are created by the owner in authentik, not in
+  blueprints. Designs read a convention.
+- APs (and switches) send RADIUS from the management network VLAN 10
+  (`10.2.10.0/24`). VLAN 10 is dual-stack, `10.2.10.0/24` and
+  `fd02:10::/64` (verified live: all APs/switches have fd02:10:: addresses).
+- LB services: pool `bgp-pool` (10.2.99.0/24, fd99::/64, label `lb-pool: bgp`,
+  `kubernetes/infrastructure/post-crds/cilium-bgp.yaml`), pinned IPs with the
+  same last byte in both families (`lbipam.cilium.io/ips`),
+  `externalTrafficPolicy: Local` (preserves the AP source IP),
+  `ipFamilyPolicy: PreferDualStack`. Live in use: .81–.90.
+- UDM firewall: the LB range 10.2.99.0/24 is in the UDM "External" zone; the
+  existing policy "Allow APs syslog to Loki" (Isolated 10.2.10.0/24 → External
+  10.2.99.84 UDP 5514) is the template. Firewall policies and WLANs are not in
+  OpenTofu today (UI/API only; the UDM API key is available to the builder).
+- House patterns: cert-manager `Certificate` with ClusterIssuer
+  `letsencrypt-cluster` (Cloudflare DNS-01), as `ldap-outpost-cert.yaml`;
+  secrets via External Secrets Operator from OpenBao (`ClusterSecretStore
+  openbao`, key `apps/<app>`, Reloader restarts pods); DNS via
+  `external-dns.kubernetes.io/hostname` on the Service (UDM split-horizon);
+  additive CNP for LAN ingress like `ldap-outpost-cnp.yaml`; namespace
+  baseline `infrastructure/network-policies/authentik-ns.yaml`.
+
+## Design (decided)
+
+### Authentication path
+
+```
+client --EAP-TTLS (outer TLS to FreeRADIUS, cert radius.renner.uno), inner PAP--> AP / switch
+AP/switch --RADIUS UDP 1812--> FreeRADIUS (in cluster, LB 10.2.99.91)
+FreeRADIUS (inner tunnel) --RADIUS PAP--> authentik RADIUS outpost (in cluster)
+   <-- Access-Accept + VLAN attributes (authentik property mapping) --
+FreeRADIUS --Access-Accept + Tunnel attrs (copied from inner reply)--> AP/switch
+```
+
+- Owner decision: username + **authentik password** (central credentials).
+- Owner decision: password check **directly by the authentik RADIUS outpost**.
+- Owner decision: **separate test SSID**; test devices are the owner's own,
+  across all OSes, and must keep working normally.
+- Owner decision: client certificates and NT hashes are out.
+- Success threshold (proposed by me, accepted by the owner): RADIUS time per
+  full login **< 0.5 s** vs. ~2 s today — a data point for the follow-up
+  decision, not a hard pass/fail gate.
+
+### Protecting the FreeRADIUS → outpost hop (my calls)
+
+- CNP so the RADIUS outpost accepts RADIUS only from the FreeRADIUS pods.
+- Long random shared secret for this hop (OpenBao).
+- Require and send `Message-Authenticator` on both hops (BlastRADIUS).
+
+### Server certificate
+
+Public Let's Encrypt certificate for `radius.renner.uno` via cert-manager
+(renewed automatically). Android/Linux validate with system certificates +
+domain `radius.renner.uno`; Apple via the profile (CA/server name in the
+profile); Windows shows the certificate on first join. No private CA.
+(My call on the hostname.) The builder verifies and documents what clients do
+after a certificate renewal (Windows may prompt again).
+
+### VLAN from groups (convention, my call)
+
+A group that grants 802.1X access (WiFi and wired) carries the group
+attribute `dot1x_vlan` (integer VLAN ID, e.g. `50`). An authentik RADIUS
+property mapping returns `Tunnel-Type = VLAN (13)`,
+`Tunnel-Medium-Type = IEEE-802 (6)`, `Tunnel-Private-Group-Id = <dot1x_vlan>`.
+A user without any group carrying `dot1x_vlan` is rejected. If a user has
+several, the builder picks a deterministic rule and documents it. The owner
+creates the groups and memberships in authentik; for the test the owner's
+group maps to VLAN 50 ((50) Privat), like his current UDM account.
+
+### authentik side (my calls)
+
+- A dedicated RADIUS provider for 802.1X (blueprint-managed), with the VLAN
+  property mapping and a non-interactive authentication flow, attached to an
+  outpost with **2 replicas**. Whether that is the existing "Local Radius"
+  outpost or a new one is the builder's call, after finding out what uses
+  "Unifi Radius" today; nothing that already uses it may break.
+- The provider's allowed client network: the FreeRADIUS pods only.
+
+### Test SSID (my calls)
+
+- Name: "Renner Test".
+- WPA2/WPA3-Enterprise like "Renner UniFi", Fast Roaming on, BSS transition on,
+  same bands. Fallback network for unassigned clients: same as "Renner UniFi"
+  ((90) Guest).
+- RADIUS profile with **only** the cluster RADIUS (no UDM fallback), so the
+  measurement shows the real performance.
+
+### Placement and exposure (my calls)
+
+- FreeRADIUS in namespace `authentik`, files under `kubernetes/apps/authentik/`
+  (no new Flux Kustomization; egress to the outpost is already allowed by the
+  namespace baseline). **2 replicas on different nodes.**
+- LB Service `radius-lb`, IPs `10.2.99.91,fd99::91`, UDP 1812 (+1813 so APs
+  don't wait on accounting), `external-dns` hostname `radius.renner.uno`.
+- Additive CNP: ingress from `10.2.10.0/24` to the FreeRADIUS pods, UDP
+  1812/1813.
+- RADIUS clients in FreeRADIUS: APs and switches (`10.2.10.0/24`).
+- Secrets (AP/switch↔FreeRADIUS, FreeRADIUS↔outpost) in OpenBao `apps/radius`.
+- UDM firewall policy "Allow APs RADIUS": Isolated `10.2.10.0/24` → External
+  `10.2.99.91` UDP 1812/1813, modelled on "Allow APs syslog to Loki".
+- Accounting: FreeRADIUS accepts and discards.
+
+### Measurement and test
+
+- stahtd `STA_ASSOC_TRACKER` events in Loki (`{source="unifi-syslog",
+  app="stahtd"}`) carry `radius_auth_delta` (µs) per full login, end to end as
+  seen by the AP (including the authentik check). Compare the test SSID's VAPs
+  against "Renner UniFi" over the test period.
+- Test matrix: the owner's devices — Android, iOS/iPadOS, macOS (with
+  hand-made profile), Windows, Linux — join "Renner Test"; each must connect,
+  land in VLAN 50, survive fast roaming between APs, and keep working
+  normally.
+
+## Left to the builder
+
+- FreeRADIUS image/version and configuration details (EAP-TTLS module,
+  inner-tunnel proxying of PAP to the outpost, copying inner reply
+  attributes / `use_tunneled_reply`, Message-Authenticator settings, TLS
+  settings), resource requests/limits.
+- The authentik flow used for RADIUS password checks (must not require
+  interactive stages) and the exact property-mapping code.
+- How the UniFi RADIUS profile, test WLAN and firewall policy are created
+  (UniFi API vs. OpenTofu); if not IaC, document them.
+- The Apple profile for the test (`.mobileconfig` with TTLS/PAP, server name
+  `radius.renner.uno`), and the Windows manual steps.
+- Verification steps and monitoring (metrics, alert on RADIUS unreachable).
@@ -19,7 +19,7 @@ The image is the official archiso **releng** profile plus:
 - the extra disk tools the installer needs

 Division of labour: the ISO produces an **ansible-ready base system**;
-all service configuration (zwave-js-ui, sml2mqtt, open3e/CAN) stays in
+all service configuration (zwave-js-ui, sml2mqtt) stays in
 `ansible/docs/edge-host.md` as the single source of truth. Rebuilding the
 box is: boot ISO → `edge-install` → run the play.

@@ -42,10 +42,11 @@ for the CA key; rebuild the ISO after a CA rotation.
 2. Boot the target from it (UEFI, Secure Boot off; one-time F12/setup
   visit if the box doesn't already boot USB first)
 3. Either on the console (auto-login as root) or headless —
-   `ssh root@<dhcp-ip>` with an owner certificate — run `edge-install`. It auto-detects the internal disk
-   (NVMe, else eMMC — covers the Wyse 3040 — else first non-USB disk),
-   shows the target and requires typing the hostname before wiping
-   anything. Override with `edge-install /dev/sdY`.
