fix(authentik): embedded outpost config lives in the blueprint

The embedded outpost's config is Authentik's own and does not depend on authentik-gate-sync. A blueprint update of an existing outpost is partial (importer: partial=True unless MUST_CREATED), so the entry sets config without providers and the gates the controller attached stay. config is replaced whole; the entry mirrors the live row (authentik_outposts_outpost, 2026-10-23) with refresh_interval minutes=1. kubernetes_namespace stays default: the outpost has the Local Kubernetes Cluster connection, and the authentik namespace would let the worker create an ak-outpost Service for it. The controller drops embedded_config/ensure_embedded_config and only attaches providers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(authentik-gate-sync): refresh the embedded outpost every minute
2026-10-23 19:00:21 +02:00 · 2026-10-23 10:19:49 +02:00
436 changed files with 5450 additions and 13330 deletions
@@ -41,14 +41,13 @@ when:
      - "ci/images/**"
      - "secret-rotator/**"
      - "review-bot/**"
-      - "wlan-setup/**"
      - ".woodpecker/build-ci-images.yml"
  - event: deployment
    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "build-ci-images"'

 steps:
  - name: build-ansible
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/ansible
    # Only rebuild when THIS image's source (or the pipeline file) changed, or
    # on a manual run. Without this every step ran on any matching push, so a
@@ -75,7 +74,7 @@ steps:
          --destination gitea.renner.uno/gitea_admin/ci-ansible:latest

  - name: build-k8s
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/k8s
    when:
      - event: deployment
@@ -98,7 +97,7 @@ steps:
          --destination gitea.renner.uno/gitea_admin/ci-k8s:latest

  - name: build-vmtest
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/vmtest
    when:
      - event: deployment
@@ -121,7 +120,7 @@ steps:
          --destination gitea.renner.uno/gitea_admin/ci-vmtest:latest

  - name: build-tofu
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/tofu
    when:
      - event: deployment
@@ -151,7 +150,7 @@ steps:
  # Runtime image, not CI tooling: a static musl binary in a FROM-scratch image,
  # used as the base for secret-rotation CronJobs. Replaces per-job inline Python.
  - name: build-secret-rotator
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: secret-rotator
    when:
      - event: deployment
@@ -176,7 +175,7 @@ steps:
  # review-bot: the Go service that reviews pull requests with a Mistral agent (webhook plus sweep).
  # Runs after Gitea is up, so no ghcr mirror.
  - name: build-review-bot
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: review-bot
    when:
      - event: deployment
@@ -198,31 +197,6 @@ steps:
          --destination gitea.renner.uno/gitea_admin/review-bot:$TAG \
          --destination gitea.renner.uno/gitea_admin/review-bot:latest

-  # wlan-setup: the Go service behind wlan.renner.uno (802.1X/Passpoint setup page with per-device
-  # authentik app passwords). Runs after Gitea is up, so no ghcr mirror.
-  - name: build-wlan-setup
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
-    directory: wlan-setup
-    when:
-      - event: deployment
-      - event: push
-        path: ["wlan-setup/**", ".woodpecker/build-ci-images.yml"]
-    environment:
-      GITEA_USER: gitea_admin
-      GITEA_TOKEN:
-        from_secret: ci_images_token
-    commands:
-      - mkdir -p /kaniko/.docker
-      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
-      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
-      - TAG=$(date +%Y-%m-%d-%H%M)
-      - |
-        /kaniko/executor \
-          --context . \
-          --dockerfile Containerfile \
-          --destination gitea.renner.uno/gitea_admin/wlan-setup:$TAG \
-          --destination gitea.renner.uno/gitea_admin/wlan-setup:latest
-
  # Runtime image, not CI tooling: a general-purpose alpine + jq base for
  # workloads that need to read JSON from a shell script. Named for what it IS,
  # not for who uses it — its first consumer is the zigbee2mqtt seed-data init
@@ -251,7 +225,7 @@ steps:
  #
  # The gitea_admin/ copy stays until nothing references it any more.
  - name: build-alpine-jq
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/alpine-jq
    when:
      - event: deployment
@@ -269,8 +243,7 @@ steps:
      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
      - GH_AUTH=$(printf '%s:%s' "$GHCR_USER" "$GHCR_TOKEN" | base64 | tr -d '\n')
      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"},"ghcr.io":{"auth":"%s"}}}' "$AUTH" "$GH_AUTH" > /kaniko/.docker/config.json
-      # konairius/ gets one tag per build: Gitea's cleanup rule counts tags.
-      - TAG=$(date +%Y-%m-%d-%H%M)
+      - TAG=$(date +%Y-%m-%d)
      - |
        /kaniko/executor \
          --context . \
@@ -278,7 +251,9 @@ steps:
          --destination gitea.renner.uno/gitea_admin/alpine-jq:$TAG \
          --destination gitea.renner.uno/gitea_admin/alpine-jq:latest \
          --destination gitea.renner.uno/konairius/alpine-jq:$TAG \
-          --destination ghcr.io/konairius/alpine-jq:$TAG
+          --destination gitea.renner.uno/konairius/alpine-jq:latest \
+          --destination ghcr.io/konairius/alpine-jq:$TAG \
+          --destination ghcr.io/konairius/alpine-jq:latest

  # Runtime image, not CI tooling: upstream containernetworking/plugins binaries
  # baked in, consumed by the multus cni-plugins-installer DaemonSet. Replaces a
@@ -302,7 +277,7 @@ steps:
  # note on build-alpine-jq. Anything an app needs while the cluster is still
  # being built cannot live only in that cluster's own registry.
  - name: build-cni-plugins
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/cni-plugins
    when:
      - event: deployment
@@ -320,8 +295,7 @@ steps:
      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
      - GH_AUTH=$(printf '%s:%s' "$GHCR_USER" "$GHCR_TOKEN" | base64 | tr -d '\n')
      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"},"ghcr.io":{"auth":"%s"}}}' "$AUTH" "$GH_AUTH" > /kaniko/.docker/config.json
-      # konairius/ gets one tag per build: Gitea's cleanup rule counts tags.
-      - TAG=$(date +%Y-%m-%d-%H%M)
+      - TAG=$(date +%Y-%m-%d)
      - |
        /kaniko/executor \
          --context . \
@@ -329,7 +303,9 @@ steps:
          --destination gitea.renner.uno/gitea_admin/cni-plugins:$TAG \
          --destination gitea.renner.uno/gitea_admin/cni-plugins:latest \
          --destination gitea.renner.uno/konairius/cni-plugins:$TAG \
-          --destination ghcr.io/konairius/cni-plugins:$TAG
+          --destination gitea.renner.uno/konairius/cni-plugins:latest \
+          --destination ghcr.io/konairius/cni-plugins:$TAG \
+          --destination ghcr.io/konairius/cni-plugins:latest

  # Runtime image, not CI tooling: alpine + the openssl CLI, for shell scripts
  # needing s_client/x509. Named for what it is; first consumer is the paperless
@@ -342,7 +318,7 @@ steps:
  # gitea.renner.uno is not there to serve it. A cold-rebuild rehearsal left
  # paperless in Init:ErrImagePull on exactly this image.
  - name: build-alpine-openssl
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/alpine-openssl
    when:
      - event: deployment
@@ -360,8 +336,7 @@ steps:
      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
      - GH_AUTH=$(printf '%s:%s' "$GHCR_USER" "$GHCR_TOKEN" | base64 | tr -d '\n')
      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"},"ghcr.io":{"auth":"%s"}}}' "$AUTH" "$GH_AUTH" > /kaniko/.docker/config.json
-      # konairius/ gets one tag per build: Gitea's cleanup rule counts tags.
-      - TAG=$(date +%Y-%m-%d-%H%M)
+      - TAG=$(date +%Y-%m-%d)
      - |
        /kaniko/executor \
          --context . \
@@ -369,7 +344,9 @@ steps:
          --destination gitea.renner.uno/gitea_admin/alpine-openssl:$TAG \
          --destination gitea.renner.uno/gitea_admin/alpine-openssl:latest \
          --destination gitea.renner.uno/konairius/alpine-openssl:$TAG \
-          --destination ghcr.io/konairius/alpine-openssl:$TAG
+          --destination gitea.renner.uno/konairius/alpine-openssl:latest \
+          --destination ghcr.io/konairius/alpine-openssl:$TAG \
+          --destination ghcr.io/konairius/alpine-openssl:latest

  # Heating CAN readers: open3e (Vitocal/VX3) + E3onCAN (E380 meter), one image
  # run as two services on edge-1. Replaces pip-into-venv on the host, where an
@@ -377,7 +354,7 @@ steps:
  # Ansible converge. Not a ci-* image -- it is a runtime artifact -- but it
  # builds the same way and lands in the same registry so the audit sees it.
  - name: build-heating-can
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/heating-can
    when:
      - event: deployment
@@ -403,7 +380,7 @@ steps:
  # services (public Ingress hosts -> TLS passthrough -> Traefik ClusterIP).
  # Runtime artifact like heating-can; same registry so the audit tracks it.
  - name: build-netbird-service-sync
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/netbird-service-sync
    when:
      - event: deployment
@@ -428,7 +405,7 @@ steps:
  # authentik-gate-sync: the authentik-gate ingress class (Ingress -> Authentik
  # proxy gate + Traefik route). Its unit tests run as a stage of the image build.
  - name: build-authentik-gate-sync
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/authentik-gate-sync
    when:
      - event: deployment
@@ -454,7 +431,7 @@ steps:
  # kuma-sync: reconciles KumaMonitor resources into Uptime Kuma. Its unit
  # tests run as a stage of the image build.
  - name: build-kuma-sync
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/kuma-sync
    when:
      - event: deployment
@@ -480,7 +457,7 @@ steps:
  # cloudflare-lb-sync: reconciles CloudflareLoadBalancer resources into
  # Cloudflare. Its unit tests run as a stage of the image build.
  - name: build-cloudflare-lb-sync
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/cloudflare-lb-sync
    when:
      - event: deployment
@@ -506,7 +483,7 @@ steps:
  # bird: BGP daemon for the pod-network mesh over pod0 (#576). Runtime
  # artifact like heating-can; same registry so the audit tracks it.
  - name: build-bird
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/bird
    when:
      - event: deployment
@@ -530,7 +507,7 @@ steps:

  # Orchestrator for the monthly backup-verify CronJob (velero ns).
  - name: build-backup-verify
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/backup-verify
    when:
      - event: deployment
@@ -131,7 +131,7 @@ steps:
  #    --build-arg to the resolved version (not "latest") guarantees the tag and
  #    the image content agree even if a new release lands mid-run.
  - name: build
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/claude
    depends_on: [decide]
    environment:
@@ -172,7 +172,7 @@ steps:
  # whenever it trails the deployed server. If you bump the server, bump here.
  - name: woodpecker-lint
    depends_on: [] # see note above `steps:`
-    image: woodpeckerci/woodpecker-cli:v3.20.1-alpine@sha256:74c576faf49cce699825d11c7d7bd38ab5f007dd4f57cdbdd55099d2c0f2621a
+    image: woodpeckerci/woodpecker-cli:v3.19.0-alpine@sha256:27a77117e38d7bbdc380f0e90ff3ee4871ab1eefa78b5d9136a2c969fbecd9f4
    commands:
      - |
        set -eu
@@ -319,7 +319,7 @@ steps:
  # writes its stripped mirror under mktemp and never into the workspace.
  - name: promtool
    depends_on: [] # see note above `steps:`
-    image: prom/prometheus:v3.15.1@sha256:fa3302279710be2f21a8301ec17a8b4f2301fd829bd113839b3b6b02b6f191a2
+    image: prom/prometheus:v3.15.0@sha256:efd719c99d83b060d9daefdcf00360461adf279f45ef5391f8d111892118753e
    commands:
      - sh scripts/ci/promtool-rules.sh

@@ -35,25 +35,25 @@ when:
 steps:
  - name: model-selection-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
    commands:
      - sh scripts/ci/test-model-selection.sh

  - name: pr-review-mistral-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
    commands:
      - sh scripts/ci/test-pr-review-mistral.sh

  - name: promtool-rules-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
    commands:
      - sh scripts/ci/test-promtool-rules.sh

  - name: yaml-citations-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
    commands:
      - sh scripts/ci/test-yaml-citations.sh

@@ -63,7 +63,7 @@ steps:
  # bridge, and the secret guard.
  - name: hermes-skill-tests
    depends_on: []
-    image: python:3.15-alpine@sha256:20a82dbc2783112ddb91d1534603f802d222a3e63e593cd002eb2ac534e70211
+    image: python:3.14-alpine@sha256:f6a589d43c42b9e7f7dc67a12d37132491f362859a5d750607710cc56da3bc72
    environment:
      PYTHONDONTWRITEBYTECODE: "1"
    commands:
@@ -0,0 +1,33 @@
+when:
+  # Deploy only on main (merge) + manual — never auto-deploy from a branch.
+  - event: push
+    branch: main
+    path:
+      - "ansible/roles/claude-workstation/**"
+      - "ansible/plays/install-claude-workstation.yml"
+      - ".woodpecker/deploy-claude-workstation.yml"
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-claude-workstation"'
+
+timeout: 30
+
+steps:
+  - name: deploy-claude-workstation
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
+    environment:
+      ANSIBLE_FORCE_COLOR: "true"
+      ANSIBLE_HOST_KEY_CHECKING: "false"
+      ANSIBLE_ROLES_PATH: "../roles:./roles"
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      VAULT_PASS:
+        from_secret: vault_pass
+    commands:
+      - mkdir -p ~/.ssh
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
+      - chmod 600 ~/.ssh/id_ed25519
+      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
+      - cd ansible
+      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
+      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
+      - ansible-playbook -i inventory/ plays/install-claude-workstation.yml -v
@@ -0,0 +1,36 @@
+when:
+  # Deploy only on main (merge) + manual — never auto-deploy from a branch.
+  - event: push
+    branch: main
+    path:
+      - "ansible/roles/mqtt-bridge/**"
+      - "ansible/plays/edge-mqtt-bridge.yml"
+      - "ansible/inventory/group_vars/edge_host/**"
+      - ".woodpecker/deploy-edge-mqtt-bridge.yml"
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-edge-mqtt-bridge"'
+
+timeout: 30
+
+steps:
+  - name: deploy-edge-mqtt-bridge
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
+    environment:
+      ANSIBLE_FORCE_COLOR: "true"
+      ANSIBLE_HOST_KEY_CHECKING: "false"
+      ANSIBLE_ROLES_PATH: "../roles:./roles"
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      VAULT_PASS:
+        from_secret: vault_pass
+    commands:
+      - mkdir -p ~/.ssh
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
+      - chmod 600 ~/.ssh/id_ed25519
+      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
+      - cd ansible
+      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
+      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
+      # Local MQTT bridge on the edge hosts only (REN-1307); restarts only the
+      # local mosquitto on edge-1, never the cluster broker.
+      - ansible-playbook -i inventory/ plays/edge-mqtt-bridge.yml -v
@@ -13,7 +13,7 @@ when:

 steps:
  - name: validate-secrets
-    image: alpine:3.24.3@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
+    image: alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
    environment:
      TF_VAR_proxmox_api_url:
        from_secret: proxmox_api_url
@@ -109,6 +109,8 @@ steps:
        from_secret: hetzner_s3_access_key
      TF_VAR_hetzner_s3_secret_key:
        from_secret: hetzner_s3_secret_key
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
      PROXMOX_TOKEN_ID:
        from_secret: proxmox_token_id
      PROXMOX_TOKEN_SECRET:
@@ -119,6 +121,11 @@ steps:
      ANSIBLE_ROLES_PATH: "../roles:./roles"
      ANSIBLE_FORCE_COLOR: "true"
    commands:
+      - mkdir -p ~/.ssh
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
+      - chmod 600 ~/.ssh/id_ed25519
+      - export TF_VAR_ssh_private_key="$(cat ~/.ssh/id_ed25519)"
+      - printf "Host *\n\tStrictHostKeyChecking no\n" > ~/.ssh/config
      - echo "$VAULT_PASS" > /tmp/.vault_pass && chmod 600 /tmp/.vault_pass
      - export ANSIBLE_VAULT_PASSWORD_FILE=/tmp/.vault_pass
      - tofu init -upgrade -backend-config="access_key=$AWS_ACCESS_KEY_ID" -backend-config="secret_key=$AWS_SECRET_ACCESS_KEY"
@@ -0,0 +1,35 @@
+when:
+  # Deploy only on main (merge) + manual — never auto-deploy from a branch.
+  - event: push
+    branch: main
+    path:
+      - "ansible/roles/netbird-client/**"
+      - "ansible/plays/install-netbird-client.yml"
+      - "ansible/inventory/group_vars/claude_workstation/**"
+      - ".woodpecker/deploy-netbird-client.yml"
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-netbird-client"'
+
+timeout: 30
+
+steps:
+  - name: deploy-netbird-client
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
+    environment:
+      ANSIBLE_FORCE_COLOR: "true"
+      ANSIBLE_HOST_KEY_CHECKING: "false"
+      ANSIBLE_ROLES_PATH: "../roles:./roles"
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      VAULT_PASS:
+        from_secret: vault_pass
+    commands:
+      - mkdir -p ~/.ssh
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
+      - chmod 600 ~/.ssh/id_ed25519
+      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
+      - cd ansible
+      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
+      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
+      # Enrol only the off-site Claude workstation into the Netbird mesh.
+      - ansible-playbook -i inventory/ plays/install-netbird-client.yml --limit claude_workstation -v
@@ -0,0 +1,54 @@
+when:
+  # Deploy only on main (merge) + manual — never auto-deploy from a branch.
+  - event: push
+    branch: main
+    path:
+      - "ansible/roles/netbird-proxy/**"
+      # install-netbird-proxy.yml also applies the netbird-proxy-watchdog role,
+      # so changes to it must redeploy this host too.
+      - "ansible/roles/netbird-proxy-watchdog/**"
+      # install-netbird-proxy.yml also applies the edge bouncer.
+      - "ansible/roles/crowdsec-edge-bouncer/**"
+      - "ansible/plays/install-netbird-proxy.yml"
+      # The variables that steer those roles, not just the roles themselves.
+      # Without these two, a change that only touches inventory never deploys
+      # and nothing says so: arming the bouncer lives in host_vars, and its
+      # LAPI key lives in group_vars, so both would sit in git looking applied
+      # while the hosts kept running the previous configuration.
+      #
+      # pve_hosts.yml is deliberately NOT listed. It is the single inventory
+      # file for the whole fleet, so listing it would redeploy the proxies for
+      # any unrelated host edit. The cost is that a change to [netbird_proxy]
+      # group membership needs a manual deployment run.
+      - "ansible/inventory/host_vars/proxy-*.yml"
+      - "ansible/inventory/group_vars/netbird_proxy/**"
+      - ".woodpecker/deploy-netbird-proxy.yml"
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-netbird-proxy"'
+
+timeout: 30
+
+steps:
+  - name: deploy-netbird-proxy
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
+    environment:
+      ANSIBLE_FORCE_COLOR: "true"
+      ANSIBLE_HOST_KEY_CHECKING: "false"
+      ANSIBLE_ROLES_PATH: "../roles:./roles"
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      VAULT_PASS:
+        from_secret: vault_pass
+      PROXMOX_TOKEN_ID:
+        from_secret: proxmox_token_id
+      PROXMOX_TOKEN_SECRET:
+        from_secret: proxmox_token_secret
+    commands:
+      - mkdir -p ~/.ssh
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
+      - chmod 600 ~/.ssh/id_ed25519
+      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
+      - cd ansible
+      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
+      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
+      - ansible-playbook -i inventory/ plays/install-netbird-proxy.yml -v
@@ -0,0 +1,37 @@
+when:
+  # Deploy only on main (merge) + manual — never auto-deploy from a branch.
+  - event: push
+    branch: main
+    path:
+      - "ansible/roles/netbird-server/**"
+      - "ansible/plays/install-netbird-server.yml"
+      - ".woodpecker/deploy-netbird-server.yml"
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-netbird-server"'
+
+timeout: 30
+
+steps:
+  - name: deploy-netbird-server
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
+    environment:
+      ANSIBLE_FORCE_COLOR: "true"
+      ANSIBLE_HOST_KEY_CHECKING: "false"
+      ANSIBLE_ROLES_PATH: "../roles:./roles"
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      VAULT_PASS:
+        from_secret: vault_pass
+      PROXMOX_TOKEN_ID:
+        from_secret: proxmox_token_id
+      PROXMOX_TOKEN_SECRET:
+        from_secret: proxmox_token_secret
+    commands:
+      - mkdir -p ~/.ssh
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
+      - chmod 600 ~/.ssh/id_ed25519
+      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
+      - cd ansible
+      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
+      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
+      - ansible-playbook -i inventory/ plays/install-netbird-server.yml -v
@@ -0,0 +1,47 @@
+when:
+  # Deploy only on main (merge) + manual — never auto-deploy from a branch.
+  - event: push
+    branch: main
+    path:
+      - "ansible/roles/uptime-kuma/**"
+      - "ansible/plays/install-uptime-kuma.yml"
+      - ".woodpecker/deploy-uptime-kuma.yml"
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-uptime-kuma"'
+  - event: cron
+    cron: uptime-kuma-token-renew
+
+timeout: 30
+
+steps:
+  - name: renew-openbao-token
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-10-18
+    environment:
+      VAULT_TOKEN:
+        from_secret: openbao_uptime_kuma_token
+    commands:
+      - 'curl -sSf -X POST -H "X-Vault-Token: $VAULT_TOKEN" https://openbao.renner.uno/v1/auth/token/renew-self -o /dev/null'
+
+  - name: deploy-uptime-kuma
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-10-18
+    when:
+      - event: [push, deployment]
+    environment:
+      ANSIBLE_FORCE_COLOR: "true"
+      ANSIBLE_HOST_KEY_CHECKING: "false"
+      ANSIBLE_ROLES_PATH: "../roles:./roles"
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      VAULT_PASS:
+        from_secret: vault_pass
+      VAULT_TOKEN:
+        from_secret: openbao_uptime_kuma_token
+    commands:
+      - mkdir -p ~/.ssh
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
+      - chmod 600 ~/.ssh/id_ed25519
+      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
+      - cd ansible
+      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
+      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
+      - ansible-playbook -i inventory/ plays/install-uptime-kuma.yml -v
@@ -26,7 +26,7 @@ steps:
    # fetch-models.sh response mapping. No cluster, no secrets, no network — the
    # ci-claude image just provides sh + jq. Keeps the flag-injection regression
    # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
    commands:
      - sh scripts/ci/test-model-selection.sh

@@ -1,5 +1,5 @@
 # Builds ci/images/hermes (nousresearch/hermes-agent plus the agent's CLIs) as
-# gitea.renner.uno/konairius/hermes:YYYY-MM-DD-HHMM, one tag per build.
+# gitea.renner.uno/konairius/hermes:build.<unix-ts> and :latest.
 when:
  - event: push
    branch: main
@@ -10,7 +10,7 @@ when:

 steps:
  - name: build
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/hermes
    environment:
      # registry-bot write:package PAT (konairius org secret).
@@ -20,9 +20,10 @@ steps:
      - mkdir -p /kaniko/.docker
      - AUTH=$(printf '%s:%s' registry-bot "$GITEA_TOKEN" | base64 | tr -d '\n')
      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
-      - TAG=$(date +%Y-%m-%d-%H%M)
+      - TAG="build.$(date +%s)"
      - |
        /kaniko/executor \
          --context . \
          --dockerfile Containerfile \
-          --destination gitea.renner.uno/konairius/hermes:$TAG
+          --destination gitea.renner.uno/konairius/hermes:$TAG \
+          --destination gitea.renner.uno/konairius/hermes:latest
@@ -6,7 +6,7 @@ when:

 steps:
  - name: go-test
-    image: golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9
+    image: golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61
    commands:
      - test -z "$(gofmt -l review-bot)"
      - go -C review-bot vet ./...
@@ -18,12 +18,12 @@ when:

 steps:
  - name: iac-scan
-    image: aquasec/trivy:latest@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c
+    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
    commands:
      - trivy fs --format json -o trivy-iac.json --severity CRITICAL,HIGH --ignore-unfixed .

