chore(deps): update ci non-major

chore(image-automation): bump lscr.io/linuxserver/lidarr:3.1.6.5079-ls46
Updates managed by image-automation-controller.
2026-10-26 03:01:34 +00:00 · 2026-10-26 02:52:46 +00:00 · 2026-10-25 22:16:39 +00:00 · 2026-10-25 22:16:23 +00:00 · 2026-10-25 21:06:03 +01:00 · 2026-10-25 15:23:41 +00:00
77 changed files with 1194 additions and 1064 deletions
@@ -319,7 +319,7 @@ steps:
  # writes its stripped mirror under mktemp and never into the workspace.
  - name: promtool
    depends_on: [] # see note above `steps:`
-    image: prom/prometheus:v3.15.0@sha256:efd719c99d83b060d9daefdcf00360461adf279f45ef5391f8d111892118753e
+    image: prom/prometheus:v3.15.1@sha256:fa3302279710be2f21a8301ec17a8b4f2301fd829bd113839b3b6b02b6f191a2
    commands:
      - sh scripts/ci/promtool-rules.sh

@@ -35,25 +35,25 @@ when:
 steps:
  - name: model-selection-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
    commands:
      - sh scripts/ci/test-model-selection.sh

  - name: pr-review-mistral-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
    commands:
      - sh scripts/ci/test-pr-review-mistral.sh

  - name: promtool-rules-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
    commands:
      - sh scripts/ci/test-promtool-rules.sh

  - name: yaml-citations-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
    commands:
      - sh scripts/ci/test-yaml-citations.sh

@@ -63,7 +63,7 @@ steps:
  # bridge, and the secret guard.
  - name: hermes-skill-tests
    depends_on: []
-    image: python:3.14-alpine@sha256:f6a589d43c42b9e7f7dc67a12d37132491f362859a5d750607710cc56da3bc72
+    image: python:3.15-alpine@sha256:d44b1254cb92329418d164b22b20d86bbd3869d48e80e09e476531a409a728bb
    environment:
      PYTHONDONTWRITEBYTECODE: "1"
    commands:
@@ -13,7 +13,7 @@ when:

 steps:
  - name: validate-secrets
-    image: alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+    image: alpine:3.24.3@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
    environment:
      TF_VAR_proxmox_api_url:
        from_secret: proxmox_api_url
@@ -26,7 +26,7 @@ steps:
    # fetch-models.sh response mapping. No cluster, no secrets, no network — the
    # ci-claude image just provides sh + jq. Keeps the flag-injection regression
    # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
    commands:
      - sh scripts/ci/test-model-selection.sh

@@ -6,7 +6,7 @@ when:

 steps:
  - name: go-test
-    image: golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61
+    image: golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
    commands:
      - test -z "$(gofmt -l review-bot)"
      - go -C review-bot vet ./...
@@ -18,12 +18,12 @@ when:

 steps:
  - name: iac-scan
-    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
+    image: aquasec/trivy:latest@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c
    commands:
      - trivy fs --format json -o trivy-iac.json --severity CRITICAL,HIGH --ignore-unfixed .

  - name: image-scans
-    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
+    image: aquasec/trivy:latest@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c
    commands:
      - trivy image --download-db-only
      - |
@@ -70,7 +70,7 @@ steps:
    # this step is skipped — otherwise we'd fork-bomb PRs.
    when:
      - branch: main
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -30,7 +30,7 @@ when:

 steps:
  - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -72,14 +72,14 @@ none of these commands.

 ## Secrets (before first play run)

-Create `inventory/group_vars/edge_host/vault.yml` with ansible-vault; the
-current live values come straight out of the cluster:
+Create `inventory/group_vars/edge_host/vault.yml` with ansible-vault. The
+cluster broker has no `open3e` user: edge-1 logs in only as the register
+account `edge-1` (see "MQTT bridge" below), so
+`vault_edge_open3e_mqtt_password` reaches only the loopback broker, which
+allows anonymous clients; any random value works (`openssl rand -hex 24`).
+The zwave-js value comes out of the cluster:

 ```
-# sml2mqtt broker password
-kubectl -n home-assistant get secret mosquitto-sml2mqtt-credentials -o jsonpath='{.data.password}' | base64 -d
-# open3e broker password
-kubectl -n home-assistant get secret mosquitto-open3e-credentials -o jsonpath='{.data.password}' | base64 -d
 # zwave-js session secret
 kubectl -n home-assistant get secret zwave-js-session -o jsonpath='{.data.session-secret}' | base64 -d
 ```
@@ -230,15 +230,14 @@ They connect to a **local mosquitto on loopback** (`127.0.0.1:1883`,
  broker is briefly unreachable, and flushes on reconnect — edge-1 no longer
  hard-depends on cluster/network uptime for every publish.

-Two bridge `connection`s preserve the existing cluster identities, so **no
-cluster-side change was needed**: one authenticates as the `open3e` user
-(carries `open3e/#` out + `open3e/cmnd` back), one as `sml2mqtt` (`sml2mqtt/#`
-out). The local broker is `allow_anonymous` on loopback — the trust boundary
-is the host; nothing off-host can reach it.
+The local broker is `allow_anonymous` on loopback — the trust boundary is the
+host; nothing off-host can reach it.

-**Bridge credential (REN-1307).** The two vault-password bridges are being
-replaced by one bridge as the register account `edge-1`
-(`kubernetes/apps/home-assistant/mqtt-accounts.yaml`). Its password is pushed
+**Bridge credential (REN-1307).** One bridge `connection` logs in as the
+register account `edge-1` (`kubernetes/apps/home-assistant/mqtt-accounts.yaml`)
+and carries `open3e/#` out and `open3e/cmnd` back. The cluster broker does not
+accept the vault-password bridges in `bridge.d/legacy.conf`, which exists only
+until the first push. Its password is pushed
 by mqtt-account-controller to `edge-mqtt-cred` (`:8443`, the controller's
 esp32 API over HTTPS). That endpoint accepts only a client certificate from
 the MQTT CA with CN `mqtt-account-controller`; edge-1 holds the public CA and
@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a

 # Alpine plus jq. Nothing application-specific — a general-purpose base for any
 # workload that needs to read JSON from a shell script.
@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a

 # Alpine plus the openssl CLI. Nothing application-specific — named for what it
 # is, so anything needing `openssl s_client` / `x509` from a shell script can use
@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a

 RUN apk add --no-cache \
      ansible \
@@ -5,12 +5,12 @@

 # The unit tests gate the image: the final stage copies the controller out of
 # this stage, so a failing test fails the build.
-FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce AS test
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 AS test
 WORKDIR /src
 COPY controller.py test_controller.py ./
 RUN python3 -B -m unittest -v

-FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51

 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY --from=test /src/controller.py /opt/controller.py
@@ -1,6 +1,6 @@
-FROM hetznercloud/cli:v1.70.1@sha256:795ac09a5ecabd48cc13a8f1c3dc45983c8f75ae1277c70d621719e07f276ccb AS hcloud
+FROM hetznercloud/cli:v1.70.2@sha256:3b3a8f66323a5754089df7939fd9d3f350127072deed13418f3d3052b4bbeeae AS hcloud

-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a

 RUN apk add --no-cache \
      bash \
@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a

 # bird: BGP daemon for the pod-network mesh over pod0. Distro package, no build
 # step — the image is the binary plus its runtime.
@@ -1,4 +1,4 @@
-FROM node:24-alpine@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f
+FROM node:24-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53

 # Default to the latest Claude Code. Pinning a fixed version is the wrong
 # default here: old releases eventually stop working against the API, so a
@@ -2,7 +2,7 @@
 # Cloudflare. The unit tests (no tags, so no envtest) gate the image: the
 # final stage copies the binary out of this stage, so a failing test fails the
 # build.
-FROM golang:1.27@sha256:820153096fda4de6ac1b7194d12e416b7dd8f4e9a33d17e0345b111b945162d8 AS build
+FROM golang:1.27@sha256:f20d83a83e18dbd2a4714b8ffd4b30b287b6243962dd75608e86abcc63ba4efc AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -10,7 +10,7 @@ COPY . .
 RUN go test ./...
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/cloudflare-lb-sync ./cmd/cloudflare-lb-sync

-FROM gcr.io/distroless/static:nonroot@sha256:e2e927ec666bae08560abb3c55d0659eceabb657f56b6782ab500a9fc7f555e3
+FROM gcr.io/distroless/static:nonroot@sha256:18f4cc26c9ffa7f20a359298be7deadac5c607c8e03a02b8119f1a5fc2f82c99
 COPY --from=build /out/cloudflare-lb-sync /cloudflare-lb-sync
 USER 65532
 ENTRYPOINT ["/cloudflare-lb-sync"]
@@ -28,7 +28,7 @@
 # amd64 only, matching the ARCH the installer already hardcoded and the cluster's
 # node architecture. Add a second stage if a different arch is ever needed.

-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS fetch
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a AS fetch

 ARG CNI_PLUGINS_VERSION=v1.9.1
 ARG CNI_PLUGINS_SHA256=b98f74a0f8522f0a83867178729c1aa70f2158f90c45a2ca8fa791db1c76b303
@@ -61,7 +61,7 @@ RUN set -eu; \
      [ -x "/plugins/$p" ] || { echo "FATAL: /plugins/$p missing or not executable" >&2; exit 1; }; \
    done

-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a

 # Alpine rather than scratch: the installer needs a shell to copy the binaries
 # onto the host. busybox covers cp/mv/chown/ls, so nothing is added.
@@ -23,7 +23,7 @@
 # namespace, so can0 is only reachable with network_mode: host. That is also
 # how the local MQTT broker on 127.0.0.1:1883 is reached. CAN_RAW sockets need
 # no capabilities, so both run unprivileged.
-FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce AS build
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 AS build

 # Pins live here, in the artifact, rather than in Ansible variables.
 #
@@ -56,7 +56,7 @@ RUN git clone --quiet https://github.com/MyHomeMyData/E3onCAN.git /opt/e3oncan \
 && rm -rf /opt/e3oncan/.git


-FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51

 ARG OPEN3E_REF=6553c10453a6bae1210908f38a5af2481a46a3e5
 ARG E3ONCAN_REF=461dcbdf97e8d72d2edb9929c63b39382af6c3a1
@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a

 ARG TALOS_VERSION=v1.13.12
 ARG VELERO_VERSION=v1.16.0
@@ -1,7 +1,7 @@
 # kuma-sync: reconciles KumaMonitor resources into Uptime Kuma. The unit tests
 # (no tags, so no Docker and no envtest) gate the image: the final stage copies
 # the binary out of this stage, so a failing test fails the build.
-FROM golang:1.27@sha256:820153096fda4de6ac1b7194d12e416b7dd8f4e9a33d17e0345b111b945162d8 AS build
+FROM golang:1.27@sha256:f20d83a83e18dbd2a4714b8ffd4b30b287b6243962dd75608e86abcc63ba4efc AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -9,7 +9,7 @@ COPY . .
 RUN go test ./...
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/kuma-sync ./cmd/kuma-sync

-FROM gcr.io/distroless/static:nonroot@sha256:e2e927ec666bae08560abb3c55d0659eceabb657f56b6782ab500a9fc7f555e3
+FROM gcr.io/distroless/static:nonroot@sha256:18f4cc26c9ffa7f20a359298be7deadac5c607c8e03a02b8119f1a5fc2f82c99
 COPY --from=build /out/kuma-sync /kuma-sync
 USER 65532
 ENTRYPOINT ["/kuma-sync"]
@@ -2,7 +2,7 @@
 # domains -> TLS passthrough -> Traefik ClusterIP) from Ingresses carrying the
 # public label. Standard library only, so the image is the interpreter plus one
 # file; runs unprivileged as its own user.
-FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51

 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY controller.py /opt/controller.py
@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a

 ARG TOFU_VERSION=1.11.0

@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a

 # Everything `bootstrap.sh vmtest` needs, so the rebuild test can run as a Job in
 # the cluster instead of on a workstation. The workstation has 31G and the test
@@ -70,7 +70,7 @@ spec:
              mountPath: /ca
      containers:
        - name: audiobookshelf
-          image: ghcr.io/advplyr/audiobookshelf:2.37.1 # {"$imagepolicy": "flux-system:audiobookshelf"}
+          image: ghcr.io/advplyr/audiobookshelf:2.37.2 # {"$imagepolicy": "flux-system:audiobookshelf"}
          ports:
            - name: http
              containerPort: 80
@@ -1034,9 +1034,19 @@ data:
          negate: false
          failure_result: false

+      # wiki.renner.uno signs in via OIDC application `wiki`; only this group may sign in.
+      # Members are managed in Authentik.
+      - id: wiki-readers-group
+        model: authentik_core.group
+        identifiers:
+          name: Wiki Readers
+        state: present
+        attrs:
+          is_superuser: false
+
      # Wiki (apps/wiki): its own OIDC login. Public client + PKCE; RS256
-      # so the service verifies the ID token against the JWKS. No policy
-      # binding: every Authentik user may sign in.
+      # so the service verifies the ID token against the JWKS. Only the
+      # Wiki Readers group passes.
      - id: wiki-provider
        model: authentik_providers_oauth2.oauth2provider
        identifiers:
@@ -1072,6 +1082,17 @@ data:
          meta_launch_url: https://wiki.renner.uno
          meta_description: "Homelab wiki"