+   `ssh root@<dhcp-ip>` with an owner certificate — run
+   `edge-install <hostname>` (e.g. `edge-install edge-2`). It auto-detects
+   the internal disk (NVMe, else eMMC — covers the Wyse 3040 — else first
+   non-USB disk), shows the target and requires typing the hostname before
+   wiping anything. Override with `edge-install <hostname> /dev/sdY`.
 4. Reboot. Confirm the box is reachable by name — `ssh root@<host>` — before
   going further; it is identified by name everywhere and its address is
   never recorded. Then add it to `[edge_host]` in
@@ -1,13 +1,19 @@
 #!/usr/bin/env bash
-# Installer for edge-1 (bare-metal edge host, replaces the k8s-edge VM).
+# Installer for the bare-metal edge hosts (edge-1, edge-2, ...).
 # Runs from the edge-host ISO live environment. WIPES the target disk.
-# Usage: edge-install [disk]
-# Default: the internal disk — first NVMe, else eMMC (Wyse 3040), else
+# Usage: edge-install <hostname> [disk]
+# Default disk: the internal disk — first NVMe, else eMMC (Wyse 3040), else
 # the first non-USB, non-optical disk. The live USB stick itself is
 # excluded via the ISO9660 label mount.
 set -euo pipefail

-HOST=edge-1
+usage() { echo "usage: edge-install <hostname> [disk]"; exit 1; }
+[ $# -ge 1 ] && [ $# -le 2 ] || usage
+HOST=$1
+# RFC 1123 label: what systemd-networkd sends as the DHCP hostname.
+[[ "$HOST" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] \
+  || { echo "invalid hostname: $HOST"; exit 1; }
+shift

 detect_disk() {
  # eMMC needs mmc_block before any /dev/mmcblk* exists (see
@@ -51,7 +57,7 @@ mount --mkdir "$(part 1)" /mnt/boot

 # Everything the edge-host ansible role expects to find; the role itself
 # is applied over SSH after first boot (see ansible/docs/edge-host.md).
-pacstrap -K /mnt base linux linux-firmware intel-ucode openssh python git \
+pacstrap -K /mnt base linux linux-firmware intel-ucode openssh sudo python git \
  docker docker-compose

 genfstab -U /mnt >> /mnt/etc/fstab
@@ -22,6 +22,13 @@ Two rules, one per family, send every packet with a pod source to table 47
 (`talos/patches/site-homelab.yaml`, priorities 1000/1001, below main). The
 table decides by longest prefix; no rule carves out exceptions.

+A reply from a LoadBalancer VIP is pod traffic as well, but it reaches the
+routing decision with the VIP as its source. Two more rules (1002/1003) send
+the LoadBalancer pool to table 47, so the reply leaves over `ingress0`, where
+the request arrived as the BGP next hop. Without them main sent it out
+`mgmt0`. The pool is a site fact: the site patch's `lb-pool-site` ConfigMap,
+which `bgp-pool` takes by Flux substitution, and the rules beside it.
+
 bird (`kubernetes/infrastructure/bird/`) owns table 47 and fills it with:

 - the node's attached networks — `mgmt0`, `ingress0`, `pod0`, `node0` —
@@ -48,7 +48,7 @@ spec:
        # cert when doing server-side OIDC token exchange. Bundle both
        # roots into one PEM since NODE_EXTRA_CA_CERTS accepts one file.
        - name: fetch-le-staging-roots
-          image: curlimages/curl:8.23.0@sha256:11e64e28c5f58c8d93ee95fcf22ac055f48b0bc440e0ce7d8013bbb5ad6aa8ac
+          image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
          command:
            - sh
            - -c
@@ -1262,12 +1262,6 @@ data:
            - authentik_policies_expression.add_expressionpolicy
            - authentik_policies_expression.change_expressionpolicy
            - authentik_policies_expression.delete_expressionpolicy
-            - authentik_providers_oauth2.view_oauth2provider
-            - authentik_providers_oauth2.add_oauth2provider
-            - authentik_providers_oauth2.change_oauth2provider
-            - authentik_providers_oauth2.delete_oauth2provider
-            - authentik_providers_oauth2.view_scopemapping
-            - authentik_crypto.view_certificatekeypair
            - authentik_core.view_group
            - authentik_flows.view_flow
            - authentik_outposts.view_outpostserviceconnection
@@ -1453,3 +1447,269 @@ data:
          stage: !KeyOf sso-passkey-validation
          order: 30
        state: present
+
+  # 802.1X: FreeRADIUS terminates EAP-TTLS and proxies inner PAP to the
+  # "802.1X Radius" outpost. VLAN from group attribute dot1x_vlan; see
+  # docs/radius/dot1x.md.
+  dot1x-radius.yaml: |
+    version: 1
+    metadata:
+      name: 802.1X RADIUS (homelab)
+    entries:
+      # Non-interactive: identification, password, login. No MFA.
+      - id: dot1x-flow
+        model: authentik_flows.flow
+        identifiers:
+          slug: dot1x-authentication-flow
+        state: present
+        attrs:
+          name: 802.1X authentication
+          title: "802.1X"
+          designation: authentication
+
+      - id: dot1x-identification
+        model: authentik_stages_identification.identificationstage
+        identifiers:
+          name: dot1x-identification
+        state: present
+        attrs:
+          user_fields:
+            - username
+            - email
+
+      - id: dot1x-password
+        model: authentik_stages_password.passwordstage
+        identifiers:
+          name: dot1x-password
+        state: present
+        attrs:
+          # App passwords: the WLAN credential that devices store (Android
+          # Passpoint profiles carry it), created by wlan.renner.uno.
+          backends:
+            - authentik.core.auth.InbuiltBackend
+            - authentik.core.auth.TokenBackend
+
+      - id: dot1x-login
+        model: authentik_stages_user_login.userloginstage
+        identifiers:
+          name: dot1x-login
+        state: present
+
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          target: !KeyOf dot1x-flow
+          stage: !KeyOf dot1x-identification
+          order: 10
+        state: present
+
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          target: !KeyOf dot1x-flow
+          stage: !KeyOf dot1x-password
+          order: 20
+        state: present
+
+      - id: binding-dot1x-login
+        model: authentik_flows.flowstagebinding
+        identifiers:
+          target: !KeyOf dot1x-flow
+          stage: !KeyOf dot1x-login
+          order: 100
+        state: present
+        attrs:
+          evaluate_on_plan: false
+          re_evaluate_policies: true
+
+      # Sliding expiry: an app password used for 802.1X expires 60 days
+      # after its last use; authentik rejects and deletes expired app
+      # passwords. auth_method_args.token is set by TokenBackend. Always
+      # passes; failure_result true keeps an error from blocking the login.
+      - id: dot1x-app-password-renew
+        model: authentik_policies_expression.expressionpolicy
+        identifiers:
+          name: dot1x-app-password-renew
+        state: present
+        attrs:
+          expression: |
+            from datetime import timedelta
+            from django.utils.timezone import now
+            from authentik.core.models import Token, TokenIntents
+            ref = (request.context.get("auth_method_args") or {}).get("token")
+            if request.context.get("auth_method") == "token" and isinstance(ref, dict):
+                renewed = now() + timedelta(days=60)
+                count = Token.objects.filter(
+                    pk=ref.get("pk"),
+                    user=request.user,
+                    intent=TokenIntents.INTENT_APP_PASSWORD,
+                    expiring=True,
+                    expires__lt=renewed - timedelta(days=1),
+                ).update(expires=renewed)
+                ak_logger.info("dot1x app password", token=ref.get("name"), renewed=count)
+            return True
+
+      - model: authentik_policies.policybinding
+        identifiers:
+          policy: !KeyOf dot1x-app-password-renew
+          target: !KeyOf binding-dot1x-login
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: false
+          failure_result: true
+
+      - id: dot1x-has-vlan
+        model: authentik_policies_expression.expressionpolicy
+        identifiers:
+          name: dot1x-has-vlan
+        state: present
+        attrs:
+          expression: |
+            for g in request.user.all_groups():
+                v = g.attributes.get("dot1x_vlan")
+                if type(v) is int and 1 <= v <= 4094:
+                    return True
+            return False
+
+      # Lowest dot1x_vlan wins. Tunnel-* (RFC 3580) set by raw code: the
+      # bundled dictionary lacks them. Cisco-AV-Pair is the fallback.
