From 4316d503d29922e86282abd6d30a570cfbdf21d1 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Fri, 6 Nov 2026 10:59:25 +0100 Subject: [PATCH] feat(edge-host): add edge-2 as second edge host edge-2.iot.renner.uno joins [edge_host] (base roles only, no peripherals) and [ssh_ca], and the NTP VRRP group as BACKUP with priority 60, below edge-1. The MQTT bridge account follows the host's short name instead of a fixed edge-1, and the bridge client id is derived from it (edge-1 keeps edge1-bridge). The register gets the account edge-2, and the controller's egress policy allows edge-2's credential endpoint on 8443. Co-Authored-By: Claude Opus 5.5 --- ansible/inventory/pve_hosts.yml | 2 ++ ansible/plays/install-ntp-ha.yml | 3 +++ ansible/roles/mqtt-bridge/defaults/main.yml | 2 +- ansible/roles/mqtt-bridge/templates/edge-1-bridge.conf.in.j2 | 2 +- kubernetes/apps/home-assistant/mqtt-accounts.yaml | 5 +++++ .../infrastructure/network-policies/home-assistant-ns.yaml | 1 + 6 files changed, 13 insertions(+), 2 deletions(-) diff --git a/ansible/inventory/pve_hosts.yml b/ansible/inventory/pve_hosts.yml index 9fe9c028..9147f75d 100644 --- a/ansible/inventory/pve_hosts.yml +++ b/ansible/inventory/pve_hosts.yml @@ -22,6 +22,7 @@ proxy-2.renner.uno ansible_host=proxy-2.nb.renner.uno ansible_user=root # sub-interface. Nothing here assumes any peripheral is attached. [edge_host] edge-1.iot.renner.uno ansible_user=root +edge-2.iot.renner.uno ansible_user=root # Synology NAS (DSM): nas-1 RS1221+ on site, nas-2 DS1522+ off site. [synology_nas] @@ -73,6 +74,7 @@ proxy-1.renner.uno proxy-2.renner.uno netbird.renner.uno edge-1.iot.renner.uno +edge-2.iot.renner.uno nas-1.renner.uno nas-2.renner.uno diff --git a/ansible/plays/install-ntp-ha.yml b/ansible/plays/install-ntp-ha.yml index c742af64..3e39bf93 100644 --- a/ansible/plays/install-ntp-ha.yml +++ b/ansible/plays/install-ntp-ha.yml @@ -83,6 +83,9 @@ edge-1.iot.renner.uno: priority: 70 state: "BACKUP" + edge-2.iot.renner.uno: + priority: 60 + state: "BACKUP" roles: - role: chrony-ntp-server diff --git a/ansible/roles/mqtt-bridge/defaults/main.yml b/ansible/roles/mqtt-bridge/defaults/main.yml index 0e85bbfc..bc809227 100644 --- a/ansible/roles/mqtt-bridge/defaults/main.yml +++ b/ansible/roles/mqtt-bridge/defaults/main.yml @@ -16,7 +16,7 @@ edge_mqtt_bridge_cafile: /etc/ssl/certs/ca-certificates.crt # kubernetes/apps/home-assistant/mqtt-accounts.yaml). The controller pushes # its password to edge-mqtt-cred and rotates it when the bridge reports # "not connected"; there is no copy in ansible-vault. -edge_mqtt_bridge_account: edge-1 +edge_mqtt_bridge_account: "{{ inventory_hostname_short }}" # HTTPS port of edge-mqtt-cred (esp32 device API, mTLS). Only a client # certificate from the MQTT CA with this CN is accepted. edge_mqtt_cred_port: 8443 diff --git a/ansible/roles/mqtt-bridge/templates/edge-1-bridge.conf.in.j2 b/ansible/roles/mqtt-bridge/templates/edge-1-bridge.conf.in.j2 index f23b9ace..6967adbc 100644 --- a/ansible/roles/mqtt-bridge/templates/edge-1-bridge.conf.in.j2 +++ b/ansible/roles/mqtt-bridge/templates/edge-1-bridge.conf.in.j2 @@ -7,7 +7,7 @@ connection {{ edge_mqtt_bridge_account }} address {{ edge_mqtt_cluster_host }}:{{ edge_mqtt_cluster_tls_port }} bridge_cafile {{ edge_mqtt_bridge_cafile }} bridge_insecure false -remote_clientid edge1-bridge +remote_clientid {{ edge_mqtt_bridge_account | replace('-', '') }}-bridge cleansession false try_private true restart_timeout 5 30 diff --git a/kubernetes/apps/home-assistant/mqtt-accounts.yaml b/kubernetes/apps/home-assistant/mqtt-accounts.yaml index 0b52fa14..c6011902 100644 --- a/kubernetes/apps/home-assistant/mqtt-accounts.yaml +++ b/kubernetes/apps/home-assistant/mqtt-accounts.yaml @@ -61,6 +61,11 @@ # No sml2mqtt/#: the SML meter reader is retired for good (owner, # 2026-09-19; grid data comes from the E380 on the CAN bus). acl: ["readwrite open3e/#"] +# edge-2's local mosquitto bridge, same role and pinning as edge-1. +- name: edge-2 + auth: password + deliver: {esp32: "https://edge-2.iot.renner.uno:8443"} + acl: ["readwrite open3e/#"] # Shellies (REN-1017): one password account per device, pushed by the # controller through shelly-manager's per-device API. Name shelly- = # shelly-manager device id. ACL as the former shared user `shellies` diff --git a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml index 19544b71..b48edb83 100644 --- a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml +++ b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml @@ -516,6 +516,7 @@ spec: - matchPattern: "*" - toFQDNs: - matchName: "edge-1.iot.renner.uno" + - matchName: "edge-2.iot.renner.uno" toPorts: - ports: - port: "8443" -- 2.54.0