chore(edge): retire the open3e MQTT bridge from all edge hosts #1596

2026-11-07T13:41:10Z

claude-bot commented

2026-11-07 13:41:10 +00:00

Nothing on any edge host publishes to the loopback mosquitto any more. The CAN stack is gone (#1595), vitocal-can publishes open3e/# to the cluster broker itself, and the bridges on edge-1 and edge-2 carried only open3e/# out and open3e/cmnd in. Gen1 Shellies are not affected: they publish to mqtt.renner.uno:1883 directly, and the edge broker listens on 127.0.0.1:1883 only.

Delete the role mqtt-bridge from the base play install-edge-host.yml.
install-edge-host.yml pre_tasks remove the bridge from every edge host. Each step is a no-op where already absent:
- stop and disable edge-mqtt-cred and mosquitto, if the unit exists
- delete the unit, /usr/local/sbin/edge-mqtt-cred, /etc/edge-mqtt-cred and /etc/mosquitto
- uninstall mosquitto
group_vars/edge_host: drop the local MQTT contract (edge_mqtt_host/_port, edge_open3e_mqtt_user/_password) and the mosquitto/edge-mqtt-cred entries of ssh_ca_claude_sudo_units.
Register mqtt-accounts.yaml: drop edge-1 and edge-2 (39 accounts remain).
mqtt-account-controller-egress: drop edge-1/edge-2.iot.renner.uno:8443. The rule for open3e.iot.renner.uno:80 (vitocal-can) stays.
Docs: ansible/docs/edge-host.md loses the MQTT bridge section and the vault_edge_open3e_mqtt_password entry. The key itself stays in the encrypted group_vars/edge_host/vault.yml until it is next edited.

Checks: ansible-playbook --syntax-check site.yml passes. kubectl kustomize of apps/home-assistant and infrastructure/network-policies builds.

After the merge, Flux applies the register and egress changes. The edge hosts follow on the next ansible-playbook site.yml.

🤖 Generated with Claude Code

Nothing on any edge host publishes to the loopback mosquitto any more. The CAN stack is gone (#1595), vitocal-can publishes `open3e/#` to the cluster broker itself, and the bridges on edge-1 and edge-2 carried only `open3e/#` out and `open3e/cmnd` in. Gen1 Shellies are not affected: they publish to `mqtt.renner.uno:1883` directly, and the edge broker listens on `127.0.0.1:1883` only. - Delete the role `mqtt-bridge` from the base play `install-edge-host.yml`. - `install-edge-host.yml` `pre_tasks` remove the bridge from every edge host. Each step is a no-op where already absent: - stop and disable `edge-mqtt-cred` and `mosquitto`, if the unit exists - delete the unit, `/usr/local/sbin/edge-mqtt-cred`, `/etc/edge-mqtt-cred` and `/etc/mosquitto` - uninstall mosquitto - `group_vars/edge_host`: drop the local MQTT contract (`edge_mqtt_host`/`_port`, `edge_open3e_mqtt_user`/`_password`) and the `mosquitto`/`edge-mqtt-cred` entries of `ssh_ca_claude_sudo_units`. - Register `mqtt-accounts.yaml`: drop `edge-1` and `edge-2` (39 accounts remain). - `mqtt-account-controller-egress`: drop `edge-1`/`edge-2.iot.renner.uno:8443`. The rule for `open3e.iot.renner.uno:80` (vitocal-can) stays. - Docs: `ansible/docs/edge-host.md` loses the MQTT bridge section and the `vault_edge_open3e_mqtt_password` entry. The key itself stays in the encrypted `group_vars/edge_host/vault.yml` until it is next edited. Checks: `ansible-playbook --syntax-check site.yml` passes. `kubectl kustomize` of `apps/home-assistant` and `infrastructure/network-policies` builds. After the merge, Flux applies the register and egress changes. The edge hosts follow on the next `ansible-playbook site.yml`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-11-07 13:41:10 +00:00

chore(edge): retire the open3e MQTT bridge from edge-1

ci/woodpecker/pr/ci-manifests-test Pipeline was canceled

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ff6ad64783

Nothing on edge-1 publishes to its loopback mosquitto any more: the CAN stack is
gone (#1595) and vitocal-can publishes open3e/# to the cluster broker itself.
The bridge carried only open3e/# out and open3e/cmnd in.