+      - id: dot1x-vlan-mapping
+        model: authentik_providers_radius.radiusproviderpropertymapping
+        identifiers:
+          name: dot1x-vlan
+        state: present
+        attrs:
+          expression: |
+            vlans = [g.attributes.get("dot1x_vlan") for g in request.user.all_groups()]
+            vlans = [v for v in vlans if type(v) is int and 1 <= v <= 4094]
+            if not vlans:
+                return packet
+            vlan = str(min(vlans))
+            try:
+                packet[64] = [b"\x00\x00\x00\x0d"]  # Tunnel-Type = VLAN
+                packet[65] = [b"\x00\x00\x00\x06"]  # Tunnel-Medium-Type = IEEE-802
+                packet[81] = [vlan.encode()]  # Tunnel-Private-Group-Id
+            except Exception:
+                pass
+            define_attribute(
+                vendor_code=9,
+                vendor_name="Cisco",
+                attribute_name="AV-Pair",
+                attribute_code=1,
+                attribute_type="string",
+            )
+            packet["Cisco-AV-Pair"] = f"dot1x-vlan={vlan}"
+            return packet
+
+      # client_networks: cluster pod CIDRs (kube-controller-manager
+      # --cluster-cidr, talos/patches/cluster.yaml podSubnets).
+      - id: dot1x-provider
+        model: authentik_providers_radius.radiusprovider
+        identifiers:
+          name: 802.1X Radius
+        state: present
+        attrs:
+          authorization_flow: !KeyOf dot1x-flow
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
+          shared_secret: !Env DOT1X_OUTPOST_SECRET
+          client_networks: "10.244.0.0/16,fd10:244::/48"
+          mfa_support: false
+          certificate: null
+          property_mappings:
+            - !KeyOf dot1x-vlan-mapping
+
+      - id: dot1x-application
+        model: authentik_core.application
+        identifiers:
+          slug: dot1x
+        state: present
+        attrs:
+          name: 802.1X network access
+          slug: dot1x
+          provider: !KeyOf dot1x-provider
+          meta_description: "WiFi and wired 802.1X via FreeRADIUS"
+
+      - model: authentik_policies.policybinding
+        identifiers:
+          target: !KeyOf dot1x-application
+          policy: !KeyOf dot1x-has-vlan
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: false
+          failure_result: false
+
+      - model: authentik_outposts.outpost
+        identifiers:
+          name: 802.1X Radius
+        state: present
+        attrs:
+          type: radius
+          service_connection: !Find [authentik_outposts.kubernetesserviceconnection, [name, "Local Kubernetes Cluster"]]
+          providers:
+            - !KeyOf dot1x-provider
+          config:
+            log_level: info
+            authentik_host: "http://authentik-server.authentik.svc.cluster.local"
+            authentik_host_insecure: false
+            authentik_host_browser: "https://auth.renner.uno/"
+            refresh_interval: "minutes=5"
+            container_image: null
+            object_naming_template: "ak-outpost-%(name)s"
+            kubernetes_namespace: authentik
+            kubernetes_replicas: 2
+            kubernetes_service_type: ClusterIP
+            kubernetes_disabled_components: []
+            kubernetes_image_pull_secrets: []
+            kubernetes_ingress_annotations: {}
+            kubernetes_ingress_class_name: null
+            kubernetes_ingress_secret_name: "authentik-outpost-tls"
+            kubernetes_ingress_path_type: null
+            kubernetes_httproute_annotations: {}
+            kubernetes_httproute_parent_refs: []
+            kubernetes_json_patches: null
+
+      # wlan.renner.uno (wlan-setup.yaml): signs the user in and, with the
+      # user's own access token (scope goauthentik.io/api), creates the WLAN
+      # app password for the Android Passpoint profile. Confidential client;
+      # the secret comes from wlan-setup-oauth (wlan-setup-oauth.yaml). No
+      # policy binding: every authentik user may set up the WLAN.
+      - id: wlan-setup-provider
+        model: authentik_providers_oauth2.oauth2provider
+        identifiers:
+          name: WLAN setup
+        state: present
+        attrs:
+          authentication_flow: null
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: confidential
+          client_id: wlan-setup
+          client_secret: !Env WLAN_SETUP_CLIENT_SECRET
+          grant_types:
+            - authorization_code
+          access_token_validity: minutes=5
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-authentik_api]]
+          redirect_uris:
+            - url: https://wlan.renner.uno/android/callback
+              matching_mode: strict
+            - url: https://wlan.renner.uno/apple/callback
+              matching_mode: strict
+            - url: https://wlan.renner.uno/windows/callback
+              matching_mode: strict
+
+      - model: authentik_core.application
+        identifiers:
+          slug: wlan-setup
+        state: present
+        attrs:
+          name: WLAN setup
+          slug: wlan-setup
+          provider: !KeyOf wlan-setup-provider
+          meta_launch_url: https://wlan.renner.uno
+          meta_description: "WLAN setup page; creates WLAN app passwords"
@@ -73,6 +73,10 @@ spec:
      # on an unclean shutdown is not an acceptable trade.
      checkpoint_timeout: "15min"
      max_wal_size: "2GB"
+      # authentik's subclass joins over empty tables get planner costs far above
+      # jit_above_cost; LLVM compilation then takes ~420 ms for a query that
+      # executes in 0.1 ms (every flow start, every RADIUS/LDAP login).
+      jit: "off"
      # zstd, not "on": the boolean spelling resolves to pglz (2016-era, weaker
      # and slower than the lz4/zstd this build also accepts). Compresses the
      # full-page images that dominate WAL volume after each checkpoint.
@@ -0,0 +1,45 @@
+# RADIUS clients reach FreeRADIUS through radius-lb (externalTrafficPolicy
+# Local keeps their source IP): APs 10.2.10.0/24 + fd02:10::/64, test
+# clients 10.2.50.0/24 + fd02:50::/64 (test phase only).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: freeradius-nas-ingress
+  namespace: authentik
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: freeradius
+  ingress:
+    - fromCIDR:
+        - 10.2.10.0/24
+        - fd02:10::/64
+        - 10.2.50.0/24
+        - fd02:50::/64
+      toPorts:
+        - ports:
+            - port: "1812"
+              protocol: UDP
+            - port: "1813"
+              protocol: UDP
+---
+# FreeRADIUS proxies inner PAP to the 802.1X outpost on its container port.
+# Additive: default-deny-ingress already admits the whole namespace.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: dot1x-outpost-freeradius-ingress
+  namespace: authentik
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: authentik-outpost-radius
+      goauthentik.io/outpost-name: 8021x-radius
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: freeradius
+      toPorts:
+        - ports:
+            - port: "1812"
+              protocol: UDP
@@ -0,0 +1,404 @@
+# FreeRADIUS 3.2 config for 802.1X: outer identity anonymous[@...] -> EAP-TTLS
+# terminated here, inner PAP proxied to the authentik outpost
+# ak-outpost-8021x-radius; any other outer identity -> whole EAP conversation
+# proxied to the UDM RADIUS (UniFi Endpoint). Replaces the image's raddb
+# completely. Functional test: tests/radius/run.sh.
+# VLAN contract: docs/radius/dot1x.md.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: freeradius-config
+  namespace: authentik
+  annotations:
+    # FreeRADIUS uses ${...} itself; Flux postBuild substitution must skip it.
+    kustomize.toolkit.fluxcd.io/substitute: disabled
+data:
+  radiusd.conf: |
+    prefix = /opt
+    exec_prefix = ${prefix}
+    sbindir = ${exec_prefix}/sbin
+    libdir = ${exec_prefix}/lib
+    raddbdir = /run/raddb/raddb
+    confdir = ${raddbdir}
+    modconfdir = ${confdir}/mods-config
+    certdir = ${confdir}/certs
+    cadir = ${confdir}/certs
+    db_dir = ${raddbdir}
+    # only writable path in the pod
+    localstatedir = /tmp
+    logdir = /tmp
+    radacctdir = /tmp
+    run_dir = /tmp
+    name = radiusd
+    pidfile = ${run_dir}/${name}.pid
+
+    max_request_time = 30
+    cleanup_delay = 5
+    # Greater than every home server's response_window (proxy.conf): never
+    # forward a NAS retransmit to a home server. A TTLS inner request sent
+    # twice to the home server leaves a freed request in the proxy hash;
+    # radiusd segfaults.