  - name: image-scans
-    image: aquasec/trivy:latest@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c
+    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
    commands:
      - trivy image --download-db-only
      - |
@@ -70,7 +70,7 @@ steps:
    # this step is skipped — otherwise we'd fork-bomb PRs.
    when:
      - branch: main
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -30,7 +30,7 @@ when:

 steps:
  - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -0,0 +1,28 @@
+when:
+  # Manual only: reboots edge-1 (Z-Wave, heating CAN, sole NTP server) and the
+  # NetBird control plane. Run inside the 02:00-05:00 Europe/Berlin window.
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "update-os"'
+
+timeout: 120
+
+steps:
+  - name: update-os
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
+    environment:
+      ANSIBLE_FORCE_COLOR: "true"
+      ANSIBLE_HOST_KEY_CHECKING: "false"
+      ANSIBLE_ROLES_PATH: "../roles:./roles"
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      VAULT_PASS:
+        from_secret: vault_pass
+    commands:
+      - mkdir -p ~/.ssh
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
+      - chmod 600 ~/.ssh/id_ed25519
+      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
+      - cd ansible
+      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
+      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
+      - ansible-playbook -i inventory/ plays/update-os.yml -v
@@ -1,13 +0,0 @@
-# Tests for the wlan-setup Go service (wlan-setup/). Offline: the tests run against a fake
-# authentik server, so the step needs no secret and no network beyond the module cache.
-when:
-  - event: pull_request
-    path: ["wlan-setup/**", ".woodpecker/wlan-setup-test.yml"]
-
-steps:
-  - name: go-test
-    image: golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9
-    commands:
-      - test -z "$(gofmt -l wlan-setup)"
-      - go -C wlan-setup vet ./...
-      - go -C wlan-setup test -race ./...
@@ -112,7 +112,7 @@

 # (string) This setting controls the default policy of fact gathering (facts discovered about remote systems).
 # This option can be useful for those wishing to save fact gathering time. Both 'smart' and 'explicit' will use the cache plugin.
-gathering=smart
+;gathering=implicit

 # (list) Set the `gather_subset` option for the :ref:`ansible_collections.ansible.builtin.setup_module` task in the implicit fact gathering. See the module documentation for specifics.
 # It does **not** apply to user defined ``ansible.builtin.setup`` tasks.
@@ -134,7 +134,7 @@ gathering=smart
 ;hash_behaviour=replace

 # (pathlist) Comma separated list of Ansible inventory sources
-inventory=inventory
+inventory=~/source/homelab/ansible/inventory

 # (pathspec) Colon separated paths in which Ansible will search for HttpApi Plugins.
 ;httpapi_plugins={{ ANSIBLE_HOME ~ "/plugins/httpapi:/usr/share/ansible/plugins/httpapi" }}
@@ -206,7 +206,7 @@ inventory=inventory
 ;poll_interval=15

 # (path) Option for connections using a certificate or key file to authenticate, rather than an agent or passwords, you can set the default value here to avoid re-specifying --private-key with every invocation.
-;private_key_file=
+private_key_file=~/.ssh/id_ed25519

 # (boolean) By default, imported roles publish their variables to the play and other roles, this setting can avoid that.
 # This was introduced as a way to reset role variables to default values if a role is used more than once in a playbook.
@@ -274,7 +274,7 @@ roles_path=../roles:./roles

 # (path) The vault password file to use. Equivalent to --vault-password-file or --vault-id
 # If executable, it will be run and the resulting stdout will be used as the password.
-vault_password_file=vault-password.sh
+vault_password_file=~/source/homelab/ansible/vault-password.sh

 # (integer) Sets the default verbosity, equivalent to the number of ``-v`` passed in the command line.
 ;verbosity=0
@@ -484,7 +484,7 @@ vault_password_file=vault-password.sh
 # It can result in a very significant performance improvement when enabled.
 # However this conflicts with privilege escalation (become). For example, when using 'sudo:' operations you must first disable 'requiretty' in /etc/sudoers on all managed hosts, which is why it is disabled by default.
 # This setting will be disabled if ``ANSIBLE_KEEP_REMOTE_FILES`` is enabled.
-pipelining=True
+;pipelining=False


 [colors]
@@ -694,8 +694,3 @@ pipelining=True
 # (list) default list of tags to skip in your plays, has precedence over Run Tags
 ;skip=

-
-[ssh_connection]
-# Connections stay open across the plays of a run, so each host costs one
-# YubiKey PIN; plays/close-connections.yml closes them at the end of a run.
-ssh_args=-C -o ControlMaster=auto -o ControlPersist=30m
@@ -1,17 +1,13 @@
 # edge-host — bare-metal Arch thin client (replaces the k8s-edge Talos VM)

 Runs the hardware-bound services that used to be pinned to the `k8s-edge`
-Talos node (opentofu `vm_153_k8s_edge.tf`):
+Talos node (opentofu `vm_153_k8s_edge.tf`), plus the new CAN bridge:

 | Service | How it runs | Hardware | Talks to |
 |---|---|---|---|
 | zwave-js-ui | docker compose | ZWA-2 Z-Wave USB radio | HA `zwave_js` via ws://:3000, UI :8091 |
 | sml2mqtt | docker compose | FTDI FT230X meter reader | Mosquitto (`sml2mqtt` user) |
-
-The Viessmann E3 CAN bus is not read by an edge host: the ESP32 gateway
-`vitocal-can` (open3e-esp32) at the Vitocal publishes `open3e/#` directly to
-the cluster broker. `plays/install-edge-host.yml` removes the former
-heating-can stack and the can0 configuration from edge hosts.
+| open3e | venv + systemd | Innomaker USB2CAN (gs_usb) | Mosquitto (`open3e` user) |

 Everything else that once lived on k8s-edge (HA core, matter-server, OTBR,
 music-assistant) already moved to the general node pool and stays in the
@@ -23,13 +19,17 @@ The deployed unit is a **Dell Wyse 3040** (Atom x5-Z8350, 2 GB RAM) on a
 flash-wear handling that hardware implies. The installer also supports an
 N100/NVMe box; it autodetects the target disk, so either works.

+Rationale for leaving Kubernetes for the CAN part: the stock Talos kernel
+ships with `CONFIG_CAN` unset (siderolabs/talos#7686), so SocketCAN cannot
+work in any pod without a custom kernel image per Talos release.
+
 ## Base install (once, from the edge-host installer ISO)

 Build and boot the dedicated installer image — see
 `images/edge-host-iso/README.md`. Short version:

 1. `sudo pacman -S archiso && sudo images/edge-host-iso/build.sh`
-2. Write ISO to a USB stick, boot the target box from it, run `edge-install <hostname>`
+2. Write ISO to a USB stick, boot the target box from it, run `edge-install`
   (partitions the internal disk — NVMe if present, else the eMMC; the
   installer autodetects — installs the ansible-ready base system with SSH
   keys, DHCP, docker — asks for confirmation before wiping).
@@ -41,11 +41,13 @@ Build and boot the dedicated installer image — see
 4. Add the host to `[edge_host]` in `inventory/pve_hosts.yml`, by name.
   That group is the base: every edge thin client belongs to it, and it
   assumes no peripherals.
-5. From the workstation, in `ansible/`:
+5. From the workstation:
   ```
-   ansible-playbook site.yml
+   ansible-playbook -i inventory/pve_hosts.yml plays/install-edge-host.yml
   ```
-   One unrestricted run, no `--limit`. It converges every host, which is
+   One unrestricted run over the whole group. The play is self-contained --
+   it carries `certificates` and `common` itself, so there is no second
+   command and no `--limit`. Running it converges every edge host, which is
   the point: a run that touches only the new box tells you nothing about
   the others.

@@ -58,26 +60,33 @@ inventory change.

 | device | group | playbook |
 |---|---|---|
+| Innomaker USB2CAN (Vitocal/VX3 + E380) | `heating_can` | `plays/install-heating-can.yml` |
 | Nabu Casa ZWA-2 Z-Wave radio | `zwave_gateway` | `plays/install-zwave-gateway.yml` |

-Add the host to the matching group, then run that playbook. It depends on
-the base play having run: it needs docker.
+Add the host to the matching group, then run that playbook. They depend on
+the base play having run: all three need the local MQTT bridge, and two of
+them need docker.

-A host with nothing attached is simply absent from these groups and needs
+A host with nothing attached is simply absent from all three groups and needs
 none of these commands.

 ## Secrets (before first play run)

-Create `inventory/group_vars/edge_host/vault.yml` with ansible-vault. The
-zwave-js value comes out of the cluster:
+Create `inventory/group_vars/edge_host/vault.yml` with ansible-vault; the
+current live values come straight out of the cluster:

 ```
+# sml2mqtt broker password
+kubectl -n home-assistant get secret mosquitto-sml2mqtt-credentials -o jsonpath='{.data.password}' | base64 -d
+# open3e broker password
+kubectl -n home-assistant get secret mosquitto-open3e-credentials -o jsonpath='{.data.password}' | base64 -d
 # zwave-js session secret
 kubectl -n home-assistant get secret zwave-js-session -o jsonpath='{.data.session-secret}' | base64 -d
 ```

 ```yaml
 # vault.yml
+vault_edge_open3e_mqtt_password: "..."
 vault_edge_zwavejs_session_secret: "..."
 vault_edge_loki_password: "..."   # dedicated edge-1 Loki push cred (see "Logging & eMMC")
 ```
@@ -95,6 +104,9 @@ The Z-Wave network keys do NOT need separate handling — they live in

 Preparation:
 - [ ] `vault.yml` populated (above), play runs green against edge-1
+- [ ] CAN: Innomaker adapter connected to the VX3 external CAN port,
+      `ip -details link show can0` shows `state ERROR-ACTIVE bitrate 250000`,
+      `candump can0 -n 5` shows frames

 zwave-js (order matters — never two servers on one radio):
 - [ ] Copy the store out of the PVC while the pod still runs:
@@ -112,6 +124,11 @@ sml2mqtt:
      port, Wh stays Wh) → remove sml2mqtt from the home-assistant
      kustomization in the follow-up PR

+open3e:
+- [ ] Stop any workstation listener (ONE instance per bus, hard rule)
+- [ ] Move the USB2CAN adapter, `systemctl start open3e`
+- [ ] Topics under `open3e/#` update on the broker
+
 Afterwards:
 - [ ] Retire VM 153: remove `vm_153_k8s_edge.tf`, `talos/patches/k8s-edge.yaml`,
      node from the cluster (`kubectl delete node k8s-edge`, tofu apply)
@@ -119,13 +136,22 @@ Afterwards:

 ## Day-2 notes

- Image bumps: Renovate opens a PR for `edge_*_image` in
-  `roles/*/defaults/main.yml` (tag + digest, `customManagers` in
-  `renovate.json`). No pipeline deploys to edge-1, so after the merge run
-  `ansible-playbook plays/install-zwave-gateway.yml` from `ansible/` on a
-  mesh-connected workstation. The play reads the image's Alpine release
-  itself and rebuilds the preloaded `.so` when it changes (see
-  "Logging & eMMC" → zwave-js).
+- Image bumps: edit `edge_zwavejs_image` / `edge_sml2mqtt_image` in
+  defaults and re-run the play (no flux image-automation out here —
+  deliberate for sml2mqtt, acceptable for zwave-js). If a zwave-js bump
+  changes its Alpine major, also update `edge_zwave_alpine_base` and refresh
+  the preloaded `.so` (see "Logging & eMMC" → zwave-js).
+- open3e / E3onCAN updates: both are pinned to commits in
+  `roles/heating-can/defaults/main.yml`, so re-running the play does NOT pick
+  up upstream changes -- that is deliberate, these drive the heat pump. The
+  weekly update-audit reports when either falls behind (see
+  `ci/agents/update-audit/prompt.md`); bump the pin and re-run.
+  Pinning to a tag is not an option for open3e: it publishes none.
+- Ad-hoc CAN scans: `systemctl stop open3e` first (single-instance rule),
+  restart afterwards.
+- can-utils (`candump`) is AUR-only on Arch — install manually via
+  `pamac build can-utils` if needed for debugging; the role deliberately
+  doesn't manage AUR packages.

 ## Logging & eMMC

@@ -138,9 +164,7 @@ role keeps logs off local flash and monitors wear:
 - **Docker logs to journald** (`docker-daemon.json`, `log-driver: journald`)
  instead of unbounded json files under `/var/lib/docker/containers`. Both
  compose services inherit it; `docker logs` still works.
- **Grafana Alloy ships the journal to Loki** (`edge-alloy.service`, which
-  runs the upstream `grafana/alloy` image with `/run/log/journal` mounted
-  read-only; Arch's `grafana-alloy` package has no `loki.source.journal`). Its
+- **Grafana Alloy ships the journal to Loki** (`edge-alloy.service`). Its
  WAL/positions sit on `/run/alloy` (tmpfs), so the agent writes nothing to
  the eMMC either. Net effect: no log writes hit local flash — the trade-off
  is that logs are RAM-only and lost on reboot unless already shipped.
@@ -168,7 +192,7 @@ journal commit).

 - **Fix:** the `zwave-js` container preloads **`libeatmydata`**
  (`LD_PRELOAD=/usr/lib/libeatmydata.so`, mounted read-only from
-  `zwave-js/libeatmydata-alpine<X.Y>.so`). This makes `fsync`/`fdatasync` no-ops *for that
+  `zwave-js/libeatmydata.so`). This makes `fsync`/`fdatasync` no-ops *for that
  one process*, so the kernel batches the writes via normal writeback (~30 s)
  instead of forcing each one. The WS/MQTT value stream to Home Assistant and
  the on-disk cache are **unchanged** — full data resolution, no re-interview
@@ -177,9 +201,9 @@ journal commit).
  batch it); the only mount-level alternative is putting the cache on tmpfs,
  which makes the *whole* store volatile → re-interview on every restart.
 - **The `.so` is musl** (the image is Alpine-based), extracted from
-  `alpine:<X.Y>`, where `X.Y` is read from the image's `/etc/alpine-release`
-  on every run. A new Alpine release gives a new file name, so the play
-  extracts it, recreates the container and deletes the old file.
+  `edge_zwave_alpine_base` — keep that var in sync with the image's Alpine
+  version; to refresh after a major bump, `rm zwave-js/libeatmydata.so` and
+  re-run.
 - **Durability guard:** because `fsync` is neutralized, a hard power-loss
  during the (rare) settings write could truncate `settings.json`, which holds
  the **Z-Wave network keys**. `edge-zwave-settings-backup.timer` keeps a
@@ -189,3 +213,49 @@ journal commit).
 - Verify the drop with the eMMC-write sampling described above; roll back by
  removing the `LD_PRELOAD` env + `.so` mount from the compose file.

+## MQTT bridge (TLS to the cluster broker)
+
+open3e, e3oncan and sml2mqtt do **not** publish to the cluster broker directly.
+They connect to a **local mosquitto on loopback** (`127.0.0.1:1883`,
+`edge_mqtt_host`), which **bridges to the cluster broker over TLS**
+(`mqtt.renner.uno:8883`). Two reasons:
+
+- **Security:** open3e and e3oncan have no native MQTTS support (their MQTT
+  code does a plain `connect()`), so they can't use the broker's 8883 TLS
+  listener. Terminating TLS in the local broker keeps their plaintext MQTT on
+  loopback only — off the untrusted IoT VLAN — while the actual network hop is
+  encrypted. The public Let's Encrypt cert is validated against the system CA
+  bundle (`edge_mqtt_bridge_cafile`); no cert distribution needed.
+- **Availability:** the local broker buffers telemetry (in RAM) if the cluster
+  broker is briefly unreachable, and flushes on reconnect — edge-1 no longer
+  hard-depends on cluster/network uptime for every publish.
+
+Two bridge `connection`s preserve the existing cluster identities, so **no
+cluster-side change was needed**: one authenticates as the `open3e` user
+(carries `open3e/#` out + `open3e/cmnd` back), one as `sml2mqtt` (`sml2mqtt/#`
+out). The local broker is `allow_anonymous` on loopback — the trust boundary
+is the host; nothing off-host can reach it.
+
+**Bridge credential (REN-1307).** The two vault-password bridges are being
+replaced by one bridge as the register account `edge-1`
+(`kubernetes/apps/home-assistant/mqtt-accounts.yaml`). Its password is pushed
+by mqtt-account-controller to `edge-mqtt-cred` (`:8443`, the controller's
+esp32 API over HTTPS). That endpoint accepts only a client certificate from
+the MQTT CA with CN `mqtt-account-controller`; edge-1 holds the public CA and
+its own server key, nothing else. On a push it writes
+`/etc/mosquitto/bridge.d/edge-1.conf`, deletes `bridge.d/legacy.conf` and
+restarts the local mosquitto. The controller sets a new password whenever the
+bridge reports "not connected" (also after a reinstall), so no play run is
+needed for a rotation. `.woodpecker/deploy-edge-mqtt-bridge.yml` runs
+`plays/edge-mqtt-bridge.yml` on merge. Diagnosis: `journalctl -u
+edge-mqtt-cred`, and `mosquitto_sub -t '$SYS/broker/connection/edge-1/state'`
+(retained `1` = connected).
+
+**eMMC:** the local broker writes **nothing** to flash — `persistence false`
+(retained/queued messages in RAM) and `log_dest stdout` (to the volatile
+journal → Loki). Do not add persistence or log-file settings to
+`edge-mqtt-bridge.conf.j2`.
+
+Rollback: point `edge_mqtt_host` back to `mqtt.renner.uno` and re-run (clients
+reconnect directly on 1883). Config: `edge-mqtt-bridge.conf.j2` →
+`/etc/mosquitto/mosquitto.conf`.
@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+"""
+Discover Shelly devices on the network via HTTP API
+Returns JSON array of discovered devices
+"""
+
+import sys
+import json
+import ipaddress
+import concurrent.futures
+import urllib.request
+import urllib.error
+
+def check_shelly(ip):
+    """Check if IP is a Shelly device and return info"""
+    try:
+        url = f"http://{ip}/shelly"
+        req = urllib.request.Request(url, headers={'User-Agent': 'Ansible-Shelly-Discovery'})
+        with urllib.request.urlopen(req, timeout=2) as response:
+            data = json.loads(response.read().decode())
+            # Gen1 devices don't have 'gen' field, default to 1
+            gen = data.get('gen', 1)
+            if gen is None:
+                gen = 1
+            return {
+                'ip': str(ip),
+                'type': data.get('type', 'unknown'),
+                'mac': data.get('mac', ''),
+                'gen': gen,
+                'name': data.get('name', data.get('id', str(ip))),
+                'fw_id': data.get('fw_id', data.get('fw', 'unknown'))
+            }
+    except (urllib.error.URLError, urllib.error.HTTPError, OSError, json.JSONDecodeError):
+        return None
+    except Exception:
+        return None
+
+def main():
+    if len(sys.argv) < 2:
+        print("Usage: discover_shelly.py <network1> [network2] ...")
+        print("Example: discover_shelly.py 10.2.30.0/24 10.2.20.0/24")
+        sys.exit(1)
+
+    networks = sys.argv[1:]
+    devices = []
+
+    # Collect all IPs to scan
+    all_ips = []
+    for network in networks:
+        try:
+            all_ips.extend(ipaddress.IPv4Network(network).hosts())
+        except ValueError as e:
+            print(f"Invalid network: {network} - {e}", file=sys.stderr)
+            continue
+
+    # Scan in parallel
+    with concurrent.futures.ThreadPoolExecutor(max_workers=100) as executor:
+        results = executor.map(check_shelly, all_ips)
+        for result in results:
+            if result:
+                devices.append(result)
+
+    # Output JSON
+    print(json.dumps(devices, indent=2))
+
+if __name__ == "__main__":
+    main()
@@ -5,10 +5,27 @@ pve_token_id: "ansible"
 ansible_user: "ladmin"
 ansible_python_interpreter: /usr/bin/python3

