
===== HOST =====

Hostname:   esh-matter.esteban.net
Date:       2026-09-26T20:06:32+00:00
Uptime:     up 4 minutes
OS:         Debian GNU/Linux 12 (bookworm)
Kernel:     6.8.12-42-pve
Arch:       x86_64

===== HARDWARE =====

CPU cores:  2
CPU model:  13th Gen Intel(R) Core(TM) i9-13900H
MemTotal:   1.0 GB
MemAvailable: 0.7 GB

===== GPUS =====

nvidia-smi not present (no NVIDIA GPUs or driver not installed)

===== FILESYSTEMS (df) =====

Filesystem                        Size  Used Avail Use% Mounted on
/dev/mapper/pve-vm--111--disk--0  7.8G  2.0G  5.5G  27% /

===== PERSISTENT MOUNTS (/etc/fstab, non-comment) =====


===== TARGETED DATA PATHS =====

/opt  (total: 40K)
  total 16
  drwxr-xr-x  4 root root   4096 2026-09-26 20:03 .
  drwxr-xr-x 18 root root   4096 2026-09-26 20:02 ..
  drwx--x--x  4 root root   4096 2026-09-26 20:03 containerd
  drwxrwsr-x  5 root docker 4096 2026-09-26 20:03 docker

/opt/docker  (total: 32K)
  total 20
  drwxrwsr-x 5 root docker 4096 2026-09-26 20:03 .
  drwxr-xr-x 4 root root   4096 2026-09-26 20:03 ..
  drwxrwsr-x 3 root docker 4096 2026-09-26 20:04 compose
  drwxrwsr-x 2 root docker 4096 2026-09-26 20:03 conf
  drwxr-s--- 3 vh   vh     4096 2026-09-26 20:03 data

/opt/docker/compose  (total: 20K)
  total 12
  drwxrwsr-x 3 root      docker 4096 2026-09-26 20:04 .
  drwxrwsr-x 5 root      docker 4096 2026-09-26 20:03 ..
  drwxr-sr-x 2 infra-ops docker 4096 2026-09-26 20:04 matter-server

/opt/docker/conf  (total: 4.0K)
  total 8
  drwxrwsr-x 2 root docker 4096 2026-09-26 20:03 .
  drwxrwsr-x 5 root docker 4096 2026-09-26 20:03 ..

/var/lib/docker  (total: 4.0K)

/srv  (total: 4.0K)
  total 8
  drwxr-xr-x  2 root root 4096 2025-09-07 15:14 .
  drwxr-xr-x 18 root root 4096 2026-09-26 20:02 ..