+      - model: authentik_policies.policybinding
+        identifiers:
+          target: !Find [authentik_core.application, [slug, wiki]]
+          group: !KeyOf wiki-readers-group
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: false
+          failure_result: false
+
      # OpenProject, decommissioned. Application first: Application.provider
      # is on_delete=PROTECT. Its policy binding cascades with it.
      - model: authentik_core.application
@@ -105,7 +105,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-23-0748 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
+          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-25-1458 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
@@ -30,7 +30,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/cloudflare-lb-sync:2026-10-22-1904 # {"$imagepolicy": "flux-system:cloudflare-lb-sync"}
+          image: gitea.renner.uno/gitea_admin/cloudflare-lb-sync:2026-10-25-1504 # {"$imagepolicy": "flux-system:cloudflare-lb-sync"}
          env:
            - name: CLOUDFLARE_API_TOKEN
              valueFrom:
@@ -32,7 +32,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: sync
-              image: gitea.renner.uno/konairius/hermes:build.1792569647 # {"$imagepolicy": "flux-system:hermes"}
+              image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
              command:
                - /opt/hermes/.venv/bin/python
                - /opt/hermes-skills/gitea-issues/scripts/sync_webhook.py
@@ -51,7 +51,7 @@ spec:
        # connects from the pod network. No env equivalent exists, so it is
        # set in config.yaml on every start (idempotent).
        - name: config
-          image: gitea.renner.uno/konairius/hermes:build.1792569647 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
          command:
            - /opt/hermes/.venv/bin/hermes
            - config
@@ -75,7 +75,7 @@ spec:
              mountPath: /opt/data
        # WebSocket keepalive ping interval in seconds (default 20).
        - name: config-ws-ping
-          image: gitea.renner.uno/konairius/hermes:build.1792569647 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
          command:
            - /opt/hermes/.venv/bin/hermes
            - config
@@ -99,7 +99,7 @@ spec:
              mountPath: /opt/data
        # Skills from git (ConfigMap hermes-skills) beside the PVC's skills/.
        - name: skills-config
-          image: gitea.renner.uno/konairius/hermes:build.1792569647 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
          command:
            - /opt/hermes/.venv/bin/hermes
            - config
@@ -130,7 +130,7 @@ spec:
        # - alert-monitor: hourly; the script wakes the agent only for
        #   untriaged alerts.
        - name: cron-jobs
-          image: gitea.renner.uno/konairius/hermes:build.1792569647 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
          # Non-fatal: a broken jobs.json or a changed cron CLI after an image
          # bump logs a warning instead of keeping Hermes from starting.
          command:
@@ -187,7 +187,7 @@ spec:
              readOnly: true
        # Home Assistant MCP server; token resolved from HA_TOKEN at connect, writes need approval.
        - name: config-mcp-homeassistant
-          image: gitea.renner.uno/konairius/hermes:build.1792569647 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
          command:
            - /opt/hermes/.venv/bin/hermes
            - config
@@ -214,7 +214,7 @@ spec:
        # skills, the Home Assistant MCP and the tea login are re-applied on
        # every start. default gets the kanban toolset to hand cards to them.
        - name: experts
-          image: gitea.renner.uno/konairius/hermes:build.1792569647 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
          # Non-fatal like cron-jobs: a broken expert logs a warning.
          command:
            - sh
@@ -305,7 +305,7 @@ spec:
        # Gitea issues -> kanban (skills/gitea-issues): route script, webhook route on default,
        # completion shell hook plus its allowlist entry on every profile.
        - name: gitea-issues
-          image: gitea.renner.uno/konairius/hermes:build.1792569647 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
          # Non-fatal like cron-jobs: a failure logs a warning.
          command:
            - sh
@@ -368,7 +368,7 @@ spec:
              readOnly: true
        # Multiplexed default reads platform credentials only from .env (rationale: commit message).
        - name: default-env
-          image: gitea.renner.uno/konairius/hermes:build.1792569647 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
          # Fatal on a writer failure: without these Matrix and the API server stay down.
          command:
            - /opt/hermes/.venv/bin/python
@@ -428,7 +428,7 @@ spec:
        # tea login hermes-bot, written from the mounted token into an
        # emptyDir at the agent's ~/.config/tea.
        - name: tea-login
-          image: gitea.renner.uno/konairius/hermes:build.1792569647 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
          command:
            - sh
            - -ec
@@ -457,7 +457,7 @@ spec:
              readOnly: true
      containers:
        - name: hermes
-          image: gitea.renner.uno/konairius/hermes:build.1792569647 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
          args: ["gateway", "run"]
          env:
            - name: HERMES_DASHBOARD
@@ -1,179 +0,0 @@
-# Proposal: enrol the mosquitto broker credentials in Class-A rotation
-
-**Status:** proposal, nothing implemented.
-**Scope:** the 8 MQTT broker users and the credentials behind them.
-
-## Problem
-
-Every self-generated secret in this cluster rotates automatically except these.
-`kubernetes/infrastructure/openbao/rotation/` holds 13 manifests defining 15
-rotator CronJobs (`home-assistant.yaml` alone defines three). Five are **Class-A**
-— authentik, crowdsec, paperless, shelly-manager and woodpecker — meaning
-"self-generated random secret", which is exactly what a broker password is.
-The mosquitto credentials are the only Class-A-shaped secrets not enrolled.
-
-They are currently minted once by seven near-identical bootstrap Jobs
-(`mosquitto-bootstrap.yaml`, 508 lines — the ServiceAccount, Role and RoleBinding
-are inside that same file) which generate a password, hand-build Secret JSON with
-`jq` and POST it to the Kubernetes API with `curl`. Once created they never
-change again.
-
-Three consequences:
-
-1. **They never rotate.** Not on a schedule, not on compromise, not ever.
-2. **They exist only in the Secret object** — not in OpenBao, so not covered by
-   the OpenBao snapshot CronJob, and unrecoverable if lost.
-3. **The Jobs cannot be modified.** A Job's `spec.template` is immutable, so
-   changing even the container image makes the whole `home-assistant`
-   Kustomization fail to reconcile with `field is immutable`. Any edit requires
-   deleting or renaming the Jobs.
-
-## Why the obvious fixes do not work
-
-Recorded because each was tried and rejected on evidence, and the reasons are
-not obvious from the code.
-
-| Approach | Why it fails |
-| --- | --- |
-| ExternalSecrets reading hand-seeded OpenBao paths | Depends on content copied in by hand. Git cannot recreate it; a fresh OpenBao leaves the paths empty and ESO then overwrites live broker credentials with nothing. |
-| ESO `Password` generator | **Overwrites pre-existing Secrets.** Verified: a Secret holding `KNOWN-PREEXISTING-VALUE` was replaced with a freshly generated password on first sync. Adopting it rotates the 7 Job-minted credentials at once, uncoordinated (`evcc` is already ESO-extract-backed and so unaffected). |
-| Keep the Jobs, fix only the image | Blocked by `spec.template` immutability. Renaming the Jobs works but is a hack that recurs on every future edit. |
-
-The common thread: each treats the credential as something to *place*, when the
-real requirement is a credential that can be *replaced*.
-
-## How rotation actually has to work here
-
-The broker rebuilds its password file from scratch on **every pod start**
-(`mosquitto-deployment.yaml`): `rm -f /mosquitto/auth/passwd` followed by
-`mosquitto_passwd -c -b …` for each of the 8 users, sourced from env vars backed
-by the 8 Secrets.
-
-Two things follow, and they shape the whole design:
-
- **A Secret change has no effect until the broker restarts.** There is no
-  Reloader annotation on the mosquitto Deployment today, unlike the consumers of
-  the existing Class-A rotators.
- **There is no make-before-break.** A mosquitto user has exactly one password.
-  The LLAT rotators can mint a second token and revoke the first afterwards; a
-  broker user cannot hold old and new simultaneously. Unless a transitional
-  second user is created, broker and client must cut over together.
-
-### Who holds each credential
-
-This is the part that determines cutover cost, and it is not visible from the
-manifests alone.
-
-| Broker user | Held by | Cutover |
-| --- | --- | --- |
-| `health` | the broker's own liveness/readiness probes | in-cluster, same pod restart |
-| `zigbee2mqtt` | zigbee2mqtt Deployment (`secretKeyRef`) | in-cluster, pod restart |
-| `evcc` | evcc app; already OpenBao-backed via ESO | in-cluster, pod restart |
-| `sml2mqtt` | edge host, from `vault_edge_sml2mqtt_mqtt_password` | re-run the edge-host play |
-| `open3e` | edge host, from `vault_edge_open3e_mqtt_password` | re-run the edge-host play |
-| `homeassistant` | HA MQTT integration — a config entry created in the UI | needs an API/WebSocket update, or a manual re-entry |
-| `shellies` | Shelly device firmware | pushed per-device; `shelly-manager` is deployed and is the natural mechanism |
-| `admin` | a workstation client, held by a human | read the new value from OpenBao |
-
-Note `sml2mqtt` and `open3e` currently keep **the same password in two unlinked
-places** — the Kubernetes Secret for the broker, and `ansible-vault` for the
-client — synchronised by hand. That duplication, not any client limitation, is
-what makes rotation feel impossible today.
-
-## Proposed design
-
-Follow the existing Class-A pattern exactly (`rotation/paperless.yaml` is the
-closest model): *generate random bytes → merge-patch into OpenBao → ESO syncs the
-Secret → restart the consumer*.
-
-1. **One rotator CronJob per broker user**, running the existing `secret-rotator`
-   binary in random mode, writing `apps/home-assistant/mosquitto-<user>-credentials`
-   in OpenBao. Reuses the established policy/role/SA pattern; no new machinery.
-2. **ExternalSecrets** project each OpenBao entry to the existing Secret name and
-   key, so `mosquitto-deployment.yaml` and the in-cluster consumers are unchanged.
-   Key names stay as they are (`homeassistant-password` on one, `password` on the
-   rest) — consumers reference them, so normalising is a separate change.
-3. **Add a Reloader annotation to the mosquitto Deployment** so a Secret change
-   restarts the broker, instead of silently taking effect at some unrelated future
-   restart.
-4. **Move the edge host off `ansible-vault` for these two values**, reading the
-   same OpenBao entry instead, so there is one source of truth per credential.
-5. **Rotate one user at a time.** Each rotation then affects exactly one client,
-   not all eight.
-
-### The cutover window
-
-With no make-before-break, each rotation has a window where broker and client
-disagree. Two options:
-
- **Accept a brief window** (recommended for most users). Order: rotator writes
-  OpenBao → client picks up the new value → broker restarts. MQTT clients
-  reconnect automatically; the window is seconds. Because rotation is per-user,
-  only that one client is affected.
-
-  One failure mode to expect rather than be alarmed by: the broker rolls with
-  `maxUnavailable: 0` / `maxSurge: 1`, so mid-rollout **two broker pods with
-  different passwd files sit behind the LB**. A client reconnecting during that
-  window can land on the old pod and fail auth until the rollout completes. It is
-  self-healing and lasts seconds to a minute, but it will look alarming in logs
-  during the first `health` / `zigbee2mqtt` rotation, so it is worth knowing in
-  advance.
- **Transitional dual user** (`<user>` and `<user>-next` in the passwd file and
-  ACL) for any credential where even a brief outage is unacceptable. More moving
-  parts; probably only worth it for `homeassistant`, which carries everything.
-
-## Suggested phasing
-
-Ordered so the risky work happens after the pattern is proven, and so each phase
-is independently valuable.
-
-1. **`health` and `zigbee2mqtt` first.** Both are entirely in-cluster and pick up
-   a new password on pod restart with no external coordination. Proves rotator →
-   OpenBao → ESO → Reloader end to end with the smallest blast radius. `health`
-   is the safest possible start: only the broker's own probes consume it.
-2. **`evcc`.** Already OpenBao-backed via ESO; only the rotator is missing.
-3. **`sml2mqtt` and `open3e`**, together with switching the edge host to read from
-   OpenBao. This is where the duplicate-source-of-truth problem gets fixed.
-4. **`shellies`**, via shelly-manager pushing to devices. Needs investigation:
-   shelly-manager has its own Class-A rotator today, but that rotates
-   shelly-manager's own secret and does not touch device MQTT credentials.
-5. **`homeassistant`** last. Highest blast radius, and the config entry is UI-created,
-   so it needs an API/WebSocket update path — the HA LLAT rotators
-   (`rotation/home-assistant.yaml`) already talk to HA over WebSocket and are the
-   obvious precedent.
-6. **`admin`** whenever convenient; a human reads the new value from OpenBao.
-
-Only once a user is enrolled does its bootstrap Job become dead code. Delete the
-Jobs incrementally as their users migrate, rather than in one step — that also
-avoids the immutability problem entirely, since the Jobs are deleted, never
-patched.
-
-## Open questions
-
- **Does `secret-rotator` random mode fit unchanged?** The existing rotators write
-  a field into an OpenBao entry; here the entry holds a single password field, so
-  it should, but this needs confirming against the binary rather than assumed.
- **Can shelly-manager push MQTT credentials to devices**, and does it cover both
-  Gen1 (`/settings/mqtt`) and Gen2+ (`Mqtt.SetConfig`) firmwares? If not, the
-  `shellies` user may need a different mechanism or stay manual longest.
- **How is the HA MQTT config entry updated programmatically?** Reusing the
-  WebSocket approach from the LLAT rotator is plausible but unverified.
- **Rotation cadence.** The existing rotators' schedules should be the reference
-  rather than inventing a new one.
- **ESO refresh latency.** Rotator-writes-OpenBao → Secret-updates →
-  Reloader-restarts is delayed by up to one `refreshInterval`; the `evcc`
-  ExternalSecret uses `1h`. That does not widen the outage window — broker and
-  client still move together — but it does stretch how long a rotation takes to
-  land, which matters for verifying one completed and for the cold-rebuild
-  ordering question above. Worth deciding whether these ExternalSecrets want a
-  shorter interval than 1h, or whether the rotator should trigger the sync
-  directly.
- **Bootstrap on a cold rebuild.** On a fresh cluster the rotator must create the
-  OpenBao entry before ESO can sync it; check this against
-  `kubernetes/RUNBOOK-cold-rebuild.md` so broker bring-up is not blocked.
-
-## What this does not change
-
- Secret names, key names and every `secretKeyRef` in `mosquitto-deployment.yaml`.
- The ACL model and the per-user topic scoping.
- The `evcc` ExternalSecret, which already follows the target pattern.
@@ -128,7 +128,7 @@ spec:
              memory: 32Mi
      containers:
        - name: home-assistant
-          image: ghcr.io/home-assistant/home-assistant:2026.10.2 # {"$imagepolicy": "flux-system:home-assistant"}
+          image: ghcr.io/home-assistant/home-assistant:2026.10.4 # {"$imagepolicy": "flux-system:home-assistant"}
          env:
            - name: TZ
              value: Europe/Berlin
@@ -12,26 +12,20 @@ resources:
  - config-sync-token-externalsecret.yaml
  - config-sync-gitea-externalsecret.yaml
  - matrix-externalsecret.yaml
-  - mosquitto-bootstrap.yaml
-  # Former `health` probe credential. The broker no longer reads it (the
-  # probes use the cert account mosquitto-probe, REN-953); removed with its
-  # rotator in the REN-802 cleanup step.
-  - mosquitto-health-credentials-externalsecret.yaml
+  - mosquitto-admin-password.yaml
  - mosquitto-config.yaml
  - mosquitto-certificate.yaml
  - mosquitto-service.yaml
  - mosquitto-iot-service.yaml
  - mosquitto-deployment.yaml
-  - mosquitto-evcc-credentials-externalsecret.yaml
  # shelly-manager and the mDNS relay sit on the IoT VLAN: ../home-assistant-iot.
  - esphome-pvc.yaml
  - esphome-deployment.yaml
  - esphome-service.yaml
  - esphome-ingress.yaml
  # Zigbee2MQTT — ZHA replacement bridge. Ships scaled to 0; the cutover
-  # runbook (zigbee2mqtt-migration-runbook.md) scales it up. The MQTT
-  # `zigbee2mqtt` broker user is provisioned by mosquitto-bootstrap.yaml
-  # (above) and wired into mosquitto-deployment.yaml (passwd + ACL).
+  # runbook (zigbee2mqtt-migration-runbook.md) scales it up. It logs in to
+  # the broker as register account `zigbee2mqtt-bridge` (mqtt-accounts.yaml).
  - zigbee2mqtt-coordinator-backup-externalsecret.yaml
  - zigbee2mqtt-config.yaml
  - zigbee2mqtt-pvc.yaml
@@ -0,0 +1,32 @@
+# Password of the broker's `admin` workstation login (mosquitto-deployment.yaml).
+# Generated once in-cluster, nothing in OpenBao. Read it with
+#   kubectl -n home-assistant get secret mosquitto-admin-password -o jsonpath='{.data.password}' | base64 -d
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: mosquitto-admin-password
+  namespace: home-assistant
+spec:
+  length: 32
+  digits: 8
+  symbols: 0
+  allowRepeat: true
+  noUpper: false
+  secretKeys:
+    - password
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: mosquitto-admin-password
+  namespace: home-assistant
+spec:
+  refreshPolicy: CreatedOnce
+  target:
+    name: mosquitto-admin-password
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: mosquitto-admin-password
@@ -1,394 +0,0 @@
---
-# Generates mosquitto-credentials on first deploy. The password is created
-# in-cluster, lives only in the Secret object, and is never written to git
-# or seen by a human. The Mosquitto broker hashes it via mosquitto_passwd
-# -U at startup; HA reads the same value from this Secret (configured
-# manually in the HA MQTT integration UI).
-#
-# Idempotent: if the Secret already exists, the Job exits 0 without
-# regenerating, so subsequent Flux reconciles don't rotate the password.
-# To rotate, delete both the Secret and this Job; Flux will re-create
-# the Job and a fresh password.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: mosquitto-bootstrap
-  namespace: home-assistant
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: mosquitto-bootstrap
-  namespace: home-assistant
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "create"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: mosquitto-bootstrap
-  namespace: home-assistant
-subjects:
-  - kind: ServiceAccount
-    name: mosquitto-bootstrap
-    namespace: home-assistant
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: mosquitto-bootstrap
---
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: mosquitto-credentials-bootstrap
-  namespace: home-assistant
-  annotations:
-    # Job pod templates are immutable; force-recreate so image bumps
-    # apply on Flux re-reconcile. Safe: the Job is idempotent (see above).
-    kustomize.toolkit.fluxcd.io/force: enabled
-spec:
-  backoffLimit: 4
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: mosquitto-bootstrap
-    spec:
-      serviceAccountName: mosquitto-bootstrap
-      restartPolicy: OnFailure
-      containers:
-        - name: bootstrap
-          image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              apk add --no-cache curl jq >/dev/null
-
-              NS=home-assistant
-              NAME=mosquitto-credentials
-              TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-              CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-              API=https://kubernetes.default.svc
-
-              if curl -fsSL --cacert "$CA" -H "Authorization: Bearer $TOKEN" \
-                   "$API/api/v1/namespaces/$NS/secrets/$NAME" >/dev/null 2>&1; then
-                echo "$NAME already exists; nothing to do."
-                exit 0
-              fi
-
-              PW=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32)
-              PW_B64=$(printf '%s' "$PW" | base64 | tr -d '\n')
-
-              body=$(jq -nc \
-                --arg name "$NAME" \
-                --arg ns "$NS" \
-                --arg pw "$PW_B64" \
-                '{apiVersion: "v1",
-                  kind: "Secret",
-                  metadata: {name: $name, namespace: $ns},
-                  type: "Opaque",
-                  data: {"homeassistant-password": $pw}}')
-
-              curl -fsSL --cacert "$CA" -H "Authorization: Bearer $TOKEN" \
-                   -H "Content-Type: application/json" -X POST \
-                   --data "$body" \
-                   "$API/api/v1/namespaces/$NS/secrets" >/dev/null
-
-              echo "generated $NAME"
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              memory: 64Mi
---
-# Third broker user: `admin`. Full readwrite (same as HA) but kept on
-# its own credential so a workstation client can hold a password the
-# in-cluster HA config never sees, and rotating one doesn't affect the
-# other. Retrieve with:
-#   kubectl -n home-assistant get secret mosquitto-admin-credentials \
-#     -o jsonpath='{.data.password}' | base64 -d
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: mosquitto-admin-credentials-bootstrap
-  namespace: home-assistant
-  annotations:
-    # Job pod templates are immutable; force-recreate so image bumps
-    # apply on Flux re-reconcile. Safe: the Job is idempotent (see above).
-    kustomize.toolkit.fluxcd.io/force: enabled
-spec:
-  backoffLimit: 4
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: mosquitto-bootstrap
-    spec:
-      serviceAccountName: mosquitto-bootstrap
-      restartPolicy: OnFailure
-      containers:
-        - name: bootstrap
-          image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              apk add --no-cache curl jq >/dev/null
-
-              NS=home-assistant
-              NAME=mosquitto-admin-credentials
-              TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-              CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-              API=https://kubernetes.default.svc
-
-              if curl -fsSL --cacert "$CA" -H "Authorization: Bearer $TOKEN" \
-                   "$API/api/v1/namespaces/$NS/secrets/$NAME" >/dev/null 2>&1; then
-                echo "$NAME already exists; nothing to do."
-                exit 0
-              fi
-
-              PW=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32)
-              PW_B64=$(printf '%s' "$PW" | base64 | tr -d '\n')
-
-              body=$(jq -nc \
-                --arg name "$NAME" \
-                --arg ns "$NS" \
-                --arg pw "$PW_B64" \
-                '{apiVersion: "v1",
-                  kind: "Secret",
-                  metadata: {name: $name, namespace: $ns},
-                  type: "Opaque",
-                  data: {password: $pw}}')
-
-              curl -fsSL --cacert "$CA" -H "Authorization: Bearer $TOKEN" \
-                   -H "Content-Type: application/json" -X POST \
-                   --data "$body" \
-                   "$API/api/v1/namespaces/$NS/secrets" >/dev/null
-
-              echo "generated $NAME"
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              memory: 64Mi
---
-# Fourth broker user: `sml2mqtt` — the power-meter bridge. Publish-only
-# under `sml2mqtt/#` (ACL in mosquitto-deployment.yaml). Own credential so
-# its lifecycle is independent of the others. The sml2mqtt pod reads this
-# password via its init container and renders it into config.yml.
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: mosquitto-sml2mqtt-credentials-bootstrap
-  namespace: home-assistant
-  annotations:
-    # Job pod templates are immutable; force-recreate so image bumps
-    # apply on Flux re-reconcile. Safe: the Job is idempotent (see above).
-    kustomize.toolkit.fluxcd.io/force: enabled
-spec:
-  backoffLimit: 4
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: mosquitto-bootstrap
-    spec:
-      serviceAccountName: mosquitto-bootstrap
-      restartPolicy: OnFailure
-      containers:
-        - name: bootstrap
-          image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              apk add --no-cache curl jq >/dev/null
-
-              NS=home-assistant
-              NAME=mosquitto-sml2mqtt-credentials
-              TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-              CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-              API=https://kubernetes.default.svc
-
-              if curl -fsSL --cacert "$CA" -H "Authorization: Bearer $TOKEN" \
-                   "$API/api/v1/namespaces/$NS/secrets/$NAME" >/dev/null 2>&1; then
-                echo "$NAME already exists; nothing to do."
-                exit 0
-              fi
-
-              PW=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32)
-              PW_B64=$(printf '%s' "$PW" | base64 | tr -d '\n')
-
-              body=$(jq -nc \
-                --arg name "$NAME" \
-                --arg ns "$NS" \
-                --arg pw "$PW_B64" \
-                '{apiVersion: "v1",
-                  kind: "Secret",
-                  metadata: {name: $name, namespace: $ns},
-                  type: "Opaque",
-                  data: {password: $pw}}')
-
-              curl -fsSL --cacert "$CA" -H "Authorization: Bearer $TOKEN" \
-                   -H "Content-Type: application/json" -X POST \
-                   --data "$body" \
-                   "$API/api/v1/namespaces/$NS/secrets" >/dev/null
-
-              echo "generated $NAME"
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              memory: 64Mi
---
-# Fifth broker user: `open3e` — the Viessmann E3 CAN bridge (Vitocal 250-A
-# + Vitocharge VX3 via open3e). Scoped to `open3e/#` (ACL in
-# mosquitto-deployment.yaml). Own credential so its lifecycle is
-# independent of the others. Retrieve with:
-#   kubectl -n home-assistant get secret mosquitto-open3e-credentials \
-#     -o jsonpath='{.data.password}' | base64 -d
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: mosquitto-open3e-credentials-bootstrap
-  namespace: home-assistant
-  annotations:
-    # Job pod templates are immutable; force-recreate so image bumps
-    # apply on Flux re-reconcile. Safe: the Job is idempotent (see above).
-    kustomize.toolkit.fluxcd.io/force: enabled
-spec:
-  backoffLimit: 4
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: mosquitto-bootstrap
-    spec:
-      serviceAccountName: mosquitto-bootstrap
-      restartPolicy: OnFailure
-      containers:
-        - name: bootstrap
-          image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              apk add --no-cache curl jq >/dev/null
-
-              NS=home-assistant
-              NAME=mosquitto-open3e-credentials
-              TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-              CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-              API=https://kubernetes.default.svc
-
-              if curl -fsSL --cacert "$CA" -H "Authorization: Bearer $TOKEN" \
-                   "$API/api/v1/namespaces/$NS/secrets/$NAME" >/dev/null 2>&1; then
-                echo "$NAME already exists; nothing to do."
-                exit 0
-              fi
-
-              PW=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32)
-              PW_B64=$(printf '%s' "$PW" | base64 | tr -d '\n')
-
-              body=$(jq -nc \
-                --arg name "$NAME" \
-                --arg ns "$NS" \
-                --arg pw "$PW_B64" \
-                '{apiVersion: "v1",
-                  kind: "Secret",
-                  metadata: {name: $name, namespace: $ns},
-                  type: "Opaque",
-                  data: {password: $pw}}')
-
-              curl -fsSL --cacert "$CA" -H "Authorization: Bearer $TOKEN" \
-                   -H "Content-Type: application/json" -X POST \
-                   --data "$body" \
-                   "$API/api/v1/namespaces/$NS/secrets" >/dev/null
-
-              echo "generated $NAME"
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              memory: 64Mi
---
-# Broker user `zigbee2mqtt` — the Zigbee2MQTT bridge (ZHA replacement). Scoped
-# to its own `zigbee2mqtt/#` subtree plus `write homeassistant/#` (so it can
-# publish HA MQTT-discovery configs) and
-# `read homeassistant/status` (HA's birth/will topic; on `online` Z2M
-# republishes cached device states, NOT discovery configs — ACL and the full
-# reasoning in mosquitto-deployment.yaml). Own credential so its lifecycle is
-# independent of the others. The Z2M init container reads this password and
-# renders it into /app/data/secret.yaml.
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: mosquitto-zigbee2mqtt-credentials-bootstrap
-  namespace: home-assistant
-  annotations:
-    # Job pod templates are immutable; force-recreate so image bumps
-    # apply on Flux re-reconcile. Safe: the Job is idempotent (see above).
-    kustomize.toolkit.fluxcd.io/force: enabled
-spec:
-  backoffLimit: 4
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: mosquitto-bootstrap
-    spec:
-      serviceAccountName: mosquitto-bootstrap
-      restartPolicy: OnFailure
-      containers:
-        - name: bootstrap
-          image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              apk add --no-cache curl jq >/dev/null
-
-              NS=home-assistant
-              NAME=mosquitto-zigbee2mqtt-credentials
-              TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-              CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-              API=https://kubernetes.default.svc
-
-              if curl -fsSL --cacert "$CA" -H "Authorization: Bearer $TOKEN" \
-                   "$API/api/v1/namespaces/$NS/secrets/$NAME" >/dev/null 2>&1; then
-                echo "$NAME already exists; nothing to do."
-                exit 0
-              fi
-
-              PW=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32)
-              PW_B64=$(printf '%s' "$PW" | base64 | tr -d '\n')
-
-              body=$(jq -nc \
-                --arg name "$NAME" \
-                --arg ns "$NS" \
-                --arg pw "$PW_B64" \
-                '{apiVersion: "v1",
-                  kind: "Secret",
-                  metadata: {name: $name, namespace: $ns},
-                  type: "Opaque",
-                  data: {password: $pw}}')
-
-              curl -fsSL --cacert "$CA" -H "Authorization: Bearer $TOKEN" \
-                   -H "Content-Type: application/json" -X POST \
-                   --data "$body" \
-                   "$API/api/v1/namespaces/$NS/secrets" >/dev/null
-
-              echo "generated $NAME"
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              memory: 64Mi
@@ -77,18 +77,15 @@ data:

    allow_anonymous false

-    # Two account sources side by side (REN-802 step 2, tested on 2.0.22 in
-    # REN-900, document `coexistence`):
-    #   Dynamic Security: accounts from the register mqtt-accounts.yaml,
-    #     managed live by mqtt-account-controller over $CONTROL.
-    #   password_file/acl_file: the legacy users, unchanged until each client
-    #     moves to the register (step 3).
+    # Accounts (tested on 2.0.22 in REN-900, document `coexistence`):
+    #   Dynamic Security: every client account, from the register
+    #     mqtt-accounts.yaml, managed live by mqtt-account-controller over
+    #     $CONTROL. Applies to all listeners (per_listener_settings false).
+    #   password_file/acl_file: the owner's workstation login `admin` only
+    #     (mosquitto-deployment.yaml).
    # Dynamic Security is asked first. For a username it does not know, and
    # for a request none of its roles match, it defers to the files. A
-    # register entry with the same name as a legacy user therefore replaces
-    # that user's password, while its acl_file block still applies to
-    # whatever the entry's roles do not cover. Delete the legacy user when
-    # its client moves.
+    # register entry named `admin` therefore replaces the file login.
    #
    # The acl_file check of 2.0 allows every SUBSCRIBE and checks only on
    # delivery, so the Dynamic Security default must deny publishClientReceive.
@@ -64,67 +64,15 @@ spec:
            - -c
            - |
              set -eu
+              # `admin` is the owner's workstation login over the LoadBalancer
+              # (1883/8883), full readwrite. The only password_file user: the
+              # controller cannot deliver a password account to a Secret, and
+              # the cert listener :8884 is in-cluster only.
              rm -f /mosquitto/auth/passwd
-              mosquitto_passwd -c -b /mosquitto/auth/passwd homeassistant "$HA_PASSWORD"
-              mosquitto_passwd -b /mosquitto/auth/passwd admin "$ADMIN_PASSWORD"
-              mosquitto_passwd -b /mosquitto/auth/passwd sml2mqtt "$SML2MQTT_PASSWORD"
-              mosquitto_passwd -b /mosquitto/auth/passwd open3e "$OPEN3E_PASSWORD"
-              mosquitto_passwd -b /mosquitto/auth/passwd evcc "$EVCC_PASSWORD"
-              mosquitto_passwd -b /mosquitto/auth/passwd zigbee2mqtt "$ZIGBEE2MQTT_PASSWORD"
-              # ACL: HA keeps full access (subscribes to everything). Shellies
-              # are not legacy users any more: each has its own Dynamic Security
-              # account from mqtt-accounts.yaml (REN-802, REN-1017).
-              # `admin` is a workstation/debugging credential — full
-              # readwrite, kept on its own credential so its password can
-              # be rotated independently of the HA session.
-              # `sml2mqtt` is the power-meter bridge — WRITE-only under its own
-              # `sml2mqtt/#` subtree (it only publishes; HA reads it via the
-              # full-access homeassistant user).
-              # `open3e` is the Viessmann E3 CAN bridge (Vitocal/VX3) —
-              # scoped to its own `open3e/#` subtree: publishes datapoints
-              # and later subscribes to `open3e/cmnd` in listener mode (HA
-              # reads via the full-access homeassistant user).
-              # `evcc` is the (cross-namespace) EV charge controller — reads
-              # `open3e/#` (VX3 grid/PV/battery/SoC datapoints), publishes its
-              # own state under `evcc/#`, and reads the grid price from
-              # `energy/#` (HA republishes input_number.strompreis to
-              # energy/tariff/grid; kept OUTSIDE evcc/# so evcc's own retained-
-              # topic management can't wipe it).
+              mosquitto_passwd -c -b /mosquitto/auth/passwd admin "$ADMIN_PASSWORD"
              cat > /mosquitto/auth/acl <<'EOF'
-              user homeassistant
-              topic readwrite #
-
              user admin
              topic readwrite #
-
-              user sml2mqtt
-              topic write sml2mqtt/#
-
-              user open3e
-              topic readwrite open3e/#
-
-              user evcc
-              topic read open3e/#
-              topic readwrite evcc/#
-              topic read energy/#
-
-              # `zigbee2mqtt` is the Zigbee2MQTT bridge (the ZHA replacement).
-              # Owns its own `zigbee2mqtt/#` subtree; may WRITE `homeassistant/#`
-              # to publish HA MQTT-discovery configs (write-only there, to deny
-              # discovery-tree recon from a compromised bridge); and READs `homeassistant/status`, HA's birth/will topic.
-              #
-              # That read grant does NOT buy a discovery re-publish: on
-              # `online`, Z2M 2.12.1 republishes bridge/state and cached device
-              # states only (lib/extension/homeassistant.ts onMQTTMessage) —
-              # discover() runs solely from start(). The grant is still correct,
-              # because the cached-state republish is what makes HA show current
-              # values right after an HA restart. Restoring discovery after a
-              # BROKER restart is handled by the discovery-guard sidecar in
-              # zigbee2mqtt-deployment.yaml.
-              user zigbee2mqtt
-              topic readwrite zigbee2mqtt/#
-              topic write homeassistant/#
-              topic read homeassistant/status
              EOF
              # Dynamic Security start file (REN-802): the controller's seed
              # if it exists, else the static base file. The seed carries
@@ -143,38 +91,11 @@ spec:
              chmod 0600 /mosquitto/auth/passwd /mosquitto/auth/acl /mosquitto/auth/dynamic-security.json
              exec mosquitto -c /mosquitto/config/mosquitto.conf
          env:
-            - name: HA_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: mosquitto-credentials
-                  key: homeassistant-password
+            # mosquitto-admin-password.yaml
            - name: ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
-                  name: mosquitto-admin-credentials
-                  key: password
-            - name: SML2MQTT_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: mosquitto-sml2mqtt-credentials
-                  key: password
-            - name: OPEN3E_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: mosquitto-open3e-credentials
-                  key: password
-            - name: EVCC_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: mosquitto-evcc-credentials
-                  key: password
-            # Zigbee2MQTT bridge credential (mosquitto-zigbee2mqtt-credentials-
-            # bootstrap). Hashed into the passwd file here; Z2M reads the same
-            # Secret via its init container to authenticate to the broker.
-            - name: ZIGBEE2MQTT_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: mosquitto-zigbee2mqtt-credentials
+                  name: mosquitto-admin-password
                  key: password
          ports:
            - name: mqtt
@@ -231,12 +152,12 @@ spec:
          # Service and the probe dials 127.0.0.1; the chain is still checked
          # against mqtt-ca.
          #
-          # mosquitto is a single-replica SPOF (HA, Shelly, sml2mqtt, open3e,
-          # evcc). Liveness is deliberately slow to fire — failureThreshold 6
-          # x 30s = 3 min of sustained failure before a restart — so a
-          # transient hiccup never bounces the broker every client depends
-          # on. The startupProbe (tcpSocket) suspends both while the
-          # container builds the passwd/acl files and mosquitto binds :1883.
+          # mosquitto is a single-replica SPOF (HA, Shelly, Zigbee2MQTT,
+          # edge-1, evcc). Liveness is deliberately slow to fire —
+          # failureThreshold 6 x 30s = 3 min of sustained failure before a
+          # restart — so a transient hiccup never bounces the broker every
+          # client depends on. The startupProbe (tcpSocket) suspends both while
+          # the container prepares /mosquitto/auth and mosquitto binds :1883.
          startupProbe:
            tcpSocket:
              port: mqtt
@@ -1,15 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mosquitto-evcc-credentials
-  namespace: home-assistant
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  target:
-    name: mosquitto-evcc-credentials # keeps the old Secret's name — consumers unchanged
-  dataFrom:
-    - extract:
-        key: apps/home-assistant/mosquitto-evcc-credentials
@@ -1,36 +0,0 @@
-# Projects the mosquitto `health` broker credential from OpenBao into the Secret
-# the broker already consumes. FIRST of the eight broker users to move off the
-# bootstrap Jobs and onto Class-A rotation (see
-# PROPOSAL-mosquitto-credential-rotation.md (PR #453 — not yet merged; this
-# file lands with it)); the rotator lives at
-# kubernetes/infrastructure/openbao/rotation/mosquitto-health.yaml.
-#
-# Secret name and key are UNCHANGED (`password`), so mosquitto-deployment.yaml's
-# secretKeyRef and the exec probes that read $HEALTH_PASSWORD need no edit.
-#
-# refreshInterval is 10m rather than the 1h used by mosquitto-evcc-credentials:
-# a rotation only lands once ESO re-reads, so 1h would mean up to an hour between
-# the rotator running and the broker actually using the new password, with the
-# old one still valid in the meantime. 10m keeps that window short without
-# polling OpenBao pointlessly hard.
-#
-# ⚠️ OWNERSHIP: creationPolicy is implicitly Owner, so ESO sets an ownerReference
-# on the Secret. Deleting this ExternalSecret therefore DELETES the live Secret
-# and with it the broker's probe credential — the bootstrap Job it replaces had
-# no such coupling. To detach without destroying, set creationPolicy: Orphan
-# before removing it.
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mosquitto-health-credentials
-  namespace: home-assistant
-spec:
-  refreshInterval: 10m
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  target:
-    name: mosquitto-health-credentials
-  dataFrom:
-    - extract:
-        key: apps/home-assistant/mosquitto-health-credentials
@@ -5,9 +5,7 @@
 # mqtt-accounts.yaml, every INTERVAL (2m).
 #
 # Manages the production broker `mosquitto` over its mTLS listener :8884
-# (REN-802 step 2, REN-900). The legacy users in that broker's password_file
-# are not Dynamic Security clients, so the controller never sees or touches
-# them.
+# (REN-802 step 2, REN-900).
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -87,6 +85,9 @@ subjects:
 #     delivered to this namespace. Add the name with the register entry.
 #   mqtt-ha-cert-sync: sha256 of the client certificate last accepted by
 #     Home Assistant's MQTT config entry (HA cert sync, REN-953/REN-1284).
+#   mqtt-<name>-password: the login of a password account delivered to this
+#     namespace, written, rewritten and deleted on revocation. One entry per
+#     account.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -99,6 +100,11 @@ rules:
    resources: ["secrets"]
    resourceNames: ["mqtt-account-hashes", "mqtt-dynsec-seed", "mqtt-ha-cert-sync"]
    verbs: ["get", "create", "patch"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    resourceNames:
+      - mqtt-admin-password
+    verbs: ["get", "create", "patch", "delete"]
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames:
@@ -219,7 +225,7 @@ spec:
        - name: controller
          # Woodpecker builds main-<sha> on every merge to main; no sortable
          # tag, so bumps are manual (same as ical-proxy).
-          image: gitea.renner.uno/konairius/mqtt-account-controller:main-cb96b1a@sha256:9d9b9e83a9c0f9f567e57edacab11cf4c58e8c0e49e38e8d7b51421cd1242911
+          image: gitea.renner.uno/konairius/mqtt-account-controller:main-b1f294d@sha256:8081adfee171c36cfa83734e5e7ccc3aad3debf1c0154488de70143674cde85f
          env:
            - name: BROKER_URL
              value: ssl://mosquitto.home-assistant.svc.cluster.local:8884
@@ -7,51 +7,50 @@
 # configMapGenerator in kustomization.yaml). An empty list is refused, so it
 # never revokes everyone.
 #
-# The controller manages the production broker `mosquitto` (REN-900). Its
-# legacy users (password_file in mosquitto-deployment.yaml) are not listed
-# here; each moves here with its client (REN-802 step 3). `test-cert` is the
-# certificate test account from REN-888.
+# The controller manages the production broker `mosquitto` (REN-900).
+# `test-cert` is the certificate test account from REN-888.
 #
-# A cert account needs its Secret `mqtt-<name>-tls` added to the
+# A cert account needs its Secret `mqtt-<name>-tls`, a password account
+# delivered to a namespace its Secret `mqtt-<name>-password`, added to the
 # `mqtt-account-controller-secrets-<namespace>` Role in
-# mqtt-account-controller.yaml, or revoking it fails with 403.
+# mqtt-account-controller.yaml, or writing or revoking it fails with 403.
+# The owner's workstation login over the LoadBalancer (1883/8883). Password in
+# the Secret mqtt-admin-password (home-assistant); deleting the Secret makes a
+# new one.
+- name: admin
+  auth: password
+  deliver: {namespace: home-assistant}
+  acl: ["readwrite #"]
 - name: test-cert
  auth: cert
  deliver: {namespace: home-assistant}
  acl: ["readwrite test/cert/#"]
 # The broker's own liveness/readiness probe (mosquitto-deployment.yaml).
-# Not named `health`: a Dynamic Security client of that name would shadow the
-# legacy password user while the old broker pod still probes with it.
 - name: mosquitto-probe
  auth: cert
  deliver: {namespace: home-assistant}
  acl: ["readwrite health/#"]
 # Zigbee2MQTT and its two sidecars (discovery-guard, interview-watch), one
-# certificate for the pod. Same ACL as the legacy user `zigbee2mqtt`; not
-# named like it, so this entry cannot shadow the password login of a running
-# Z2M (REN-953).
+# certificate for the pod (REN-953).
 - name: zigbee2mqtt-bridge
  auth: cert
  deliver: {namespace: home-assistant}
  acl: ["readwrite zigbee2mqtt/#", "write homeassistant/#", "read homeassistant/status"]
-# evcc (evcc namespace). Same ACL as the legacy user `evcc`, different name
-# so it cannot shadow the running password login (REN-953). evcc takes the
-# certificate PEMs by env (EVCC_MQTT_*), see apps/evcc/deployment.yaml.
+# evcc (evcc namespace, REN-953). evcc takes the certificate PEMs by env
+# (EVCC_MQTT_*), see apps/evcc/deployment.yaml.
 - name: evcc-client
  auth: cert
  deliver: {namespace: evcc}
  acl: ["read open3e/#", "readwrite evcc/#", "read energy/#"]
 # Home Assistant, via the ghostunnel sidecar `mqtt-tls` in its pod (HA keeps
 # client certificates only as uploaded PEMs in its config entry, so a renewal
-# could not reach it without a reconfigure). Same ACL as the legacy user
-# `homeassistant`; not named like it, so it cannot shadow that login (REN-953).
+# could not reach it without a reconfigure, REN-953).
 - name: home-assistant
  auth: cert
  deliver: {namespace: home-assistant}
  acl: ["readwrite #"]
-# edge-1's local mosquitto bridge (REN-1307): one bridge for open3e/e3oncan
-# and sml2mqtt, replacing the legacy password users `open3e` and `sml2mqtt`
-# (different name, so it cannot shadow their logins). The controller pushes
+# edge-1's local mosquitto bridge (REN-1307): one bridge for open3e/e3oncan.
+# The controller pushes
 # the password to edge-mqtt-cred on edge-1 (ansible role mqtt-bridge) over
 # HTTPS with its own client certificate, and pins edge-1's self-generated
 # server certificate on first contact (key edge-1.pin in mqtt-account-hashes;
@@ -50,13 +50,13 @@ release it before Z2M connects (step 3).
 Confirm the standing pieces are in place (nothing is running yet):

 ```
-kubectl -n home-assistant get secret mosquitto-zigbee2mqtt-credentials       # exists (bootstrap Job ran)
+kubectl -n home-assistant get secret mqtt-zigbee2mqtt-bridge-tls             # exists (register account zigbee2mqtt-bridge)
 kubectl -n home-assistant get externalsecret zigbee2mqtt-coordinator-backup  # SecretSyncedError / NotReady — EXPECTED
 kubectl -n home-assistant get deploy zigbee2mqtt                             # 0/0 — EXPECTED
 ```