- mqtt-bridge leaves the edge base play; the new play install-mqtt-bridge.yml
  applies it to the inventory group mqtt_bridge (edge-2) and removes it from
  every other edge host: stop and disable edge-mqtt-cred and mosquitto, delete
  the unit, script, /etc/edge-mqtt-cred and /etc/mosquitto/bridge.d,
  uninstall mosquitto
- register: drop the account edge-1 (readwrite open3e/#)
- mqtt-account-controller-egress: drop edge-1.iot.renner.uno:8443
- docs: the bridge runs only on [mqtt_bridge] hosts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot added 1 commit 2026-11-07 13:44:10 +00:00

chore(edge): retire the MQTT bridge from edge-2 too, drop the role

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

6baf3139b9

edge-2's bridge carried only open3e/# as well, with nothing publishing to it
(owner decision 2026-11-07). The mqtt-bridge role is gone entirely.

- delete the role mqtt-bridge and the play install-mqtt-bridge.yml with its
  site.yml import and the inventory group mqtt_bridge
- install-edge-host.yml pre_tasks remove the bridge from every edge host:
  stop and disable edge-mqtt-cred and mosquitto (if present), delete the unit,
  script, /etc/edge-mqtt-cred and /etc/mosquitto, uninstall mosquitto
- group_vars edge_host: drop the local MQTT contract (edge_mqtt_host/port,
  edge_open3e_mqtt_user/password) and the mosquitto/edge-mqtt-cred sudo units
- register: drop the account edge-2; controller egress: drop
  edge-2.iot.renner.uno:8443
- docs: drop the MQTT bridge section and the vault_edge_open3e_mqtt_password
  entry

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot changed title from ~~chore(edge): retire the open3e MQTT bridge from edge-1~~ to chore(edge): retire the open3e MQTT bridge from all edge hosts

2026-11-07 13:44:25 +00:00

k.renner requested review from review-bot 2026-11-07 13:45:12 +00:00

review-bot approved these changes

2026-11-07 13:49:45 +00:00

review-bot left a comment

🤖 Automated review — model claude-opus-5-5, commit 6baf3139b9f00df2fdd1a083e6b4a3ebada1d8d9.

Automated review by the review-bot: it approves only when it found nothing red or yellow, and a human still merges. Request a review from review-bot again for a fresh one.

Summary

This PR removes the mqtt-bridge role, meaning the loopback mosquitto and edge-mqtt-cred, from all edge hosts. It adds idempotent pre_tasks that clean the bridge off hosts that already have it. It also drops the edge-1/edge-2 register accounts and their controller egress rule. The change is clean and consistent: nothing left in the repo uses the removed variables or the role, and I found no blocking problems. The PR is based on the merge commit of #1595 (07e1684b) and is mergeable.

⚪ Unverified

Old broker accounts after the register change: I couldn't check whether mqtt-account-controller deletes the Dynamic Security clients edge-1/edge-2 from the broker once they leave kubernetes/apps/home-assistant/mqtt-accounts.yaml. Its code lives in the separate repo konairius/mqtt-account-controller. The RBAC comments in mqtt-account-controller.yaml mention "deleted on revocation", which suggests it does, but I couldn't confirm it. After Flux applies the change, check that both clients are gone from dynsec and that the edge-1.pin/edge-2.pin keys are cleared from mqtt-account-hashes. Otherwise two password accounts with readwrite open3e/# stay valid on the broker.
Other references to edge-*:8443: the full repo tree was truncated, so I couldn't search monitoring and probes (probes-blackbox.yaml, gatus) for checks against edge-1/2.iot.renner.uno:8443. A search of issues and PRs for edge-mqtt-cred and edge_mqtt_host returns only this PR. Within ansible/, I read every remaining consumer (zwave-gateway defaults and compose template, install-zwave-gateway.yml, edge-alloy.alloy.j2), and none of them uses MQTT or the removed vars.