+    proxy_dedup_window = 10
+    max_requests = 16384
+    hostname_lookups = no
+
+    log {
+      destination = stdout
+      colourise = no
+      stripped_names = no
+      auth = yes
+      auth_badpass = no
+      auth_goodpass = no
+    }
+
+    checkrad = ${sbindir}/checkrad
+
+    security {
+      allow_core_dumps = no
+      max_attributes = 200
+      # Rejects decided here wait 0.5 s; proxied rejects are not delayed.
+      reject_delay = 0.5
+      status_server = yes
+      require_message_authenticator = yes
+      limit_proxy_state = yes
+    }
+
+    proxy_requests = yes
+    $INCLUDE proxy.conf
+    $INCLUDE clients.conf
+
+    thread pool {
+      start_servers = 2
+      max_servers = 16
+      min_spare_servers = 2
+      max_spare_servers = 4
+      max_requests_per_server = 0
+    }
+
+    modules {
+      $INCLUDE mods-enabled/
+    }
+
+    instantiate {
+    }
+
+    policy {
+    }
+
+    $INCLUDE sites-enabled/
+
+  # Site-local dictionary; the image's dictionaries under /opt/share/freeradius
+  # are loaded first.
+  dictionary: |
+    # no local attributes
+
+  clients.conf: |
+    client aps {
+      ipaddr = 10.2.10.0/24
+      secret = $ENV{DOT1X_NAS_SECRET}
+      require_message_authenticator = yes
+    }
+
+    client aps6 {
+      ipv6addr = fd02:10::/64
+      secret = $ENV{DOT1X_NAS_SECRET}
+      require_message_authenticator = yes
+    }
+
+    # test, test6: test phase only (docs/radius/dot1x.md).
+    client test {
+      ipaddr = 10.2.50.0/24
+      secret = $ENV{DOT1X_TEST_SECRET}
+      require_message_authenticator = yes
+    }
+
+    client test6 {
+      ipv6addr = fd02:50::/64
+      secret = $ENV{DOT1X_TEST_SECRET}
+      require_message_authenticator = yes
+    }
+
+  proxy.conf: |
+    proxy server {
+      default_fallback = no
+    }
+
+    home_server authentik {
+      type = auth
+      ipaddr = ak-outpost-8021x-radius.authentik.svc.cluster.local
+      port = 1812
+      proto = udp
+      secret = $ENV{DOT1X_OUTPOST_SECRET}
+      # The outpost sends Message-Authenticator on Access-Accept only.
+      require_message_authenticator = no
+      # Less than proxy_dedup_window (radiusd.conf).
+      response_window = 5
+      zombie_period = 20
+      # The outpost does not answer Status-Server. Probe with an
+      # Access-Request for a user that does not exist in authentik; the
+      # reject counts as an answer. Sent only while zombie or dead.
+      status_check = request
+      username = "dot1x-status-probe"
+      password = "not-a-secret"
+      check_interval = 6
+      check_timeout = 4
+      num_answers_to_alive = 3
+    }
+
+    home_server_pool authentik {
+      type = fail-over
+      home_server = authentik
+    }
+
+    realm authentik {
+      auth_pool = authentik
+      nostrip
+    }
+
+    # UDM RADIUS (FreeRADIUS) for UniFi Endpoint accounts; gets the whole
+    # outer EAP conversation. Address: UDM on VLAN 11 "(11) RADIUS", reached
+    # over net1 (freeradius-network-attachment.yaml); the UDM accepts
+    # RADIUS clients from 10.2.11.0/24 only.
+    home_server udm {
+      type = auth
+      ipaddr = 10.2.11.1
+      port = 1812
+      proto = udp
+      secret = $ENV{UDM_RADIUS_SECRET}
+      # RFC 3579: every reply to an EAP request carries Message-Authenticator.
+      require_message_authenticator = yes
+      # Less than proxy_dedup_window (radiusd.conf).
+      response_window = 5
+      zombie_period = 20
+      # Probe with an Access-Request for a user that cannot exist (no
+      # EAP-Message, so no Endpoint login); the reject counts as an answer.
+      # Sent only while zombie or dead.
+      status_check = request
+      username = "udm-status-probe.invalid"
+      password = "not-a-secret"
+      check_interval = 6
+      check_timeout = 4
+      num_answers_to_alive = 3
+    }
+
+    home_server_pool udm {
+      type = fail-over
+      home_server = udm
+    }
+
+    realm udm {
+      auth_pool = udm
+      nostrip
+    }
+
+  mods-enabled_always: |
+    always ok {
+      rcode = ok
+    }
+    always reject {
+      rcode = reject
+    }
+    always noop {
+      rcode = noop
+    }
+
+  mods-enabled_eap: |
+    eap {
+      default_eap_type = ttls
+      timer_expire = 60
+      ignore_unknown_eap_types = no
+      max_sessions = ${max_requests}
+
+      tls-config tls-common {
+        certificate_file = ${certdir}/radius-tls/tls.crt
+        private_key_file = ${certdir}/radius-tls/tls.key
+        # tls.crt from cert-manager carries leaf + intermediate.
+        auto_chain = yes
+        tls_min_version = "1.2"
+        tls_max_version = "1.2"
+        cipher_list = "DEFAULT"
+        ecdh_curve = ""
+        cache {
+          enable = no
+        }
+      }
+
+      ttls {
+        tls = tls-common
+        copy_request_to_tunnel = no
+        use_tunneled_reply = yes
+        virtual_server = inner-tunnel
+      }
+    }
+
+  sites-enabled_default: |
+    server default {
+      # NAS listeners on eth0 only; net1 (VLAN 11) carries the UDM proxy
+      # traffic and nothing else.
+      listen {
+        type = auth
+        ipaddr = *
+        port = 1812
+        interface = eth0
+      }
+
+      listen {
+        type = acct
+        ipaddr = *
+        port = 1813
+        interface = eth0
+      }
+
+      listen {
+        type = auth
+        ipv6addr = ::
+        port = 1812
+        interface = eth0
+      }
+
+      listen {
+        type = acct
+        ipv6addr = ::
+        port = 1813
+        interface = eth0
+      }
+
+      authorize {
+        # EAP only.
+        if (!&EAP-Message) {
+          reject
+        }
+        # Outer identity anonymous[@realm]: authentik clients, EAP-TTLS here.
+        # Any other: UniFi Endpoint account (real name as outer identity);
+        # every round goes to the UDM unprocessed.
+        if (&User-Name && &User-Name !~ /^anonymous(@.*)?$/i) {
+          update control {
+            &Proxy-To-Realm := udm
+          }
+          return
+        }
+        eap {
+          ok = return
+          updated = return
+        }
+        Autz-Type Status-Server {
+          ok
+        }
+      }
+
+      authenticate {
+        Auth-Type EAP {
+          eap
+        }
+      }
+
+      # Answered here; the outpost has no accounting port.
+      preacct {
+      }
+      accounting {
+        ok
+      }
+
+      # UDM replies pass unchanged.
+      post-auth {
+        if (&control:Proxy-To-Realm == "udm") {
+          noop
+        }
+        else {
+          update reply {
+            &Cisco-AVPair !* ANY
+          }
+        }
+        Post-Auth-Type REJECT {
+          if (&control:Proxy-To-Realm == "udm") {
+            noop
+          }
+          else {
+            eap
+          }
+        }
+      }
+
+      pre-proxy {
+      }
+
+      # Runs the TTLS callback that hands the outpost reply back into the tunnel.
+      post-proxy {
+        if (&control:Proxy-To-Realm == "udm") {
+          noop
+        }
+        else {
+          eap
+        }
+      }
+    }
+
+  sites-enabled_inner-tunnel: |
+    server inner-tunnel {
+      authorize {
+        # PAP only.
+        if (!&User-Password) {
+          reject
+        }
+        update control {
+          &Proxy-To-Realm := authentik
+        }
+      }
+
+      authenticate {
+      }
+
+      # Runs on the outpost's Access-Accept. use_tunneled_reply copies this
+      # reply into the outer Access-Accept.
+      post-auth {
+        update reply {
+          &Message-Authenticator !* ANY
+          &Proxy-State !* ANY
+        }
+        if (!&reply:Tunnel-Private-Group-Id && &reply:Cisco-AVPair && &reply:Cisco-AVPair =~ /^dot1x-vlan=([0-9]+)$/) {
+          update reply {
+            &Tunnel-Type := VLAN
+            &Tunnel-Medium-Type := IEEE-802
+            &Tunnel-Private-Group-Id := "%{1}"
+          }
+        }
+        update reply {
+          &Cisco-AVPair !* ANY
+        }
+        # No VLAN would put the client in the WLAN's fallback network.
