feat(otbr): run an own Thread network on the SLZB-06P7

otbr comes back with its own network instead of joining the Nest's
NEST-PAN-339C, so the Nest Hub can leave the IoT VLAN (S28-46/S28-48).
The bootstrap Job forms it (dataset init new, channel 15, name
Suedstr28-Thread) on a fresh otbr-thread PVC; the Nest dataset
ExternalSecret is dropped and the Flux Kustomization un-suspended.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kubernetes/apps/authentik/helmrelease.yaml

@@ -113,8 +113,10 @@ spec:
           value: "10.244.0.0/16,fd10:244::/48,127.0.0.0/8,::1/128"
     authentik:
       log_level: info
+      # Off: reports would go to authentik.error-reporting.a7k.io (Sentry),
+      # which egress policy denies. The outposts take this from the server.
       error_reporting:
-        enabled: true
+        enabled: false
       postgresql:
         host: "ak-pg-rw.authentik.svc.cluster.local"
         name: "authentik"

kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml

@@ -64,7 +64,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: shelly-manager
-          image: gitea.renner.uno/konairius/shelly-manager:2026-11-07-1918 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/konairius/shelly-manager:2026-11-07-2052 # {"$imagepolicy": "flux-system:shelly-manager"}
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

kubernetes/apps/otbr/dataset-bootstrap.yaml

@@ -1,14 +1,18 @@
 ---
-# One-shot seed Job. Idempotent — exits 0 immediately if the OTBR pod
-# already has an active dataset configured. On a clean install (PVC
-# empty, otbr-agent loaded with --auto-attach=0 so it boots into the
-# `disabled` state without crashing), it runs the proven bring-up
-# sequence:
+# One-shot Job that forms otbr's own Thread network. Idempotent — exits 0
+# immediately if the OTBR pod already has an active dataset. On a clean
+# install (PVC empty, otbr-agent loaded with --auto-attach=0 so it boots
+# into the `disabled` state without crashing), it runs:
 #   1. ot-ctl ifconfig up   (enables PHY on the radio)
-#   2. ot-ctl dataset set active <hex>  (commits dataset; SetMacKey
-#      now succeeds because the radio is enabled)
-#   3. ot-ctl thread start  (MLE attaches; state goes detached → child
-#      → router → leader)
+#   2. ot-ctl dataset init new, channel, networkname, commit active
+#      (random network key, PAN ID, extended PAN ID and mesh-local
+#      prefix; SetMacKey succeeds because the radio is enabled)
+#   3. ot-ctl thread start  (MLE attaches; state goes detached → leader)
+#
+# Channel 15 sits between Wi-Fi channels 1 and 6, clear of the 2.4 GHz
+# APs (channels 1, 6, 11) and of Zigbee on channel 25. The dataset,
+# including the network key, lives only on the otbr-thread PVC and in
+# Home Assistant's thread.datasets (read over the OTBR REST API).
 #
 # This sequence is the workaround for SLZB-06P7 firmware behavior where
 # `dataset set active` triggers an immediate KeyManager push that fails
@@ -76,11 +80,10 @@ spec:
           # (mismatched skew can break exec streaming).
           image: docker.io/alpine/kubectl:1.37.2@sha256:5e2de75d37e811ba6eb92e06890b1b3263eae4f0a1c17b49269edec589b1352a
           env:
-            - name: DATASET_TLV
-              valueFrom:
-                secretKeyRef:
-                  name: otbr-active-dataset
-                  key: active-dataset.tlv
+            - name: THREAD_CHANNEL
+              value: "15"
+            - name: THREAD_NETWORK_NAME
+              value: "Suedstr28-Thread"
           command:
             - sh
             - -c
@@ -89,8 +92,8 @@ spec:
               NS=home-assistant
               SEL=app.kubernetes.io/name=otbr
 
-              # otbr is disabled (replicas: 0, see deployment.yaml). With
-              # the force annotation, every image bump re-creates this Job;
+              # With otbr scaled to 0 there is no pod to seed. With the
+              # force annotation, every image bump re-creates this Job;
               # exit 0 instead of waiting for a pod that never comes.
               replicas=$(kubectl -n "$NS" get deployment otbr \
                 -o jsonpath='{.spec.replicas}')
@@ -132,16 +135,19 @@ spec:
                 exit 0
               fi
 
-              echo "no active dataset; seeding..."
+              echo "no active dataset; forming ${THREAD_NETWORK_NAME} on channel ${THREAD_CHANNEL}..."
 