-# The only plain key the admin logins accept on [ssh_keys_managed] hosts
-# (ssh-ca role, tasks/authorized_keys.yml). People log in with OpenBao SSH CA
-# certificates; this one is for when that path is unavailable.
-#   breakglass-neo: PIV key (slot 9a, PIN) on the offline YubiKey NEO.
-#     ssh -I /usr/lib/opensc-pkcs11.so root@<host>
-ssh_admin_authorized_keys:
-  - key: "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKvSl9LUP8u3S2Sq5YTWpW0Jxbue8cJhD7/LMFQbEsa3xo145HVR7pBzRxW71MUy+jgrgmpSlDhIb606Hswhvoo= breakglass-neo-6532348"
+# SSH Public Keys for Cloud-Init
+# ansible-runner@ci-new removed (issue #184): dead key, no such host exists.
+common_ssh_public_keys: |
+  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPzFNBP3bq2m/6JqDqod9w+FP/uxXxHMolqhq3Ojflr1 krenner@fortress
+  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyNnX1I4W9jyDvCJ1DJauHSmbo1ZXSyBxVhSAwMWgen woodpecker-ci@homelab
+
+# Network-of-origin restriction for the woodpecker-ci@homelab CI key
+# (issue #184). Consumed by plays/configure-ssh-keys.yml as the authorized_key
+# `from=` option so the CI key only authenticates from within the cluster's
+# pod network — NOT from any host-pinned IP.
+#
+# The in-cluster Woodpecker step pods SSH to fleet hosts using their POD IP as
+# source, not a node IP: Cilium runs `ipv4-native-routing-cidr=10.0.0.0/8` +
+# `ipv6-native-routing-cidr=fd00::/8` with masquerade enabled, so pod egress to
+# any 10.x / fd.. LAN destination is NOT SNAT'd, and each node's PodCIDR is
+# advertised to the UDM over BGP (kubernetes/infrastructure/post-crds/
+# cilium-bgp.yaml) so return traffic L3-routes back to the pod. Hosts therefore
+# see the real pod source IP.
+#
+# The cluster pod subnets (kubernetes/talos/patches/cluster.yaml podSubnets)
+# are the stable boundary — they survive node DHCP-lease churn and pod
+# rescheduling across k8s-1/2/3, unlike pinning any node's current IP.
+# v6 is included because some SSH targets (edge IoT hosts) are IPv6-only.
+ci_ssh_from_cidrs: '10.244.0.0/16,fd10:244::/48'
@@ -0,0 +1,16 @@
+$ANSIBLE_VAULT;1.1;AES256
+35646538363164363061366433343963623166336630376233333033646637336266343337343230
+3233356135323762636439336466663430366238363338650a633762623366643137303333383634
+62623739363132303335636261626263333332623066303161633466306431623930666166323833
+6439663964353338350a656435626664646666363831363164393335386666356637613037323838
+63653461656366613331353064656161346263356131346437666632386166623037373363333534
+37323435623366643534633333303534313434613135653237303966656162633266623433363934
+36343133393834393765353338383764303664363431653865633764306138376366623832346262
+36303766623331666632613639366139333661636665363631326565653938343637323861653064
+37393465383263376337376639613162306563653365623036376662303030613264653534353332
+66363030356363373439306164386561363734353631363738656236633164633062613437663366
+62386430396262366336316166353366383233316333333234666538643962336361363630363762
+31653963303032373531386566336632336130383034343430303964396538663237346434613737
+39643765623766373639306132316635376434643232336163303066393736313130323065666232
+39393038616162666666383837326137376233613437636361636238663566336365653863643933
+353338646134383038323134323034653564
@@ -2,6 +2,7 @@
 # Secret indirection — real values live in vault.yml (ansible-vault) next
 # to this file; see docs/edge-host.md for how to populate it from
 # the cluster secrets.
+edge_open3e_mqtt_password: "{{ vault_edge_open3e_mqtt_password }}"
 edge_zwavejs_session_secret: "{{ vault_edge_zwavejs_session_secret }}"
 # Loki push credential (dedicated 'edge-1' user, Traefik basic-auth on the
 # loki.renner.uno ingress; the matching htpasswd line lives in the cluster
@@ -35,8 +36,17 @@ keepalived_ntp_sysctl:
 # Realtek NIC on the Wyse 3040 has no hardware timestamping.
 chrony_hwtimestamp: false

-# Units claude-bot may restart (ssh-ca role); the containers go through docker.
-ssh_ca_claude_sudo_units:
-  - edge-alloy
-  - keepalived
-  - chronyd
+# --- Local MQTT contract -------------------------------------------------
+# Shared between the broker and its clients, so it belongs to the inventory
+# rather than to either side's role. mqtt-bridge listens here; heating-can
+# publishes here; and the bridge authenticates to the cluster
+# broker AS the open3e user, so it needs that identity too.
+#
+# Keeping these in one role's defaults only worked while a single play loaded
+# every role at once. Splitting the plays by capability exposed it: the bridge
+# could not render without a heating-can default, and the CAN services could
+# not render without an mqtt-bridge default.
+edge_mqtt_host: 127.0.0.1
+edge_mqtt_port: 1883
+edge_open3e_mqtt_user: open3e
+edge_open3e_mqtt_topic: open3e
@@ -1,9 +0,0 @@
---
-# The host NetBird client (wt0) must not take over DNS: resolv.conf is pinned to
-# the systemd-resolved stub by the netbird-proxy role.
-netbird_disable_dns: true
-
-ssh_ca_claude_sudo_units:
-  - netbird
-  - netbird-proxy-flood-watchdog
-  - crowdsec-firewall-bouncer
@@ -8,7 +8,7 @@
 # two plays over this group -- withdraw the static assignments fleet-wide, then
 # hand the address to keepalived -- and both need the same value. Duplicating a
 # service address across plays is exactly the sort of thing that drifts.
-ntp_vip6: "fd02:40::123/128"
+ntp_vip6: "fd40::123/128"

 # Link-local address carried as the FIRST virtual_ipaddress of the IPv6 VRRP
 # instance. RFC 5798 gives an IPv6 virtual router a link-local primary, and
@@ -1,8 +0,0 @@
---
-# DSM's own python3 is 3.8; plays/configure-synology-python.yml installs this.
-ansible_python_interpreter: /var/packages/Python3.9/target/usr/bin/python3.9
-# DSM offers no sftp/scp.
-ansible_ssh_transfer_method: piped
-
-# claude-bot is a DSM administrator here; its password is unknown.
-ssh_ca_claude_sudo_all: true
@@ -2,6 +2,3 @@
 # NetBird server - VPS not managed by Proxmox
 # Enable Docker monitoring (cAdvisor) for container metrics
 docker_monitoring_enabled: true
-
-ssh_ca_claude_sudo_units:
-  - netbird
@@ -8,26 +8,22 @@
 #   pve_cluster (jupiter/neptune/saturn)  run Talos on bare metal; no SSH at all
 #   authentik_db / authentik_app          authentik runs in-cluster (CNPG)
 #   grafana                               runs in-cluster
+#   synology_nas (nas-1)                  powered off; Garage and the PBS client
+#                                         it hosted are gone with it
 # Their hosts no longer resolve, except the three that resolve to Talos nodes.

 [netbird_server]
-netbird.renner.uno ansible_host=netbird.nb.renner.uno ansible_user=root
+netbird.renner.uno ansible_user=root

 [netbird_proxy]
-proxy-1.renner.uno ansible_host=proxy-1.nb.renner.uno ansible_user=root
-proxy-2.renner.uno ansible_host=proxy-2.nb.renner.uno ansible_user=root
+proxy-1.renner.uno ansible_user=root
+proxy-2.renner.uno ansible_user=root

 # Every bare-metal edge thin client. Gets the host-generic roles only:
-# flash-wear handling, the log shipper, the VLAN sub-interface. Nothing here
-# assumes any peripheral is attached.
+# flash-wear handling, the log shipper, the MQTT bridge, the VLAN
+# sub-interface. Nothing here assumes any peripheral is attached.
 [edge_host]
 edge-1.iot.renner.uno ansible_user=root
-edge-2.iot.renner.uno ansible_user=root
-
-# Synology NAS (DSM): nas-1 RS1221+ on site, nas-2 DS1522+ off site.
-[synology_nas]
-nas-1.renner.uno ansible_user=root
-nas-2.renner.uno ansible_user=root

 # Capability groups. Membership states which hardware a host physically has,
 # and each service playbook targets the group for its own concern. No flags and
@@ -37,46 +33,39 @@ nas-2.renner.uno ansible_user=root
 # These are children of [edge_host], declared below: a peripheral is added to an
 # edge client, it does not replace the base. Making that a :children relation
 # rather than a comment means a host added only to a capability group still
-# resolves group_vars/edge_host.
+# resolves group_vars/edge_host -- where the local MQTT contract lives -- so it
+# cannot silently come up without edge_mqtt_host and friends.
 [zwave_gateway]
 edge-1.iot.renner.uno

+[heating_can]
+edge-1.iot.renner.uno
+
 [edge_host:children]
 zwave_gateway
+heating_can

-# NTP servers: every edge host (edge-1 BACKUP prio 70, edge-2 BACKUP prio 60;
-# see the ntp_servers map in plays/install-ntp-ha.yml). Talos nodes cannot run
-# chrony or keepalived. The jupiter/saturn/neptune entries in that map
-# describe retired PVE hosts. See plays/install-ntp-ha.yml for why keepalived
-# is scoped more narrowly than chrony within this group.
+# NTP servers. edge-1 was added here so the role would survive the PVE hosts
+# being retired for bare-metal Talos, which cannot run chrony or keepalived
+# itself. That retirement has now happened, so edge-1 is the ONLY member.
+#
+# THIS IS NO LONGER HIGHLY AVAILABLE. The group was jupiter (MASTER, prio 100),
+# saturn (90), neptune (80) and edge-1 (BACKUP, 70); the first three are gone.
+# A single VRRP member takes the address regardless of its configured state, so
+# fd40::123 is still served — verified answering — but by one thin client with
+# no failover behind it. install-ntp-ha.yml still carries the four-host
+# ntp_servers priority map, which now describes hosts that do not exist.
+#
+# Restoring redundancy needs a second chrony host that is not a Talos node.
+# See plays/install-ntp-ha.yml for why keepalived is scoped more narrowly than
+# chrony within this group.
 [ntp_cluster:children]
 edge_host

-# Hosts that trust the OpenBao SSH user CA (plays/configure-ssh-ca.yml).
-# Rolled out one host at a time: add the next host after the previous one
-# was verified.
-[ssh_ca]
-proxy-1.renner.uno
-proxy-2.renner.uno
-netbird.renner.uno
-edge-1.iot.renner.uno
-edge-2.iot.renner.uno
-nas-1.renner.uno
-nas-2.renner.uno
-
-# Hosts whose admin logins accept only ssh_admin_authorized_keys (break-glass);
-# everything else needs a CA certificate. Members must be in [ssh_ca].
-# Added one host at a time after the [ssh_ca] report was reviewed.
-[ssh_keys_managed]
-proxy-1.renner.uno
-proxy-2.renner.uno
-netbird.renner.uno
-edge-1.iot.renner.uno
-
-# Internet hosts whose sshd listens on the NetBird interface only
-# (plays/configure-ssh-mesh-only.yml). Members need the host NetBird client.
-# Added one host at a time after the previous one was verified.
-[ssh_mesh_only]
-proxy-1.renner.uno
-proxy-2.renner.uno
-netbird.renner.uno
+# Off-site Debian VM (Synology VMM on nas-2, 10.3.40.0/24) running Claude Code.
+# Reached over the site-to-site tunnel at its current DHCP lease. Switch
+# ansible_host to the stable Netbird mesh IP once the host is enrolled — the
+# obg.renner.uno FQDN is split-horizon and resolves to the public proxy from
+# home, so it must NOT be used as ansible_host.
+[claude_workstation]
+claude-ws ansible_host=10.3.40.78 ansible_user=root
@@ -1,11 +0,0 @@
---
-# Last play of every playbook that is run directly (site.yml and the one-off
-# actions). SSH connections stay open for 30 minutes (ansible.cfg) so a run
-# costs one YubiKey PIN per host; closing them at the end leaves nothing that
-# another process of the same user could reuse.
- name: Close the SSH connections
-  hosts: all
-  gather_facts: false
-  tasks:
-    - name: Close the connection
-      ansible.builtin.meta: reset_connection
@@ -13,5 +13,4 @@

  roles:
    - common
-    - role: qemu-guest-agent
-      when: ansible_facts['virtualization_role'] == 'guest'
+    - qemu-guest-agent
@@ -0,0 +1,125 @@
+---
+# Configure NTP server on all Shelly devices
+# Discovers Shelly devices via network scan and configures them to use local NTP server
+#
+# Usage:
+#   ansible-playbook plays/configure-shelly-ntp.yml
+#   ansible-playbook plays/configure-shelly-ntp.yml -e "shelly_ntp_server=10.2.40.4"
+#   ansible-playbook plays/configure-shelly-ntp.yml -e "shelly_networks=10.2.30.0/24,10.2.20.0/24"
+
+- name: Configure Shelly NTP Settings
+  hosts: localhost
+  connection: local
+  gather_facts: no
+
+  vars:
+    shelly_ntp_server: "ntp.renner.uno"
+    shelly_networks: "10.2.30.0/24 10.2.20.0/24"
+    shelly_timeout: 5
+
+  tasks:
+    - name: Discover Shelly devices on network
+      script: "{{ playbook_dir }}/../files/discover_shelly.py {{ shelly_networks }}"
+      args:
+        executable: python3
+      register: discovered_devices
+      changed_when: false
+
+    - name: Parse discovered devices
+      set_fact:
+        shelly_devices: "{{ discovered_devices.stdout | from_json }}"
+
+    - name: Display discovered Shelly devices
+      debug:
+        msg: "Found {{ shelly_devices | length }} Shelly devices"
+
+    - name: Show device list
+      debug:
+        msg: "{{ item.name }} ({{ item.type }}) - {{ item.ip }} - Gen{{ item.gen }}"
+      loop: "{{ shelly_devices }}"
+      when: shelly_devices | length > 0
+
+    - name: Configure NTP on Gen1 devices
+      uri:
+        url: "http://{{ item.ip }}/settings?sntp_server={{ shelly_ntp_server }}"
+        method: GET
+        timeout: "{{ shelly_timeout }}"
+        return_content: yes
+      loop: "{{ shelly_devices | selectattr('gen', 'equalto', 1) | list }}"
+      register: gen1_results
+      ignore_errors: yes
+      when: shelly_devices | length > 0
+
+    - name: Configure NTP on Gen2+ devices
+      uri:
+        url: "http://{{ item.ip }}/rpc/Sys.SetConfig"
+        method: POST
+        body_format: json
+        body:
+          config:
+            sntp:
+              server: "{{ shelly_ntp_server }}"
+        timeout: "{{ shelly_timeout }}"
+        return_content: yes
+      loop: "{{ shelly_devices | selectattr('gen', 'greaterthan', 1) | list }}"
+      register: gen2_results
+      ignore_errors: yes
+      when: shelly_devices | length > 0
+
+    - name: Verify Gen1 NTP configuration
+      uri:
+        url: "http://{{ item.ip }}/settings"
+        method: GET
+        timeout: "{{ shelly_timeout }}"
+        return_content: yes
+      loop: "{{ shelly_devices | selectattr('gen', 'equalto', 1) | list }}"
+      register: gen1_verify
+      ignore_errors: yes
+      when: shelly_devices | length > 0
+
+    - name: Verify Gen2+ NTP configuration
+      uri:
+        url: "http://{{ item.ip }}/rpc/Sys.GetConfig"
+        method: GET
+        timeout: "{{ shelly_timeout }}"
+        return_content: yes
+      loop: "{{ shelly_devices | selectattr('gen', 'greaterthan', 1) | list }}"
+      register: gen2_verify
+      ignore_errors: yes
+      when: shelly_devices | length > 0
+
+    - name: Summary - Gen1 devices configured
+      debug:
+        msg: "{{ item.item.name }} ({{ item.item.ip }}): NTP={{ item.json.sntp.server | default('unknown') }}"
+      loop: "{{ gen1_verify.results | default([]) }}"
+      when:
+        - gen1_verify is defined
+        - gen1_verify.results is defined
+        - item.json is defined
+        - item.json.sntp is defined
+      loop_control:
+        label: "{{ item.item.name | default(item.item.ip) }}"
+
+    - name: Summary - Gen2+ devices configured
+      debug:
+        msg: "{{ item.item.name }} ({{ item.item.ip }}): NTP={{ item.json.sntp.server | default('unknown') }}"
+      loop: "{{ gen2_verify.results | default([]) }}"
+      when:
+        - gen2_verify is defined
+        - gen2_verify.results is defined
+        - item.json is defined
+        - item.json.sntp is defined
+      loop_control:
+        label: "{{ item.item.name | default(item.item.ip) }}"
+
+    - name: Final summary
+      debug:
+        msg: |
+          ==========================================
+          Shelly NTP Configuration Complete
+          ==========================================
+          Total devices found: {{ shelly_devices | length }}
+          Gen1 devices: {{ shelly_devices | selectattr('gen', 'equalto', 1) | list | length }}
+          Gen2+ devices: {{ shelly_devices | selectattr('gen', 'greaterthan', 1) | list | length }}
+          NTP Server: {{ shelly_ntp_server }}
+          ==========================================
@@ -1,23 +0,0 @@
---
-# Trust the OpenBao SSH user CA (ssh-client-signer) on the hosts in [ssh_ca]:
-# owner certificates (principal k.renner) for root/ladmin, Claude's 1h
-# certificates (principal claude-bot) for its own claude-bot account with
-# limited sudo. The role reports the admin logins' authorized_keys; on
-# [ssh_keys_managed] they are then reduced to ssh_admin_authorized_keys.
-#
-# serial: 1 so a host whose sshd rejects the change stops the run before the
-# next host is touched. One play, so each host needs one login (one YubiKey
-# PIN from a workstation).
- name: Configure the SSH user CA
-  hosts: ssh_ca
-  become: true
-  gather_facts: true
-  serial: 1
-  roles:
-    - ssh-ca
-  tasks:
-    - name: Reduce authorized_keys to the break-glass key
-      ansible.builtin.include_role:
-        name: ssh-ca
-        tasks_from: authorized_keys
-      when: inventory_hostname in groups['ssh_keys_managed']
@@ -0,0 +1,48 @@
+---
+- name: Deploy authorized SSH keys to all hosts
+  hosts: all:!localhost
+  become: true
+  gather_facts: false
+  # Authorized keys deployed to root and ladmin on every managed host.
+  #
+  # - krenner@fortress (human): unrestricted.
+  # - woodpecker-ci@homelab (CI): restricted with from= to the cluster's pod
+  #   network (ci_ssh_from_cidrs in group_vars/all/vars.yml). The in-cluster
+  #   Woodpecker step pods SSH to fleet hosts presenting their POD IP as source
+  #   (Cilium native-routing-cidr covers the LAN, so no SNAT; PodCIDRs are
+  #   BGP-advertised). This is a network-of-origin restriction, NOT host-pinned,
+  #   so it survives node DHCP churn and pod rescheduling. See vars.yml for the
+  #   full derivation.
+  # - ansible-runner@ci-new: removed — dead key, no such host exists.
+  vars:
+    authorized_keys:
+      - key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPzFNBP3bq2m/6JqDqod9w+FP/uxXxHMolqhq3Ojflr1 krenner@fortress"
+      - key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyNnX1I4W9jyDvCJ1DJauHSmbo1ZXSyBxVhSAwMWgen woodpecker-ci@homelab"
+        options: 'from="{{ ci_ssh_from_cidrs }}"'
+  tasks:
+    - name: Check SSH connectivity
+      ansible.builtin.wait_for_connection:
+        timeout: 5
+      ignore_errors: true
+      register: ssh_check
+
+    - name: Skip unreachable hosts
+      ansible.builtin.meta: end_host
+      when: ssh_check is failed
+
+    - name: Deploy authorized keys to root
+      ansible.builtin.authorized_key:
+        user: root
+        key: "{{ item.key }}"
+        key_options: "{{ item.options | default(omit) }}"
+        state: present
+      loop: "{{ authorized_keys }}"
+
+    - name: Deploy authorized keys to ladmin
+      ansible.builtin.authorized_key:
+        user: ladmin
+        key: "{{ item.key }}"
+        key_options: "{{ item.options | default(omit) }}"
+        state: present
+      loop: "{{ authorized_keys }}"
+      ignore_errors: true
@@ -1,15 +0,0 @@
---
-# sshd on the hosts in [ssh_mesh_only] accepts connections only on the NetBird
-# interface; nothing listens on their public addresses. Run from a workstation
-# in the mesh. A switchover reverts by itself unless the play logs in again
-# through the new listener.
-#
-# serial: 1 so a host that does not come back stops the run before the next
-# host is touched.
- name: Restrict sshd to the mesh interface
-  hosts: ssh_mesh_only
-  become: true
-  gather_facts: true
-  serial: 1
-  roles:
-    - ssh-mesh-only
@@ -1,19 +0,0 @@
---
-# Ansible needs Python >= 3.9 on the target; DSM ships 3.8. Synology's
-# Python3.9 package installs beside it. raw, because the modules cannot run
-# before it is there; raw is skipped in check mode.
- name: Install Python 3.9 on the Synology NAS
-  hosts: synology_nas
-  become: true
-  gather_facts: false
-  tasks:
-    - name: Install the Python3.9 package
-      ansible.builtin.raw: >-
-        if [ -x {{ ansible_python_interpreter }} ]; then echo present;
-        else /usr/syno/bin/synopkg install_from_server Python3.9; fi
-      register: synology_python_install
-      changed_when: "'present' not in synology_python_install.stdout"
-
-    - name: Check the interpreter exists
-      ansible.builtin.raw: test -x {{ ansible_python_interpreter }}
-      changed_when: false
@@ -0,0 +1,68 @@
+---
+# Configure VMs to use host time sync via kvm-clock
+# Disables systemd-timesyncd to prevent NTP conflicts
+#
+# VMs get time from Proxmox host via kvm-clock paravirtualized clock
+# This is more accurate and reliable than network NTP for VMs
+
+- name: Configure VM time synchronization from host
+  hosts: all
+  become: yes
+  gather_facts: yes
+
+  tasks:
+    - name: Check if running as VM (not LXC)
+      stat:
+        path: /sys/devices/system/clocksource/clocksource0/current_clocksource
+      register: clocksource_file
+
+    - name: Get current clock source
+      slurp:
+        src: /sys/devices/system/clocksource/clocksource0/current_clocksource
+      register: clocksource
+      when: clocksource_file.stat.exists
+
+    - name: Display clock source
+      debug:
+        msg: "Clock source: {{ (clocksource.content | b64decode | trim) if clocksource_file.stat.exists else 'N/A (LXC)' }}"
+
+    - name: Check if systemd-timesyncd is installed
+      command: systemctl list-unit-files systemd-timesyncd.service
+      register: timesyncd_installed
+      failed_when: false
+      changed_when: false
+
+    - name: Stop and disable systemd-timesyncd on VMs using kvm-clock
+      systemd:
+        name: systemd-timesyncd
+        state: stopped
+        enabled: no
+      when:
+        - clocksource_file.stat.exists
+        - clocksource.content is defined
+        - "'kvm-clock' in (clocksource.content | b64decode)"
+        - "'systemd-timesyncd.service' in timesyncd_installed.stdout"
+
+    - name: Mask systemd-timesyncd to prevent re-enabling
+      systemd:
+        name: systemd-timesyncd
+        masked: yes
+      when:
+        - clocksource_file.stat.exists
+        - clocksource.content is defined
+        - "'kvm-clock' in (clocksource.content | b64decode)"
+        - "'systemd-timesyncd.service' in timesyncd_installed.stdout"
+
+    - name: Verify time sync status
+      command: timedatectl show --property=NTPSynchronized
+      register: timesync_status
+      changed_when: false
+      failed_when: false
+
+    - name: Display final status
+      debug:
+        msg: |
+          Host: {{ inventory_hostname }}
+          Type: {{ 'VM (kvm-clock)' if (clocksource_file.stat.exists and 'kvm-clock' in (clocksource.content | b64decode | default(''))) else 'LXC/Other' }}
+          Time sync: {{ timesync_status.stdout | default('unknown') }}
+          Note: VMs sync time from Proxmox host, LXCs inherit host time automatically
@@ -0,0 +1,33 @@
+---
+# Local MQTT bridge and its credential receiver only (REN-1307). Run by
+# .woodpecker/deploy-edge-mqtt-bridge.yml on merge, so a change to this role
+# reaches edge-1 without a play run by hand. The full base play
+# (install-edge-host.yml) carries the same role.
+- name: Converge the edge MQTT bridge
+  hosts: edge_host
+  become: true
+
+  # The SML power-meter reader (sml2mqtt) is retired for good: owner decision
+  # 2026-09-19, grid data comes from the E380 on the CAN bus. Its role and
+  # play are gone; this removes the leftover compose project from edge-1 on
+  # the next pipeline run. Idempotent: a no-op once the directory is gone.
+  pre_tasks:
+    - name: Check for the retired sml2mqtt compose project
+      ansible.builtin.stat:
+        path: /opt/edge-host/sml2mqtt/docker-compose.yml
+      register: edge_sml2mqtt_compose
+
+    - name: Stop the retired sml2mqtt container
+      ansible.builtin.command:
+        cmd: docker compose down --remove-orphans
+        chdir: /opt/edge-host/sml2mqtt
+      when: edge_sml2mqtt_compose.stat.exists
+      changed_when: true
+
+    - name: Remove the retired sml2mqtt directory
+      ansible.builtin.file:
+        path: /opt/edge-host/sml2mqtt
+        state: absent
+
+  roles:
+    - mqtt-bridge
@@ -0,0 +1,20 @@
+---
+# Off-site Debian VM running Claude Code — reattachable interactive sessions
+# plus an unattended notes-distill timer. Host creation (Synology VMM), the
+# Netbird dashboard route and secret material are manual prerequisites; see
+# roles/claude-workstation/README.md and docs/claude-workstation.md.
+#
+# CI reaches this off-site host over the site-to-site tunnel (home -> off-site
+# works), same as it reaches every other inventory host.
+
+- name: Deploy the Claude Code workstation
+  hosts: claude_workstation
+  become: true
+  # qemu-guest-agent is applied
+  # to every inventory host by the umbrella plays/common.yml, same as for the
+  # netbird-proxy host — run that against this host too (see RUNBOOK Step 5).
+  roles:
+    - common
+    - role: netbird-client       # mesh enrolment (needs netbird_setup_key in vault)
+      when: netbird_setup_key is defined
+    - claude-workstation
@@ -8,6 +8,7 @@
 # their own inventory groups:
 #
 #   plays/install-zwave-gateway.yml   [zwave_gateway]   ZWA-2 radio
+#   plays/install-heating-can.yml     [heating_can]     Innomaker USB2CAN
 #
 # Splitting the roles without splitting the plays would have kept the coupling:
 # one play applying every role to one group is the monolith again, a layer up.
@@ -30,96 +31,11 @@
  # do not silently depend on the connection user staying privileged.
  become: true