+        if (!&reply:Tunnel-Private-Group-Id) {
+          reject
+        }
+      }
+
+      pre-proxy {
+      }
+
+      post-proxy {
+      }
+    }
+
+  # Status-Server only, loopback only; used by the probes.
+  sites-enabled_status: |
+    server status {
+      listen {
+        type = status
+        ipaddr = 127.0.0.1
+        port = 18121
+      }
+
+      client probe {
+        ipaddr = 127.0.0.1
+        secret = status-probe
+      }
+
+      authorize {
+        ok
+        Autz-Type Status-Server {
+          ok
+        }
+      }
+    }
+
+  probe_status: |
+    Message-Authenticator = 0x00
@@ -0,0 +1,48 @@
+---
+# FreeRADIUS net1: macvlan on radius0, VLAN 11 "(11) RADIUS" (VLANConfig in
+# kubernetes/talos/patches/k8s-{1,2,3}.yaml). Carries only the proxy traffic
+# to home server `udm` (freeradius-config.yaml): the UDM RADIUS accepts
+# clients from 10.2.11.0/24, not from the pod CIDR. Bypasses Cilium policy.
+# Address leased from the UDM; nothing references it.
+#
+# net1 holds only its connected /24, so the unbound proxy socket reaches the
+# UDM via net1 with the leased source. No sbr: it moves that route into a
+# source-based table, and the proxy would leave via eth0 from the pod IP.
+# skipDefault + subnet-mask: the lease is requested without routers, so no
+# default route lands on net1 (dnsmasq sends only requested options).
+# IPv6 off on net1: VLAN 11 sends RAs (default route, SLAAC); the UDM
+# RADIUS clients are IPv4 only.
+#
+# Requires cni-dhcp-daemon (infrastructure/multus) and VLAN 11 in Cilium's
+# bpf.vlanBypass (infrastructure/cilium/helmrelease.yaml).
+apiVersion: k8s.cni.cncf.io/v1
+kind: NetworkAttachmentDefinition
+metadata:
+  name: freeradius-udm
+  namespace: authentik
+spec:
+  config: |
+    {
+      "cniVersion": "0.3.1",
+      "name": "freeradius-udm",
+      "plugins": [
+        {
+          "type": "macvlan",
+          "master": "radius0",
+          "mode": "bridge",
+          "ipam": {
+            "type": "dhcp",
+            "request": [
+              { "skipDefault": true },
+              { "option": "subnet-mask" }
+            ]
+          }
+        },
+        {
+          "type": "tuning",
+          "sysctl": {
+            "net.ipv6.conf.IFNAME.disable_ipv6": "1"
+          }
+        }
+      ]
+    }
@@ -0,0 +1,235 @@
+# 802.1X RADIUS front end (radius.renner.uno). Config: freeradius-config.yaml.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: freeradius
+  namespace: authentik
+  labels:
+    app.kubernetes.io/name: freeradius
+  annotations:
+    configmap.reloader.stakater.com/reload: freeradius-config
+    secret.reloader.stakater.com/reload: radius-secrets,radius-tls
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: freeradius
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: freeradius
+      annotations:
+        # net1 on VLAN 11: the path to the UDM RADIUS.
+        k8s.v1.cni.cncf.io/networks: freeradius-udm
+    spec:
+      enableServiceLinks: false
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: freeradius
+              topologyKey: kubernetes.io/hostname
+      # The image has no radius user and its own raddb is root-only; the
+      # mounted raddb replaces it.
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        fsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      # FreeRADIUS refuses a config dir that is world-writable; kubelet's
+      # volume root is, so the config is copied to a dir the pod owns.
+      initContainers:
+        - name: raddb-copy
+          image: docker.io/freeradius/freeradius-server:3.2.10-alpine # {"$imagepolicy": "flux-system:freeradius"}
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - mkdir -p /run/raddb/raddb && cp -rL /etc/raddb-src/. /run/raddb/raddb/ && chmod 0750 /run/raddb/raddb
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              memory: 64Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: raddb
+              mountPath: /etc/raddb-src
+              readOnly: true
+            - name: raddb-run
+              mountPath: /run/raddb
+      containers:
+        - name: freeradius
+          image: docker.io/freeradius/freeradius-server:3.2.10-alpine # {"$imagepolicy": "flux-system:freeradius"}
+          args:
+            - -f
+            - -l
+            - stdout
+            - -d
+            - /run/raddb/raddb
+          env:
+            - name: DOT1X_NAS_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: radius-secrets
+                  key: DOT1X_NAS_SECRET
+            - name: DOT1X_TEST_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: radius-secrets
+                  key: DOT1X_TEST_SECRET
+            - name: DOT1X_OUTPOST_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: radius-secrets
+                  key: DOT1X_OUTPOST_SECRET
+            - name: UDM_RADIUS_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: radius-secrets
+                  key: UDM_RADIUS_SECRET
+          ports:
+            - name: radius
+              containerPort: 1812
+              protocol: UDP
+            - name: radius-acct
+              containerPort: 1813
+              protocol: UDP
+          readinessProbe:
+            exec:
+              command:
+                - /opt/bin/radclient
+                - -d
+                - /run/raddb/raddb
+                - -q
+                - -r
+                - "1"
+                - -t
+                - "2"
+                - -f
+                - /run/raddb/raddb/probe/status
+                - 127.0.0.1:18121
+                - status
+                - status-probe
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            exec:
+              command:
+                - /opt/bin/radclient
+                - -d
+                - /run/raddb/raddb
+                - -q
+                - -r
+                - "1"
+                - -t
+                - "2"
+                - -f
+                - /run/raddb/raddb/probe/status
+                - 127.0.0.1:18121
+                - status
+                - status-probe
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: 20m
+              memory: 64Mi
+            limits:
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: raddb-run
+              mountPath: /run/raddb
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: raddb
+          projected:
+            defaultMode: 0440
+            sources:
+              - configMap:
+                  name: freeradius-config
+                  items:
+                    - key: radiusd.conf
+                      path: radiusd.conf
+                    - key: dictionary
+                      path: dictionary
+                    - key: clients.conf
+                      path: clients.conf
+                    - key: proxy.conf
+                      path: proxy.conf
+                    - key: mods-enabled_always
+                      path: mods-enabled/always
+                    - key: mods-enabled_eap
+                      path: mods-enabled/eap
+                    - key: sites-enabled_default
+                      path: sites-enabled/default
+                    - key: sites-enabled_inner-tunnel
+                      path: sites-enabled/inner-tunnel
+                    - key: sites-enabled_status
+                      path: sites-enabled/status
+                    - key: probe_status
+                      path: probe/status
+              - secret:
+                  name: radius-tls
+                  items:
+                    - key: tls.crt
+                      path: certs/radius-tls/tls.crt
+                    - key: tls.key
+                      path: certs/radius-tls/tls.key
+        - name: raddb-run
+          emptyDir:
+            medium: Memory
+            sizeLimit: 4Mi
+        # pidfile
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 16Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: radius-lb
+  namespace: authentik
+  labels:
+    lb-pool: bgp
+  annotations:
+    lbipam.cilium.io/ips: "10.2.99.91,fd99::91"
+    # LAN-side DNS only (external-dns-unifi); see ldap-outpost-lb.yaml.
+    external-dns.kubernetes.io/hostname: radius.renner.uno
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  ipFamilyPolicy: PreferDualStack
+  ipFamilies:
+    - IPv4
+    - IPv6
+  selector:
+    app.kubernetes.io/name: freeradius
+  ports:
+    - name: radius
+      port: 1812
+      targetPort: radius
+      protocol: UDP
+    - name: radius-acct
+      port: 1813
+      targetPort: radius-acct
+      protocol: UDP
@@ -62,12 +62,6 @@ rules:
  - apiGroups: ["cilium.io"]
    resources: ["ciliumnetworkpolicies"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["auth.renner.uno"]
-    resources: ["oidcclients"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["auth.renner.uno"]
-    resources: ["oidcclients/status"]
-    verbs: ["get", "patch", "update"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -111,7 +105,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-29-1349 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
+          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-11-05-1355 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
@@ -20,7 +20,7 @@ spec:
      # Pinned to match the samba-bridge fork's app image (server.Dockerfile
      # AUTHENTIK_VERSION). Bump in lockstep with the bridge rebuild — a
      # floating range drifts the chart ahead of the pinned app image.
-      version: "2026.8.4"
+      version: "2026.8.5"
      sourceRef:
        kind: HelmRepository
        name: authentik
@@ -69,6 +69,11 @@ spec:
            secretKeyRef:
              name: ak-pg-app
              key: password
+        # Default 0 opens a new Postgres connection per request.
