claude-botandClaude Opus 4.8
6928448cbe
Prerequisite for enabling keepalived on edge-1: VRRP needs layer-2 adjacency
with the other NTP members on the service VLAN, and the host has only untagged
VLAN 30. The switch port already permits VLAN 40.
Built to be additive and revertible, because enp1s0 is this headless host's
only path to the network:
- The parent's 20-wired.network is not edited. The VLAN is attached through
a 20-wired.network.d/ drop-in instead, so reverting is deleting three paths.
- The VLAN .network sorts before 20-wired.network and matches explicitly on
Name=. 20-wired.network matches broadly on Type=ether; a VLAN link types as
'vlan' rather than 'ether' (confirmed against networkctl output) so it
should not match anyway, but ordering makes that belt-and-braces.
- UseRoutes, UseDNS, UseNTP and IPv6AcceptRA are all disabled on the VLAN.
Taking a second default route and DNS from the VLAN 40 lease would make
return traffic asymmetric across the two VLANs; untagged VLAN 30 stays the
only default route.
Tasks are tagged vlan40 so they can be applied without running the whole
edge-host role, which would restart the Z-Wave, open3e and alloy services.
Reconfiguring the parent link is what materialises the VLAN child -- a bare
networkctl reload leaves existing links untouched -- so the handler does that
explicitly. That re-runs DHCP on enp1s0 and is the one genuinely risky step;
worth running with console access to hand.
Not yet applied: the apply was blocked pending authorisation, so edge-1 remains
in its original network state with only 20-wired.network and 80-can0.network.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
119 lines
7.2 KiB
YAML
119 lines
7.2 KiB
YAML
---
|
|
edge_base_dir: /opt/edge-host
|
|
edge_tz: Europe/Berlin
|
|
|
|
# --- Logging & eMMC wear mitigation ------------------------------------
|
|
# edge-1 runs on a small internal eMMC (Dell Wyse 3040, 7.3 GB), so logs are
|
|
# kept off local flash: containers + native services log to a RAM-only
|
|
# journal and Grafana Alloy ships it to Loki. TRIM, noatime and a weekly
|
|
# wear check round out the flash-longevity measures. See README "Logging &
|
|
# eMMC".
|
|
edge_journald_runtime_max: "128M" # cap the volatile (RAM) journal
|
|
edge_docker_log_driver: journald # container stdout -> journal, no json logs on eMMC
|
|
|
|
# Grafana Alloy log shipper. The srv-network Loki (loki.srv.renner.uno:3100,
|
|
# no auth) is firewalled off the IoT VLAN; the only endpoint edge-1 can reach
|
|
# is the authenticated cluster ingress (Traefik basic-auth).
|
|
edge_alloy_config_file: /etc/alloy/edge.alloy
|
|
edge_alloy_http_port: 12345
|
|
edge_alloy_bin: /usr/bin/grafana-alloy # Arch `grafana-alloy` pkg names the binary this, not `alloy`
|
|
edge_loki_push_url: "https://loki.renner.uno/loki/api/v1/push"
|
|
edge_loki_username: edge-1
|
|
edge_alloy_labels:
|
|
environment: production
|
|
datacenter: homelab
|
|
|
|
# --- MQTT: edge clients (open3e, e3oncan, sml2mqtt) publish to a LOCAL
|
|
# mosquitto on loopback, which bridges to the central cluster broker over TLS
|
|
# (open3e/e3oncan have no native MQTTS). This keeps plaintext on loopback only
|
|
# — off the untrusted IoT VLAN — and buffers telemetry in RAM during cluster
|
|
# blips. The local broker writes nothing to the eMMC (persistence off, logs to
|
|
# the volatile journal). See edge-mqtt-bridge.conf.j2 and README "MQTT bridge".
|
|
edge_mqtt_host: 127.0.0.1
|
|
edge_mqtt_port: 1883
|
|
# Upstream cluster broker the local bridge connects to (TLS; the public
|
|
# Let's Encrypt cert is validated against the system CA bundle).
|
|
edge_mqtt_cluster_host: mqtt.renner.uno
|
|
edge_mqtt_cluster_tls_port: 8883
|
|
edge_mqtt_bridge_cafile: /etc/ssl/certs/ca-certificates.crt
|
|
|
|
# --- USB devices (stable by-id symlinks). After physically moving the
|
|
# sticks to edge-1, verify with `ls -l /dev/serial/by-id/` — the by-id
|
|
# names travel with the device, not the host, so these should not change.
|
|
edge_zwave_device: /dev/serial/by-id/usb-Nabu_Casa_ZWA-2_80B54EE15720-if00
|
|
edge_stromzaehler_device: /dev/serial/by-id/usb-FTDI_FT230X_Basic_UART_DK0E1GP5-if00-port0
|
|
|
|
# --- Images. Versions mirror the k8s manifests at migration time.
|
|
# sml2mqtt stays hand-pinned (critical meter bridge — was deliberately
|
|
# excluded from image-automation in k8s, keep that property here).
|
|
edge_zwavejs_image: ghcr.io/zwave-js/zwave-js-ui:11.21.1
|
|
edge_sml2mqtt_image: spacemanspiff2007/sml2mqtt:3.6.0
|
|
# Alpine version the zwave-js-ui image is built on — the source for the musl
|
|
# libeatmydata.so preloaded into that container (see tasks "Extract musl
|
|
# libeatmydata.so"). Keep in sync with the base if edge_zwavejs_image bumps
|
|
# its Alpine major (check: docker exec zwave-js cat /etc/os-release).
|
|
edge_zwave_alpine_base: alpine:3.22
|
|
|
|
# --- CAN / open3e (Viessmann E3 external bus) ---
|
|
edge_can_interface: can0
|
|
edge_can_bitrate: 250000
|
|
edge_open3e_pkg: git+https://github.com/open3e/open3e.git
|
|
edge_open3e_mqtt_user: open3e
|
|
edge_open3e_mqtt_topic: open3e
|
|
edge_open3e_mqtt_format: "{device}_{didNumber:04d}_{didName}"