-  # The Viessmann E3 CAN bus is read by vitocal-can (open3e-esp32 at the
-  # Vitocal), which publishes to the cluster broker itself, not by an edge
-  # host. These remove the former heating-can stack, the can0 configuration
-  # and the open3e MQTT bridge (loopback mosquitto + edge-mqtt-cred); each is
-  # a no-op where they are absent.
-  pre_tasks:
-    - name: Read the service list
-      ansible.builtin.service_facts:
-
-    - name: Stop and disable the retired MQTT bridge services
-      ansible.builtin.systemd:
-        name: "{{ item }}"
-        state: stopped
-        enabled: false
-      loop:
-        - edge-mqtt-cred
-        - mosquitto
-      when: (item ~ '.service') in ansible_facts.services
-
-    - name: Remove the retired MQTT bridge files
-      ansible.builtin.file:
-        path: "{{ item }}"
-        state: absent
-      loop:
-        - /etc/systemd/system/edge-mqtt-cred.service
-        - /usr/local/sbin/edge-mqtt-cred
-        - /etc/edge-mqtt-cred
-        - /etc/mosquitto
-      register: edge_mqtt_bridge_files
-
-    - name: Reload systemd without the edge-mqtt-cred unit
-      ansible.builtin.systemd:
-        daemon_reload: true
-      when: edge_mqtt_bridge_files.changed
-
-    - name: Uninstall mosquitto
-      ansible.builtin.package:
-        name: mosquitto
-        state: absent
-
-    - name: Check for the retired heating-can compose project
-      ansible.builtin.stat:
-        path: /opt/edge-host/heating-can/docker-compose.yml
-      register: edge_heating_can_compose
-
-    - name: Stop and remove the retired heating-can containers and image
-      ansible.builtin.command:
-        cmd: docker compose down --remove-orphans --rmi all
-        chdir: /opt/edge-host/heating-can
-      when: edge_heating_can_compose.stat.exists
-      changed_when: true
-
-    - name: Remove the retired heating-can directory
-      ansible.builtin.file:
-        path: /opt/edge-host/heating-can
-        state: absent
-
-    - name: Remove the can0 networkd configuration
-      ansible.builtin.file:
-        path: /etc/systemd/network/80-can0.network
-        state: absent
-      register: edge_can0_network
-
-    - name: Reload networkd without the can0 configuration
-      ansible.builtin.command:
-        cmd: networkctl reload
-      when: edge_can0_network.changed
-      changed_when: true
-
-    - name: Read the can0 link flags
-      ansible.builtin.command:
-        cmd: ip -o link show can0
-      register: edge_can0_link
-      check_mode: false
-      changed_when: false
-      failed_when: false
-
-    - name: Take can0 down
-      ansible.builtin.command:
-        cmd: ip link set can0 down
-      when:
-        - edge_can0_link.rc == 0
-        - edge_can0_link.stdout is search('[<,]UP[,>]')
-      changed_when: true
-
  roles:
    - certificates
    - common
-    - pacman-cache
    - edge-flash-wear
    - docker-install
    - edge-log-shipper
+    - mqtt-bridge
    - edge-vlan
@@ -0,0 +1,18 @@
+---
+# Heating system over the Viessmann E3 CAN bus, for hosts with the Innomaker
+# USB2CAN adapter attached.
+#
+# Targets [heating_can]: membership means the adapter is physically present.
+# Two roles because they are two concerns -- the interface is host network
+# state, the services consume it -- but one group, because both need the same
+# hardware.
+#
+# Requires the base play (plays/install-edge-host.yml) to have run: these
+# services publish to the local MQTT bridge it sets up.
+- name: Install heating CAN services
+  hosts: heating_can
+  become: true
+
+  roles:
+    - socketcan
+    - heating-can
@@ -6,25 +6,26 @@
 #   - host_vars/<hostname>/vars.yml - per-host key (overrides group)
 #   - group_vars/all/vault.yml - encrypted keys
 #
-# Applied by site.yml.
+# Usage:
+#   ansible-playbook -i inventory/ plays/setup-netbird-client.yml
+#
+# Limit to specific hosts:
+#   ansible-playbook -i inventory/ plays/setup-netbird-client.yml --limit caddy_servers

 - name: Install NetBird client on hosts with setup key defined
  hosts: all
  become: true
-  # One host at a time: from a workstation every new SSH session asks for the
-  # YubiKey PIN and a touch, and parallel hosts would prompt at once.
-  serial: 1
-  # Facts only after the skip: gathering them first opens an SSH session (a
-  # YubiKey touch from a workstation) to every host, including skipped ones.
-  gather_facts: false
+  gather_facts: true

  pre_tasks:
+    - name: Check if netbird_setup_key is defined
+      ansible.builtin.debug:
+        msg: "NetBird setup key is defined for {{ inventory_hostname }}"
+      when: netbird_setup_key is defined
+
    - name: Skip hosts without netbird_setup_key
      ansible.builtin.meta: end_host
      when: netbird_setup_key is not defined

-    - name: Gather facts
-      ansible.builtin.setup:
-
  roles:
    - netbird-client
@@ -1,6 +1,6 @@
 ---
 # Deploy the NetBird reverse-proxy HA cluster members (the public edge).
-# Applied by site.yml.
+# Usage: ansible-playbook -i inventory/ plays/install-netbird-proxy.yml
 #
 # Prerequisites:
 # - Proxy VPS provisioned (proxy-1 is Arch Linux), root SSH reachable, and
@@ -22,7 +22,6 @@
  become: true
  roles:
    - common
-    - timesyncd
    - docker-install
    - netbird-proxy
    - netbird-proxy-watchdog
@@ -1,6 +1,6 @@
 ---
 # Deploy NetBird Server to VPS
-# Applied by site.yml.
+# Usage: ansible-playbook -i inventory/ plays/install-netbird-server.yml
 #
 # Prerequisites:
 # - VPS provisioned with Ubuntu 22.04/24.04
@@ -16,6 +16,5 @@
  become: true
  roles:
    - common
-    - timesyncd
    - docker-install
    - netbird-server
@@ -0,0 +1,22 @@
+---
+# Install Node Exporter on all managed hosts
+# Usage: ansible-playbook -i inventory/ plays/install-node-exporter.yml
+
+- name: Install Node Exporter
+  hosts: all
+  become: yes
+  gather_facts: yes
+
+  roles:
+    - node-exporter
+
+  post_tasks:
+    - name: Verify node-exporter is running
+      uri:
+        url: "http://127.0.0.1:9100/metrics"
+        status_code: 200
+      register: exporter_health
+      retries: 3
+      delay: 5
+      until: exporter_health.status == 200
+      ignore_errors: yes
@@ -62,7 +62,7 @@
  # One node at a time. The keepalived role withdraws the statically assigned
  # IPv6 service address and restarts keepalived so the address is re-taken
  # under VRRP control; doing that across every NTP server at once would leave
-  # the whole fleet with nobody holding the service address until the elections settle.
+  # the whole fleet with nobody holding fd40::123 until the elections settle.
  # Serialised, the remaining members keep answering throughout.
  serial: 1

@@ -83,9 +83,6 @@
      edge-1.iot.renner.uno:
        priority: 70
        state: "BACKUP"
-      edge-2.iot.renner.uno:
-        priority: 60
-        state: "BACKUP"

  roles:
    - role: chrony-ntp-server
@@ -105,45 +102,32 @@
      ansible.builtin.pause:
        seconds: 5

-    - name: Verify chronyd answers
-      ansible.builtin.command:
-        argv:
-          - chronyc
-          - -n
-          - tracking
-      check_mode: false
+    - name: Verify chrony is serving NTP
+      ansible.builtin.shell: chronyc clients | head -10
+      register: chrony_clients
      changed_when: false

-    - name: Verify chronyd listens on udp/123
-      ansible.builtin.command:
-        argv:
-          - ss
-          - -Hlunp
-          - sport = :123
+    - name: Check NTP port is listening
+      ansible.builtin.shell: ss -lun | grep ':123 '
      register: ntp_port
-      check_mode: false
+      failed_when: false
      changed_when: false
-      failed_when: "'chronyd' not in ntp_port.stdout"
+
+    - name: Display NTP port status
+      ansible.builtin.debug:
+        msg: "NTP port 123: {{ 'LISTENING' if ntp_port.rc == 0 else 'NOT LISTENING' }}"

    - name: Check if this server has the VIP
-      ansible.builtin.command:
-        argv:
-          - ip
-          - -4
-          - addr
-          - show
-          - to
-          - "{{ ntp_vip }}"
+      ansible.builtin.shell: ip addr show | grep {{ ntp_vip }}
      register: vip_check
-      check_mode: false
-      failed_when: vip_check.rc != 0
+      failed_when: false
      changed_when: false
      when: ntp_keepalived_enabled | default(false)

    - name: Display VIP status
      ansible.builtin.debug:
        msg: >
-          {% if vip_check.stdout | default('') | length > 0 %}
+          {% if vip_check.rc == 0 %}
          This server ({{ inventory_hostname }}) is MASTER and holds the VIP {{ ntp_vip }}
          {% else %}
          This server ({{ inventory_hostname }}) is BACKUP
@@ -175,8 +159,7 @@
          - to
          - "{{ ntp_vip6 }}"
      register: vip6_check
-      check_mode: false
-      failed_when: vip6_check.rc != 0
+      failed_when: false
      changed_when: false
      when: ntp_keepalived_enabled | default(false)

@@ -201,28 +184,18 @@
          (keepalived not enabled on this host).
      when: not (ntp_keepalived_enabled | default(false))

-    # chronyc talks to the command port, which is loopback-only; this is a real
-    # NTP query. Directives on the command line mean no config file and no
-    # pidfile, and -Q opens no server or command port, so it runs alongside
-    # the live daemon.
-    - name: Query NTP through the VIP (only on master)
-      ansible.builtin.command:
-        argv:
-          - chronyd
-          - -Q
-          - -t
-          - "10"
-          - "server {{ ntp_vip }} iburst maxsamples 1"
+    - name: Test NTP via VIP (only on master)
+      ansible.builtin.shell: |
+        chronyc -h {{ ntp_vip }} tracking 2>&1 || echo "Cannot connect to VIP (may need to wait for failover)"
      register: ntp_vip_test
-      check_mode: false
      when:
        - ntp_keepalived_enabled | default(false)
-        - vip_check.stdout | default('') | length > 0
+        - vip_check.rc == 0
      changed_when: false

    - name: Display VIP NTP test result
      ansible.builtin.debug:
-        msg: "{{ ntp_vip_test.stderr_lines + ntp_vip_test.stdout_lines }}"
+        msg: "{{ ntp_vip_test.stdout_lines | default(['Not master, skipping VIP test']) }}"
      when:
        - ntp_keepalived_enabled | default(false)
-        - vip_check.stdout | default('') | length > 0
+        - vip_check.rc == 0
@@ -1,14 +1,13 @@
 ---
 # Deploy Uptime Kuma to the NetBird VPS
-# Applied by site.yml.
+# Usage: ansible-playbook -i inventory/ plays/install-uptime-kuma.yml
 #
 # Prerequisites:
 # - netbird-server play applied (docker, Traefik on netbird_netbird)
 # - OpenBao homelab/infrastructure/uptime-kuma with keys username, password
 # - OpenBao homelab/infrastructure/uptime-kuma/smtp with keys server, port, username, token
 # - homelab/infrastructure/uptime-kuma-metrics (key api_key) is written by the role
-# - an OpenBao token with policy uptime-kuma-vps: `bao login -method=oidc`
-#   (role owner) or VAULT_TOKEN
+# - VAULT_TOKEN in the environment (policy: uptime-kuma-vps)
 # - DNS for kuma.renner.uno pointing at the VPS

 - name: Deploy Uptime Kuma
@@ -248,6 +248,3 @@
          - "Commit inventory/group_vars/all/netbird-rotatable.yml — it is encrypted."
          - "NOT rotated: datastore_key (needs dump/restore), auth_client_secret (Authentik side)."
          - "OpenBao is unaffected by design — its NetBird credentials are separate ones."
-
- name: Close the SSH connections
-  ansible.builtin.import_playbook: close-connections.yml
@@ -43,6 +43,7 @@
            - ubuntu_upgrade.rc != 0 
            - "'No new release found' not in ubuntu_upgrade.stdout"
            - "'No new release found' not in ubuntu_upgrade.stderr"
+          ignore_errors: true

        - name: Display Upgrade Result
          ansible.builtin.debug:
@@ -110,6 +111,3 @@
      when: 
        - (ansible_distribution == 'Ubuntu' and reboot_required.stat.exists) or
          (ansible_distribution == 'Debian')
-
- name: Close the SSH connections
-  ansible.builtin.import_playbook: close-connections.yml
@@ -1,7 +1,7 @@
 ---
 # Package upgrade + reboot for netbird_proxy, edge_host and netbird_server,
 # one host at a time.
-# Usage (from ansible/): ansible-playbook plays/update-os.yml
+# Usage: ansible-playbook -i inventory/ plays/update-os.yml
 #
 # Plays run in order; a failed host stops the whole run (max_fail_percentage: 0).