+        - name: AUTHENTIK_POSTGRESQL__CONN_MAX_AGE
+          value: "60"
+        - name: AUTHENTIK_POSTGRESQL__CONN_HEALTH_CHECKS
+          value: "true"
        - name: AUTHENTIK_EMAIL__PASSWORD
          valueFrom:
            secretKeyRef:
@@ -80,8 +85,8 @@ spec:
        # authentik_crypto.certificatekeypair the LDAP providers attach
        # via attrs.certificate. Issued by cert-manager — see
        # ldap-outpost-cert.yaml. Both pods get it because the chart's
-        # global.env propagates to server AND worker; if only the worker
-        # had it, blueprint apply would crash on startup with KeyError.
+        # global.env propagates to server AND worker; a pod without the
+        # variable resolves `!Env` to None/the default (no KeyError).
        - name: LDAP_OUTPOST_TLS_CRT
          valueFrom:
            secretKeyRef:
@@ -164,6 +169,26 @@ spec:
            hosts:
              - auth.renner.uno
    worker:
+      # Overrides the global key; keep authentik-secrets in the list.
+      podAnnotations:
+        secret.reloader.stakater.com/reload: authentik-secrets,radius-secrets,wlan-setup-oauth
+      # Shared secret of the 802.1X Radius provider and client secret of the
+      # WLAN setup provider, set via `!Env` in dot1x-radius.yaml. Worker only
+      # (blueprint applier); optional so a missing Secret fails only the
+      # blueprint entries that use it.
+      env:
+        - name: DOT1X_OUTPOST_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: radius-secrets
+              key: DOT1X_OUTPOST_SECRET
+              optional: true
+        - name: WLAN_SETUP_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: wlan-setup-oauth
+              key: client_secret
+              optional: true
      resources:
        requests:
          # Same reasoning as server above, and the worker is burstier still:
@@ -10,6 +10,15 @@ resources:
  - ldap-outpost-cert.yaml
  - ldap-outpost-lb.yaml
  - ldap-outpost-cnp.yaml
+  - radius-cert.yaml
+  - radius-externalsecret.yaml
+  - freeradius-config.yaml
+  - freeradius-network-attachment.yaml
+  - freeradius.yaml
+  - freeradius-cnp.yaml
+  - wlan-setup-oauth.yaml
+  - wlan-setup-signing-cert.yaml
+  - wlan-setup.yaml
  # ak-pg CNPG Postgres backend (moved here from the retired seed-authentik KS;
  # each carries prune: disabled so ownership transferred without a teardown).
  # authentik has no data PVCs — all state lives in ak-pg. This KS depends on
@@ -0,0 +1,15 @@
+---
+# EAP-TTLS server certificate for the FreeRADIUS service (radius.renner.uno).
+# Issued via the cluster-wide Cloudflare DNS-01 ClusterIssuer.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: radius-tls
+  namespace: authentik
+spec:
+  secretName: radius-tls
+  issuerRef:
+    name: letsencrypt-cluster
+    kind: ClusterIssuer
+  dnsNames:
+    - radius.renner.uno
@@ -0,0 +1,15 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: radius-secrets
+  namespace: authentik
+spec:
+  refreshInterval: 10m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: radius-secrets
+  dataFrom:
+    - extract:
+        key: apps/radius
@@ -0,0 +1,32 @@
+# Client secret of the "WLAN setup" OAuth2 provider (dot1x-radius blueprint).
+# Generated once; the authentik worker reads it as WLAN_SETUP_CLIENT_SECRET
+# for the blueprint, wlan-setup reads it for the code exchange.
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: wlan-setup-oauth
+  namespace: authentik
+spec:
+  length: 64
+  digits: 16
+  symbols: 0
+  allowRepeat: true
+  noUpper: false
+  secretKeys:
+    - client_secret
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: wlan-setup-oauth
+  namespace: authentik
+spec:
+  refreshPolicy: CreatedOnce
+  target:
+    name: wlan-setup-oauth
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: wlan-setup-oauth
@@ -0,0 +1,21 @@
+---
+# Signs the Windows Wi-Fi provisioning XML of wlan.renner.uno (XML-DSig in the
+# wlan-setup service). Issued via the cluster-wide Cloudflare DNS-01
+# ClusterIssuer.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wlan-setup-signing
+  namespace: authentik
+spec:
+  secretName: wlan-setup-signing
+  issuerRef:
+    name: letsencrypt-cluster
+    kind: ClusterIssuer
+  dnsNames:
+    - wlan.renner.uno
+  privateKey:
+    algorithm: RSA
+    size: 2048
+    encoding: PKCS8
+    rotationPolicy: Always
@@ -0,0 +1,157 @@
+# wlan.renner.uno: setup page for the 802.1X WLAN "Renner UniFi", served by the
+# wlan-setup Go service (wlan-setup/). Android, Apple and Windows get Passpoint
+# profiles with a per-device authentik app password; Linux an nmcli command.
+# Public, so a device can reach it before it is in the WLAN (mobile data,
+# Renner Gast). Any Authentik user passes the gate (no group); the service
+# stores no user credentials beyond the 5-minute single-use Windows profile.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wlan-setup
+  namespace: authentik
+  labels:
+    app.kubernetes.io/name: wlan-setup
+  annotations:
+    secret.reloader.stakater.com/reload: wlan-setup-oauth
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: wlan-setup
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: wlan-setup
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        # Group of the signing key files (defaultMode 0440).
+        fsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: wlan-setup
+          image: gitea.renner.uno/gitea_admin/wlan-setup:2026-11-05-1517 # {"$imagepolicy": "flux-system:wlan-setup"}
+          env:
+            # Client secret of the "WLAN setup" OAuth2 provider.
+            - name: WLAN_SETUP_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: wlan-setup-oauth
+                  key: client_secret
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            requests:
+              cpu: 5m
+              memory: 16Mi
+            limits:
+              memory: 64Mi
+          volumeMounts:
+            # Key and chain that sign the Windows provisioning XML; read per
+            # request, so cert-manager renewals need no restart.
+            - name: signing
+              mountPath: /etc/wlan-signing
+              readOnly: true
+      volumes:
+        - name: signing
+          secret:
+            secretName: wlan-setup-signing
+            defaultMode: 0440
+            items:
+              - key: tls.key
+                path: tls.key
+              - key: tls.crt
+                path: tls.crt
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: wlan-setup
+  namespace: authentik
+  labels:
+    app.kubernetes.io/name: wlan-setup
+spec:
+  ipFamilyPolicy: PreferDualStack
+  selector:
+    app.kubernetes.io/name: wlan-setup
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wlan-setup
+  namespace: authentik
+  labels:
+    # Public: Cloudflare CNAME → NetBird proxy → Traefik.
