From 2f2b96905e2c66dbca7b52995deb9e2f26cadac2 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Mon, 13 Jul 2026 17:52:33 +0200 Subject: [PATCH] feat(shelly-manager): wire the ESPHome proxy Noise key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit shelly-manager's native ESPHome-API client (PR k.renner/shelly-manager#12) does the real Noise_NNpsk0 handshake to the Atom Echo bluetooth_proxy when it has the api.encryption.key. Provide it: * shelly-ble-proxy-key.sops.yaml — SOPS Secret holding api-key, the same value as the ESPHome dashboard's shelly_ble_proxy_api_key. * shelly-manager-deployment: inject it as Ble__Proxies__0__Key via secretKeyRef. Effect: /ble-radios upgrades from a bare TCP :6053 check to a real handshake + DeviceInfo (device name/version), which also validates the Noise/frame stack on live hardware ahead of the BLE scan/GATT work. Co-Authored-By: Claude Opus 4.8 --- .../apps/home-assistant/kustomization.yaml | 1 + .../shelly-ble-proxy-key.sops.yaml | 23 +++++++++++++++++++ .../shelly-manager-deployment.yaml | 10 ++++++++ 3 files changed, 34 insertions(+) create mode 100644 kubernetes/apps/home-assistant/shelly-ble-proxy-key.sops.yaml diff --git a/kubernetes/apps/home-assistant/kustomization.yaml b/kubernetes/apps/home-assistant/kustomization.yaml index 0d790c13..1ec0d3b1 100644 --- a/kubernetes/apps/home-assistant/kustomization.yaml +++ b/kubernetes/apps/home-assistant/kustomization.yaml @@ -21,6 +21,7 @@ resources: - mosquitto-evcc-credentials.sops.yaml - shelly-manager-pvc.yaml - shelly-manager-network-attachment.yaml + - shelly-ble-proxy-key.sops.yaml - shelly-manager-deployment.yaml - shelly-manager-service.yaml - shelly-manager-gate-service.yaml diff --git a/kubernetes/apps/home-assistant/shelly-ble-proxy-key.sops.yaml b/kubernetes/apps/home-assistant/shelly-ble-proxy-key.sops.yaml new file mode 100644 index 00000000..cf5bd781 --- /dev/null +++ b/kubernetes/apps/home-assistant/shelly-ble-proxy-key.sops.yaml @@ -0,0 +1,23 @@ +apiVersion: ENC[AES256_GCM,data:xPM=,iv:3YhI7b/nFD70v5c2BPxo+aVsGqBmMCnBTh91ytUBkMo=,tag:8gqlr2c/1mLHKm/vi+xF+Q==,type:str] +kind: ENC[AES256_GCM,data:7or3VRp+,iv:KT0MeTG6qbWbDo7tzsTWZG7g7NexTSBD27jk1g8b18M=,tag:1JbDvOsrxm/Mq6+YiEm8zQ==,type:str] +metadata: + name: ENC[AES256_GCM,data:UCBsOXu6kHgKIaZ0YGO4q+ZevCM=,iv:DCH/VAMjy1+DA9Rz+0pirgCi2V1apYJz66X2kOqPBXk=,tag:dJ8VNWZu4SXardqM9jyShQ==,type:str] + namespace: ENC[AES256_GCM,data:LP//AzoK2lv9ooGVJCs=,iv:mTxMYwfEkcqlkLxdI85ytx/A87KQkWRkBY+yybKOxJM=,tag:kd/Zm7VJn54MhLuezck0KQ==,type:str] +type: ENC[AES256_GCM,data:hx7qJ20g,iv:znqniKSaFjcymsw+brA8qjUO1yphurh1M22NdnnG/0I=,tag:0ooYcw3yZgym+yF1t7+ijw==,type:str] +stringData: + api-key: ENC[AES256_GCM,data:YZdzd72xZWsaU4RSyDMlDCmeqhbjszxgXFaHe/Yf/W0/z9/4YzG/OqUmXqU=,iv:W8cCswws0tdgCi3AOed2/d0bl+RZ0oRsrG16AQDZCPY=,tag:9FBCS07FlVvyHC0rT1Q6eg==,type:str] +sops: + age: + - recipient: age1yqjvqkwwwxdj7mr546zfs5ckzuwndp69ya2n2drd4vypwns8w4ys04qfy3 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0SW9YVmZhOTA1clZDUFRF + WGRLeXRGd2xYb09hYTREMFA4N1MvYmc1aUg0Cm5iQmUvTndaYjE5NWVNaGF2Umgv + Tzk1UXVrdzVIcmQvS0VKZnhER2FGSkkKLS0tIFlXNVNlV1BuV2oyTDk5T0Jpa3hQ + SU5FUG16TGl2QUUrOHRpU3lhYkVDWmcKnNNqv58gsJoDoy5ou25r9yEJWqxuBO7b + zlscIZf3jPfggSlalcpJkJyBgZdghU+MybPcmNOCXkKJsHf/iC2Zjg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-13T15:51:01Z" + mac: ENC[AES256_GCM,data:Id/hgO1z9itGj60FAByLeRB5sd/X2tOEshPALSXXt8J3Z4akhxKSdDECI0BOyTe4Cevt3yVBpHTzOk6txTJSA3e74RkxCd7EXUumTFAIAcW/QkkVE3phdqbXdmpxWiS3TfamTrvcWvHbW3/kw2COSoYELeGmdeQGYxMoGw4jRBU=,iv:wkmwdIpOSXhmH67cMI3GrmF9AKb3ADRZxsHu+d2rsZs=,tag:oSBR8HUVDqd45cZBF8mdyQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.10.2 diff --git a/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml b/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml index cd8abc69..09553ee3 100644 --- a/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml +++ b/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml @@ -83,6 +83,16 @@ spec: value: shelly-ble-proxy-1.iot.renner.uno - name: Ble__Proxies__0__Port value: "6053" + # The ESPHome api.encryption.key (base64 Noise PSK) — same value as + # the dashboard's shelly_ble_proxy_api_key secret. With it, the app + # does the real Noise_NNpsk0 handshake to the proxy (DeviceInfo on + # /ble-radios, and the BLE scan/GATT provisioning path); without it + # the proxy is only TCP-probed on :6053. + - name: Ble__Proxies__0__Key + valueFrom: + secretKeyRef: + name: shelly-ble-proxy-key + key: api-key volumeMounts: - name: data mountPath: /data -- 2.54.0