@@ -28,6 +28,3 @@
  become: true
  roles:
    - os-update
-
- name: Close the SSH connections
-  ansible.builtin.import_playbook: close-connections.yml
@@ -18,7 +18,6 @@
 - name: Get installed version
  command: "{{ chrony_exporter_binary }} --version"
  register: installed_version
-  check_mode: false
  when: chrony_exporter_installed.stat.exists
  changed_when: false
  failed_when: false
@@ -4,7 +4,7 @@
 # Networks allowed to use this server as NTP source.
 #
 # BOTH families are required. IPv6 is the primary address family here -- the
-# service address ntp.srv.renner.uno resolves to fd02:40::123 -- so an IPv4-only
+# service address ntp.srv.renner.uno resolves to fd40::123 -- so an IPv4-only
 # allow list refuses every client that uses the documented name.
 #
 # The hosts carried `allow fd00::/8` for a long time without it ever being in
@@ -0,0 +1,57 @@
+# claude-workstation
+
+An always-on, **off-site** headless Claude Code host (Debian 12 VM under Synology
+VMM on nas-2). It runs (a) reattachable interactive `tmux` sessions and (b) an
+unattended notes-distill timer. It deliberately holds the **least** privilege
+that still does the job.
+
+## What lives here vs. what's manual
+
+This role configures everything **inside** the VM. Three things are **manual**
+(no IaC path) and precede/accompany it — see [`RUNBOOK.md`](RUNBOOK.md) for the
+full step-by-step:
+
+1. **VM creation** in Synology VMM (`ladmin` has no sudo; the DSM API is
+   root-only), with a cloud-init drive that installs the CI SSH key.
+2. **Netbird dashboard route** advertising the k8s API to the mesh, and the
+   **site-to-site return route** on the off-site gateway (backup path).
+3. **Secret material**: `claude setup-token` (subscription OAuth), the claude-bot
+   creds, and the read-only SA kubeconfig — encrypted into the group vault.
+
+## Credential isolation
+
+Two Unix users with separate credential stores so an unattended job cannot read
+the interactive session's secrets:
+
+| User | Holds | Runs |
+|------|-------|------|
+| `claude` | OAuth token, claude-bot creds, **read-only** SA kubeconfig | interactive tmux |
+| `claude-job` | its **own** OAuth token, claude-bot creds (no kubeconfig) | notes-distill timer |
+
+**No talosconfig, no SOPS age key** ever land here (Fable review #1). The
+kubeconfig is a read-only `view` ServiceAccount (`kubernetes/apps/claude-workstation/`).
+
+## Egress lockdown (staged)
+
+`claude_ws_egress_enforce` ships **`false`** so a fresh host is never bricked.
+The deny-default nftables ruleset, the DNS-resolver, and its refresh timer are
+installed regardless. Flip to `true` (in host/group vars) only after confirming
+`claude_ws_egress_allow_fqdns` / `claude_ws_egress_allow_cidrs*` cover real
+traffic — watch the `claude-egress-dropped` counter first.
+
+## Vault keys (encrypt into `inventory/group_vars/claude_workstation/vault.yml`)
+
+```
+netbird_setup_key                  # from the Netbird dashboard
+claude_ws_oauth_token_interactive  # `claude setup-token` (interactive user)
+claude_ws_oauth_token_job          # `claude setup-token` (job user, separate)
+claude_ws_gitea_token              # claude-bot PAT
+claude_ws_gitea_git_credentials    # https://claude-bot:<pat>@gitea.renner.uno
+claude_ws_kubeconfig               # read-only SA kubeconfig (literal YAML)
+```
+
+## Kill switch
+
+Everything unattended hangs off systemd timers; `systemctl disable --now
+claude-notes-distill.timer` (and the egress refresh) stops it. Every credential
+is independently revocable (SA token, claude-bot PAT, OAuth token, Netbird peer).
@@ -0,0 +1,221 @@
+# Runbook — off-site Claude Code workstation (nas-2)
+
+Operator guide for the manual steps around the `claude-workstation` role. The
+role automates everything **inside** the VM; this covers what it can't:
+VM creation, networking, secret material, egress cutover, rotation and DR.
+
+## Architecture (scope)
+
+An always-on **Debian 13 VM under Synology VMM on the off-site nas-2**
+(DS1522+, 10.3.40.0/24, reached over the site-to-site VPN, ~55 ms). It runs:
+
+- **Reattachable interactive sessions** (`tmux` over SSH as user `claude`).
+- **Unattended notes-distill timer** (as user `claude-job`).
+- **A thin is-home-up signal** (the existing external Gatus on the Netbird VPS
+  already covers this — don't duplicate it).
+
+**Out of scope (runs in-cluster instead):** scheduled repo-automation and
+cluster-reports go in as Woodpecker cron / CronJobs with an in-cluster
+ServiceAccount — *not* on this VM, so the VM holds no cluster-write creds.
+
+Credentials on the VM are minimal: a **read-only** `view` SA kubeconfig,
+claude-bot (non-admin) gitea creds, and a Claude subscription OAuth token.
+**No talosconfig, no SOPS age key.**
+
+---
+
+## Step 1 — Create + install the VM (Synology VMM)
+
+`ladmin` has no sudo and the DSM API is root-only, so VMM is driven through the
+DSM **web UI**. Two hard facts dictate the method (all confirmed 2026-07-16, as
+built): **VMM has no cloud-init**, and its ISO-install wizard only creates blank
+disks. So the OS is installed from a **remastered Debian netinst ISO that
+auto-boots a preseed** — no console interaction, no boot-menu race.
+
+VMM gotchas that shape this (see the wiki build-record):
+- VMM refuses to change/unmount a VM's ISO while it is **running** ("Failed to
+  replace ISO files"). Do all ISO/boot-device edits with the VM **off**.
+- A **guest reboot does not re-read** VMM's boot-device/ISO config — only a full
+  VMM power-cycle applies it. So an auto-booting install ISO **loops** (reboot →
+  CD → reinstall, wiping the disk). Break it by preseeding the installer to
+  **power off** at the end: `d-i debian-installer/exit/poweroff boolean true`.
+- Attach the NIC to the **untagged `Default VM Network`** — the VLAN-40
+  `40_Server` network is isolated (no DHCP, no network). The LAN has DHCP.
+
+Procedure (build the ISO on a host with `xorriso`):
+1. Download the current Debian **netinst** (`.../debian-cd/current/amd64/iso-cd/`).
+2. Remaster it — add `/preseed.cfg` and replace `/isolinux/isolinux.cfg` with a
+   minimal one (`default preseed`, `timeout 1`, one label:
+   `kernel /install.amd/vmlinuz` /
+   `append auto=true priority=critical preseed/file=/cdrom/preseed.cfg vga=788 initrd=/install.amd/initrd.gz --- quiet`):
+   `xorriso -indev in.iso -outdev out.iso -boot_image any replay -map preseed.cfg /preseed.cfg -map isolinux.cfg /isolinux/isolinux.cfg`.
+   The preseed uses **DHCP** (`netcfg/dhcp_timeout 120` — the virtual-switch port
+   is slow to link), disk **`/dev/sda`** (VirtIO SCSI), **no user** + a locked
+   random root hash (key-only via `PermitRootLogin prohibit-password`), packages
+   `openssh-server sudo qemu-guest-agent python3`, and a `late_command` that
+   injects the SSH keys (`krenner@fortress`, `woodpecker-ci@homelab`, your
+   workstation key) into `/root/.ssh/authorized_keys`, plus the `poweroff` line.
+3. Upload to nas-2 via `ssh 'cat > /volume1/Install/<iso>' < <iso>` — **scp /
+   sftp / rsync are blocked on DSM**. Then VMM → Image → Add → From Synology NAS
+   → import (VMM **copies** it; re-import if you change the source file).
+4. Create VM: 2 vCPU, 4 GB, 50 GB on `/volume1`, **Default VM Network**, Legacy
+   BIOS, **Autostart: Yes**; attach the ISO, **Boot from DVD/CD-ROM**, power on.
+5. It installs unattended and **powers off**. Then (VM off) set **ISO =
+   Unmounted**, **Boot from = Virtual Disk**, power on → boots the installed
+   Debian. `qemu-guest-agent` reports the DHCP lease in VMM's IP column.
+6. **Pin a DSM update window** (Control Panel → Update & Restore) so an
+   auto-reboot doesn't kill tmux/jobs.
+
+> As built 2026-07-16: Debian 13 (trixie), got DHCP `10.3.40.78`, all three keys
+> injected, packages present. Freeing RAM required powering off the pre-existing
+> `pbs1` PBS VM (kept its 3.4 TB backup disk).
+
+> **At-rest encryption (Fable #6).** Off-site physical custody is weaker than
+> home. For true at-rest protection of the VM's secrets *with* unattended
+> autostart, use **network-bound decryption** (clevis + a Tang server at home):
+> a stolen disk off-site can't unlock because it can't reach Tang. Full-disk
+> LUKS with a manual passphrase would break autostart. Until Tang is stood up,
+> secrets rely on 0600 perms + VM access control — documented gap, not a fix.
+
+---
+
+## Step 2 — Networking (two paths)
+
+**Netbird mesh (done via CI):** mint a setup key in the dashboard
+(`https://netbird.renner.uno`), vault it as `netbird_setup_key` under
+`group_vars/claude_workstation/`, and run `.woodpecker/deploy-netbird-client.yml`
+(`install-netbird-client.yml --limit claude_workstation`). As built 2026-07-16
+the VM enrolled as `claude-ws-190-112.nb.renner.uno` / `100.96.190.112` (+ IPv6).
+
+> **Mesh reachability caveat.** The mesh IP (`100.96.x`) is only reachable from
+> **other Netbird peers**. The home workstation and the Woodpecker CI agent are
+> **not** peers — they reach the VM only via the site-to-site tunnel at its DHCP
+> lease. So a *stable* mesh-based `ansible_host` needs CI (or a home host) on the
+> mesh first, or a Netbird routing peer bridging tunnel↔mesh. Until then the
+> inventory targets the tunnel DHCP IP.
+
+> **DNS trap.** `claude-ws.obg.renner.uno` resolves to the VM's lease **only at
+> the off-site DNS** (`@10.3.40.1`). From home this FQDN does not resolve (it
+> exists only at the off-site DNS @10.3.40.1). Never use it as `ansible_host`.
+
+**Optional — mesh route to the k8s API (redundant read path):** to reach the API
+over the mesh too, add a Netbird dashboard **network route** advertising the
+apiserver's ClusterIP to the `netbird-ingress` peer group, and add an egress
+rule to the `netbird-ingress-egress` CiliumNetworkPolicy
+(`kubernetes/infrastructure/network-policies/ingress-isolation.yaml`) permitting
+`app: netbird-ingress` pods to reach `kube-apiserver:443`. Deferred from this PR
+because it edits a security-critical CNP that can't be validated offline — do it
+as a follow-up when you want the redundant API path.
+
+---
+
+## Step 3 — Read-only SA kubeconfig
+
+After the `kubernetes/apps/claude-workstation/` PR merges and Flux reconciles:
+
+```sh
+NS=apps
+TOKEN=$(kubectl -n $NS get secret claude-workstation-token -o jsonpath='{.data.token}' | base64 -d)
+kubectl -n $NS get secret claude-workstation-token -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt
+# server = the cluster's stable API endpoint (kubernetes/talos/patches/cluster.yaml).
+# Use the name, not an address: it is what the API server certificate carries as a
+# SAN, so an IP here fails TLS verification even when it is reachable. It must
+# resolve from the workstation over the site-to-site route.
+kubectl config set-cluster homelab --server=https://k8s.renner.uno:6443 \
+  --certificate-authority=/tmp/ca.crt --embed-certs=true --kubeconfig=/tmp/claude-ws.kubeconfig
+kubectl config set-credentials claude-workstation --token="$TOKEN" --kubeconfig=/tmp/claude-ws.kubeconfig
+kubectl config set-context homelab --cluster=homelab --user=claude-workstation --kubeconfig=/tmp/claude-ws.kubeconfig
+kubectl config use-context homelab --kubeconfig=/tmp/claude-ws.kubeconfig
+# verify read-only:
+KUBECONFIG=/tmp/claude-ws.kubeconfig kubectl get nodes        # works
+KUBECONFIG=/tmp/claude-ws.kubeconfig kubectl get secrets -A   # Forbidden (view excludes secrets)
+```
+
+The resulting file becomes the `claude_ws_kubeconfig` vault value.
+
+---
+
+## Step 4 — Secret material → vault
+
+```sh
+# Two independent OAuth tokens so job jobs can't impersonate the interactive user:
+claude setup-token   # -> claude_ws_oauth_token_interactive
+claude setup-token   # -> claude_ws_oauth_token_job  (run again / separate session)
+```
+
+Encrypt into `ansible/inventory/group_vars/claude_workstation/vault.yml`
+(ansible-vault; same VAULT_PASS the CI uses):
+
+```yaml
+netbird_setup_key: "..."
+claude_ws_oauth_token_interactive: "..."
+claude_ws_oauth_token_job: "..."
+claude_ws_gitea_token: "..."                # claude-bot PAT
+claude_ws_gitea_git_credentials: "https://claude-bot:<PAT>@gitea.renner.uno"
+claude_ws_kubeconfig: |
+  apiVersion: v1
+  ...                                        # the file from Step 3
+```
+
+> **Never run `claude` with `--bare`** here or on the VM — bare mode silently
+> ignores `CLAUDE_CODE_OAUTH_TOKEN` and the jobs will fail auth.
+
+---
+
+## Step 5 — Deploy
+
+Merge the PR, then trigger the pipeline (Woodpecker → Run → `PIPELINE ==
+"deploy-claude-workstation"`), or push a change under the role's paths. CI SSHes
+to `10.3.40.60` over the tunnel and applies `common`, `netbird-client`, and this
+role. Also run the umbrella `plays/common.yml` against the new host once, so it
+picks up `qemu-guest-agent` like every other inventory host.
+
+---
+
+## Step 6 — Egress cutover (staged)
+
+The nftables allowlist ships **disabled**. To enforce:
+
+1. Leave it off for a few days; watch what the box actually talks to.
+2. Confirm `claude_ws_egress_allow_fqdns` + `claude_ws_egress_allow_cidrs*`
+   (home Prometheus/Loki/API) cover it.
+3. Set `claude_ws_egress_enforce: true` in host/group vars, redeploy.
+4. Watch the `claude-egress-dropped` nft counter (`nft list ruleset`) and Loki
+   for anything legitimate being dropped; widen the allowlist as needed.
+
+---
+
+## Step 7 — Notes (Syncthing pairing)
+
+The role installs Syncthing for `claude-job` and starts
+`syncthing@claude-job`. Pair it once (manual): from the VM's GUI (SSH tunnel to
+`127.0.0.1:8384`) add your existing vault's device ID and accept the shared
+`Notes` folder pointed at `{{ claude_ws_notes_dir }}`. The distill timer runs
+daily at 04:30 and only ever **creates** new atomic notes.
+
+---
+
+## Rotation
+
+- **OAuth token** (expires/can be revoked): re-run `claude setup-token` on your
+  laptop, update the two vault keys, redeploy. Headless auth failures surface in
+  Loki (the wrapper logs `result=failure`) — don't let them go quiet.
+- **claude-bot PAT**: rotate in Gitea, update `claude_ws_gitea_*`, redeploy.
+- **SA token**: `kubectl -n apps delete secret claude-workstation-token` (Flux
+  recreates it), re-assemble the kubeconfig (Step 3), update vault, redeploy.
+
+## Kill switch
+
+```sh
+systemctl disable --now claude-notes-distill.timer claude-egress-refresh.timer
+```
+
+Every credential is independently revocable: delete the SA, revoke the PAT,
+revoke the OAuth token, or remove the Netbird peer — no shared blast radius.
+
+## Disaster recovery (cattle, not pet)
+
+The VM holds no unique state — the only real state is the Notes replica, which
+re-syncs from Syncthing. To rebuild: redo **Step 1** (VM + cloud-init), then
+**Step 5** (pipeline). No VMM snapshots needed (they'd bloat the 86%-full
+`/volume1`).
@@ -0,0 +1,68 @@
+---
+# claude-workstation role defaults
+#
+# An always-on headless host that runs Claude Code for (a) reattachable
+# interactive sessions and (b) unattended notes/wiki timers. It deliberately
+# holds the LEAST privilege that still lets it do its job: a read-only k8s
+# ServiceAccount kubeconfig, claude-bot (non-admin) gitea creds, and a Claude
+# subscription OAuth token — NO talosconfig and NO SOPS age key. See README.
+
+# --- Users -----------------------------------------------------------------
+# Two Unix users with separate credential stores so an unattended (timer) job
+# cannot read the interactive session's OAuth token / kube / gitea creds.
+claude_ws_interactive_user: claude          # human tmux sessions
+claude_ws_job_user: claude-job              # unattended systemd-timer jobs
+
+claude_ws_base_dir: /opt/claude-workstation
+
+# --- Toolchain -------------------------------------------------------------
+claude_ws_node_major: 22                     # matches the ci-claude image
+claude_ws_claude_code_pkg: "@anthropic-ai/claude-code"
+claude_ws_base_packages:
+  - git
+  - tmux
+  - jq
+  - curl
+  - ca-certificates
+  - ripgrep
+  - unzip
+  - nftables
+  - python3
+  - python3-venv
+
+# --- Egress allowlist ------------------------------------------------------
+# Deny-default OUTPUT is the target end-state, but it can brick a fresh host if
+# an allowed destination is missed, so it ships DISABLED and is tightened after
+# observing real egress (staged rollout). Flip claude_ws_egress_enforce to true
+# once the allowlist below is confirmed complete. See templates/nftables.conf.j2.
+claude_ws_egress_enforce: false
+# Static destinations the host must always reach. CDN-backed hosts (Anthropic,
+# npm, apt) are matched by name at apply time via the fqdn set; home services
+# are matched by IP. Tune in host_vars.
+claude_ws_egress_allow_fqdns:
+  - api.anthropic.com
+  - statsig.anthropic.com
+  - gitea.renner.uno
+  - fsn1.your-objectstorage.com          # Hetzner Object Storage (SOPS bundle)
+  - deb.debian.org
+  - security.debian.org
+  - deb.nodesource.com
+  - pkgs.netbird.io
+  - registry.npmjs.org
+claude_ws_egress_allow_cidrs: []          # home Prometheus/Loki/API (v4), per-host
+claude_ws_egress_allow_cidrs6: []         # same (v6) — IPv6-first, prefer these
+
+# --- Notes / wiki pipeline -------------------------------------------------
+# The Obsidian vault syncs onto this host via Syncthing (matches the user's
+# existing multi-device setup). Unattended pipeline jobs must CREATE new atomic
+# files rather than rewrite existing ones, to keep Syncthing conflicts rare.
+claude_ws_notes_enabled: true
+claude_ws_notes_dir: "/home/{{ claude_ws_job_user }}/Notes"
+claude_ws_syncthing_gui_bind: "127.0.0.1:8384"
+
+# --- Secrets (populated from the ansible-vault'd group_vars — see README) ---
+# claude_ws_oauth_token_interactive : CLAUDE_CODE_OAUTH_TOKEN for the human user
+# claude_ws_oauth_token_job         : CLAUDE_CODE_OAUTH_TOKEN for timer jobs
+# claude_ws_gitea_token             : claude-bot PAT
+# claude_ws_gitea_git_credentials   : https://claude-bot:<pat>@gitea.renner.uno line
+# claude_ws_kubeconfig              : read-only SA kubeconfig (base64 or literal)
@@ -0,0 +1,22 @@
+You are running unattended as a scheduled job on the claude-workstation host.
+Your job is a conservative distillation pass over the Obsidian wiki vault.
+
+Scope and rules (follow exactly — you have only Read, Write, Glob, Grep):
+
+1. Look at `~/Notes/raw/` (ignore `~/Notes/raw/_processed/` and `~/Notes/_archive/`
+   entirely) for source material.
+2. For each raw source, check whether `~/Notes/wiki/` already contains a note
+   grounded in it (Grep the wiki for the source filename / its `sources:` slug).
+   If a note already exists, SKIP that source — do not rewrite or duplicate it.
+3. For raw sources with NO corresponding wiki note yet, create new atomic
+   concept notes in `~/Notes/wiki/`: one concept per file, self-contained,
+   tagged, cross-linked with `[[wikilinks]]`, every claim grounded in a
+   `sources:` entry. Never invent facts not present in the source.
+4. CREATE new files only. Never rewrite, move, delete, or truncate an existing
+   file in `~/Notes/` — appending a missing cross-link to a note you created
+   THIS run is fine; touching pre-existing notes is not.
+5. If there is nothing new to distill, do nothing and stop. Do not manufacture
+   work.
+
+Preserve disagreement: if sources conflict, surface the conflict in the note
+rather than silently picking a winner. Keep each note short and single-purpose.
@@ -0,0 +1,8 @@
+# claude-workstation shared tmux config — reattachable long-running sessions.
+set -g history-limit 100000
+set -g mouse on
+set -g base-index 1
+setw -g pane-base-index 1
+set -g status-right "#H  %Y-%m-%d %H:%M"
+# Keep sessions alive across client disconnects (the whole point of this host).
+set -g destroy-unattached off
@@ -0,0 +1,10 @@
+---
+- name: Reload systemd
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Reload nftables
+  ansible.builtin.systemd:
+    name: nftables.service
+    state: reloaded
+  when: claude_ws_egress_enforce | bool
@@ -0,0 +1,42 @@
+---
+# Deny-default egress allowlist. Ships DISABLED (claude_ws_egress_enforce:
+# false) so a fresh host is never bricked by a missed destination; the ruleset,
+# the FQDN-resolver, and its refresh timer are installed regardless, and the
+# operator flips the toggle to true once egress is confirmed complete against
+# real traffic (staged rollout). CDN-backed hosts are matched via nft named
+# sets that the refresh unit repopulates from DNS; static home services are
+# matched by claude_ws_egress_allow_cidrs.
+
+- name: Deploy the egress-refresh resolver
+  ansible.builtin.template:
+    src: claude-egress-refresh.sh.j2
+    dest: "{{ claude_ws_base_dir }}/claude-egress-refresh.sh"
+    mode: "0755"
+
+- name: Deploy the egress-refresh service + timer
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "/etc/systemd/system/{{ item }}"
+    mode: "0644"
+  loop:
+    - claude-egress-refresh.service
+    - claude-egress-refresh.timer
+  notify: Reload systemd
+
+- name: Deploy the nftables ruleset
+  ansible.builtin.template:
+    src: nftables.conf.j2
+    dest: /etc/nftables.conf
+    mode: "0644"
+    validate: "nft -c -f %s"
+  notify: Reload nftables
+
+- name: Enforce or relax egress lockdown
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: "{{ claude_ws_egress_enforce | bool }}"
+    state: "{{ 'started' if (claude_ws_egress_enforce | bool) else 'stopped' }}"
+    daemon_reload: true
+  loop:
+    - nftables.service
+    - claude-egress-refresh.timer
@@ -0,0 +1,183 @@
+---
+# claude-workstation: an always-on headless Claude Code host.
+# Debian 12 VM on the off-site nas-2 (Synology VMM). See README for the manual
+# bootstrap (VM creation, Netbird route, secret material) that precedes this.
+#
+# common.yml already applies `common` and `qemu-guest-agent`
+# to every inventory host, so this role owns only the
+# Claude-specific surface: toolchain, the two credential-isolated users, the
+# read-only creds, notes sync, the unattended timers, and egress lockdown.
+
+- name: Assert we are on Debian (role is apt-only)
+  ansible.builtin.assert:
+    that:
+      - ansible_facts['os_family'] == 'Debian'
+    fail_msg: "claude-workstation targets Debian; got {{ ansible_facts['os_family'] }}."
+
+# --- Base packages ---------------------------------------------------------
+- name: Install base packages
+  ansible.builtin.apt:
+    name: "{{ claude_ws_base_packages }}"
+    state: present
+    update_cache: true
+
+# --- Node.js 22 + Claude Code (matches the ci-claude image toolchain) -------
+- name: Add NodeSource signing key
+  ansible.builtin.get_url:
+    url: https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key
+    dest: /usr/share/keyrings/nodesource.gpg
+    mode: "0644"
+    force: false
+
+- name: Add NodeSource apt repository
+  ansible.builtin.apt_repository:
+    repo: "deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_{{ claude_ws_node_major }}.x nodistro main"
+    state: present
+    filename: nodesource
+
+- name: Install Node.js
+  ansible.builtin.apt:
+    name: nodejs
+    state: present
+    update_cache: true
+
+# NodeSource installs Node under /usr, so global npm modules land in
+# /usr/lib/node_modules and `claude` is on PATH for every user/timer. `creates`
+# keeps it idempotent (re-run `npm install -g` manually to bump the version).
+- name: Install Claude Code globally
+  ansible.builtin.command:
+    cmd: "npm install -g {{ claude_ws_claude_code_pkg }}"
+    creates: /usr/lib/node_modules/@anthropic-ai/claude-code
+
+# --- Credential-isolated users --------------------------------------------
+- name: Create Claude users
+  ansible.builtin.user:
+    name: "{{ item }}"
+    shell: /bin/bash
+    create_home: true
+  loop:
+    - "{{ claude_ws_interactive_user }}"
+    - "{{ claude_ws_job_user }}"
+
+- name: Create the role base directory (scripts, prompts)
+  ansible.builtin.file:
+    path: "{{ claude_ws_base_dir }}"
+    state: directory
+    mode: "0755"
+
+# Let the interactive user's tmux server survive SSH logout / reboot.
+- name: Enable lingering for the interactive user
+  ansible.builtin.command: "loginctl enable-linger {{ claude_ws_interactive_user }}"
+  args:
+    creates: "/var/lib/systemd/linger/{{ claude_ws_interactive_user }}"
+
+- name: Deploy shared tmux config
+  ansible.builtin.copy:
+    src: tmux.conf
+    dest: "/home/{{ item }}/.tmux.conf"
+    owner: "{{ item }}"
+    group: "{{ item }}"
+    mode: "0644"
+  loop:
+    - "{{ claude_ws_interactive_user }}"
+    - "{{ claude_ws_job_user }}"
+
+# --- Secrets: each user gets only what its role needs ----------------------
+# The interactive user gets gitea + OAuth + read-only kubeconfig. The job user
+# gets its OWN OAuth token + gitea (to open PRs) but NO kubeconfig.
+- name: Create ~/.config/claude-bot for the interactive user
+  ansible.builtin.file:
+    path: "/home/{{ item }}/.config/claude-bot"
+    state: directory
+    owner: "{{ item }}"
+    group: "{{ item }}"
+    mode: "0700"
+  loop:
+    - "{{ claude_ws_interactive_user }}"
+    - "{{ claude_ws_job_user }}"
+
+- name: Deploy claude-bot gitea token
+  ansible.builtin.copy:
+    content: "{{ claude_ws_gitea_token }}\n"
+    dest: "/home/{{ item }}/.config/claude-bot/gitea-token"
+    owner: "{{ item }}"
+    group: "{{ item }}"
+    mode: "0600"
+  loop:
+    - "{{ claude_ws_interactive_user }}"
+    - "{{ claude_ws_job_user }}"
+  no_log: true
+
+- name: Deploy claude-bot git-credentials
+  ansible.builtin.copy:
+    content: "{{ claude_ws_gitea_git_credentials }}\n"
+    dest: "/home/{{ item }}/.config/claude-bot/git-credentials"
+    owner: "{{ item }}"
+    group: "{{ item }}"
+    mode: "0600"
+  loop:
+    - "{{ claude_ws_interactive_user }}"
+    - "{{ claude_ws_job_user }}"
+  no_log: true
+
+# CLAUDE_CODE_OAUTH_TOKEN is delivered as an EnvironmentFile so both interactive
+# shells and timer units can source it without it landing in shell history.
+# NEVER run claude with --bare here: bare mode silently ignores this token.
+- name: Deploy per-user Claude OAuth environment file
+  ansible.builtin.copy:
+    content: "CLAUDE_CODE_OAUTH_TOKEN={{ item.token }}\n"
+    dest: "/home/{{ item.user }}/.config/claude-code.env"
+    owner: "{{ item.user }}"
+    group: "{{ item.user }}"
+    mode: "0600"
+  loop:
+    - { user: "{{ claude_ws_interactive_user }}", token: "{{ claude_ws_oauth_token_interactive }}" }
+    - { user: "{{ claude_ws_job_user }}", token: "{{ claude_ws_oauth_token_job }}" }
+  loop_control:
+    label: "{{ item.user }}"
+  no_log: true
+
+- name: Create ~/.kube for the interactive user
+  ansible.builtin.file:
+    path: "/home/{{ claude_ws_interactive_user }}/.kube"
+    state: directory
+    owner: "{{ claude_ws_interactive_user }}"
+    group: "{{ claude_ws_interactive_user }}"
+    mode: "0700"
+
+- name: Deploy read-only SA kubeconfig (interactive user only)
+  ansible.builtin.copy:
+    content: "{{ claude_ws_kubeconfig }}"
+    dest: "/home/{{ claude_ws_interactive_user }}/.kube/config"
+    owner: "{{ claude_ws_interactive_user }}"
+    group: "{{ claude_ws_interactive_user }}"
+    mode: "0600"
+  no_log: true
+
+# This VM's only git identity IS claude-bot (unlike the shared human
+# workstation, where a global credential.helper is forbidden), so a per-user
+# ~/.gitconfig pointing at each user's own claude-bot store is appropriate.
+- name: Configure git identity + credential store for the Claude users
+  ansible.builtin.copy:
+    dest: "/home/{{ item }}/.gitconfig"
+    owner: "{{ item }}"
+    group: "{{ item }}"
+    mode: "0644"
+    content: |
+      [user]
+      	name = Claude Bot
+      	email = claude-bot@renner.uno
+      [credential]
+      	helper = store --file=/home/{{ item }}/.config/claude-bot/git-credentials
+  loop:
+    - "{{ claude_ws_interactive_user }}"
+    - "{{ claude_ws_job_user }}"
+
+# --- Notes / wiki pipeline (Syncthing + timers) ----------------------------
+- name: Notes pipeline
+  ansible.builtin.include_tasks: notes.yml
+  when: claude_ws_notes_enabled | bool
+
+# --- Egress lockdown -------------------------------------------------------
+- name: Egress firewall
+  ansible.builtin.include_tasks: firewall.yml
@@ -0,0 +1,48 @@
+---
+# Notes/wiki pipeline: the Obsidian vault syncs onto this host via Syncthing
+# (matching the user's existing multi-device setup), and a hardened, bounded
+# systemd timer runs an unattended `claude -p` distill pass over it as the
+# credential-isolated job user. Device pairing is a one-time manual step (see
+# README) — this only installs Syncthing and the timer.
+
+- name: Install Syncthing
+  ansible.builtin.apt:
+    name: syncthing
+    state: present
+    update_cache: true
+
+- name: Enable Syncthing for the job user
+  ansible.builtin.systemd:
+    name: "syncthing@{{ claude_ws_job_user }}.service"
+    enabled: true
+    state: started
+    daemon_reload: true
+
+- name: Deploy the notes-distill prompt
+  ansible.builtin.copy:
+    src: claude-notes-distill-prompt.md
+    dest: "{{ claude_ws_base_dir }}/claude-notes-distill-prompt.md"
+    mode: "0644"
+
+- name: Deploy the notes-distill wrapper
+  ansible.builtin.template:
+    src: claude-notes-distill.sh.j2
+    dest: "{{ claude_ws_base_dir }}/claude-notes-distill.sh"
+    mode: "0755"
+
+- name: Deploy the notes-distill service + timer
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "/etc/systemd/system/{{ item }}"
+    mode: "0644"
+  loop:
+    - claude-notes-distill.service
+    - claude-notes-distill.timer
+  notify: Reload systemd
+
+- name: Enable the notes-distill timer
+  ansible.builtin.systemd:
+    name: claude-notes-distill.timer
+    enabled: true
+    state: started
+    daemon_reload: true
@@ -0,0 +1,10 @@
+[Unit]
+# {{ ansible_managed }}
+Description=Refresh claude-workstation egress allowlist from DNS
+After=nftables.service network-online.target
+Wants=network-online.target
+Requires=nftables.service
+
+[Service]
+Type=oneshot
+ExecStart={{ claude_ws_base_dir }}/claude-egress-refresh.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# {{ ansible_managed }}
+# Resolve the egress FQDN allowlist to current IPs and load them into the
+# nftables @allow4/@allow6 sets. CDN IPs rotate, so this runs on a timer.
+# No-op unless the claude_egress table is loaded (i.e. enforcement is on).
+set -euo pipefail
+
+TABLE="inet claude_egress"
+FQDNS=(
+{% for fqdn in claude_ws_egress_allow_fqdns %}
+    "{{ fqdn }}"
+{% endfor %}
+)
+
+nft list table $TABLE >/dev/null 2>&1 || { echo "claude_egress table not loaded; enforcement off"; exit 0; }
+
+v4=(); v6=()
+for host in "${FQDNS[@]}"; do
+    while read -r ip; do [ -n "$ip" ] && v4+=("$ip"); done < <(getent ahostsv4 "$host" | awk '{print $1}' | sort -u)
+    while read -r ip; do [ -n "$ip" ] && v6+=("$ip"); done < <(getent ahostsv6 "$host" | awk '{print $1}' | sort -u)
+done
+
+nft flush set $TABLE allow4
+nft flush set $TABLE allow6
+[ ${#v4[@]} -gt 0 ] && nft add element $TABLE allow4 "{ $(IFS=,; echo "${v4[*]}") }"
+[ ${#v6[@]} -gt 0 ] && nft add element $TABLE allow6 "{ $(IFS=,; echo "${v6[*]}") }"
+echo "claude-egress-refresh: ${#v4[@]} v4 + ${#v6[@]} v6 addresses loaded"
@@ -0,0 +1,10 @@
+[Unit]
+# {{ ansible_managed }}
+Description=Periodically refresh the claude-workstation egress allowlist
+
+[Timer]
+OnBootSec=30s
+OnUnitActiveSec=15min
+
+[Install]
+WantedBy=timers.target
@@ -0,0 +1,32 @@
+[Unit]
+# {{ ansible_managed }}
+Description=Claude Code unattended notes-distill pass
+After=network-online.target syncthing@{{ claude_ws_job_user }}.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User={{ claude_ws_job_user }}
+Group={{ claude_ws_job_user }}
+EnvironmentFile=/home/{{ claude_ws_job_user }}/.config/claude-code.env
+ExecStart={{ claude_ws_base_dir }}/claude-notes-distill.sh
+# Hard wall-clock kill — the runaway/kill switch for this unattended agent.
+TimeoutStartSec=1800
+
+# --- Hardening: an unattended LLM job on internet-influenced input ----------
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ReadWritePaths=/home/{{ claude_ws_job_user }}
+# Credential isolation: cannot read the interactive session's tokens/kubeconfig.
+InaccessiblePaths=/home/{{ claude_ws_interactive_user }}
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=false
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# {{ ansible_managed }}
+# Unattended notes-distill pass. Prompt via stdin (never shell-substituted),
+# tool-allowlisted, no --bare (bare silently drops CLAUDE_CODE_OAUTH_TOKEN).
+# Bounded by the unit's TimeoutStartSec, not a CLI flag (--max-turns is absent
+# in the installed Claude Code). Emits a terminal state line to the journal on
+# EVERY outcome so a Loki alert can catch silent failures (dead-man switch).
+set -euo pipefail
+
+export HOME="/home/{{ claude_ws_job_user }}"
+NOTES="{{ claude_ws_notes_dir }}"
+PROMPT="{{ claude_ws_base_dir }}/claude-notes-distill-prompt.md"
+
+log() { logger -t claude-notes-distill -- "$*"; echo "claude-notes-distill: $*"; }
+
+if [ ! -d "$NOTES/raw" ]; then
+  log "result=skipped reason=no-vault path=$NOTES"
+  exit 0
+fi
+
+log "result=start"
+if claude -p \
+     --add-dir "$NOTES" \
+     --allowedTools "Read,Write,Glob,Grep" \
+     --model sonnet \
+     < "$PROMPT"; then
+  log "result=success"
+else
+  rc=$?
+  log "result=failure rc=$rc"
+  exit "$rc"
+fi
@@ -0,0 +1,11 @@
+[Unit]
+# {{ ansible_managed }}
+Description=Run the Claude Code notes-distill pass daily
+
+[Timer]
+OnCalendar=*-*-* 04:30:00
+Persistent=true
+RandomizedDelaySec=900
+
+[Install]
+WantedBy=timers.target
@@ -0,0 +1,55 @@
+#!/usr/sbin/nft -f
+# {{ ansible_managed }}
+# Deny-default egress for the claude-workstation. CDN-backed destinations are
+# matched via the @allow4/@allow6 named sets, repopulated from DNS by
+# claude-egress-refresh. Static home services are matched by the @static* sets.
+# Only loaded when claude_ws_egress_enforce is true.
+flush ruleset
+
+table inet claude_egress {
+    set allow4 { type ipv4_addr; flags interval; }
+    set allow6 { type ipv6_addr; flags interval; }
+
+    set static4 {
+        type ipv4_addr
+        flags interval
+{% if (claude_ws_egress_allow_cidrs | default([])) | length > 0 %}
+        elements = { {{ claude_ws_egress_allow_cidrs | join(', ') }} }
+{% endif %}
+    }
+    set static6 {
+        type ipv6_addr
+        flags interval
+{% if (claude_ws_egress_allow_cidrs6 | default([])) | length > 0 %}
+        elements = { {{ claude_ws_egress_allow_cidrs6 | join(', ') }} }
+{% endif %}
+    }
+
+    chain output {
+        type filter hook output priority 0; policy drop;
+
+        oif "lo" accept
+        ct state established,related accept
+
+        # DNS — required to resolve the allowlist itself.
+        udp dport 53 accept
+        tcp dport 53 accept
+
+        # Diagnostics + DHCP lease renewal on the bridged interface.
+        ip protocol icmp accept
+        ip6 nexthdr icmpv6 accept
+        udp dport { 67, 68 } accept
+
+        # NetBird / WireGuard control + data plane (initial handshakes).
+        udp dport { 3478, 51820 } accept
+
+        # Allowed destinations.
+        ip  daddr @allow4  accept
+        ip6 daddr @allow6  accept
+        ip  daddr @static4 accept
+        ip6 daddr @static6 accept
+
+        # Everything else is dropped and counted for inspection.
+        counter comment "claude-egress-dropped"
+    }
+}
@@ -8,11 +8,12 @@
  lineinfile:
    path: /etc/hosts
    regexp: '^127\.0\.1\.1\s+{{ inventory_hostname }}'
-    line: "{{ ansible_facts['default_ipv4']['address'] }} {{ inventory_hostname }} {{ inventory_hostname_short | default(inventory_hostname.split('.')[0]) }}"
+    line: "{{ ansible_default_ipv4.address }} {{ inventory_hostname }} {{ inventory_hostname_short | default(inventory_hostname.split('.')[0]) }}"
    state: present
  when:
-    - ansible_facts['virtualization_type'] == 'lxc'
-    - ansible_facts['default_ipv4']['address'] is defined
+    - ansible_virtualization_type is defined
+    - ansible_virtualization_type == 'lxc'
+    - ansible_default_ipv4.address is defined