-The `mosquitto` pod will have rolled to pick up the new `zigbee2mqtt` passwd/ACL
-entry. Verify the broker still serves HA (it will — the change is additive).
+Z2M logs in to the broker by certificate on `:8884` as the register account
+`zigbee2mqtt-bridge` (`mqtt-accounts.yaml`).

 ## Step 1 — export the Open Coordinator Backup (non-disruptive)

@@ -30,7 +30,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/kuma-sync:2026-10-22-1858 # {"$imagepolicy": "flux-system:kuma-sync"}
+          image: gitea.renner.uno/gitea_admin/kuma-sync:2026-10-25-1459 # {"$imagepolicy": "flux-system:kuma-sync"}
          env:
            - name: KUMA_URL
              value: https://kuma.renner.uno
@@ -82,9 +82,9 @@ spec:
          #
          # The pod regex is the Deployment's name shape
          # (mosquitto-<replicaset hash>-<suffix>) and not `mosquitto-.*` on
-          # purpose: mosquitto-bootstrap.yaml runs six Jobs named
-          # mosquitto-*-credentials-bootstrap, and a bootstrap pod that is
-          # briefly Ready must not hide a broker that is down.
+          # purpose: other pods in the namespace start with `mosquitto-`
+          # (mosquitto-dynsec-test), and a Ready one must not hide a broker
+          # that is down.
          expr: |
            absent(kube_pod_status_ready{namespace="home-assistant", pod=~"mosquitto-[a-z0-9]{6,10}-[a-z0-9]{5}", condition="true"} == 1)
          for: 5m
@@ -137,13 +137,13 @@ tests:
        exp_alerts: []