+    dns.renner.uno/public: "true"
+    netbird.renner.uno/public: "true"
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: authentik-gate@kubernetescrd
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - wlan.renner.uno
+      secretName: wlan-setup-tls
+  rules:
+    - host: wlan.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: wlan-setup
+                port:
+                  number: 80
+---
+# Without the gate: Windows Settings fetches the signed provisioning XML
+# without the browser's session; the single-use token in the path is the only
+# gate. Traefik reaches the pods through the CNP wlan-setup-gate that
+# gate-sync creates for the Ingress above.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wlan-setup-provisioning
+  namespace: authentik
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - wlan.renner.uno
+      secretName: wlan-setup-tls
+  rules:
+    - host: wlan.renner.uno
+      http:
+        paths:
+          - path: /windows/profile/
+            pathType: Prefix
+            backend:
+              service:
+                name: wlan-setup
+                port:
+                  number: 80
@@ -30,7 +30,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/cloudflare-lb-sync:2026-10-29-1355 # {"$imagepolicy": "flux-system:cloudflare-lb-sync"}
+          image: gitea.renner.uno/gitea_admin/cloudflare-lb-sync:2026-11-05-1401 # {"$imagepolicy": "flux-system:cloudflare-lb-sync"}
          env:
            - name: CLOUDFLARE_API_TOKEN
              valueFrom:
@@ -28,7 +28,7 @@ spec:
      enableServiceLinks: false
      containers:
        - name: evcc
-          image: evcc/evcc:0.318.1@sha256:2f8163ab22f04863afd86cd511c09607ba71debd9eebd65511f3d654922a80d1
+          image: evcc/evcc:0.318.2@sha256:7ef9bcb15a4fdbfe3bf75d7a0857c40b6272b8783ea833fcbb22f8f134b336c7
          # evcc auto-discovers /etc/evcc.yaml on its default search path;
          # the file is delivered (with the MQTT password) via the
          # sops-encrypted evcc-config Secret mounted below.
@@ -23,7 +23,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: gitea-mcp
-          image: docker.gitea.com/gitea-mcp-server:1.12.0 # {"$imagepolicy": "flux-system:gitea-mcp"}
+          image: docker.gitea.com/gitea-mcp-server:1.13.0 # {"$imagepolicy": "flux-system:gitea-mcp"}
          # Image has no ENTRYPOINT (binary is in CMD), so args alone would replace it.
          command:
            - /app/gitea-mcp
@@ -44,7 +44,7 @@ spec:
      annotations:
        # Bump to restart the pod and re-attach net1 (DHCP via multus).
        # 2026-10-06: first attach on containernetworking/plugins v1.9.1.
-        homelab.renner.uno/restarted-for: "2026-10-06 cni-plugins v1.9.1 attach check"
+        homelab.renner.uno/restarted-for: "2026-11-07 net1 without RA (S28-36)"
        k8s.v1.cni.cncf.io/networks: mdns-relay-iot
    spec:
      # Runs where the node patch declares the IoT VLAN (ens19).
@@ -88,7 +88,7 @@ spec:
        # deliver, and the ClusterIP has no backend while HA restarts. The
        # trap forwards SIGTERM so the pod still terminates promptly.
        - name: socat-ipv4
-          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
+          image: alpine/socat:1.8.1.3@sha256:466c8a0383e16463fabdb7df01008292fb78d07da60224a46cb5d3142ce122ed
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -130,7 +130,7 @@ spec:
        # depends on the kernel's bindv6only default rather than on anything
        # stated here, so the roles are made explicit instead of inherited.
        - name: socat-ipv6
-          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
+          image: alpine/socat:1.8.1.3@sha256:466c8a0383e16463fabdb7df01008292fb78d07da60224a46cb5d3142ce122ed
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -31,6 +31,11 @@ spec:
  # dropped. The relay's forward path to Home Assistant runs over eth0, so
  # that route has to stay intact.
  #
+  # sbr covers IPv4 only. With Router Advertisements net1 gets a global IPv6
+  # address and default route in the main table, and the IPv6 forward to the
+  # Service leaves via net1 with an IoT source, which HA's CNP drops. tuning
+  # turns RA processing off; the link-local address ff02::fb needs stays.
+  #
  # Requires the cni-dhcp-daemon DaemonSet in infrastructure/multus.
  config: |
    {
@@ -45,6 +50,13 @@ spec:
            "type": "dhcp"
          }
        },
+        {
+          "type": "tuning",
+          "sysctl": {
+            "net.ipv6.conf.IFNAME.accept_ra": "0",
+            "net.ipv6.conf.IFNAME.autoconf": "0"
+          }
+        },
        {
          "type": "sbr"
        }
@@ -46,7 +46,7 @@ spec:
        k8s.v1.cni.cncf.io/networks: shelly-manager-iot
        # Changing this rolls the pod, which is the only way a change to the
        # shelly-manager-iot attachment takes effect.
-        net.renner.uno/iot-attachment-config: "tuning-no-ra"
+        net.renner.uno/iot-attachment-config: "tuning-no-ra-no-mtu-probing"
    spec:
      # eth0 (Cilium-managed pod network) is still the primary — it
      # carries the ingress, mosquitto LB return path, etc. The macvlan
@@ -64,7 +64,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: shelly-manager
-          image: gitea.renner.uno/konairius/shelly-manager:2026-10-30-1343 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/konairius/shelly-manager:2026-11-07-1918 # {"$imagepolicy": "flux-system:shelly-manager"}
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
@@ -50,6 +50,9 @@ spec:
  # to IPv6 clients on v30iot leave via net1, bypassing Cilium's LoadBalancer
  # reverse NAT. tuning turns RA processing off on net1; the link-local
  # address mDNS uses stays.
+  #
+  # tcp_mtu_probing (pod-wide; Cilium sets 1): Shelly flash-write stalls
+  # trip black-hole detection, which cuts firmware downloads to 48-byte MSS.
  config: |
    {
      "cniVersion": "0.3.1",
@@ -67,7 +70,8 @@ spec:
          "type": "tuning",
          "sysctl": {
            "net.ipv6.conf.IFNAME.accept_ra": "0",
-            "net.ipv6.conf.IFNAME.autoconf": "0"
+            "net.ipv6.conf.IFNAME.autoconf": "0",
+            "net.ipv4.tcp_mtu_probing": "0"
          }
        },
        {
@@ -60,7 +60,7 @@ spec:
        # repo's configuration.yaml reads this key, so HA does not start
        # without it. Removing this init container takes the recorder down.
        - name: render-db-url
-          image: busybox:1.38@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
+          image: busybox:1.38@sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4
          command:
            - sh
            - -c
@@ -97,7 +97,7 @@ spec:
        # (homeassistant repo packages/matrix_assist.yaml), same filter-then-append
        # render as recorder_db_url above. Value is hex, nothing to escape.
        - name: render-matrix-password
-          image: busybox:1.38@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
+          image: busybox:1.38@sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4
          command:
            - sh
            - -c
@@ -128,7 +128,7 @@ spec:
              memory: 32Mi
      containers:
        - name: home-assistant
-          image: ghcr.io/home-assistant/home-assistant:2026.10.4 # {"$imagepolicy": "flux-system:home-assistant"}
+          image: ghcr.io/home-assistant/home-assistant:2026.11.0 # {"$imagepolicy": "flux-system:home-assistant"}
          env:
            - name: TZ
              value: Europe/Berlin
@@ -275,7 +275,7 @@ spec:
        # any LAN client can edit, matching the user's trust-the-network
        # model. Runs as root so its writes match HA's root-owned files.
        - name: code-server
-          image: codercom/code-server:4.143.1@sha256:377b66bec5645510ed52549bb00e648c273edc604d230a3f90fd2b2433afcb97
+          image: codercom/code-server:4.144.0@sha256:b9e8056bb74bd0c4f90284c7559eddeccd38400cfedc28e64c9d3ca50fef1f83
          args:
            - "--auth=none"
            - "--bind-addr=0.0.0.0:8080"
@@ -337,7 +337,7 @@ spec:
        # dedicated long-lived token.
        # Runs as root to match HA's root-owned /config files. See config-sync.sh.
        - name: config-sync
-          image: alpine/git:2.54.0@sha256:e8ceedc73bd80992ae8d58a7d24c58b8322146c354f1d2e81a97db4452068ec0
+          image: alpine/git:2.54.0@sha256:ac6c828f15d82775d204d3d75112e1d34af8945da80ccf922713c9891ba68e7a
          command: ["/bin/sh", "/scripts/sync.sh"]
          env:
            - name: SYNC_BRANCH
@@ -36,7 +36,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: esphome
-          image: ghcr.io/esphome/esphome:2026.10.0@sha256:1dff19a59070cdb523b76576cdc74d200f862d43c1407809088855920cf57145
+          image: ghcr.io/esphome/esphome:2026.10.1@sha256:eab8cd6b4f51077c3883af4cedc058280ddc34a94f3b2ffee23e9d2cd5f1db64
          imagePullPolicy: IfNotPresent
          # Default entrypoint runs the dashboard (Device Builder) against the
          # mounted /config — no command override needed.
@@ -223,7 +223,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/konairius/mqtt-account-controller:2026-10-29-1634 # {"$imagepolicy": "flux-system:mqtt-account-controller"}
+          image: gitea.renner.uno/konairius/mqtt-account-controller:2026-11-02-1058 # {"$imagepolicy": "flux-system:mqtt-account-controller"}
          env:
            - name: BROKER_URL
              value: ssl://mosquitto.home-assistant.svc.cluster.local:8884
@@ -49,17 +49,12 @@
  auth: cert
  deliver: {namespace: home-assistant}
  acl: ["readwrite #"]
-# edge-1's local mosquitto bridge (REN-1307): one bridge for open3e/e3oncan.