 # -------------------------------------------------------
 # 1. Install Common Packages
@@ -50,13 +51,24 @@
 # -------------------------------------------------------
 # 4. SSH Configuration
 # -------------------------------------------------------
-# SSH access (CA trust, admin authorized_keys) is managed by the ssh-ca role
-# via plays/configure-ssh-ca.yml.
+# Authorized keys (human + woodpecker-ci, the latter from=-restricted) are
+# managed by the dedicated ansible/plays/configure-ssh-keys.yml play. The old
+# "Add Ansible Runner SSH Key" task deployed ansible-runner@ci-new, a dead key
+# for a host that no longer exists — removed (issue #184).

 # -------------------------------------------------------
-# 5. Time sync
+# 5. Disable NTP on VMs/LXC (use host time)
 # -------------------------------------------------------
-# Moved to separate roles: timesyncd (internet VPS), chrony-ntp-server (edge).
+- name: Stop and disable systemd-timesyncd on VMs/LXC
+  systemd:
+    name: systemd-timesyncd
+    state: stopped
+    enabled: no
+    masked: yes
+  when:
+    - ansible_virtualization_type is defined
+    - ansible_virtualization_type in ['kvm', 'lxc']
+  ignore_errors: yes

 # -------------------------------------------------------
 # 6. Certificates
@@ -15,8 +15,6 @@
 # amd64 asset for exactly this tag.
 crowdsec_bouncer_version: v0.0.36
 crowdsec_bouncer_sha256: f86e4b72693549d99f40a9402abefb894108f047a3fbe6e72fada25ee17ce88b
-# Controller cache for the release archive; it outlives /tmp cleanups.
-crowdsec_bouncer_download_dir: "{{ lookup('ansible.builtin.env', 'HOME') }}/.cache/ansible/crowdsec"

 # The LAPI over the public path these hosts already serve, see
 # kubernetes/infrastructure/crowdsec/lapi-ingress.yaml. The proxies cannot
@@ -29,26 +29,14 @@
 # upstream ships no container image for this bouncer, which is expected —
 # it manipulates host netfilter.
 #
-# The controller has v4, so it does the fetching. The checksum is verified
-# there, before anything is copied to a host. Also in check mode: the fetch
-# only writes on the controller, and the copy below needs the file.
- name: Create the controller download directory
-  ansible.builtin.file:
-    path: "{{ crowdsec_bouncer_download_dir }}"
-    state: directory
-    mode: "0755"
-  delegate_to: localhost
-  become: false
-  run_once: true
-  check_mode: false
-
+# The CI runner has v4, so it does the fetching. The checksum is verified
+# there, before anything is copied to a host.
 - name: Fetch the pinned bouncer release on the controller
-  check_mode: false
  ansible.builtin.get_url:
    url: >-
      https://github.com/crowdsecurity/cs-firewall-bouncer/releases/download/{{
      crowdsec_bouncer_version }}/crowdsec-firewall-bouncer-linux-amd64.tgz
-    dest: "{{ crowdsec_bouncer_download_dir }}/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}.tgz"
+    dest: /tmp/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}.tgz
    checksum: sha256:{{ crowdsec_bouncer_sha256 }}
    mode: "0644"
  delegate_to: localhost
@@ -63,7 +51,7 @@
 # host.
 - name: Copy the bouncer archive to the host
  ansible.builtin.copy:
-    src: "{{ crowdsec_bouncer_download_dir }}/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}.tgz"
+    src: /tmp/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}.tgz
    dest: /opt/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}.tgz
    mode: "0644"

@@ -7,9 +7,7 @@

 edge_alloy_config_file: /etc/alloy/edge.alloy
 edge_alloy_http_port: 12345
-# Upstream image: Arch's grafana-alloy 1.21 is built without
-# loki.source.journal. Renovate-tracked (customManagers in renovate.json).
-edge_alloy_image: grafana/alloy:v1.21.3@sha256:8ab871206bd2d8f89277f53abffee5f452a293980788d52f85fa183a87a505a4
+edge_alloy_bin: /usr/bin/grafana-alloy   # Arch `grafana-alloy` pkg names the binary this, not `alloy`
 edge_loki_push_url: "https://loki.renner.uno/loki/api/v1/push"
 edge_loki_username: edge-1
 edge_alloy_labels:
@@ -6,18 +6,15 @@
 # directly, so one journal source covers everything. Alloy s storage/WAL sits
 # on /run (tmpfs) so it does not write to flash either.

-# Alloy runs from the upstream image (see edge-alloy.service); the Arch package
-# lacks journal support.
- name: Remove the grafana-alloy package
+- name: Install grafana-alloy
  ansible.builtin.package:
    name: grafana-alloy
-    state: absent
+    state: present

 - name: Create alloy system group
  ansible.builtin.group:
    name: alloy
    system: true
-  register: edge_alloy_group

 - name: Create alloy system user
  ansible.builtin.user:
@@ -27,25 +24,6 @@
    system: true
    create_home: false
    shell: /usr/bin/nologin
-  register: edge_alloy_user
-
- name: Look up the systemd-journal group
-  ansible.builtin.getent:
-    database: group
-    key: systemd-journal
-
- name: Set the container identity
-  ansible.builtin.set_fact:
-    edge_alloy_uid: "{{ edge_alloy_user.uid }}"
-    edge_alloy_gid: "{{ edge_alloy_group.gid }}"
-    edge_alloy_journal_gid: "{{ ansible_facts.getent_group['systemd-journal'][1] }}"
-
- name: Pull the alloy image
-  ansible.builtin.command:
-    argv: [docker, pull, "{{ edge_alloy_image }}"]
-  register: edge_alloy_pull
-  changed_when: "'Downloaded newer image' in edge_alloy_pull.stdout"
-  notify: Restart alloy

 - name: Create alloy config directory
  ansible.builtin.file:
@@ -1,35 +1,32 @@
 [Unit]
-Description=Grafana Alloy (journal -> Loki)
+Description=Grafana Alloy (edge-1 log shipper -> Loki)
 Documentation=https://grafana.com/docs/alloy/
-After=docker.service network-online.target
-Requires=docker.service
+After=network-online.target
 Wants=network-online.target

 [Service]
 Type=simple
-# WAL + positions on tmpfs so the agent never writes to the eMMC.
-ExecStartPre=/usr/bin/install -d -o alloy -g alloy -m 0750 /run/alloy
-ExecStartPre=-/usr/bin/docker rm -f edge-alloy
-# Attached run with --log-driver none: the container's output reaches the
-# journal once, through this unit.
-ExecStart=/usr/bin/docker run --rm --name edge-alloy \
-  --log-driver none \
-  --network host \
-  --user {{ edge_alloy_uid }}:{{ edge_alloy_gid }} \
-  --group-add {{ edge_alloy_journal_gid }} \
-  --read-only --tmpfs /tmp \
-  --cap-drop ALL --security-opt no-new-privileges \
-  -v /run/log/journal:/run/log/journal:ro \
-  -v /etc/machine-id:/etc/machine-id:ro \
-  -v {{ edge_alloy_config_file }}:/etc/alloy/config.alloy:ro \
-  -v /run/alloy:/var/lib/alloy \
-  {{ edge_alloy_image }} run \
+User=alloy
+Group=alloy
+# Read the (volatile) systemd journal.
+SupplementaryGroups=systemd-journal
+# WAL + positions on tmpfs so the agent never writes to the eMMC. %t is the
+# runtime dir root (/run); RuntimeDirectory creates /run/alloy owned by us.
+RuntimeDirectory=alloy
+ExecStart={{ edge_alloy_bin }} run \
  --server.http.listen-addr=127.0.0.1:{{ edge_alloy_http_port }} \
-  --storage.path=/var/lib/alloy \
-  /etc/alloy/config.alloy
-ExecStop=/usr/bin/docker stop edge-alloy
-Restart=always
+  --storage.path=%t/alloy \
+  {{ edge_alloy_config_file }}
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
 RestartSec=10s
+LimitNOFILE=65536
+
+# Hardening (bare metal, no LXC namespace limits here).
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes

 [Install]
 WantedBy=multi-user.target
@@ -0,0 +1,71 @@
+---
+# Heating system over the Viessmann E3 CAN bus: open3e (heat pump) and
+# e3oncan (E380 energy meter). The can0 interface itself is the socketcan
+# role.
+
+# Service root. Kept per-role so the role is usable on its own.
+edge_base_dir: /opt/edge-host
+
+edge_open3e_mqtt_user: open3e
+edge_open3e_mqtt_topic: open3e
+edge_open3e_mqtt_format: "{device}_{didNumber:04d}_{didName}"
+edge_open3e_poll_seconds: 30
+# Read-only datapoint set (Phase 1 extended set, established 2026-07-02 on
+# the commissioning workstation; see vican repo CLAUDE.md for the rationale).
+# NO -w / write DIDs here — live heating + battery, writes are Phase 3.
+# vx3.266 = ErrorDtcHistory (O3EList) — the VX3 fault log; polled to catch
+# recurrences of FailureCommunicationEnergyMeter (the E380 energy-meter link
+# the internal PV-surplus EMS depends on). Decodes via the master O3EList
+# codec inherited through the vx3plus overlay.
+# vitocal.543/2350/2543/2560: SmartGrid-/EMS-Status-Beobachtung (2026-07-06)
+# — klärt, ob die Eigenstromoptimierung (EMS) bei PV-Überschuss von selbst
+# den WW-Boost auslöst (2543.2 steht laut Scan bereits auf +10 K), bevor
+# SG-Ready-Verdrahtung oder andere Trigger gebaut werden. Alle vier ro.
+# vitocal.259/260 = InfoDtcList/InfoDtcHistory (O3EList) — the HPMU event log,
+# the Vitocal-side counterpart to vx3.266. Both are capped lists (2 and 9
+# entries when added), so the multi-frame read is cheap at a 30 s poll.
+# Records faults/info events only (NormalOperation, LagDeviceDtcReported,
+# LegionellaProtectionTemperatureReached) — NOT setpoint or program changes.
+# onebase.*: the 29 paired ZigBee slots on the One Base gateway (ECU 0x6c3) --
+# 8 radiator valves, 9 climate sensors, 9 underfloor actuators, 3 floor
+# thermostats. Per-device room temperature, active setpoint, humidity, valve
+# opening/demand, battery and RSSI; the local replacement for the ViCare cloud
+# room sensors. Needs the onebase overlay (files/open3e-onebase.py) -- the stock
+# codec declares 57 bytes and a paired slot answers with 68.
+# Only CurrentValues are polled. The room and device registries (1884.., 2084..)
+# are static configuration and are read on demand, not every 30 s.
+edge_open3e_datapoints: >-
+  vitocal.259,vitocal.260,vitocal.268,vitocal.269,vitocal.271,vitocal.274,vitocal.286,vitocal.288,vitocal.318,vitocal.321,vitocal.324,vitocal.335,vitocal.336,vitocal.396,vitocal.402,vitocal.403,vitocal.476,vitocal.477,vitocal.543,vitocal.548,vitocal.565,vitocal.1007,vitocal.1043,vitocal.1190,vitocal.1211,vitocal.1391,vitocal.1416,vitocal.1417,vitocal.2320,vitocal.2346,vitocal.2350,vitocal.2351,vitocal.2352,vitocal.2369,vitocal.2370,vitocal.2486,vitocal.2487,vitocal.2488,vitocal.2543,vitocal.2560,vitocal.2622,vitocal.2624,vitocal.2625,vitocal.2735,vitocal.3016,vx3.266,vx3.378,vx3.379,vx3.380,vx3.535,vx3.1603,vx3.1664,vx3.1690,vx3.1801,vx3.1802,vx3.1810,vx3.1828,vx3.1830,vx3.1577,vx3.1578,vx3.1579,vx3.1580,vx3.1581,vx3.1582,vx3.1834,vx3.1836,vx3.2214,vx3.2240,vx3.3085,vx3.3086,vx3.3087,vx3.3088,vx3.3089,vx3.3090,vcmu.320,vcmu.322,vcmu.325,vcmu.355,vcmu.389,vcmu.391,vcmu.1772,vcmu.1773,vcmu.1775,vcmu.1776,vcmu.2256,vcmu.2259,vcmu.2333,vcmu.2334,vcmu.2569,vcmu.2571,vitocal.2791,onebase.2086,onebase.2089,onebase.2092,onebase.2095,onebase.2098,onebase.2101,onebase.2104,onebase.2107,onebase.2110,onebase.2113,onebase.2116,onebase.2119,onebase.2122,onebase.2125,onebase.2128,onebase.2131,onebase.2134,onebase.2137,onebase.2140,onebase.2143,onebase.2262,onebase.2265,onebase.2268,onebase.2271,onebase.2274,onebase.2277,onebase.2280,onebase.2283,onebase.2286
+# ECU addresses; -dev selects codec set, tx selects the UDS address.
+# vcmu (refrigerant-circuit controller) has no dedicated codec set —
+# omitting dpList makes open3e fall back to the generic datapoint list,
+# which decodes all polled VCMU DIDs.
+edge_open3e_devices:
+  vitocal: { tx: "0x680", dpList: "vcal" }
+  # dpList als Pfad: Overlay-Datei mit den Batteriemodul-DIDs (siehe
+  # files/open3e-vx3plus.py) — die Stock-vx3-Liste filtert sie sonst weg.
+  vx3: { tx: "0x6a1", dpList: "/config/vx3plus.py" }
+  vcmu: { tx: "0x68c" }
+  # One Base ZigBee gateway. Overlay re-declares the paired ZigBee slots at
+  # their real 68-byte length (see files/open3e-onebase.py).
+  onebase: { tx: "0x6c3", dpList: "/config/onebase.py" }
+
+edge_e3oncan_gap_seconds: 10
+edge_e3oncan_mqtt_format: "{device}_{didNumber:04d}_{didName}"
+
+# Secrets come from inventory/group_vars/edge_host/vault.yml:
+#   edge_open3e_mqtt_password
+
+# The image carrying both readers, built and pinned in CI
+# (ci/images/heating-can/Containerfile). The source pins live in the
+# Containerfile, in the artifact -- not here -- so what is deployed is a tag,
+# and `docker compose up -d` on an unchanged tag is a genuine no-op.
+#
+# Tracked by the weekly update-audit as an ordinary image, which is why this is
+# simpler to keep current than the two git refs it replaced: one publishes no
+# tags at all, the other was pinned to an untagged commit between releases.
+heating_can_image: gitea.renner.uno/gitea_admin/heating-can:latest
+
+# Compose project directory. Separate from the old native layout under
+# {{ edge_base_dir }}/open3e, which this role removes.
+heating_can_base_dir: "{{ edge_base_dir }}/heating-can"
@@ -0,0 +1,54 @@
+# Managed by ansible (roles/heating-can). Datapoint overlay for the One Base
+# ZigBee gateway on ECU 0x6c3 (BACKENDGATEWAY).
+#
+# Upstream declares ZigBee<N>DeviceCurrentValues as 57 bytes. A PAIRED device
+# slot on this gateway answers with 68: the 57 known bytes plus the parent
+# device serial and three trailing bytes. udsoncan reads only the declared
+# length and then treats the next two bytes -- the first half of that serial --
+# as a foreign data identifier, so every paired slot fails to decode with
+# "Server returned values for data identifier 0x.... that was not requested".
+# The bogus identifier differs per device because the serial does.
+#
+# This overlay re-declares the 29 paired slots at 68 bytes, reusing upstream's
+# sub-type list so the per-device-type O3ESwitch (climate sensor / TRV / floor
+# thermostat / actuator, incl. DeviceTemperatureSetpoint) is inherited rather
+# than copied.
+#
+# EMPTY slots answer with 57 and decode against the stock codec, so they are
+# left alone and are not polled. A slot that is later unpaired therefore starts
+# reporting a decode error on its topic instead of a value.
+#
+# Verified on ECU 0x6c3, 2026-09-17: 29 paired slots, all 68 bytes.
+from open3e.Open3Ecodecs import O3EComplexType, RawCodec
+from open3e.Open3Edatapoints import dataIdentifiers as _master
+
+# ZigBee<N>DeviceCurrentValues of the paired slots: devices 1-20 run 2086..2143
+# in steps of 3, devices 21-29 continue at 2262..2286.
+_PAIRED_CURRENT_VALUES = [2086 + 3 * n for n in range(20)] + [
+    2262 + 3 * n for n in range(9)
+]
+
+
+def _with_parent_serial(did):
+    stock = _master["dids"][did]
+    return O3EComplexType(
+        68,
+        stock.id,
+        list(stock.subTypes)
+        + [
+            RawCodec(8, "ParentDeviceSerialnumber"),
+            RawCodec(2, "Unknown_65_66"),
+            RawCodec(1, "Unknown_67"),
+        ],
+        desc=stock.desc,
+        info=stock.info,
+        acc=stock.acc,
+    )
+
+
+dataIdentifiers = {
+    "dids": {
+        **_master["dids"],
+        **{did: _with_parent_serial(did) for did in _PAIRED_CURRENT_VALUES},
+    }
+}
@@ -0,0 +1,20 @@
+# Managed by ansible (roles/heating-can). Datapoint overlay for the VX3:
+# the stock vx3 list acts as a FILTER (DIDs missing from it are popped
+# from the master table, Open3Eclass.py), so the per-battery-module DIDs
+# were never pollable with dpList "vx3". This overlay re-adds them with
+# codec None (= keep the master/general codec, RawCodec hex strings).
+#
+# Module DIDs (verified answering on ECU 0x6a1, 2026-07-03):
+#   1577-1582  ElectricalEnergyStorageModule{One..Six}OperatingData
+#              (139 B: 8x temperature 0.1 °C + 15x cell voltage mV)
+#   3085-3090  ElectricalEnergyStorageModule{One..Six}Information
+#              (18 B: module voltage 0.01 V, SoH?, counters)
+from open3e.Open3EdatapointsVx3 import dataIdentifiers as _vx3
+
+dataIdentifiers = {
+    "dids": {
+        **_vx3["dids"],
+        1577: None, 1578: None, 1579: None, 1580: None, 1581: None, 1582: None,
+        3085: None, 3086: None, 3087: None, 3088: None, 3089: None, 3090: None,
+    }
+}
@@ -0,0 +1,10 @@
+---
+- name: Reload systemd
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Restart heating-can
+  ansible.builtin.command:
+    cmd: docker compose up -d --force-recreate
+    chdir: "{{ heating_can_base_dir }}"
+  changed_when: true
@@ -0,0 +1,171 @@
+---
+# Heating system over the Viessmann E3 CAN bus.
+#
+# Two readers of the same heating installation, supervised inside one container
+# from one image (ci/images/heating-can):
+#   open3e    UDS request/response to the Vitocal heat pump and Vitocharge VX3
+#   e3oncan   passive CANopen listener for the E380 grid energy meter, which
+#             feeds the heat pump's own energy management
+#
+# They coexist because e3oncan issues no bus writes.
+#
+# Nothing is installed here. The image is built in CI with both sources pinned,
+# published to the registry, and this host only pulls and runs it. That is what
+# removes the churn: these were pip-installed into venvs on the node, and pip
+# re-cloned and rebuilt a VCS requirement on every converge -- restarting the
+# heating bridge each time -- which pinning the SHA did not fix.
+#
+# network_mode: host is required, not incidental: SocketCAN interfaces live in
+# the host network namespace, so can0 is only reachable that way. It is also how
+# the local MQTT broker on 127.0.0.1 is reached. CAN_RAW needs no capabilities,
+# so both run unprivileged.
+#
+# The can0 interface itself belongs to the socketcan role; this role consumes it.
+
+- name: Create heating-can directory
+  ansible.builtin.file:
+    path: "{{ heating_can_base_dir }}"
+    state: directory
+    mode: "0755"
+
+# --- Migration off the native install ---------------------------------------
+# Must happen before the containers start. Two open3e instances issuing UDS
+# requests on one CAN bus is the failure mode to avoid, so the old units are
+# stopped and masked rather than merely disabled -- masked so a stray
+# `systemctl start` or a leftover dependency cannot bring them back alongside
+# the containers.
+- name: Find which native CAN units still exist
+  ansible.builtin.stat:
+    path: "/etc/systemd/system/{{ item }}.service"
+  loop:
+    - open3e
+    - e3oncan
+  register: heating_can_native_units
+
+# Stop and disable BEFORE anything else, and do NOT swallow the result.
+#
+# The first version did stop + disable + mask in one call with
+# failed_when: false, then deleted the unit files. Masking a unit whose file
+# still exists conflicts, so the call failed, failed_when hid it, nothing was
+# stopped -- and the next task deleted the unit files out from under two
+# running processes. systemctl is-enabled then reported "not-found" and looked
+# clean while is-active still said "active".
+#
+# The result on 2026-08-10 was two open3e instances issuing UDS requests on the
+# same CAN bus for nine minutes, fighting over the open3e-edge client ID and
+# kicking each other off the broker.
+#
+# Only units that actually exist are touched, so a fresh host does not need an
+# error swallowed to get through this.
+- name: Stop and disable the native CAN services
+  ansible.builtin.systemd:
+    name: "{{ item.item }}"
+    state: stopped
+    enabled: false
+  loop: "{{ heating_can_native_units.results }}"
+  loop_control:
+    label: "{{ item.item }}"
+  when: item.stat.exists
+
+# Masking is deliberately NOT used. It writes a symlink at the same path the
+# next task removes, so the two cancel out -- which is half of how the original
+# failed. With the unit files gone there is nothing left to start.
+- name: Remove the native unit files
+  ansible.builtin.file:
+    path: "/etc/systemd/system/{{ item }}.service"
+    state: absent
+  loop:
+    - open3e
+    - e3oncan
+  notify: Reload systemd
+
+# The invariant that actually matters is "no native process is on the CAN bus",
+# and systemd reporting success is not the same claim. Two open3e instances
+# polling one bus is the failure this whole block exists to prevent, so it is
+# asserted directly rather than inferred from the calls above.
+- name: Check for surviving native CAN processes
+  ansible.builtin.command:
+    argv: [pgrep, -af, "edge-host/(open3e|e3oncan)"]
+  register: heating_can_survivors
+  changed_when: false
+  failed_when: false
+
+- name: Assert no native CAN process survived
+  ansible.builtin.assert:
+    that:
+      - heating_can_survivors.stdout | default('') | length == 0
+    fail_msg: >-
+      A native open3e/e3oncan process is still running after the units were
+      stopped and removed:
+      {{ heating_can_survivors.stdout_lines | default([]) | join('; ') }}.
+      Starting the container now would put two readers on the same CAN bus --
+      two open3e instances issue competing UDS requests and take over each
+      other's MQTT session. Kill the survivors, then re-run.
+    success_msg: No native CAN processes remain; safe to start the container.
+
+- name: Remove the native venvs
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - "{{ edge_base_dir }}/open3e/venv"
+    - "{{ edge_base_dir }}/e3oncan/venv"
+    - "{{ edge_base_dir }}/e3oncan/src"
+    - "{{ edge_base_dir }}/open3e"
+    - "{{ edge_base_dir }}/e3oncan"
+
+# --- Configuration (bind-mounted into the containers) ------------------------
+- name: Deploy open3e devices.json
+  ansible.builtin.copy:
+    content: "{{ edge_open3e_devices | to_nice_json }}\n"
+    dest: "{{ heating_can_base_dir }}/devices.json"
+    mode: "0644"
+  notify: Restart heating-can
+
+- name: Deploy open3e vx3 datapoint overlay (battery-module DIDs)
+  ansible.builtin.copy:
+    src: open3e-vx3plus.py
+    dest: "{{ heating_can_base_dir }}/vx3plus.py"
+    mode: "0644"
+  notify: Restart heating-can
+
+- name: Deploy open3e One Base datapoint overlay (68-byte ZigBee slots)
+  ansible.builtin.copy:
+    src: open3e-onebase.py
+    dest: "{{ heating_can_base_dir }}/onebase.py"
+    mode: "0644"
+  notify: Restart heating-can
+
+# --- Compose project ---------------------------------------------------------
+- name: Deploy the broker credential env file
+  ansible.builtin.template:
+    src: heating-can.env.j2
+    dest: "{{ heating_can_base_dir }}/heating-can.env"
+    mode: "0600"
+  notify: Restart heating-can
+
+- name: Deploy heating-can compose project
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ heating_can_base_dir }}/docker-compose.yml"
+    mode: "0644"
+  notify: Restart heating-can
+
+- name: Pull the heating-can image
+  ansible.builtin.command:
+    cmd: docker compose pull
+    chdir: "{{ heating_can_base_dir }}"
+  changed_when: false
+
+# Unlike the zwave and meter services there is no missing-device tolerance here:
+# can0 is created by the socketcan role from a USB adapter that is part of this
+# host's purpose. If it is absent the heating telemetry is down and the run
+# should say so rather than pass quietly.
+- name: Start heating-can services
+  ansible.builtin.command:
+    cmd: docker compose up -d
+    chdir: "{{ heating_can_base_dir }}"
+  register: heating_can_up
+  changed_when: >-
+    'Started' in heating_can_up.stderr or 'Created' in heating_can_up.stderr
+    or 'Started' in heating_can_up.stdout or 'Creating' in heating_can_up.stdout
@@ -0,0 +1,36 @@
+# Managed by ansible (roles/heating-can).
+#
+# One container. Both CAN readers live in the image and are supervised inside
+# it -- this file supplies configuration and nothing else. It does not know
+# open3e's or E3onCAN's command line.
+#
+# network_mode: host is required: SocketCAN interfaces live in the host network
+# namespace, so {{ edge_can_interface }} is only reachable this way, and it is
+# also how the local MQTT broker is reached. CAN_RAW needs no capabilities, so
+# the image runs unprivileged.
+services:
+  heating-can:
+    image: {{ heating_can_image }}
+    container_name: heating-can
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - ./devices.json:/config/devices.json:ro
+      - ./vx3plus.py:/config/vx3plus.py:ro
+      - ./onebase.py:/config/onebase.py:ro
+    env_file:
+      # Broker credential, 0600 -- see heating-can.env.j2.
+      - heating-can.env
+    environment:
+      CAN_INTERFACE: "{{ edge_can_interface }}"
+      MQTT_HOST: "{{ edge_mqtt_host }}"
+      MQTT_PORT: "{{ edge_mqtt_port }}"
+      MQTT_TOPIC: "{{ edge_open3e_mqtt_topic }}"
+      MQTT_FORMAT: "{{ edge_open3e_mqtt_format }}"
+      E3ONCAN_MQTT_FORMAT: "{{ edge_e3oncan_mqtt_format }}"
+      OPEN3E_CONFIG: /config/devices.json
+      OPEN3E_CLIENT_ID: open3e-edge
+      OPEN3E_POLL_SECONDS: "{{ edge_open3e_poll_seconds }}"
+      OPEN3E_DATAPOINTS: "{{ edge_open3e_datapoints }}"
+      E3ONCAN_DEVICE: e380
+      E3ONCAN_GAP_SECONDS: "{{ edge_e3oncan_gap_seconds }}"
@@ -0,0 +1,8 @@
+# Managed by ansible (roles/heating-can). 0600 -- carries the broker credential.
+#
+# Kept out of docker-compose.yml, which is 0644: the sibling roles on this host
+# do the same (power-meter-sml renders its config at 0600 while its compose file
+# stays world-readable), and the native unit this replaced used a 0600 env file
+# for exactly this value.
+MQTT_USER={{ edge_open3e_mqtt_user }}
+MQTT_PASSWORD={{ edge_open3e_mqtt_password }}
@@ -65,7 +65,6 @@
      - /etc/network/interfaces
      - /etc/network/interfaces.d/
  register: keepalived_ntp_static6_ifupdown
-  check_mode: false
  changed_when: false
  failed_when: false
  when:
@@ -99,7 +98,7 @@
 # quietly proceed either. install-edge-host.yml is a separate play with no
 # ordering relationship to this one, so nothing guarantees it has been re-run
 # to drop the [Address] block. If it has not, edge-1 would end up holding
-# the service address statically AND running a VRRP instance for the same address:
+# fd40::123 statically AND running a VRRP instance for the same address:
 # keepalived would believe it had withdrawn the address while networkd kept it
 # assigned, and the host would go on answering NTP with a clock the health
 # check had already rejected.
@@ -107,9 +106,9 @@
 # That is the precise failure of 2026-08-04, on the host it happened to, so it
 # fails fast rather than being left to inspection.
 # Matched on the bare address, not the full address/prefixlen, and anchored
-# with \b so it cannot also hit a longer address sharing the prefix (fd02:40::1234).
+# with \b so it cannot also hit a longer address sharing the prefix (fd40::1234).
 #
-# Searching for the literal "fd02:40::123/128" would fail open: a hand-written
+# Searching for the literal "fd40::123/128" would fail open: a hand-written
 # [Address] using any other mask -- /64, say -- would not match, the assert
 # below would pass, and keepalived would be handed an address networkd is
 # still assigning. Since this check is detect-only, with no delete afterwards
@@ -124,7 +123,6 @@
      - "{{ keepalived_ntp_vip6.split('/')[0] }}\\b"
      - /etc/systemd/network/
  register: keepalived_ntp_static6_networkd
-  check_mode: false
  changed_when: false
  failed_when: false
  when:
@@ -142,8 +140,9 @@
      Handing the address to keepalived while networkd also assigns it means
      it would NOT be withdrawn when check_ntp fails -- the host would keep
      serving time on an address VRRP believes it has released.
-      Re-apply the edge-vlan role first (site.yml runs it before this play),
-      whose template no longer carries the [Address] block.
+      Re-apply the edge-vlan role first, whose template no longer carries the
+      [Address] block:
+      ansible-playbook -i inventory/pve_hosts.yml plays/install-edge-host.yml
    success_msg: >-
      No static networkd assignment of {{ keepalived_ntp_vip6 }}; safe for
      keepalived to own it.
@@ -2,7 +2,7 @@
 # Managed by Ansible - Do not edit manually