               # Order matters: ifconfig up first so the radio's PHY is
               # ENABLED before dataset commit triggers SetMacKey. Without
               # this, SetMacKey returns INVALID_STATE and otbr-agent
               # fatal-exits.
-              kubectl -n "$NS" exec "$pod" -c otbr -- ot-ctl ifconfig up
-              kubectl -n "$NS" exec "$pod" -c otbr -- \
-                ot-ctl dataset set active "$DATASET_TLV"
-              kubectl -n "$NS" exec "$pod" -c otbr -- ot-ctl thread start
+              ot() { kubectl -n "$NS" exec "$pod" -c otbr -- ot-ctl "$@"; }
+              ot ifconfig up
+              ot dataset init new
+              ot dataset channel "$THREAD_CHANNEL"
+              ot dataset networkname "$THREAD_NETWORK_NAME"
+              ot dataset commit active
+              ot thread start
 
               # Verify Thread came up.
               for i in $(seq 1 30); do

kubernetes/apps/otbr/deployment.yaml

@@ -5,16 +5,11 @@ metadata:
   labels:
     app.kubernetes.io/name: otbr
 spec:
-  # DISABLED (replicas: 0). Running otbr broke Matter: its radio is RF-isolated
-  # enough from the Nest mesh that it forms a rival partition of the same
-  # network, and the two bridge only over Ethernet — fast enough for a ping,
-  # too slow for the fragmented CASE handshake, so devices stay discoverable
-  # while every commissioning attempt times out.
-  #
-  # The instability is at the Thread partition layer, not in the config below.
-  # Re-enable only once co-BR integration is verified to MERGE: one partition,
-  # one OMR prefix, and the Nest routers visible in otbr's router table.
-  replicas: 0
+  # otbr runs its own Thread network, formed by otbr-dataset-bootstrap. It is
+  # not a co-BR of the Nest's NEST-PAN-339C: its radio does not hear that mesh
+  # well enough to merge partitions, and partitions bridged only over
+  # Ethernet are too slow for Matter's CASE handshake.
+  replicas: 1
   strategy:
     type: Recreate
   selector:
@@ -344,4 +339,4 @@ spec:
       volumes:
         - name: data
           persistentVolumeClaim:
-            claimName: otbr-data
+            claimName: otbr-thread

kubernetes/apps/otbr/externalsecret.yaml

@@ -1,15 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: otbr-active-dataset
-  namespace: home-assistant
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  target:
-    name: otbr-active-dataset # keeps the old Secret's name — consumers unchanged
-  dataFrom:
-    - extract:
-        key: apps/otbr

kubernetes/apps/otbr/kustomization.yaml

@@ -3,7 +3,6 @@ kind: Kustomization
 namespace: home-assistant
 resources:
   - dataset-bootstrap.yaml
-  - externalsecret.yaml
   - deployment.yaml
   - network-attachment.yaml
   - pvc.yaml

kubernetes/apps/otbr/pvc.yaml

@@ -9,7 +9,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: otbr-data
+  name: otbr-thread
 spec:
   accessModes:
     - ReadWriteOnce

kubernetes/clusters/homelab/home-assistant.yaml

@@ -91,8 +91,6 @@ spec:
     name: flux-system
   path: ./kubernetes/apps/otbr
   prune: true
-  # Not in use.
-  suspend: true
   wait: true
   # decryption block dropped 2026-07-13: path is sops-free — secrets come
   # from OpenBao via ESO (MIGRATION-sops-openbao.md).

kubernetes/infrastructure/image-automation/immich.yaml

@@ -1,11 +1,14 @@
 apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImageRepository
+# 6h, not 1h: both repositories carry tens to hundreds of thousands of PR
+# build tags, and every scan pages the full list anonymously, which runs
+# into ghcr.io's rate limit.
 metadata:
   name: immich-server
   namespace: flux-system
 spec:
   image: ghcr.io/immich-app/immich-server
-  interval: 1h
+  interval: 6h
 ---
 # v-prefix tags only, semver 3.x. The 4.x cutover would need manual
 # review — Immich major bumps historically require migration.
@@ -31,7 +34,7 @@ metadata:
   namespace: flux-system
 spec:
   image: ghcr.io/immich-app/immich-machine-learning
-  interval: 1h
+  interval: 6h
 ---
 # Same policy as immich-server; machine-learning image must stay in
 # version-sync with the server image (Immich docs require it).

kubernetes/infrastructure/network-policies/home-assistant-ns.yaml

@@ -467,7 +467,8 @@ spec:
             - port: "443"
               protocol: TCP
 ---
-# zigbee2mqtt: Zigbee coordinator (SLZB) TCP socket.
+# zigbee2mqtt: Zigbee coordinator (SLZB) TCP socket, and the OTA index and
+# firmware images (Koenkk/zigbee-OTA) on raw.githubusercontent.com.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -498,6 +499,47 @@ spec:
         - ports:
             - port: "6638"
               protocol: TCP
+    - toFQDNs:
+        - matchName: "raw.githubusercontent.com"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+---
+# matter-server: the CSA DCL (PAA root certificates, vendor names, OTA
+# metadata) and the development PAA certificates of project-chip on GitHub.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: matter-server-egress
+  namespace: home-assistant
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: matter-server
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "on.dcl.csa-iot.org"
+        - matchName: "api.github.com"
+        - matchName: "raw.githubusercontent.com"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
 ---
 # mqtt-account-controller: credential delivery to deliver.esp32 targets in mqtt-accounts.yaml.
 apiVersion: cilium.io/v2