From fdddbe7e78046f8182357276f831814afc0f3acc Mon Sep 17 00:00:00 2001
From: Claude Bot <claude-bot@renner.uno>
Date: Mon, 13 Jul 2026 11:01:51 +0200
Subject: [PATCH] chore(esphome): trim Shelly BLE proxy to WiFi + API only
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per how it's actually run: drop OTA and the fallback AP/captive_portal — this is
a fixed, low-value proxy, so updates and any WiFi recovery are done by re-flashing
over USB. Secrets shrink to iot_wifi_ssid / iot_wifi_password /
shelly_ble_proxy_api_key (the api encryption key stays; it's the ble-agent
handoff). README secrets list + flashing note updated to match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 esphome/README.md             |  9 ++++-----
 esphome/shelly-ble-proxy.yaml | 11 ++---------
 2 files changed, 6 insertions(+), 14 deletions(-)

diff --git a/esphome/README.md b/esphome/README.md
index 8400dfb7..74652882 100644
--- a/esphome/README.md
+++ b/esphome/README.md
@@ -23,8 +23,6 @@ The dashboard's `secrets.yaml` (on the PVC — **not** in git) must define:
 ```yaml
 iot_wifi_ssid: "<IoT SSID>"
 iot_wifi_password: "<...>"
-shelly_ble_proxy_ap_password: "<recovery AP password, 8+ chars>"
-shelly_ble_proxy_ota_password: "<...>"
 # 32-byte base64 — dashboard "Generate", or: openssl rand -base64 32
 # This value is the handoff to the ble-agent (its BLE_PROXY_NOISE_PSK).
 shelly_ble_proxy_api_key: "<...>"
@@ -32,6 +30,7 @@ shelly_ble_proxy_api_key: "<...>"
 
 ## Flashing
 
-First flash is browser-side over USB (ESP Web Tools / Web Serial, Chrome/Edge):
-plug the Atom Echo into your computer, open the dashboard, **Install → Plug into
-this computer**. After that, updates are OTA.
+USB only — the config has no OTA and no recovery AP by design. Flash (and any
+later update or WiFi-recovery) is browser-side over USB (ESP Web Tools / Web
+Serial, Chrome/Edge): plug the Atom Echo into your computer, open the dashboard,
+**Install → Plug into this computer**.
diff --git a/esphome/shelly-ble-proxy.yaml b/esphome/shelly-ble-proxy.yaml
index 06c4575b..fc93e83c 100644
--- a/esphome/shelly-ble-proxy.yaml
+++ b/esphome/shelly-ble-proxy.yaml
@@ -36,18 +36,11 @@ api:
   encryption:
     key: !secret shelly_ble_proxy_api_key
 
-ota:
-  - platform: esphome
-    password: !secret shelly_ble_proxy_ota_password
-
+# No OTA and no fallback AP/captive_portal, deliberately — this is a fixed,
+# low-value proxy: updates and any WiFi-recovery are done by re-flashing over USB.
 wifi:
   ssid: !secret iot_wifi_ssid
   password: !secret iot_wifi_password
-  ap: # recovery AP if the IoT WiFi is down at boot
-    ssid: "${friendly_name} Setup"
-    password: !secret shelly_ble_proxy_ap_password
-
-captive_portal:
 
 # Active BLE proxy — enables the GATT connect + characteristic read/write that
 # Shelly's mOS RPC-over-BLE needs to provision a WiFi-less device
-- 
2.54.0