-# The controller pushes
-# the password to edge-mqtt-cred on edge-1 (ansible role mqtt-bridge) over
-# HTTPS with its own client certificate, and pins edge-1's self-generated
-# server certificate on first contact (key edge-1.pin in mqtt-account-hashes;
-# delete it after a reinstall of edge-1).
- name: edge-1
+# vitocal-can: open3e-esp32 CAN gateway at the Vitocal 250-A (S28-28).
+# The firmware registers its compiled-in DHCP name `open3e`, not its
+# configured hostname.
+- name: vitocal-can
  auth: password
-  deliver: {esp32: "https://edge-1.iot.renner.uno:8443"}
-  # No sml2mqtt/#: the SML meter reader is retired for good (owner,
-  # 2026-09-19; grid data comes from the E380 on the CAN bus).
+  deliver: {esp32: "http://open3e.iot.renner.uno"}
  acl: ["readwrite open3e/#"]
 # Shellies (REN-1017): one password account per device, pushed by the
 # controller through shelly-manager's per-device API. Name shelly-<id> =
@@ -106,6 +101,10 @@
  auth: password
  deliver: {shelly-manager: 25}  # Plug S Gen1 1c1a8f
  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-41
+  auth: password
+  deliver: {shelly-manager: 41}  # Plug Gen1 f4cfa26d9cb2
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
 - name: shelly-15
  auth: password
  deliver: {shelly-manager: 15}  # Plug S G3 8cbfea910578
@@ -188,6 +187,34 @@
  auth: password
  deliver: {shelly-manager: 30}  # Plus 2PM b48a0a226c28 (reachable again, REN-1108)
  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-7
+  auth: password
+  deliver: {shelly-manager: 7}  # Plus 1PM Mini 348518df3500
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-23
+  auth: password
+  deliver: {shelly-manager: 23}  # Plus 1PM Mini 348518e05b88
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-11
+  auth: password
+  deliver: {shelly-manager: 11}  # Plus 2PM ccdba7d0b804
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-28
+  auth: password
+  deliver: {shelly-manager: 28}  # Plus 2PM 0cdc7efa8dc0
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-17
+  auth: password
+  deliver: {shelly-manager: 17}  # Plus Plug S d4d4daed2054
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-18
+  auth: password
+  deliver: {shelly-manager: 18}  # Plus Plug S d4d4daecc47c
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-20
+  auth: password
+  deliver: {shelly-manager: 20}  # Plus Plug S d4d4daecb690
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
 # Sleeping H&Ts (REN-1107): awake only 8-13 s every 1-2 h, so the
 # controller pushes when the device publishes `online` on its wake topic
 # (shelly-manager topic prefix `shellies/<hostname>`), not in the 2-min loop.
@@ -211,3 +238,8 @@
  deliver: {shelly-manager: 38}  # H&T G3 ecda3bc0b6a0
  wake: shellies/shellyhtg3-ecda3bc0b6a0/online
  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-40
+  auth: password
+  deliver: {shelly-manager: 40}  # Flood G4 7c2c67732e08
+  wake: shellies/shellyfloodg4-7c2c67732e08/online
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
@@ -66,7 +66,7 @@ spec:
          # (machine.registries.mirrors, applied by bootstrap.sh), and containerd
          # keeps the repository path when it falls through — so the path has to
          # exist on both registries. Steady state still pulls from Gitea.
-          image: gitea.renner.uno/konairius/alpine-jq:2026-10-29-1348 # {"$imagepolicy": "flux-system:alpine-jq"}
+          image: gitea.renner.uno/konairius/alpine-jq:2026-11-05-1353 # {"$imagepolicy": "flux-system:alpine-jq"}
          command:
            - sh
            - -c
@@ -163,7 +163,7 @@ spec:
          # Pinned tag. No Flux image-automation marker yet (unlike mosquitto) —
          # add an infrastructure/image-automation/zigbee2mqtt.yaml policy as a
          # follow-up if desired; pinned-and-manual is fine for the initial cutover.
-          image: ghcr.io/koenkk/zigbee2mqtt:2.14.2@sha256:addbfb08fcef2e4477de1535636118241e10d13e898fbe4d9faba8a4d7396311
+          image: ghcr.io/koenkk/zigbee2mqtt:2.14.3@sha256:fb4a6b0f6868ad1cd6a9996479802b2420e599c3463b62bbff8c8cd9a908f43a
          imagePullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -17,7 +17,7 @@ spec:
    spec:
      containers:
        - name: ical-proxy
-          image: gitea.renner.uno/konairius/ical-proxy:2026-10-28-0651 # {"$imagepolicy": "flux-system:ical-proxy"}
+          image: gitea.renner.uno/konairius/ical-proxy:2026-11-02-1055 # {"$imagepolicy": "flux-system:ical-proxy"}
          ports:
            - containerPort: 8080
              name: http
@@ -32,7 +32,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: immich-machine-learning
-          image: ghcr.io/immich-app/immich-machine-learning:v3.3.5 # {"$imagepolicy": "flux-system:immich-machine-learning"}
+          image: ghcr.io/immich-app/immich-machine-learning:v3.3.6 # {"$imagepolicy": "flux-system:immich-machine-learning"}
          ports:
            - name: http
              containerPort: 3003
@@ -66,7 +66,7 @@ spec:
        # The library PVC is populated by the seed phase before this
        # Deployment reconciles, so no rsync init is needed here.
        - name: fetch-le-staging-roots
-          image: curlimages/curl:8.23.0@sha256:11e64e28c5f58c8d93ee95fcf22ac055f48b0bc440e0ce7d8013bbb5ad6aa8ac
+          image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
          command:
            - sh
            - -c
@@ -87,7 +87,7 @@ spec:
              mountPath: /ca
      containers:
        - name: immich-server
-          image: ghcr.io/immich-app/immich-server:v3.3.5 # {"$imagepolicy": "flux-system:immich-server"}
+          image: ghcr.io/immich-app/immich-server:v3.3.6 # {"$imagepolicy": "flux-system:immich-server"}
          ports:
            - name: http
              containerPort: 3001
@@ -57,7 +57,7 @@ spec:
        runAsNonRoot: false
      initContainers:
        - name: wait-for-influxd
-          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
+          image: influxdb:2.9.1@sha256:a450f6faf9573e6c2e96a0f575885ae8b7387cc87e4de94599e247ebfa3ac417
          env:
            - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
            - { name: INFLUX_ORG, value: renner }
@@ -80,7 +80,7 @@ spec:
              echo "[$(date -u +%H:%M:%S)] $INFLUX_HOST ready and authenticated"
      containers:
        - name: create
-          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
+          image: influxdb:2.9.1@sha256:a450f6faf9573e6c2e96a0f575885ae8b7387cc87e4de94599e247ebfa3ac417
          env:
            - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
            - { name: INFLUX_ORG, value: renner }
@@ -88,7 +88,7 @@ spec:
        # state). Two-stage so we don't try to create an auth before
        # the chart's `influx setup` has finished.
        - name: wait-for-influxd
-          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
+          image: influxdb:2.9.1@sha256:a450f6faf9573e6c2e96a0f575885ae8b7387cc87e4de94599e247ebfa3ac417
          env:
            - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
            - { name: INFLUX_ORG, value: renner }
@@ -111,7 +111,7 @@ spec:
              echo "[$(date -u +%H:%M:%S)] $INFLUX_HOST ready and authenticated"
      containers:
        - name: create
-          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
+          image: influxdb:2.9.1@sha256:a450f6faf9573e6c2e96a0f575885ae8b7387cc87e4de94599e247ebfa3ac417
          env:
            - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
            - { name: INFLUX_ORG, value: renner }
@@ -55,7 +55,7 @@ spec:
      repository: influxdb
      # Was pinned to VM 108's 2.7.4 for the one-time `influx restore`; that
      # migration is done. No downgrade below 2.9 without `influxd downgrade`.
-      tag: "2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2"
+      tag: "2.9.1@sha256:a450f6faf9573e6c2e96a0f575885ae8b7387cc87e4de94599e247ebfa3ac417"
    # Single replica — InfluxDB OSS doesn't cluster. RWO Ceph-block + Velero
    # backups (pending) is the durability story.
    persistence:
--- a/Show More
+++ b/Show More