  # --- MosquittoDown ------------------------------------------------------
-  # The broker goes not-Ready at t=10m while a credentials-bootstrap Job pod is
-  # Ready. The Job pod must not mask the broker.
+  # The broker goes not-Ready at t=10m while the mosquitto-dynsec-test pod is
+  # Ready. That pod must not mask the broker.
  - interval: 1m
    input_series:
      - series: 'kube_pod_status_ready{namespace="home-assistant",pod="mosquitto-7f8b9c6d5-x2k9q",condition="true"}'
        values: '1x9 0x20'
-      - series: 'kube_pod_status_ready{namespace="home-assistant",pod="mosquitto-credentials-bootstrap-q7w2e",condition="true"}'
+      - series: 'kube_pod_status_ready{namespace="home-assistant",pod="mosquitto-dynsec-test-6d9f8b7c5-r4t8w",condition="true"}'
        values: '1x30'
    alert_rule_test:
      - eval_time: 14m
@@ -52,7 +52,7 @@ spec:
        # stdlib only; Flux keeps the tag in lockstep via the shared image
        # policy) — no extra dependency.
        - name: reconcile-publish-ip
-          image: ghcr.io/music-assistant/server:2.10.7 # {"$imagepolicy": "flux-system:music-assistant"}
+          image: ghcr.io/music-assistant/server:2.10.8 # {"$imagepolicy": "flux-system:music-assistant"}
          command: ["/app/venv/bin/python", "/scripts/reconcile.py"]
          volumeMounts:
            - name: data
@@ -62,7 +62,7 @@ spec:
              readOnly: true
      containers:
        - name: music-assistant
-          image: ghcr.io/music-assistant/server:2.10.7 # {"$imagepolicy": "flux-system:music-assistant"}
+          image: ghcr.io/music-assistant/server:2.10.8 # {"$imagepolicy": "flux-system:music-assistant"}
          env:
            - name: LOG_LEVEL
              value: info
@@ -93,7 +93,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: lidarr
-          image: lscr.io/linuxserver/lidarr:3.1.0.4875-ls45 # {"$imagepolicy": "flux-system:lidarr"}
+          image: lscr.io/linuxserver/lidarr:3.1.6.5079-ls46 # {"$imagepolicy": "flux-system:lidarr"}
          env:
            - name: PUID
              value: "1000"
@@ -140,7 +140,7 @@ spec:
              drop: ["ALL"]
              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
        - name: reconcile
-          image: lscr.io/linuxserver/lidarr:3.1.0.4875-ls45 # {"$imagepolicy": "flux-system:lidarr"}
+          image: lscr.io/linuxserver/lidarr:3.1.6.5079-ls46 # {"$imagepolicy": "flux-system:lidarr"}
          command: ["sh", "/scripts/reconcile.sh"]
          volumeMounts:
            - name: config
@@ -32,7 +32,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: review-bot
-          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-22-1854 # {"$imagepolicy": "flux-system:review-bot"}
+          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-25-1455 # {"$imagepolicy": "flux-system:review-bot"}
          env:
            - name: REPOS
              value: konairius/homelab,konairius/homeassistant,konairius/authentik-samba-bridge,konairius/shelly-manager
@@ -53,7 +53,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: wiki
-          image: gitea.renner.uno/konairius/wiki:build.1792419299 # {"$imagepolicy": "flux-system:wiki"}
+          image: gitea.renner.uno/konairius/wiki:build.1792939775 # {"$imagepolicy": "flux-system:wiki"}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
@@ -77,6 +77,10 @@ spec:
              value: https://auth.renner.uno/application/o/wiki/
            - name: Auth__Oidc__ClientId
              value: wiki
+            - name: Wiki__Encyclopedia__Enabled
+              value: "true"
+            - name: Wiki__Encyclopedia__MaxArticles
+              value: "0"
            # wiki-index BasicAuth users (htpasswd), checked by the service for the read API.
            - name: Auth__Basic__UsersPath
              value: /var/run/secrets/wiki-basic-auth
@@ -87,11 +87,9 @@ spec:
            - port: "53"
              protocol: UDP
    # host/remote-node: kubelet probes + node-local reach (Ceph mons on host net)
-    # world: image pulls and llama-server's Hugging Face model download
    - toEntities:
        - host
        - remote-node
-        - world
    # ICMP — egress mirror; see ingress block above.
    - toEndpoints:
        - matchExpressions:
@@ -166,3 +164,76 @@ spec:
        - ports:
            - port: "8080"
              protocol: TCP
+---
+# Hugging Face model download on cold cache (llama-server, llama-embed, wiki-embed).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: models-egress-huggingface
+  namespace: ai
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: In
+        values:
+          - llama-server
+          - llama-embed
+          - wiki-embed
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "huggingface.co"
+        - matchName: "hf.co"
+        - matchPattern: "*.huggingface.co"
+        - matchPattern: "*.hf.co"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+---
+# wiki: Anthropic API (distillation) and TypeSafe API (typed judgements).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: wiki-egress-apis
+  namespace: ai
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: wiki
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "api.anthropic.com"
+        - matchName: "api.typesafe.ai"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
@@ -66,11 +66,9 @@ spec:
            - port: "53"
              protocol: UDP
    # host/remote-node: kubelet probes + node-local reach (Ceph mons on host net)
-    # world: image pulls, OBC S3 endpoint reachable via the cluster's LB IP, migration pipeline API
    - toEntities:
        - host
        - remote-node
-        - world
    # ICMP — egress mirror; see ingress block above.
    - toEndpoints:
        - matchExpressions:
@@ -94,3 +92,19 @@ spec:
            - { type: 135, family: IPv6 }
            - { type: 136, family: IPv6 }
            - { type: 143, family: IPv6 }
+---
+# audiobookshelf (metadata providers) and libation (Audible): HTTPS to the internet.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: audiobookshelf-egress-https
+  namespace: audiobookshelf
+spec:
+  endpointSelector: {}
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
@@ -70,7 +70,6 @@ spec:
    - toEntities:
        - host
        - remote-node
-        - world
    # ICMP — egress mirror.
    - toEndpoints:
        - matchExpressions:
@@ -94,3 +93,43 @@ spec:
            - { type: 135, family: IPv6 }
            - { type: 136, family: IPv6 }
            - { type: 143, family: IPv6 }
+---
+# authentik server and worker: SMTP relay (Proton) for mail, HTTPS for
+# outbound webhooks, OIDC/social sources and update checks.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: authentik-egress
+  namespace: authentik
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/part-of: authentik
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "smtp.protonmail.ch"
+      toPorts:
+        - ports:
+            - port: "587"
+              protocol: TCP
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
@@ -0,0 +1,74 @@
+# EGRESS ONLY: an ingress section would flip ingress to default-deny and
+# break the apiserver -> webhook admission calls.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: default-egress
+  namespace: cert-manager
+spec:
+  endpointSelector: {}
+  egress:
+    # All in-cluster destinations (pods, nodes, kube-apiserver).
+    - toEntities:
+        - cluster
+    # rules.dns lets Cilium learn FQDN mappings.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+---
+# Controller: ACME (Let's Encrypt prod + staging), Cloudflare DNS-01 API, and
+# DNS-01 self-check against the recursive nameservers.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: cert-manager-controller-egress-world
+  namespace: cert-manager
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/name: cert-manager
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "acme-v02.api.letsencrypt.org"
+        - matchName: "acme-staging-v02.api.letsencrypt.org"
+        - matchName: "api.cloudflare.com"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+    # Mirrors dns01RecursiveNameservers in
+    # kubernetes/infrastructure/cert-manager/helmrelease.yaml.
+    - toCIDR:
+        - 1.1.1.1/32
+        - 8.8.8.8/32
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
@@ -0,0 +1,34 @@
+# CNPG instance pods: the barman-cloud plugin sidecar archives WAL and base
+# backups to Hetzner S3. Additive only: every namespace holding a CNPG cluster
+# also carries a namespace egress policy covering in-cluster traffic, so
+# selecting these pods here does not cut anything else.
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: cnpg-barman-s3-egress
+spec:
+  endpointSelector:
+    matchLabels:
+      cnpg.io/podRole: instance
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "fsn1.your-objectstorage.com"
+        - matchPattern: "*.fsn1.your-objectstorage.com"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
@@ -24,10 +24,7 @@ spec:
        - host
        - remote-node
    # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See
-    # home-assistant-ns.yaml for the rationale. INGRESS ONLY: do NOT
-    # add an egress section to this CNP — that's what broke attempt
-    # 66dbe9f (it transitioned this ns from default-allow egress to
-    # egress-enforced-with-only-ICMP, killing DNS / apiserver / world).
+    # home-assistant-ns.yaml for the rationale.
    - fromEndpoints:
        - matchExpressions:
            - key: io.kubernetes.pod.namespace
@@ -50,3 +47,39 @@ spec:
            - { type: 135, family: IPv6 }
            - { type: 136, family: IPv6 }
            - { type: 143, family: IPv6 }
+  egress:
+    # All in-cluster destinations (pods, nodes, kube-apiserver).
+    - toEntities:
+        - cluster
+    # rules.dns lets Cilium learn FQDN mappings.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+---
+# lapi: CAPI + hub index. agent: hub/collection fetch.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: crowdsec-egress-world
+  namespace: crowdsec
+spec:
+  endpointSelector:
+    matchLabels:
+      k8s-app: crowdsec
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
@@ -22,8 +22,7 @@ spec:
        - host
        - remote-node
    # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See
-    # home-assistant-ns.yaml for the rationale. INGRESS ONLY: do NOT
-    # add an egress section to this CNP.
+    # home-assistant-ns.yaml for the rationale.
    - fromEndpoints:
        - matchExpressions:
            - key: io.kubernetes.pod.namespace
@@ -46,3 +45,21 @@ spec:
            - { type: 135, family: IPv6 }
            - { type: 136, family: IPv6 }
            - { type: 143, family: IPv6 }
+  egress:
+    # All in-cluster destinations (pods, nodes, kube-apiserver).
+    - toEntities:
+        - cluster
+    # rules.dns lets Cilium learn FQDN mappings.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
@@ -48,4 +48,109 @@ spec:
    - toEntities:
        - host
        - remote-node
+---
+# external-dns (Cloudflare provider): Cloudflare API.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: external-dns-egress
+  namespace: apps
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: external-dns
+      app.kubernetes.io/instance: external-dns
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "api.cloudflare.com"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+---
+# external-dns-unifi: UniFi controller API on the UDM (UNIFI_HOST).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: external-dns-unifi-egress
+  namespace: apps
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: external-dns
+      app.kubernetes.io/instance: external-dns-unifi
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "udm.renner.uno"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+---
+# gatus: DNS probes against the UDM resolver by IP; HTTP checks target in-cluster names.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: gatus-egress
+  namespace: apps
+spec:
+  endpointSelector:
+    matchLabels:
+      app: gatus
+  egress:
+    - toEntities:
        - world
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+---
+# ical-proxy: fetches caller-supplied calendar feed URLs.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: ical-proxy-egress
+  namespace: apps
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: ical-proxy
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+            - port: "80"
+              protocol: TCP
@@ -92,11 +92,27 @@ spec:
        - ports:
            - port: "8644"
              protocol: TCP
-    # Push mirror to GitHub and other external targets.
    - toEntities:
        - host
        - remote-node
+---
+# gitea: push mirrors, external webhooks and OIDC/OAuth sources over HTTPS.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: gitea-egress-https
+  namespace: gitea
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: gitea
+  egress:
+    - toEntities:
        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
 ---
 # Traefik serves git.renner.uno / gitea.renner.uno (:3000) and the gitea-ssh
 # entrypoint (:2222). Lives beside the baseline so both land in one reconcile.
@@ -143,10 +143,6 @@ spec:
    - toEntities:
        - host
        - remote-node
-    # World: IoT-VLAN devices, HA Cloud, object storage, and third-party
-    # integration endpoints on the LAN and internet.
-    - toEntities:
-        - world
    # ICMP — egress mirror of the ingress ICMP allow above. Lets HA
    # send ICMP to any cluster pod (covers the kernel's ICMPv6
    # Destination Unreachable when CoreDNS responses land on a
@@ -261,10 +257,7 @@ spec:
 # hairpin off the home-assistant-bgp LoadBalancer and are unusable from a
 # pod. It reaches HA at home-assistant-bgp.home-assistant.svc.cluster.local.
 #
-# Only the ingress half is needed here. Unlike the openbao rotator, the trmnl
-# namespace has no default-deny EGRESS covering this pod — terminus-egress is
-# scoped to the Terminus pods by label and does not select the renderer — so
-# there is no source-side rule to add.
+# The egress half is trmnl-baseline-egress (toEntities: cluster).
 #
 # Source scoped to the renderer pod specifically, not the whole trmnl
 # namespace: Terminus itself sits in that namespace and has no business
@@ -351,3 +344,149 @@ spec:
        - ports:
            - port: "5432"
              protocol: TCP
+---
+# home-assistant: IoT-VLAN devices, HA Cloud, and third-party integration
+# endpoints on the LAN and internet.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: home-assistant-egress-world
+  namespace: home-assistant
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: home-assistant
+  egress:
+    - toEntities:
+        - world
+---
+# shelly-manager: HTTP RPC to Shelly devices on the IoT VLAN, and mDNS
+# queries for their *.local names (sent out the default interface eth0).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: shelly-manager-egress
+  namespace: home-assistant
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: shelly-manager
+  egress:
+    - toCIDR:
+        - 10.2.30.0/24
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+    - toCIDR:
+        - 224.0.0.251/32
+      toPorts:
+        - ports:
+            - port: "5353"
+              protocol: UDP
+---
+# esphome: OTA/API to devices on the IoT VLAN; HTTPS for GitHub, PlatformIO and PyPI during builds.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: esphome-egress
+  namespace: home-assistant
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: esphome
+  egress:
+    - toCIDR:
+        - 10.2.30.0/24
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+---
+# zigbee2mqtt: Zigbee coordinator (SLZB) TCP socket.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: zigbee2mqtt-egress
+  namespace: home-assistant
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: zigbee2mqtt
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "slzb-zigbee.renner.uno"
+      toPorts:
+        - ports:
+            - port: "6638"
+              protocol: TCP
+---
+# mqtt-account-controller: credential delivery to edge-1 (deliver.esp32 in mqtt-accounts.yaml).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: mqtt-account-controller-egress
+  namespace: home-assistant
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: mqtt-account-controller
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "edge-1.iot.renner.uno"
+      toPorts:
+        - ports:
+            - port: "8443"
+              protocol: TCP
+---
+# whisper and speech-to-phrase: model downloads over HTTPS.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: speech-models-egress
+  namespace: home-assistant
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: In
+        values:
+          - whisper
+          - speech-to-phrase
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
@@ -33,7 +33,7 @@ spec:
        - host
        - remote-node
    # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See
-    # home-assistant-ns.yaml for the rationale. INGRESS ONLY.
+    # home-assistant-ns.yaml for the rationale.
    - fromEndpoints:
        - matchExpressions:
            - key: io.kubernetes.pod.namespace
@@ -56,3 +56,41 @@ spec:
            - { type: 135, family: IPv6 }
            - { type: 136, family: IPv6 }
            - { type: 143, family: IPv6 }
+  egress:
+    # All in-cluster destinations (pods, nodes, kube-apiserver).
+    - toEntities:
+        - cluster
