kubernetes/apps/home-assistant/kustomization.yaml

@@ -21,6 +21,7 @@ resources:
   - mosquitto-evcc-credentials.sops.yaml
   - shelly-manager-pvc.yaml
   - shelly-manager-network-attachment.yaml
+  - shelly-ble-proxy-key.sops.yaml
   - shelly-manager-deployment.yaml
   - shelly-manager-service.yaml
   - shelly-manager-gate-service.yaml

kubernetes/apps/home-assistant/shelly-ble-proxy-key.sops.yaml

@@ -0,0 +1,23 @@
+apiVersion: ENC[AES256_GCM,data:xPM=,iv:3YhI7b/nFD70v5c2BPxo+aVsGqBmMCnBTh91ytUBkMo=,tag:8gqlr2c/1mLHKm/vi+xF+Q==,type:str]
+kind: ENC[AES256_GCM,data:7or3VRp+,iv:KT0MeTG6qbWbDo7tzsTWZG7g7NexTSBD27jk1g8b18M=,tag:1JbDvOsrxm/Mq6+YiEm8zQ==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:UCBsOXu6kHgKIaZ0YGO4q+ZevCM=,iv:DCH/VAMjy1+DA9Rz+0pirgCi2V1apYJz66X2kOqPBXk=,tag:dJ8VNWZu4SXardqM9jyShQ==,type:str]
+    namespace: ENC[AES256_GCM,data:LP//AzoK2lv9ooGVJCs=,iv:mTxMYwfEkcqlkLxdI85ytx/A87KQkWRkBY+yybKOxJM=,tag:kd/Zm7VJn54MhLuezck0KQ==,type:str]
+type: ENC[AES256_GCM,data:hx7qJ20g,iv:znqniKSaFjcymsw+brA8qjUO1yphurh1M22NdnnG/0I=,tag:0ooYcw3yZgym+yF1t7+ijw==,type:str]
+stringData:
+    api-key: ENC[AES256_GCM,data:YZdzd72xZWsaU4RSyDMlDCmeqhbjszxgXFaHe/Yf/W0/z9/4YzG/OqUmXqU=,iv:W8cCswws0tdgCi3AOed2/d0bl+RZ0oRsrG16AQDZCPY=,tag:9FBCS07FlVvyHC0rT1Q6eg==,type:str]
+sops:
+    age:
+        - recipient: age1yqjvqkwwwxdj7mr546zfs5ckzuwndp69ya2n2drd4vypwns8w4ys04qfy3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0SW9YVmZhOTA1clZDUFRF
+            WGRLeXRGd2xYb09hYTREMFA4N1MvYmc1aUg0Cm5iQmUvTndaYjE5NWVNaGF2Umgv
+            Tzk1UXVrdzVIcmQvS0VKZnhER2FGSkkKLS0tIFlXNVNlV1BuV2oyTDk5T0Jpa3hQ
+            SU5FUG16TGl2QUUrOHRpU3lhYkVDWmcKnNNqv58gsJoDoy5ou25r9yEJWqxuBO7b
+            zlscIZf3jPfggSlalcpJkJyBgZdghU+MybPcmNOCXkKJsHf/iC2Zjg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-13T15:51:01Z"
+    mac: ENC[AES256_GCM,data:Id/hgO1z9itGj60FAByLeRB5sd/X2tOEshPALSXXt8J3Z4akhxKSdDECI0BOyTe4Cevt3yVBpHTzOk6txTJSA3e74RkxCd7EXUumTFAIAcW/QkkVE3phdqbXdmpxWiS3TfamTrvcWvHbW3/kw2COSoYELeGmdeQGYxMoGw4jRBU=,iv:wkmwdIpOSXhmH67cMI3GrmF9AKb3ADRZxsHu+d2rsZs=,tag:oSBR8HUVDqd45cZBF8mdyQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2

kubernetes/apps/home-assistant/shelly-manager-deployment.yaml

@@ -83,6 +83,16 @@ spec:
               value: shelly-ble-proxy-1.iot.renner.uno
             - name: Ble__Proxies__0__Port
               value: "6053"
+            # The ESPHome api.encryption.key (base64 Noise PSK) — same value as
+            # the dashboard's shelly_ble_proxy_api_key secret. With it, the app
+            # does the real Noise_NNpsk0 handshake to the proxy (DeviceInfo on
+            # /ble-radios, and the BLE scan/GATT provisioning path); without it
+            # the proxy is only TCP-probed on :6053.
+            - name: Ble__Proxies__0__Key
+              valueFrom:
+                secretKeyRef:
+                  name: shelly-ble-proxy-key
+                  key: api-key
           volumeMounts:
             - name: data
               mountPath: /data