🟡 Suggestions

ansible/plays/install-edge-host.yml:39-72: the cleanup step order is right (stop/disable → delete files → daemon-reload → uninstall). The only gap is that the daemon-reload runs only when the file deletion changed something, and it runs before the package removal. So systemd still keeps the packaged mosquitto.service loaded until the next reload. This is harmless because the unit is already stopped and disabled. A daemon_reload after Uninstall mosquitto would make it tidy.
Like the existing heating-can/can0 blocks, these pre_tasks are one-time migrations that stay in the base play for good. Consider a comment or follow-up issue to remove them once both hosts have converged.

🟢 Nits

ansible/docs/edge-host.md:72: the sentence now starts "Create … with ansible-vault. The zwave-js value comes out of the cluster:". That reads fine, but the section has only two keys now, so it could be shortened.

Tests

This repo has no Ansible tests. The author reports that ansible-playbook --syntax-check site.yml passes and that kubectl kustomize builds for both touched kustomizations, which is the appropriate level of checking here. Before the first real run, a --check --diff run against edge_host would show the cleanup steps acting as expected.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `claude-opus-5-5`, commit `6baf3139b9f00df2fdd1a083e6b4a3ebada1d8d9`. > Automated review by the `review-bot`: it approves only when it found nothing red or yellow, and a human still merges. Request a review from `review-bot` again for a fresh one. --- ## Summary This PR removes the `mqtt-bridge` role, meaning the loopback mosquitto and `edge-mqtt-cred`, from all edge hosts. It adds idempotent `pre_tasks` that clean the bridge off hosts that already have it. It also drops the `edge-1`/`edge-2` register accounts and their controller egress rule. The change is clean and consistent: nothing left in the repo uses the removed variables or the role, and I found no blocking problems. The PR is based on the merge commit of #1595 (`07e1684b`) and is mergeable. ## ⚪ Unverified - **Old broker accounts after the register change:** I couldn't check whether `mqtt-account-controller` deletes the Dynamic Security clients `edge-1`/`edge-2` from the broker once they leave `kubernetes/apps/home-assistant/mqtt-accounts.yaml`. Its code lives in the separate repo `konairius/mqtt-account-controller`. The RBAC comments in `mqtt-account-controller.yaml` mention "deleted on revocation", which suggests it does, but I couldn't confirm it. After Flux applies the change, check that both clients are gone from dynsec and that the `edge-1.pin`/`edge-2.pin` keys are cleared from `mqtt-account-hashes`. Otherwise two password accounts with `readwrite open3e/#` stay valid on the broker. - **Other references to `edge-*:8443`:** the full repo tree was truncated, so I couldn't search monitoring and probes (`probes-blackbox.yaml`, gatus) for checks against `edge-1/2.iot.renner.uno:8443`. A search of issues and PRs for `edge-mqtt-cred` and `edge_mqtt_host` returns only this PR. Within `ansible/`, I read every remaining consumer (`zwave-gateway` defaults and compose template, `install-zwave-gateway.yml`, `edge-alloy.alloy.j2`), and none of them uses MQTT or the removed vars. ## 🟡 Suggestions - `ansible/plays/install-edge-host.yml:39-72`: the cleanup step order is right (stop/disable → delete files → `daemon-reload` → uninstall). The only gap is that the `daemon-reload` runs only when the file deletion changed something, and it runs before the package removal. So systemd still keeps the packaged `mosquitto.service` loaded until the next reload. This is harmless because the unit is already stopped and disabled. A `daemon_reload` after `Uninstall mosquitto` would make it tidy. - Like the existing heating-can/can0 blocks, these `pre_tasks` are one-time migrations that stay in the base play for good. Consider a comment or follow-up issue to remove them once both hosts have converged. ## 🟢 Nits - `ansible/docs/edge-host.md:72`: the sentence now starts "Create … with ansible-vault. The zwave-js value comes out of the cluster:". That reads fine, but the section has only two keys now, so it could be shortened. ## Tests This repo has no Ansible tests. The author reports that `ansible-playbook --syntax-check site.yml` passes and that `kubectl kustomize` builds for both touched kustomizations, which is the appropriate level of checking here. Before the first real run, a `--check --diff` run against `edge_host` would show the cleanup steps acting as expected. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

k.renner merged commit b2b4cd4ab9 into main

2026-11-07 13:50:36 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1596