+    # rules.dns lets Cilium learn FQDN mappings.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+---
+# immich-server and machine-learning: HTTPS to the internet (model downloads, metadata/reverse geocoding, version checks).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: immich-egress-world
+  namespace: immich
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: In
+        values: [immich-server, immich-machine-learning]
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
@@ -33,7 +33,7 @@ spec:
        - host
        - remote-node
    # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See
-    # home-assistant-ns.yaml for the rationale. INGRESS ONLY.
+    # home-assistant-ns.yaml for the rationale.
    - fromEndpoints:
        - matchExpressions:
            - key: io.kubernetes.pod.namespace
@@ -56,3 +56,43 @@ spec:
            - { type: 135, family: IPv6 }
            - { type: 136, family: IPv6 }
            - { type: 143, family: IPv6 }
+  egress:
+    # All in-cluster destinations (pods, nodes, kube-apiserver).
+    - toEntities:
+        - cluster
+    # rules.dns lets Cilium learn FQDN mappings.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+---
+# Token job pods install tooling at runtime (apt, dl.k8s.io).
+# Selected by the job-controller `job-name` label, so the influxdb StatefulSet pod gets no world egress.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: influxdb-token-jobs-egress-world
+  namespace: influxdb
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: job-name
+        operator: Exists
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+            - port: "80"
+              protocol: TCP
@@ -9,6 +9,7 @@ resources:
  - audiobookshelf-ns.yaml
  - home-assistant-ns.yaml
  - spegel-ns.yaml
+  - cert-manager-ns.yaml
  - crowdsec-ns.yaml
  - database-ns.yaml
  - immich-ns.yaml
@@ -37,4 +38,5 @@ resources:
  - renovate-ns.yaml
  - hermes-ns.yaml
  - allow-cilium-health.yaml
+  - cnpg-barman-s3.yaml
  - kube-system-hubble-relay.yaml
@@ -33,7 +33,7 @@ spec:
        - host
        - remote-node
    # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See
-    # home-assistant-ns.yaml for the rationale. INGRESS ONLY.
+    # home-assistant-ns.yaml for the rationale.
    - fromEndpoints:
        - matchExpressions:
            - key: io.kubernetes.pod.namespace
@@ -58,8 +58,7 @@ spec:
            - { type: 143, family: IPv6 }
 ---
 # Egress for the app pods (synapse, mas, element-web),
-# selected by part-of so the mx-pg CNPG pods keep unrestricted egress for
-# the barman-cloud WAL archive to Hetzner (same trade as trmnl-ns.yaml).
+# selected by part-of; the mx-pg CNPG pods are covered by mx-pg-egress.
 #
 # Nothing here reaches the internet: that is the network half of
 # "federation off". The one exception is synapse-push-egress below.
@@ -187,3 +186,32 @@ spec:
        - ports:
            - port: "8443"
              protocol: TCP
+---
+# mx-pg CNPG pods: in-cluster + DNS. Unselected by the app egress policies above;
+# S3 backup egress comes from the clusterwide CNPG policy.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: mx-pg-egress
+  namespace: matrix
+spec:
+  endpointSelector:
+    matchLabels:
+      cnpg.io/cluster: mx-pg
+  egress:
+    - toEntities:
+        - cluster
+    # rules.dns lets Cilium learn FQDN mappings.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
@@ -34,7 +34,7 @@ spec:
        - host
        - remote-node
    # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See
-    # home-assistant-ns.yaml for the rationale. INGRESS ONLY.
+    # home-assistant-ns.yaml for the rationale.
    - fromEndpoints:
        - matchExpressions:
            - key: io.kubernetes.pod.namespace
@@ -57,6 +57,24 @@ spec:
            - { type: 135, family: IPv6 }
            - { type: 136, family: IPv6 }
            - { type: 143, family: IPv6 }
+  egress:
+    # All in-cluster destinations (pods, nodes, kube-apiserver).
+    - toEntities:
+        - cluster
+    # rules.dns lets Cilium learn FQDN mappings.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
 ---
 # Hermes Agent (hermes ns) reads metrics, alerts and logs: the Prometheus,
 # Alertmanager and Loki HTTP APIs, scoped to those pods and ports.
@@ -84,3 +102,120 @@ spec:
              protocol: TCP
            - port: "3100"
              protocol: TCP
+---
+# Alertmanager: SMTP submission (smtp_smarthost in helmrelease-prometheus.yaml). Only receiver is email.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: alertmanager-egress-world
+  namespace: monitoring
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: alertmanager
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "smtp.protonmail.ch"
+      toPorts:
+        - ports:
+            - port: "587"
+              protocol: TCP
+---
+# Prober: targets are defined by Probe objects (monitoring-rules), any port.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: blackbox-exporter-egress-world
+  namespace: monitoring
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: prometheus-blackbox-exporter
+  egress:
+    - toEntities:
+        - world
+---
+# Grafana: plugin download (grafana.com) + OAuth, and the legacy Prometheus datasource.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: grafana-egress-world
+  namespace: monitoring
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: grafana
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+    # Datasource "Prometheus (legacy)".
+    - toFQDNs:
+        - matchName: "prometheus.srv.renner.uno"
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP
+---
+# Prometheus: off-site Uptime Kuma scrape (additionalScrapeConfigs job uptime-kuma). No remoteWrite configured.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: prometheus-egress-world
+  namespace: monitoring
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: prometheus
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "kuma.renner.uno"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
@@ -24,6 +24,10 @@ spec:
              protocol: UDP
            - port: "53"
              protocol: TCP
+          # rules.dns lets Cilium learn the toFQDNs mapping
+          rules:
+            dns:
+              - matchPattern: "*"
    - toEntities:
        - kube-apiserver
    - toEndpoints:
@@ -34,9 +38,9 @@ spec:
        - ports:
            - port: "8200"
              protocol: TCP
-    # NetBird management API (netbird.renner.uno).
-    - toEntities:
-        - world
+    # NetBird management API.
+    - toFQDNs:
+        - matchName: "netbird.renner.uno"
      toPorts:
        - ports:
            - port: "443"
@@ -88,7 +88,6 @@ spec:
    - toEntities:
        - host
        - remote-node
-        - world
    # ICMP — egress mirror.
    - toEndpoints:
        - matchExpressions:
@@ -268,3 +267,49 @@ spec:
        - ports:
            - port: "8000"
              protocol: TCP
+---
+# protonmail-bridge: Proton API (HTTPS) and update/status endpoints (HTTP).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: protonmail-bridge-egress
+  namespace: paperless
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: protonmail-bridge
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+            - port: "80"
+              protocol: TCP
+---
+# syncthing: relays/discovery (443), STUN (3478), peer sync (22000), local discovery (21027).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: syncthing-egress
+  namespace: paperless
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: syncthing
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+            - port: "3478"
+              protocol: UDP
+            - port: "22000"
+              protocol: TCP
+            - port: "22000"
+              protocol: UDP
+            - port: "21027"
+              protocol: UDP
@@ -53,14 +53,20 @@ spec:
              protocol: UDP
            - port: "53"
              protocol: TCP
+          # rules.dns lets Cilium learn the toFQDNs mapping
+          rules:
+            dns:
+              - matchPattern: "*"
    # gitea.renner.uno via Traefik.
    - toEndpoints:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": ingress
            app.kubernetes.io/name: traefik
-    # api.mistral.ai, api.anthropic.com, api.typesafe.ai.
-    - toEntities:
-        - world
+    # Model APIs.
+    - toFQDNs:
+        - matchName: "api.mistral.ai"
+        - matchName: "api.anthropic.com"
+        - matchName: "api.typesafe.ai"
      toPorts:
        - ports:
            - port: "443"
@@ -54,12 +54,10 @@ spec:
        - ports:
            - port: "53"
              protocol: UDP
-    # host/remote-node: kube-apiserver (leader election Lease) + cross-node peers;
-    # world: fallback pulls to docker.io/quay.io/ghcr.io/registry.k8s.io.
+    # host/remote-node: kube-apiserver (leader election Lease) + cross-node peers
    - toEntities:
        - host
        - remote-node
-        - world
    # ICMP — egress mirror.
    - toEndpoints:
        - matchExpressions:
@@ -33,7 +33,7 @@ spec:
        - host
        - remote-node
    # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See
-    # home-assistant-ns.yaml for the rationale. INGRESS ONLY.
+    # home-assistant-ns.yaml for the rationale.
    - fromEndpoints:
        - matchExpressions:
            - key: io.kubernetes.pod.namespace
@@ -86,10 +86,9 @@ spec:
 ---
 # Egress allowlist for the Terminus pod only.
 #
-# Deliberately NOT applied to the tr-pg CNPG pods: selecting them here
-# would make their egress restricted too, and the barman-cloud WAL archive
-# path to Hetzner object storage is not worth putting behind an FQDN rule
-# that fails closed. They keep unrestricted egress, matching immich/authentik.
+# Deliberately NOT applied to the other pods: they are covered by
+# trmnl-baseline-egress (in-cluster + DNS), and the tr-pg barman-cloud WAL
+# archive egress comes from the clusterwide CNPG policy.
 #
 # Terminus needs exactly three outbound destinations, all HTTPS:
 #   - trmnl.com            → GET /api/models, /api/palettes (MODEL_SYNCHRONIZER,
@@ -152,3 +151,34 @@ spec:
    - toEntities:
        - host
        - remote-node
+---
+# In-cluster + DNS for every pod except terminus (terminus-egress is its
+# allowlist; selecting it here would widen it to all of `cluster`).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: trmnl-baseline-egress
+  namespace: trmnl
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: NotIn
+        values: [terminus]
+  egress:
+    - toEntities:
+        - cluster
+    # rules.dns lets Cilium learn FQDN mappings.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
@@ -40,14 +40,18 @@ spec:
              protocol: UDP
            - port: "53"
              protocol: TCP
+          # rules.dns lets Cilium learn the toFQDNs mapping
+          rules:
+            dns:
+              - matchPattern: "*"
    # EndpointMonitor watch, Ingress reads, and the startup GET of the config
    # Secret.
    - toEntities:
        - kube-apiserver
    # api.uptimerobot.com. Not reached at all until an EndpointMonitor exists:
    # the controller makes no API call at startup.
-    - toEntities:
-        - world
+    - toFQDNs:
+        - matchName: "api.uptimerobot.com"
      toPorts:
        - ports:
            - port: "443"
@@ -19,7 +19,7 @@ spec:
        - host
        - remote-node
    # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See
-    # home-assistant-ns.yaml for the rationale. INGRESS ONLY.
+    # home-assistant-ns.yaml for the rationale.
    - fromEndpoints:
        - matchExpressions:
            - key: io.kubernetes.pod.namespace
@@ -42,6 +42,32 @@ spec:
            - { type: 135, family: IPv6 }
            - { type: 136, family: IPv6 }
            - { type: 143, family: IPv6 }
+  egress:
+    # All in-cluster destinations (pods, nodes, kube-apiserver).
+    - toEntities:
+        - cluster
+    # rules.dns lets Cilium learn the toFQDNs mapping.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    # Hetzner S3: velero, node-agent and kopia maintenance jobs.
+    - toFQDNs:
+        - matchName: "fsn1.your-objectstorage.com"
+        - matchPattern: "*.fsn1.your-objectstorage.com"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
 ---
 # backup-verify CronJob: kube-apiserver, DNS, Hetzner Cloud API, SSH to its VM.
 apiVersion: cilium.io/v2
@@ -8,7 +8,8 @@
 # belongs in its own policy with its own selector, as
 # `wp-pg-allow-cnpg-operator` below does.
 #
-# There is no egress section, so egress is unrestricted. Still open (#433).
+# Egress: in-cluster + DNS only (server, agent, wp-pg). The CNPG S3 backup
+# egress comes from the clusterwide CNPG policy.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -36,7 +37,6 @@ spec:
        - host
        - remote-node
    # ICMP — from any cluster pod. See home-assistant-ns.yaml for the rationale.
-    # INGRESS ONLY: do NOT add an egress section to this CNP.
    #
    # Needed here specifically because wp-pg-allow-cnpg-operator below attaches
    # an L4 rule (toPorts :8000) to the wp-pg pods, and Cilium blocks ICMP to an
@@ -79,6 +79,24 @@ spec:
    # instance manager. It lands in stage 2 as its own policy selecting the
    # server pod, the way woodpecker-allow-rotators already scopes its :8000
    # rule in apps/woodpecker/networkpolicy.yaml.
+  egress:
+    # All in-cluster destinations (pods, nodes, kube-apiserver).
+    - toEntities:
+        - cluster
+    # rules.dns lets Cilium learn FQDN mappings.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
 ---
 # The CNPG operator polls each instance's status endpoint over HTTPS
 # (https://<pod-ip>:8000/pg/status) to populate Cluster status. Without it the
@@ -85,13 +85,31 @@ spec:
        - ports:
            - port: "53"
              protocol: UDP
-    # world covers two things WordPress genuinely needs outbound: the
-    # wordpress.org update/plugin API, and the Hetzner Object Storage
-    # endpoint the MariaDB Backup writes to.
    - toEntities:
        - host
        - remote-node
-        - world
+    # Hetzner Object Storage for the MariaDB backup CronJob pods (no stable
+    # label, hence namespace-wide). rules.dns lets Cilium learn the mapping.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "fsn1.your-objectstorage.com"
+        - matchPattern: "*.fsn1.your-objectstorage.com"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
    # ICMP — egress mirror.
    - toEndpoints:
        - matchExpressions:
@@ -115,3 +133,21 @@ spec:
            - { type: 135, family: IPv6 }
            - { type: 136, family: IPv6 }
            - { type: 143, family: IPv6 }
+---
+# wordpress: wordpress.org update/plugin API and other HTTPS fetches.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: wordpress-egress-https
+  namespace: wordpress
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: wordpress
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
@@ -1,46 +0,0 @@
-# OpenBao policy: rotator-mosquitto-health
-#
-# Least-privilege policy for the mosquitto `health` broker-credential rotation
-# CronJob (kubernetes auth role `rotator-mosquitto-health`). PER-SECRET
-# isolation, same template as rotator-paperless: one policy + one role per
-# rotated secret, so a compromised rotation Job cannot touch any other secret.
-#
-# Scoped to the `health` credential ALONE, deliberately not to a wildcard over
-# apps/home-assistant/mosquitto-*. The broker has eight users and they are being
-# enrolled one at a time; a wildcard would silently grant the first rotator write
-# access to the other seven before they are ready, which is exactly the blast
-# radius this per-secret pattern exists to avoid.
-#
-# Plan and phasing: kubernetes/apps/home-assistant/
-# PROPOSAL-mosquitto-credential-rotation.md — added by PR #453, which is not yet
-# merged, so that path does not resolve until it lands.
-#
-# NOT applied by Flux — OpenBao policies/roles are not Kubernetes resources
-# (same convention as eso-read.hcl and every other rotator policy). Apply ONCE
-# with an admin token:
-#
-#   bao policy write rotator-mosquitto-health \
-#     kubernetes/infrastructure/openbao/policies/rotator-mosquitto-health.hcl
-#
-#   bao write auth/kubernetes/role/rotator-mosquitto-health \
-#     bound_service_account_names=mosquitto-health-secret-rotator \
-#     bound_service_account_namespaces=openbao \
-#     policies=rotator-mosquitto-health ttl=15m
-#
-# Do NOT set token_no_default_policy=true — the `bao kv patch` kv-v2 preflight
-# needs the default policy (see rotator.hcl). The rotator writes via patch, so
-# hardening the role that way would break rotation rather than tighten it.
-#
-# BOOTSTRAP: `random` mode calls assert_fields_exist BEFORE patching, so it
-# ROTATES an existing field and never creates one. The path must already hold a
-# `password` field or the Job fails safe without writing. Seed it once:
-#
-#   bao kv put homelab/apps/home-assistant/mosquitto-health-credentials \
-#     password="$(kubectl -n home-assistant get secret mosquitto-health-credentials \
-#                 -o jsonpath='{.data.password}' | base64 -d)"
-#
-# (Reads are already covered by eso-read.hcl's `homelab/data/*`, so the
-# ExternalSecret needs no policy change.)
-path "homelab/data/apps/home-assistant/mosquitto-health-credentials" {
-  capabilities = ["read", "patch"]
-}
@@ -71,7 +71,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-23 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-25 # {"$imagepolicy": "flux-system:secret-rotator"}