 global_defs {
-    router_id {{ ansible_facts['hostname'] }}_ntp
+    router_id {{ ansible_hostname }}_ntp
    enable_script_security
    script_user root
 }
@@ -0,0 +1,23 @@
+---
+# --- MQTT: edge clients (open3e, e3oncan, sml2mqtt) publish to a LOCAL
+# mosquitto on loopback, which bridges to the central cluster broker over TLS
+# (open3e/e3oncan have no native MQTTS). This keeps plaintext on loopback only
+# — off the untrusted IoT VLAN — and buffers telemetry in RAM during cluster
+# blips. The local broker writes nothing to the eMMC (persistence off, logs to
+# the volatile journal). See edge-mqtt-bridge.conf.j2 and README "MQTT bridge".
+# Upstream cluster broker the local bridge connects to (TLS; the public
+# Let's Encrypt cert is validated against the system CA bundle).
+edge_mqtt_cluster_host: mqtt.renner.uno
+edge_mqtt_cluster_tls_port: 8883
+edge_mqtt_bridge_cafile: /etc/ssl/certs/ca-certificates.crt
+
+# --- Bridge credential from mqtt-account-controller (REN-1307) ------------
+# The cluster account the bridge logs in as (register entry in
+# kubernetes/apps/home-assistant/mqtt-accounts.yaml). The controller pushes
+# its password to edge-mqtt-cred and rotates it when the bridge reports
+# "not connected"; there is no copy in ansible-vault.
+edge_mqtt_bridge_account: edge-1
+# HTTPS port of edge-mqtt-cred (esp32 device API, mTLS). Only a client
+# certificate from the MQTT CA with this CN is accepted.
+edge_mqtt_cred_port: 8443
+edge_mqtt_cred_allowed_cn: mqtt-account-controller
@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+# Managed by ansible (roles/mqtt-bridge). Receives the cluster bridge password
+# from mqtt-account-controller (REN-1307) so no plaintext copy lives in
+# ansible-vault and no play run is needed to rotate it.
+#
+# Speaks the controller's esp32 device API over HTTPS:
+#   GET /api/status   -> {"mqtt": {"connected": bool}}
+#   PUT /api/settings <- {"mqtt": {"user": "...", "pass": "..."}}
+# A client certificate from the MQTT CA with CN mqtt-account-controller is
+# required; nothing else may call it. The server key is generated on this
+# host and never leaves it (the controller pins it on first contact).
+#
+# PUT writes the bridge file (template + credentials), removes the legacy
+# vault-password bridges and restarts the local mosquitto. The password is
+# kept only in that 0640 root:mosquitto file.
+import grp
+import json
+import os
+import socket
+import ssl
+import subprocess
+import sys
+import tempfile
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+CONF = json.load(open(sys.argv[1]))
+WRITE = threading.Lock()
+
+
+def connected():
+    try:
+        out = subprocess.run(
+            ["mosquitto_sub", "-h", "127.0.0.1", "-p", str(CONF["local_port"]),
+             "-t", CONF["state_topic"], "-C", "1", "-W", "3"],
+            capture_output=True, text=True, timeout=10).stdout
+    except (OSError, subprocess.TimeoutExpired):
+        return False
+    return out.strip() == "1"
+
+
+def write_bridge(user, password):
+    with open(CONF["template"]) as f:
+        body = f.read()
+    body += f"remote_username {user}\nremote_password {password}\n"
+    d = os.path.dirname(CONF["bridge_file"])
+    fd, tmp = tempfile.mkstemp(dir=d, prefix=".edge-mqtt-cred.")
+    with os.fdopen(fd, "w") as f:
+        f.write(body)
+    os.chown(tmp, 0, grp.getgrnam("mosquitto").gr_gid)
+    os.chmod(tmp, 0o640)
+    os.replace(tmp, CONF["bridge_file"])
+    for legacy in CONF["legacy_files"]:
+        if os.path.exists(legacy):
+            os.remove(legacy)
+    subprocess.run(["systemctl", "restart", "mosquitto"], check=True, timeout=60)
+
+
+def valid(s):
+    # Controller passwords are random URL-safe tokens; anything with
+    # whitespace or a control character would break the config line.
+    return isinstance(s, str) and 0 < len(s) <= 256 and s.isprintable() and not any(c.isspace() for c in s)
+
+
+class Handler(BaseHTTPRequestHandler):
+    def authorized(self):
+        cert = self.connection.getpeercert() or {}
+        cns = [v for rdn in cert.get("subject", ()) for k, v in rdn if k == "commonName"]
+        if cns != [CONF["allowed_cn"]]:
+            self.send_error(403)
+            return False
+        return True
+
+    def reply(self, code, obj=None):
+        data = b"" if obj is None else json.dumps(obj).encode()
+        self.send_response(code)
+        if data:
+            self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def do_GET(self):
+        if not self.authorized():
+            return
+        if self.path != "/api/status":
+            return self.send_error(404)
+        self.reply(200, {"mqtt": {"connected": connected()}})
+
+    def do_PUT(self):
+        if not self.authorized():
+            return
+        if self.path != "/api/settings":
+            return self.send_error(404)
+        try:
+            n = int(self.headers.get("Content-Length", "0"))
+            if not 0 < n <= 4096:
+                raise ValueError("body size")
+            m = json.loads(self.rfile.read(n))["mqtt"]
+            user, password = m["user"], m["pass"]
+        except (ValueError, KeyError, TypeError):
+            return self.send_error(400)
+        if user != CONF["user"] or not valid(password):
+            return self.send_error(400)
+        with WRITE:
+            write_bridge(user, password)
+        self.log_message("bridge credentials for %s replaced, mosquitto restarted", user)
+        self.reply(204)
+
+    def log_message(self, fmt, *args):
+        sys.stderr.write("%s %s\n" % (self.address_string(), fmt % args))
+
+
+class Server(ThreadingHTTPServer):
+    address_family = socket.AF_INET6
+
+    def server_bind(self):
+        self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
+        super().server_bind()
+
+    def get_request(self):
+        # The TLS handshake runs in the request thread, with a timeout, so a
+        # stalled peer cannot block the accept loop.
+        sock, addr = self.socket.accept()
+        sock.settimeout(10)
+        return self.ctx.wrap_socket(sock, server_side=True, do_handshake_on_connect=False), addr
+
+
+def main():
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    ctx.minimum_version = ssl.TLSVersion.TLSv1_2
+    ctx.load_cert_chain(CONF["cert"], CONF["key"])
+    ctx.load_verify_locations(CONF["ca"])
+    ctx.verify_mode = ssl.CERT_REQUIRED
+    srv = Server(("::", CONF["port"]), Handler)
+    srv.ctx = ctx
+    srv.serve_forever()
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBdTCCARygAwIBAgIUN8ne4k4Wif9O83GDyKiBP0Ma7EIwCgYIKoZIzj0EAwIw
+GTEXMBUGA1UEAxMOUmVubmVyIE1RVFQgQ0EwHhcNMjYxMDA2MTUzMDE1WhcNMzYx
+MDAzMTUzMDE1WjAZMRcwFQYDVQQDEw5SZW5uZXIgTVFUVCBDQTBZMBMGByqGSM49
+AgEGCCqGSM49AwEHA0IABOZhZF2JDoyvVg2oIXSbJAuAWDcoG22RxPA4oMKRMA/b
+XzIY566D2k6cVnWqbil9s/q4O2mj+Epo7plBw8NwuOOjQjBAMA4GA1UdDwEB/wQE
+AwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQcqSDDiLZzhrvqq9f16Y08
+CO7QfzAKBggqhkjOPQQDAgNHADBEAiBFkxd9pXnqIcjReEcOTvCBZ3HxKu2jNQGL
+/le7gunTGgIgZapWAcu4awa+wmZcR/z2luOjD2GhIT15um14Z+sstJk=
+-----END CERTIFICATE-----
@@ -0,0 +1,13 @@
+---
+# The MQTT clients (zwave-js, sml2mqtt, open3e, e3oncan) reconnect on their
+# own once the local broker is back.
+- name: Restart mosquitto
+  ansible.builtin.service:
+    name: mosquitto
+    state: restarted
+
+- name: Restart edge-mqtt-cred
+  ansible.builtin.systemd:
+    name: edge-mqtt-cred
+    state: restarted
+    daemon_reload: true
@@ -0,0 +1,109 @@
+---
+# Local MQTT bridge broker.
+#
+# Edge clients (open3e, e3oncan, sml2mqtt) publish here over loopback; this
+# broker bridges to the cluster broker over TLS, because those clients have no
+# native MQTTS. Persistence is off and logging goes to stdout so it writes
+# nothing to local flash.
+
+- name: Install mosquitto
+  ansible.builtin.package:
+    name: mosquitto
+    state: present
+
+- name: Create the bridge directory
+  ansible.builtin.file:
+    path: /etc/mosquitto/bridge.d
+    state: directory
+    owner: root
+    group: mosquitto
+    mode: "0750"
+
+- name: Check for the controller-managed bridge file
+  ansible.builtin.stat:
+    path: "/etc/mosquitto/bridge.d/{{ edge_mqtt_bridge_account }}.conf"
+  register: edge_mqtt_bridge_managed
+
+# Until mqtt-account-controller has pushed the first password, keep the
+# vault-password bridges so the cluster never loses edge-1's data. Once the
+# managed file exists, never render them again (edge-mqtt-cred removed them).
+- name: Deploy legacy vault-password bridges
+  ansible.builtin.template:
+    src: edge-mqtt-bridge-legacy.conf.j2
+    dest: /etc/mosquitto/bridge.d/legacy.conf
+    owner: root
+    group: mosquitto
+    mode: "0640"   # carries the legacy cluster bridge credentials
+  when: not edge_mqtt_bridge_managed.stat.exists
+  notify: Restart mosquitto
+
+- name: Deploy local mosquitto config
+  ansible.builtin.template:
+    src: edge-mqtt-bridge.conf.j2
+    dest: /etc/mosquitto/mosquitto.conf
+    owner: root
+    group: mosquitto
+    mode: "0640"
+  notify: Restart mosquitto
+
+- name: Enable local mosquitto bridge
+  ansible.builtin.systemd:
+    name: mosquitto
+    enabled: true
+    state: started
+
+# --- edge-mqtt-cred (REN-1307): receives the bridge password from
+# mqtt-account-controller. edge-1 holds only the public MQTT CA and its own
+# server key, generated here and never copied off the host.
+- name: Create edge-mqtt-cred config directory
+  ansible.builtin.file:
+    path: /etc/edge-mqtt-cred
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: Generate edge-mqtt-cred server key and certificate
+  ansible.builtin.command:
+    cmd: >-
+      openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1
+      -nodes -days 36500 -subj "/CN={{ inventory_hostname }}"
+      -keyout /etc/edge-mqtt-cred/tls.key -out /etc/edge-mqtt-cred/tls.crt
+    creates: /etc/edge-mqtt-cred/tls.key
+  notify: Restart edge-mqtt-cred
+
+- name: Deploy edge-mqtt-cred files
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: root
+    group: root
+    mode: "{{ item.mode }}"
+  loop:
+    - {src: edge-mqtt-cred.py, dest: /usr/local/sbin/edge-mqtt-cred, mode: "0755"}
+    # Public CA of the cluster's MQTT client certificates
+    # (kubernetes/infrastructure/post-crds/mqtt-ca.yaml), valid until 2036-10-03.
+    - {src: mqtt-ca.crt, dest: /etc/edge-mqtt-cred/mqtt-ca.crt, mode: "0644"}
+  notify: Restart edge-mqtt-cred
+
+- name: Deploy edge-mqtt-cred config and bridge template
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: root
+    group: root
+    mode: "{{ item.mode }}"
+  loop:
+    - {src: edge-mqtt-cred.json.j2, dest: /etc/edge-mqtt-cred/config.json, mode: "0600"}
+    # Read only on the controller's next push: a change here reaches the
+    # running bridge when the password is next set.
+    - {src: edge-1-bridge.conf.in.j2, dest: /etc/edge-mqtt-cred/bridge.conf.in, mode: "0600"}
+    - {src: edge-mqtt-cred.service.j2, dest: /etc/systemd/system/edge-mqtt-cred.service, mode: "0644"}
+  notify: Restart edge-mqtt-cred
+
+- name: Enable edge-mqtt-cred
+  ansible.builtin.systemd:
+    name: edge-mqtt-cred
+    enabled: true
+    state: started
+    daemon_reload: true
@@ -0,0 +1,21 @@
+# Managed by roles/mqtt-bridge (REN-1307). edge-mqtt-cred appends
+# remote_username/remote_password to this and writes the result to
+# /etc/mosquitto/bridge.d/{{ edge_mqtt_bridge_account }}.conf. One bridge for
+# open3e, as the register account `{{ edge_mqtt_bridge_account }}`
+# (ACL readwrite open3e/#). sml2mqtt is retired (SML reader, 2026-09-19).
+connection {{ edge_mqtt_bridge_account }}
+address {{ edge_mqtt_cluster_host }}:{{ edge_mqtt_cluster_tls_port }}
+bridge_cafile {{ edge_mqtt_bridge_cafile }}
+bridge_insecure false
+remote_clientid edge1-bridge
+cleansession false
+try_private true
+restart_timeout 5 30
+queue_qos0_messages true
+# The bridge state goes to the LOCAL broker only (retained 1/0); edge-mqtt-cred
+# reads it to answer the controller's "connected?".
+notifications true
+notifications_local_only true
+notification_topic $SYS/broker/connection/{{ edge_mqtt_bridge_account }}/state
+topic open3e/# out 0
+topic open3e/cmnd in 0
@@ -0,0 +1,21 @@
+# Managed by roles/mqtt-bridge. Legacy vault-password bridges, rendered only
+# while /etc/mosquitto/bridge.d/{{ edge_mqtt_bridge_account }}.conf does not
+# exist; edge-mqtt-cred deletes this file on the controller's first push
+# (REN-1307). Remove with the vault keys once edge-1 is on the register account.
+# --- Bridge 1: open3e datapoints + command topic, as the cluster `open3e`
+# user (its ACL is `readwrite open3e/#`, which covers publishing datapoints
+# and subscribing to open3e/cmnd). e3oncan also publishes under open3e/#.
+connection edge1-open3e
+address {{ edge_mqtt_cluster_host }}:{{ edge_mqtt_cluster_tls_port }}
+bridge_cafile {{ edge_mqtt_bridge_cafile }}
+bridge_insecure false
+remote_username {{ edge_open3e_mqtt_user }}
+remote_password {{ edge_open3e_mqtt_password }}
+remote_clientid edge1-bridge-open3e
+cleansession false
+try_private true
+notifications false
+restart_timeout 5 30
+queue_qos0_messages true
+topic open3e/# out 0
+topic open3e/cmnd in 0
@@ -0,0 +1,30 @@
+# Managed by roles/mqtt-bridge. Local mosquitto that the edge clients (open3e,
+# e3oncan, sml2mqtt) publish to over loopback; it bridges to the central
+# cluster broker over TLS. open3e/e3oncan have no native MQTTS, so this is how
+# edge-1's MQTT gets off plaintext on the untrusted IoT VLAN, and it buffers
+# telemetry in RAM if the cluster broker is briefly unreachable.
+#
+# eMMC: this host runs on a small internal eMMC, so the local broker writes
+# NOTHING to flash — `persistence false` keeps retained/queued messages in RAM
+# only, and `log_dest stdout` goes to the (volatile, RAM) journal that Alloy
+# ships to Loki. Do not add persistence/log-file settings here.
+persistence false
+log_dest stdout
+log_type error
+log_type warning
+log_type notice
+
+# Loopback only — the trust boundary is the host itself. Any process on edge-1
+# may publish here (same trust as the bridged services); nothing off-host can
+# reach it. Real authentication to the cluster happens on the bridge below.
+# Single v4-loopback listener: all edge clients dial 127.0.0.1 (edge_mqtt_host),
+# and a second same-port listener can make some builds refuse to start.
+listener 1883 127.0.0.1
+allow_anonymous true
+
+# --- Bridges to the cluster broker (REN-1307). bridge.d holds either
+# {{ edge_mqtt_bridge_account }}.conf, written by edge-mqtt-cred with the password
+# mqtt-account-controller pushed, or, until that first push, legacy.conf with
+# the two vault-password bridges. edge-mqtt-cred deletes legacy.conf when it
+# writes the new file.
+include_dir /etc/mosquitto/bridge.d
@@ -0,0 +1,13 @@
+{{ {
+  "port": edge_mqtt_cred_port,
+  "allowed_cn": edge_mqtt_cred_allowed_cn,
+  "user": edge_mqtt_bridge_account,
+  "cert": "/etc/edge-mqtt-cred/tls.crt",
+  "key": "/etc/edge-mqtt-cred/tls.key",
+  "ca": "/etc/edge-mqtt-cred/mqtt-ca.crt",
+  "template": "/etc/edge-mqtt-cred/bridge.conf.in",
+  "bridge_file": "/etc/mosquitto/bridge.d/" ~ edge_mqtt_bridge_account ~ ".conf",
+  "legacy_files": ["/etc/mosquitto/bridge.d/legacy.conf"],
+  "local_port": edge_mqtt_port,
+  "state_topic": "$SYS/broker/connection/" ~ edge_mqtt_bridge_account ~ "/state",
+} | to_nice_json }}
@@ -0,0 +1,19 @@
+# Managed by roles/mqtt-bridge (REN-1307). See /usr/local/sbin/edge-mqtt-cred.
+[Unit]
+Description=Receives the MQTT bridge credential from mqtt-account-controller
+After=network-online.target mosquitto.service
+Wants=network-online.target
+
+[Service]
+ExecStart=/usr/bin/python3 /usr/local/sbin/edge-mqtt-cred /etc/edge-mqtt-cred/config.json
+Restart=always
+RestartSec=5
+# Root only to write the bridge file and restart mosquitto.
+ProtectSystem=strict
+ReadWritePaths=/etc/mosquitto/bridge.d
+ProtectHome=true
+PrivateTmp=true
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target
@@ -6,13 +6,3 @@ netbird_management_url: "https://netbird.renner.uno"

 # Setup key - should be defined in group_vars or host_vars
 # netbird_setup_key: ""
-
-# Release installed on hosts without a NetBird package repository (Arch).
-# Debian/Ubuntu follow the apt repository instead.
-netbird_client_version: "0.75.0"
-netbird_release_url: "https://github.com/netbirdio/netbird/releases/download/v{{ netbird_client_version }}"
-# On the controller; the archive is copied from there to the hosts.
-netbird_download_dir: "{{ lookup('ansible.builtin.env', 'HOME') }}/.cache/ansible/netbird"
-
-# Leave the host's DNS configuration alone (hosts with a pinned resolv.conf).
-netbird_disable_dns: false
@@ -2,90 +2,47 @@
 # NetBird Client Installation Role
 # Installs and configures NetBird client on hosts with netbird_setup_key defined

- name: Install NetBird from the NetBird apt repository
-  when: ansible_facts['os_family'] == 'Debian'
-  block:
-    - name: Install required packages
-      ansible.builtin.apt:
-        name:
-          - curl
-          - ca-certificates
-          - gnupg
-          # deb822_repository
-          - python3-debian
-        state: present
-        update_cache: true
+- name: Install required packages
+  ansible.builtin.apt:
+    name:
+      - curl
+      - ca-certificates
+      - gnupg
+    state: present
+    update_cache: true

-    - name: Add NetBird repository key
-      ansible.builtin.shell:
-        cmd: |
-          curl -sSL https://pkgs.netbird.io/debian/public.key | gpg --dearmor -o /usr/share/keyrings/netbird-archive-keyring.gpg
-        creates: /usr/share/keyrings/netbird-archive-keyring.gpg
+- name: Add NetBird repository key
+  ansible.builtin.shell:
+    cmd: |
+      curl -sSL https://pkgs.netbird.io/debian/public.key | gpg --dearmor -o /usr/share/keyrings/netbird-archive-keyring.gpg
+    creates: /usr/share/keyrings/netbird-archive-keyring.gpg

-    - name: Add NetBird repository
-      ansible.builtin.deb822_repository:
-        name: netbird
-        types: deb
-        uris: https://pkgs.netbird.io/debian
-        suites: stable
-        components: main
-        signed_by: /usr/share/keyrings/netbird-archive-keyring.gpg
+- name: Add NetBird repository
+  ansible.builtin.apt_repository:
+    repo: "deb [signed-by=/usr/share/keyrings/netbird-archive-keyring.gpg] https://pkgs.netbird.io/debian stable main"
+    state: present
+    filename: netbird

-    # A one-line netbird.list beside netbird.sources lists the repository twice.
-    - name: Remove the one-line NetBird repository
-      ansible.builtin.file:
-        path: /etc/apt/sources.list.d/netbird.list
-        state: absent
+- name: Install NetBird client
+  ansible.builtin.apt:
+    name: netbird
+    state: present
+    update_cache: true

-    - name: Install NetBird client
-      ansible.builtin.apt:
-        name: netbird
-        state: present
-        update_cache: true
+- name: Check if NetBird is already connected
+  ansible.builtin.command: netbird status
+  register: netbird_status
+  changed_when: false
+  failed_when: false

-# Arch has no netbird package in its repositories; the release binary is
-# verified against the release's checksums file. It is downloaded on the
-# controller and copied over: github.com has no IPv6 address, and proxy-1 is
-# IPv6-only. The controller steps also run in check mode: they only write on
-# the controller, and the install step needs the archive.
- name: Install NetBird from the release tarball
-  when: ansible_facts['os_family'] == 'Archlinux'
-  block:
-    - name: Create the controller download directory
-      ansible.builtin.file:
-        path: "{{ netbird_download_dir }}"
-        state: directory
-        mode: "0755"
-      delegate_to: localhost
-      become: false
-      run_once: true
-      check_mode: false
-
-    - name: Download the NetBird release on the controller
-      check_mode: false
-      ansible.builtin.get_url:
-        url: "{{ netbird_release_url }}/netbird_{{ netbird_client_version }}_linux_amd64.tar.gz"
-        dest: "{{ netbird_download_dir }}/netbird_{{ netbird_client_version }}_linux_amd64.tar.gz"
-        checksum: "sha256:{{ netbird_release_url }}/netbird_{{ netbird_client_version }}_checksums.txt"
-        mode: "0644"
-      delegate_to: localhost
-      become: false
-      run_once: true
-
-    - name: Install the NetBird binary
-      ansible.builtin.unarchive:
-        src: "{{ netbird_download_dir }}/netbird_{{ netbird_client_version }}_linux_amd64.tar.gz"
-        dest: /usr/local/bin
-        include:
-          - netbird
-        owner: root
-        group: root
-        mode: "0755"
-
-    - name: Install the NetBird service
-      ansible.builtin.command: netbird service install
-      args:
-        creates: /etc/systemd/system/netbird.service
+- name: Connect NetBird to management server
+  ansible.builtin.command: >
+    netbird up
+    --management-url {{ netbird_management_url }}
+    --setup-key {{ netbird_setup_key }}
+  when: "'Connected' not in netbird_status.stdout"
+  register: netbird_connect
+  changed_when: netbird_connect.rc == 0

 - name: Enable NetBird service
  ansible.builtin.service:
@@ -93,29 +50,9 @@
    state: started
    enabled: true

- name: Check if NetBird is already connected
-  ansible.builtin.command: netbird status
-  register: netbird_status
-  check_mode: false
-  changed_when: false
-  failed_when: false
-
-# "Disconnected" contains "Connected", so match the management line.
- name: Connect NetBird to management server
-  ansible.builtin.command: >
-    netbird up
-    --management-url {{ netbird_management_url }}
-    --setup-key {{ netbird_setup_key }}
-    {{ '--disable-dns' if netbird_disable_dns else '' }}
-  when: "'Management: Connected' not in netbird_status.stdout"
-  register: netbird_connect
-  changed_when: netbird_connect.rc == 0
-  no_log: true
-
 - name: Get NetBird status
  ansible.builtin.command: netbird status
  register: netbird_final_status
-  check_mode: false
  changed_when: false

 - name: Display NetBird status
@@ -136,13 +136,23 @@
    - /opt/netbird/proxy
    - /opt/netbird/proxy-state

-# The management store has no cluster-side backup; the cluster's backup
-# key is gone with the managed authorized_keys (ssh-ca role).
+# The management store has no cluster-side backup. Pulling one put a root
+# key on this host that the cluster held, and this server's own state is
+# its own business to protect rather than the cluster's. Dropping the two
+# tasks that placed them would only stop ansible managing the key and the
+# script — the pair below revokes them instead, and can go once the role
+# has run against every host that ever carried them.
 - name: Remove the backup dump script
  ansible.builtin.file:
    path: /usr/local/bin/netbird-backup-dump
    state: absent

+- name: Revoke the cluster backup key
+  ansible.posix.authorized_key:
+    user: root
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeW/L9bHMTSa5/Qb0ClppCf4Z0hL39JwzI6tBmKd2FG netbird-backup@homelab-cluster"
+    state: absent
+
 - name: Wait for management container to be ready
  ansible.builtin.pause:
    seconds: 10
@@ -157,7 +167,6 @@
 - name: Read the host NetBird client config
  ansible.builtin.command: netbird debug config
  register: _netbird_client_config
-  check_mode: false
  changed_when: false
  when: _netbird_client.stat.exists

@@ -61,10 +61,6 @@ services:
      - AUTH_AUDIENCE={{ netbird_auth_audience }}
      - AUTH_CLIENT_ID={{ netbird_auth_client_id }}
      - AUTH_AUTHORITY={{ netbird_auth_issuer }}
-      # The CSP allows AUTH_AUTHORITY only as a path (/application/o/netbird/);
-      # Authentik's token/userinfo endpoints sit outside it, so the browser
-      # would block the code exchange and every token refresh.
-      - NETBIRD_CSP={{ netbird_auth_issuer | urlsplit('scheme') }}://{{ netbird_auth_issuer | urlsplit('netloc') }}
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email
      - NETBIRD_TOKEN_SOURCE=idToken
@@ -0,0 +1,20 @@
+---
+# Node Exporter defaults
+
+node_exporter_version: "1.8.2"
+node_exporter_port: 9100
+node_exporter_user: node-exporter
+node_exporter_group: node-exporter
+
+# Installation paths
+node_exporter_install_dir: /opt/node-exporter
+node_exporter_binary: "{{ node_exporter_install_dir }}/node_exporter"
+
+# Collectors to enable (defaults are usually sufficient)
+node_exporter_enabled_collectors:
+  - systemd
+  - processes
+  - timex
+
+# Collectors to disable
+node_exporter_disabled_collectors: []
@@ -0,0 +1,62 @@
+#!/bin/bash
+# Generate Prometheus metrics from chronyc tracking output
+# Runs as a cron job and outputs to textfile collector directory
+
+OUTPUT_FILE="${1:-/var/lib/node-exporter/chrony.prom}"
+
+# Get chrony tracking info
+tracking=$(chronyc tracking 2>/dev/null)
+
+if [ -z "$tracking" ]; then
+    echo "chrony_up 0" > "$OUTPUT_FILE.tmp"
+    mv "$OUTPUT_FILE.tmp" "$OUTPUT_FILE"
+    exit 0
+fi
+
+# Parse values
+stratum=$(echo "$tracking" | grep "^Stratum" | awk '{print $3}')
+system_time=$(echo "$tracking" | grep "^System time" | awk '{print $4}')
+root_delay=$(echo "$tracking" | grep "^Root delay" | awk '{print $4}')
+root_dispersion=$(echo "$tracking" | grep "^Root dispersion" | awk '{print $4}')
+last_offset=$(echo "$tracking" | grep "^Last offset" | awk '{print $4}')
+rms_offset=$(echo "$tracking" | grep "^RMS offset" | awk '{print $4}')
+frequency=$(echo "$tracking" | grep "^Frequency" | awk '{print $3}')
+ref_id=$(echo "$tracking" | grep "^Reference ID" | awk '{print $4}' | tr -d '()')
+
+# Handle negative offsets (remove leading + or keep -)
+system_time=$(echo "$system_time" | sed 's/^+//')
+last_offset=$(echo "$last_offset" | sed 's/^+//')
+rms_offset=$(echo "$rms_offset" | sed 's/^+//')
+
+# Output Prometheus metrics
+cat > "$OUTPUT_FILE.tmp" << EOF
+# HELP chrony_stratum Current stratum of the NTP server
+# TYPE chrony_stratum gauge
+chrony_stratum ${stratum:-0}
+# HELP chrony_system_time_offset_seconds System time offset from NTP time
+# TYPE chrony_system_time_offset_seconds gauge
+chrony_system_time_offset_seconds ${system_time:-0}
+# HELP chrony_root_delay_seconds Total round-trip delay to the primary reference clock
+# TYPE chrony_root_delay_seconds gauge
+chrony_root_delay_seconds ${root_delay:-0}
+# HELP chrony_root_dispersion_seconds Total dispersion to the primary reference clock
+# TYPE chrony_root_dispersion_seconds gauge
+chrony_root_dispersion_seconds ${root_dispersion:-0}
+# HELP chrony_last_offset_seconds Estimated offset of the last update
+# TYPE chrony_last_offset_seconds gauge
+chrony_last_offset_seconds ${last_offset:-0}
+# HELP chrony_rms_offset_seconds RMS offset
+# TYPE chrony_rms_offset_seconds gauge
+chrony_rms_offset_seconds ${rms_offset:-0}
+# HELP chrony_frequency_ppm Frequency offset in parts per million
+# TYPE chrony_frequency_ppm gauge
+chrony_frequency_ppm ${frequency:-0}
+# HELP chrony_up Whether chrony is running and synchronized
+# TYPE chrony_up gauge
+chrony_up 1
+# HELP chrony_reference_info Reference clock information
+# TYPE chrony_reference_info gauge
+chrony_reference_info{reference="${ref_id:-unknown}"} 1
+EOF
+
+mv "$OUTPUT_FILE.tmp" "$OUTPUT_FILE"
@@ -0,0 +1,9 @@
+---
+- name: Reload systemd
+  systemd:
+    daemon_reload: yes
+
+- name: Restart node-exporter
+  systemd:
+    name: node-exporter
+    state: restarted
--- a/Show More
+++ b/Show More