|
|
edge_open3e_poll_seconds: 30
|
|
# Read-only datapoint set (Phase 1 extended set, established 2026-07-02 on
|
|
# the commissioning workstation; see vican repo CLAUDE.md for the rationale).
|
|
# NO -w / write DIDs here — live heating + battery, writes are Phase 3.
|
|
# vx3.266 = ErrorDtcHistory (O3EList) — the VX3 fault log; polled to catch
|
|
# recurrences of FailureCommunicationEnergyMeter (the E380 energy-meter link
|
|
# the internal PV-surplus EMS depends on). Decodes via the master O3EList
|
|
# codec inherited through the vx3plus overlay.
|
|
# vitocal.543/2350/2543/2560: SmartGrid-/EMS-Status-Beobachtung (2026-07-06)
|
|
# — klärt, ob die Eigenstromoptimierung (EMS) bei PV-Überschuss von selbst
|
|
# den WW-Boost auslöst (2543.2 steht laut Scan bereits auf +10 K), bevor
|
|
# SG-Ready-Verdrahtung oder andere Trigger gebaut werden. Alle vier ro.
|
|
# vitocal.259/260 = InfoDtcList/InfoDtcHistory (O3EList) — the HPMU event log,
|
|
# the Vitocal-side counterpart to vx3.266. Both are capped lists (2 and 9
|
|
# entries when added), so the multi-frame read is cheap at a 30 s poll.
|
|
# Records faults/info events only (NormalOperation, LagDeviceDtcReported,
|
|
# LegionellaProtectionTemperatureReached) — NOT setpoint or program changes.
|
|
edge_open3e_datapoints: >-
|
|
vitocal.259,vitocal.260,vitocal.268,vitocal.269,vitocal.271,vitocal.274,vitocal.286,vitocal.288,vitocal.318,vitocal.321,vitocal.324,vitocal.335,vitocal.336,vitocal.396,vitocal.402,vitocal.403,vitocal.476,vitocal.477,vitocal.543,vitocal.548,vitocal.565,vitocal.1007,vitocal.1043,vitocal.1190,vitocal.1211,vitocal.1391,vitocal.1416,vitocal.1417,vitocal.2320,vitocal.2346,vitocal.2350,vitocal.2351,vitocal.2352,vitocal.2369,vitocal.2370,vitocal.2486,vitocal.2487,vitocal.2488,vitocal.2543,vitocal.2560,vitocal.2622,vitocal.2624,vitocal.2625,vitocal.2735,vitocal.3016,vx3.266,vx3.378,vx3.379,vx3.380,vx3.535,vx3.1603,vx3.1664,vx3.1690,vx3.1801,vx3.1802,vx3.1810,vx3.1828,vx3.1830,vx3.1577,vx3.1578,vx3.1579,vx3.1580,vx3.1581,vx3.1582,vx3.1834,vx3.1836,vx3.2214,vx3.2240,vx3.3085,vx3.3086,vx3.3087,vx3.3088,vx3.3089,vx3.3090,vcmu.320,vcmu.322,vcmu.325,vcmu.355,vcmu.389,vcmu.391,vcmu.1772,vcmu.1773,vcmu.1775,vcmu.1776,vcmu.2256,vcmu.2259,vcmu.2333,vcmu.2334,vcmu.2569,vcmu.2571,vitocal.2791
|
|
# ECU addresses; -dev selects codec set, tx selects the UDS address.
|
|
# vcmu (refrigerant-circuit controller) has no dedicated codec set —
|
|
# omitting dpList makes open3e fall back to the generic datapoint list,
|
|
# which decodes all polled VCMU DIDs.
|
|
edge_open3e_devices:
|
|
vitocal: { tx: "0x680", dpList: "vcal" }
|
|
# dpList als Pfad: Overlay-Datei mit den Batteriemodul-DIDs (siehe
|
|
# files/open3e-vx3plus.py) — die Stock-vx3-Liste filtert sie sonst weg.
|
|
vx3: { tx: "0x6a1", dpList: "/opt/edge-host/open3e/vx3plus.py" }
|
|
vcmu: { tx: "0x68c" }
|
|
|
|
# --- E3onCAN: passive E380 energy-meter listener (no bus writes, so it
|
|
# coexists with the single open3e instance). The meter broadcasts at
|
|
# ~5 Hz; the gap throttles MQTT to one update per DID per interval.
|
|
edge_e3oncan_repo: https://github.com/MyHomeMyData/E3onCAN.git
|
|
edge_e3oncan_version: 461dcbdf97e8d72d2edb9929c63b39382af6c3a1 # V0.5.2
|
|
edge_e3oncan_gap_seconds: 10
|
|
edge_e3oncan_mqtt_format: "{device}_{didNumber:04d}_{didName}"
|
|
|
|
# --- Secrets: define these in inventory/group_vars/edge_host/vault.yml
|
|
# (ansible-vault). See README.md for the kubectl one-liners that read the
|
|
# current values out of the cluster during migration.
|
|
# edge_sml2mqtt_mqtt_password: "{{ vault_edge_sml2mqtt_mqtt_password }}"
|
|
# edge_open3e_mqtt_password: "{{ vault_edge_open3e_mqtt_password }}"
|
|
# edge_zwavejs_session_secret: "{{ vault_edge_zwavejs_session_secret }}"
|
|
|
|
# --- Tagged VLAN 40 sub-interface. Off by default; enabled in
|
|
# inventory/group_vars/edge_host. Exists so edge-1 can join the NTP keepalived
|
|
# VRRP group, which needs layer-2 adjacency with the other members on the
|
|
# service VLAN. The untagged VLAN 30 lease stays this host's only default
|
|
# route -- see templates/10-vlan40.network.j2.
|
|
edge_vlan40_enabled: false
|
|
edge_vlan40_parent: enp1s0
|
|
edge_vlan40_id: 40
|
|
edge_vlan40_name: enp1s0.40
|
|
edge_vlan40_parent_network: 20-wired.network
|