              args: ["ha-token"]
              securityContext:
                allowPrivilegeEscalation: false
@@ -133,7 +133,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-23 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-25 # {"$imagepolicy": "flux-system:secret-rotator"}
              args: ["ha-token"]
              securityContext:
                allowPrivilegeEscalation: false
@@ -195,7 +195,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-23 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-25 # {"$imagepolicy": "flux-system:secret-rotator"}
              args: ["ha-token"]
              securityContext:
                allowPrivilegeEscalation: false
@@ -52,7 +52,6 @@ resources:
  - registry-bot.yaml
  - review-bot.yaml
  - claude-oauth.yaml
-  - mosquitto-health.yaml
 # NOT ROTATED, deliberately — recorded here because the whole point of this
 # directory is that unrotated credentials should be a visible choice:
 #
@@ -1,124 +0,0 @@
---
-# Class-A automated rotation of the mosquitto `health` broker credential — a
-# self-generated random secret.
-#
-# FIRST of the eight mosquitto broker users to be enrolled. The credentials were
-# previously minted once by bootstrap Jobs and then never changed at all: no
-# schedule, no compromise response, and they existed only in the Secret object,
-# outside the OpenBao snapshot. See kubernetes/apps/home-assistant/
-# PROPOSAL-mosquitto-credential-rotation.md (PR #453 — not yet merged; this
-# file lands with it) for the full plan and phasing.
-#
-# `health` deliberately goes first: it is the broker's OWN liveness/readiness
-# probe credential, consumed by exec probes inside the mosquitto container via
-# the same Secret that seeds the passwd file. Nothing outside the pod holds it,
-# so a rotation needs no coordination with any client — the smallest possible
-# blast radius for proving rotator -> OpenBao -> ESO -> Reloader end to end.
-#
-# Runs the secret-rotator binary (random mode): generate 32 random bytes,
-# standard-base64 encode, and merge-patch into OpenBao. assert_fields_exist runs
-# FIRST, so a misconfigured path fails safe (no rotation) rather than adding a
-# stray field — which also means this ROTATES an existing value and never
-# bootstraps one. Seeding is a one-time out-of-band step, documented in
-# policies/rotator-mosquitto-health.hcl.
-#
-# Base64 output is safe for this credential specifically: the probes pass it as
-# `-P "$HEALTH_PASSWORD"` to mosquitto_pub/sub inside the container, so the `+`,
-# `/` and `=` characters are never parsed by a URL or a config file. That is NOT
-# automatically true of the other seven users (sml2mqtt and open3e templates on
-# the edge host, Shelly device firmware, the HA config entry), so the charset
-# must be re-checked per user before enrolling each one — the old bootstrap Jobs
-# generated alphanumeric-only passwords with `tr -dc 'A-Za-z0-9'`.
-#
-# openbao-ns pattern: the Job runs in the openbao namespace, reaching the
-# OpenBao API intra-namespace — no NetworkPolicy needed. It writes OpenBao only;
-# ESO syncs mosquitto-health-credentials (ns home-assistant) and Reloader
-# restarts the broker so the passwd file is rebuilt from the new value.
-#
-# Rotation is not instant: it completes only after the ExternalSecret's
-# refreshInterval elapses and the broker rolls. During that roll two broker pods
-# with different passwd files sit behind the LB (maxUnavailable: 0/maxSurge: 1),
-# so a probe against the outgoing pod can fail auth briefly. Self-healing.
-#
-# ON-DEMAND: kubectl -n openbao create job --from=cronjob/mosquitto-health-secret-rotate mosquitto-health-secret-rotate-now
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: mosquitto-health-secret-rotator
-  namespace: openbao
-  labels:
-    app.kubernetes.io/name: mosquitto
-    app.kubernetes.io/component: secret-rotator
---
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: mosquitto-health-secret-rotate
-  namespace: openbao
-  labels:
-    app.kubernetes.io/name: mosquitto
-    app.kubernetes.io/component: secret-rotator
-spec:
-  # Quarterly, offset one month from paperless (which runs Jan/Apr/Jul/Oct) so
-  # unrelated rotations do not land in the same window and complicate diagnosis.
-  schedule: "0 4 1 2,5,8,11 *"
-  timeZone: Europe/Berlin
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 2
-  failedJobsHistoryLimit: 5
-  startingDeadlineSeconds: 3600
-  jobTemplate:
-    spec:
-      backoffLimit: 2
-      activeDeadlineSeconds: 300
-      ttlSecondsAfterFinished: 259200 # 3 d
-      template:
-        metadata:
-          labels:
-            app.kubernetes.io/name: mosquitto
-            app.kubernetes.io/component: secret-rotator
-        spec:
-          serviceAccountName: mosquitto-health-secret-rotator
-          restartPolicy: Never
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 65534
-            runAsGroup: 65534
-            seccompProfile:
-              type: RuntimeDefault
-          containers:
-            - name: rotate
-              # Dated tag, per the convention documented in kustomization.yaml —
-              # every rotator here now uses the same one. Verified for this tag:
-              # it pulls, `random` is among its modes, and it carries the
-              # RANDOM_BYTES>=16 floor documented below (RANDOM_BYTES=8 exits
-              # "refusing to generate a weak secret").
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
-              args: ["random"]
-              securityContext:
-                allowPrivilegeEscalation: false
-                readOnlyRootFilesystem: true
-                capabilities:
-                  drop: ["ALL"]
-              env:
-                - name: BAO_ADDR
-                  value: http://openbao.openbao.svc.cluster.local:8200
-                - name: BAO_ROLE
-                  value: rotator-mosquitto-health
-                - name: BAO_PATH
-                  value: homelab/apps/home-assistant/mosquitto-health-credentials
-                # Matches the key the ExternalSecret projects and the key the
-                # Secret already carries, so mosquitto-deployment.yaml's
-                # secretKeyRef is unchanged.
-                - name: BAO_FIELDS
-                  value: "password"
-                # 32 bytes -> 44 base64 chars. The binary refuses anything below
-                # 16 bytes outright.
-                - name: RANDOM_BYTES
-                  value: "32"
-              resources:
-                requests:
-                  cpu: 25m
-                  memory: 16Mi
-                limits:
-                  memory: 48Mi
@@ -32,7 +32,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: backup-verify
-              image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-22 # {"$imagepolicy": "flux-system:backup-verify"}
+              image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-25 # {"$imagepolicy": "flux-system:backup-verify"}
              command: ["bash", "/script/backup-verify.sh"]
              env:
                - name: HOME
Author	SHA1	Message	Date
renovate-bot	1955a11b81	chore(deps): update ci non-major ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/review-bot-test Pipeline was successful Details	2026-10-26 03:01:34 +00:00
security-bot	c79ccfb3f3	chore(image-automation): bump lscr.io/linuxserver/lidarr:3.1.6.5079-ls46 ci/woodpecker/cron/update-audit Pipeline was successful Details ci/woodpecker/cron/e2e Pipeline failed Details Updates managed by image-automation-controller.	2026-10-26 02:52:46 +00:00
k.renner	0904f73721	Merge pull request 'fix(netpol): allow shelly-manager mDNS queries' (#1436 ) from claude/shelly-manager-mdns into main Reviewed-on: #1436	2026-10-25 22:16:39 +00:00
k.renner	ef2024c565	Merge pull request 'feat(mqtt): admin login as a register account' (#1437 ) from claude/mqtt-admin-register into main Reviewed-on: #1437	2026-10-25 22:16:23 +00:00
claude-botandClaude Opus 5.5	3c86f0970c	feat(mqtt): admin login as a register account ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details The controller (main-b1f294d, konairius/mqtt-account-controller#13) delivers a password account to a namespace Secret. admin moves into the register with its password in Secret mqtt-admin-password; Dynamic Security is asked first, so it replaces the password_file login without a broker restart. The controller gets get/create/patch/delete on that Secret by name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-25 21:06:03 +01:00
security-bot	4c5665aa75	chore(image-automation): bump gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-25 gitea.renner.uno/gitea_admin/review-bot:2026-10-25-1455 gitea.renner.uno/gitea_admin/secret-rotator:2026-10-25 Updates managed by image-automation-controller.	2026-10-25 15:23:41 +00:00
security-bot	38091cbe11	chore(image-automation): bump gitea.renner.uno/gitea_admin/kuma-sync:2026-10-25-1459 Updates managed by image-automation-controller.	2026-10-25 15:23:40 +00:00
security-bot	33c0266fc1	chore(image-automation): bump gitea.renner.uno/gitea_admin/cloudflare-lb-sync:2026-10-25-1504 Updates managed by image-automation-controller.	2026-10-25 15:17:02 +00:00
claude-botandClaude Opus 5.5	9bcc1cb420	fix(netpol): allow shelly-manager mDNS queries ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details shelly-manager resolves device *.local names via mDNS; the queries leave on eth0 to 224.0.0.251:5353 and have been dropped since the egress lockdown (#1432), failing with 'Name or service not known' since 15:07Z. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-25 16:10:58 +01:00
security-bot	b10b50fd2d	chore(image-automation): bump gitea.renner.uno/konairius/hermes:build.1792940452 Updates managed by image-automation-controller.	2026-10-25 15:06:45 +00:00
security-bot	f9c517bd37	chore(image-automation): bump gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-25-1458 Updates managed by image-automation-controller.	2026-10-25 15:06:43 +00:00
security-bot	49cafb2f6d	chore(image-automation): bump gitea.renner.uno/konairius/wiki:build.1792939775 Updates managed by image-automation-controller.	2026-10-25 14:56:41 +00:00
k.renner	6fa10a7744	Merge pull request 'feat(wiki): gate wiki sign-in to Wiki Readers and enable encyclopedia planning' (#1435 ) from feat/wiki-encyclopedia-pilot into main Reviewed-on: #1435	2026-10-25 14:51:08 +00:00
k.renner	b341b26673	Merge pull request 'feat(netpol): restrict pod egress to the outside world per workload' (#1432 ) from claude/egress-lockdown into main ci/woodpecker/push/ci-claude-refresh Pipeline was successful Details ci/woodpecker/push/deploy-claude-workstation Pipeline failed Details ci/woodpecker/push/deploy-edge-mqtt-bridge Pipeline was successful Details ci/woodpecker/push/deploy-infrastructure Pipeline was successful Details ci/woodpecker/push/deploy-netbird-client Pipeline failed Details ci/woodpecker/push/deploy-netbird-proxy Pipeline was successful Details ci/woodpecker/push/deploy-netbird-server Pipeline was successful Details ci/woodpecker/push/deploy-uptime-kuma Pipeline was successful Details ci/woodpecker/push/hermes-image Pipeline was successful Details ci/woodpecker/push/build-ci-images Pipeline was successful Details Reviewed-on: #1432	2026-10-25 14:50:32 +00:00
k.renner	aad24d4186	Merge pull request 'feat(mosquitto): retire legacy password users (admin stays, generated Secret)' (#1433 ) from claude/mosquitto-legacy-auth-removal into main Reviewed-on: #1433	2026-10-25 14:50:09 +00:00
k.renner	7ef4475952	Merge pull request 'chore(ci): bump ci-claude image to 2.1.310' (#1434 ) from ci-image/claude-2.1.310 into main Reviewed-on: #1434 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-10-25 14:48:49 +00:00
claude-botandClaude Opus 5.5	aca39a5a8f	feat(wiki): gate wiki sign-in to Wiki Readers and enable encyclopedia planning ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details Only members of the new Authentik group Wiki Readers may sign in to the wiki OIDC application; membership is managed in Authentik, so the owner must be added before merge. Encyclopedia is enabled with MaxArticles=0 so the first nightly run only plans. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-25 14:52:51 +01:00
claude-bot	d7ca8dda11	chore(ci): bump ci-claude image to 2.1.310 ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details	2026-10-25 00:01:21 +00:00
security-bot	c8483b3545	chore(image-automation): bump ghcr.io/home-assistant/home-assistant:2026.10.4 ci/woodpecker/cron/ci-claude-refresh Pipeline was successful Details ci/woodpecker/cron/e2e Pipeline failed Details ci/woodpecker/cron/security-scan Pipeline was successful Details Updates managed by image-automation-controller.	2026-10-24 20:50:33 +00:00
claude-botandClaude Opus 5.5	bb090e6809	feat(mosquitto): retire legacy password users; admin stays on a generated Secret ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details Since the broker restart on 2026-10-22 only register accounts connect; the last legacy logins (homeassistant, sml2mqtt, open3e, zigbee2mqtt) were on 2026-10-08, and admin/evcc never logged in within the 30-day Loki window. - Delete mosquitto-bootstrap.yaml (5 Jobs that apk add at runtime + RBAC). - The broker's password_file/acl_file now hold only admin, the owner's workstation login over the LoadBalancer. The controller has no delivery mode that puts a password account's password into a Secret, and the cert listener :8884 is in-cluster only, so admin cannot be a register account. Its password comes from an ESO Password generator (CreatedOnce), the pattern of apps/hermes/api-key.yaml, in Secret mosquitto-admin-password. - Delete the evcc and health ExternalSecrets and the health rotator CronJob/policy; nothing reads them. - Delete PROPOSAL-mosquitto-credential-rotation.md; its subject is gone. - MosquittoDown test masks with the dynsec-test pod instead of a bootstrap Job pod; comments and docs follow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-24 20:46:00 +02:00
claude-botandClaude Opus 5.5	5aee6a54ad	revert(netpol): no world egress for mosquitto-bootstrap ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details Runtime package installs are not to be enabled by policy. The Jobs feed only the unused legacy password_file and are removed in a separate PR, which must merge before this one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-24 17:33:25 +02:00
claude-botandClaude Opus 5.5	8a53171ad0	fix(netpol): let mosquitto-bootstrap Jobs reach Alpine mirrors ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details The Jobs run apk add curl jq on every execution; without world 443/80 they fail and block the home-assistant Kustomization. Also correct the stale renderer egress comment. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-24 17:26:49 +02:00
claude-botandClaude Opus 5.5	299194247e	feat(netpol): allow mqtt-account-controller to deliver to edge-1 ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details edge-1.iot.renner.uno:8443 is the deliver.esp32 target in mqtt-accounts.yaml (https+mTLS credential push). Matched by FQDN, not the current 10.2.30.108. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-24 17:26:00 +02:00
claude-bot	6b6e1e7e04	Merge remote-tracking branch 'origin/main' into worktree-egress-lockdown ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline failed Details # Conflicts: # kubernetes/infrastructure/network-policies/gitea-ns.yaml # kubernetes/infrastructure/network-policies/matrix-ns.yaml	2026-10-24 12:45:03 +02:00
claude-botandClaude Opus 5.5	752fcd5d03	feat(netpol): restrict pod egress to the outside world per workload ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details Drop namespace-wide world egress and give each workload only the external destinations it needs (FQDN where the host is in our config, port-scoped world otherwise). Namespaces that had ingress-only policies get an in-cluster + DNS egress baseline. CNPG instances get Hetzner S3 via one clusterwide policy. Out of scope: kube-system, flux-system, rook-ceph, woodpecker-ci, music-assistant, evcc, openbao. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-24 12:43:38 +02:00
security-bot	55cd083484	chore(image-automation): bump ghcr.io/advplyr/audiobookshelf:2.37.2 ci/woodpecker/cron/e2e Pipeline failed Details ci/woodpecker/cron/security-scan Pipeline was successful Details Updates managed by image-automation-controller.	2026-10-23 20:49:32 +00:00
security-bot	ada3d3d0b4	chore(image-automation): bump ghcr.io/home-assistant/home-assistant:2026.10.3 Updates managed by image-automation-controller.	2026-10-23 19:50:03 +00:00
security-bot	1bd3111912	chore(image-automation): bump ghcr.io/music-assistant/server:2.10.8 Updates managed by image-automation-controller.	2026-10-23 14:49:29 +00:00
security-bot	0e12e90509	chore(image-automation): bump gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-23-0757 ci/woodpecker/cron/e2e Pipeline failed Details ci/woodpecker/cron/security-scan Pipeline was successful Details Updates managed by image-automation-controller.	2026-10-23 08:02:02 +00:00
k.renner	613e1da011	Merge pull request 'fix(authentik-gate-sync): embedded outpost redirects browsers to the public URL' (#1430 ) from fix/gate-embedded-browser-host into main ci/woodpecker/push/build-ci-images Pipeline was successful Details Reviewed-on: #1430	2026-10-23 07:57:11 +00:00