===== DOCKER =====

Server: 29.8.1   Client: 29.8.1

----- docker info -----
Containers:      1 (running 1, paused 0, stopped 0)
Images:          1
Runtimes:        map[io.containerd.runc.v2:{{runc []  map[]} map[org.opencontainers.runtime-spec.features:{"ociVersionMin":"1.0.0","ociVersionMax":"1.3.0","hooks":["prestart","createRuntime","createContainer","startContainer","poststart","poststop"],"mountOptions":["async","atime","bind","defaults","dev","diratime","dirsync","exec","iversion","lazytime","loud","mand","noatime","nodev","nodiratime","noexec","noiversion","nolazytime","nomand","norelatime","nostrictatime","nosuid","nosymfollow","private","ratime","rbind","rdev","rdiratime","relatime","remount","rexec","rnoatime","rnodev","rnodiratime","rnoexec","rnorelatime","rnostrictatime","rnosuid","rnosymfollow","ro","rprivate","rrelatime","rro","rrw","rshared","rslave","rstrictatime","rsuid","rsymfollow","runbindable","rw","shared","silent","slave","strictatime","suid","symfollow","sync","tmpcopyup","unbindable"],"linux":{"namespaces":["cgroup","ipc","mount","network","pid","time","user","uts"],"capabilities":["CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_DAC_READ_SEARCH","CAP_FOWNER","CAP_FSETID","CAP_KILL","CAP_SETGID","CAP_SETUID","CAP_SETPCAP","CAP_LINUX_IMMUTABLE","CAP_NET_BIND_SERVICE","CAP_NET_BROADCAST","CAP_NET_ADMIN","CAP_NET_RAW","CAP_IPC_LOCK","CAP_IPC_OWNER","CAP_SYS_MODULE","CAP_SYS_RAWIO","CAP_SYS_CHROOT","CAP_SYS_PTRACE","CAP_SYS_PACCT","CAP_SYS_ADMIN","CAP_SYS_BOOT","CAP_SYS_NICE","CAP_SYS_RESOURCE","CAP_SYS_TIME","CAP_SYS_TTY_CONFIG","CAP_MKNOD","CAP_LEASE","CAP_AUDIT_WRITE","CAP_AUDIT_CONTROL","CAP_SETFCAP","CAP_MAC_OVERRIDE","CAP_MAC_ADMIN","CAP_SYSLOG","CAP_WAKE_ALARM","CAP_BLOCK_SUSPEND","CAP_AUDIT_READ","CAP_PERFMON","CAP_BPF","CAP_CHECKPOINT_RESTORE"],"cgroup":{"v1":true,"v2":true,"systemd":true,"systemdUser":true,"rdma":true},"seccomp":{"enabled":true,"actions":["SCMP_ACT_ALLOW","SCMP_ACT_ERRNO","SCMP_ACT_KILL","SCMP_ACT_KILL_PROCESS","SCMP_ACT_KILL_THREAD","SCMP_ACT_LOG","SCMP_ACT_NOTIFY","SCMP_ACT_TRACE","SCMP_ACT_TRAP"],"operators":["SCMP_CMP_EQ","SCMP_CMP_GE","SCMP_CMP_GT","SCMP_CMP_LE","SCMP_CMP_LT","SCMP_CMP_MASKED_EQ","SCMP_CMP_NE"],"archs":["SCMP_ARCH_AARCH64","SCMP_ARCH_ARM","SCMP_ARCH_LOONGARCH64","SCMP_ARCH_MIPS","SCMP_ARCH_MIPS64","SCMP_ARCH_MIPS64N32","SCMP_ARCH_MIPSEL","SCMP_ARCH_MIPSEL64","SCMP_ARCH_MIPSEL64N32","SCMP_ARCH_PPC","SCMP_ARCH_PPC64","SCMP_ARCH_PPC64LE","SCMP_ARCH_RISCV64","SCMP_ARCH_S390","SCMP_ARCH_S390X","SCMP_ARCH_X32","SCMP_ARCH_X86","SCMP_ARCH_X86_64"],"knownFlags":["SECCOMP_FILTER_FLAG_TSYNC","SECCOMP_FILTER_FLAG_SPEC_ALLOW","SECCOMP_FILTER_FLAG_LOG","SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV"],"supportedFlags":["SECCOMP_FILTER_FLAG_TSYNC","SECCOMP_FILTER_FLAG_SPEC_ALLOW","SECCOMP_FILTER_FLAG_LOG"]},"apparmor":{"enabled":true},"selinux":{"enabled":true},"intelRdt":{"enabled":true,"schemata":true,"monitoring":true},"memoryPolicy":{"modes":["MPOL_BIND","MPOL_DEFAULT","MPOL_INTERLEAVE","MPOL_LOCAL","MPOL_PREFERRED","MPOL_PREFERRED_MANY","MPOL_WEIGHTED_INTERLEAVE"],"flags":["MPOL_F_NUMA_BALANCING","MPOL_F_RELATIVE_NODES","MPOL_F_STATIC_NODES"]},"mountExtensions":{"idmap":{"enabled":true}},"netDevices":{"enabled":true}},"annotations":{"io.github.seccomp.libseccomp.version":"2.5.4","org.opencontainers.runc.checkpoint.enabled":"true","org.opencontainers.runc.commit":"v1.5.1-0-g8f2685a4","org.opencontainers.runc.version":"1.5.1"},"potentiallyUnsafeConfigAnnotations":["bundle","org.systemd.property.","org.criu.config"]}]} runc:{{runc []  map[]} map[org.opencontainers.runtime-spec.features:{"ociVersionMin":"1.0.0","ociVersionMax":"1.3.0","hooks":["prestart","createRuntime","createContainer","startContainer","poststart","poststop"],"mountOptions":["async","atime","bind","defaults","dev","diratime","dirsync","exec","iversion","lazytime","loud","mand","noatime","nodev","nodiratime","noexec","noiversion","nolazytime","nomand","norelatime","nostrictatime","nosuid","nosymfollow","private","ratime","rbind","rdev","rdiratime","relatime","remount","rexec","rnoatime","rnodev","rnodiratime","rnoexec","rnorelatime","rnostrictatime","rnosuid","rnosymfollow","ro","rprivate","rrelatime","rro","rrw","rshared","rslave","rstrictatime","rsuid","rsymfollow","runbindable","rw","shared","silent","slave","strictatime","suid","symfollow","sync","tmpcopyup","unbindable"],"linux":{"namespaces":["cgroup","ipc","mount","network","pid","time","user","uts"],"capabilities":["CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_DAC_READ_SEARCH","CAP_FOWNER","CAP_FSETID","CAP_KILL","CAP_SETGID","CAP_SETUID","CAP_SETPCAP","CAP_LINUX_IMMUTABLE","CAP_NET_BIND_SERVICE","CAP_NET_BROADCAST","CAP_NET_ADMIN","CAP_NET_RAW","CAP_IPC_LOCK","CAP_IPC_OWNER","CAP_SYS_MODULE","CAP_SYS_RAWIO","CAP_SYS_CHROOT","CAP_SYS_PTRACE","CAP_SYS_PACCT","CAP_SYS_ADMIN","CAP_SYS_BOOT","CAP_SYS_NICE","CAP_SYS_RESOURCE","CAP_SYS_TIME","CAP_SYS_TTY_CONFIG","CAP_MKNOD","CAP_LEASE","CAP_AUDIT_WRITE","CAP_AUDIT_CONTROL","CAP_SETFCAP","CAP_MAC_OVERRIDE","CAP_MAC_ADMIN","CAP_SYSLOG","CAP_WAKE_ALARM","CAP_BLOCK_SUSPEND","CAP_AUDIT_READ","CAP_PERFMON","CAP_BPF","CAP_CHECKPOINT_RESTORE"],"cgroup":{"v1":true,"v2":true,"systemd":true,"systemdUser":true,"rdma":true},"seccomp":{"enabled":true,"actions":["SCMP_ACT_ALLOW","SCMP_ACT_ERRNO","SCMP_ACT_KILL","SCMP_ACT_KILL_PROCESS","SCMP_ACT_KILL_THREAD","SCMP_ACT_LOG","SCMP_ACT_NOTIFY","SCMP_ACT_TRACE","SCMP_ACT_TRAP"],"operators":["SCMP_CMP_EQ","SCMP_CMP_GE","SCMP_CMP_GT","SCMP_CMP_LE","SCMP_CMP_LT","SCMP_CMP_MASKED_EQ","SCMP_CMP_NE"],"archs":["SCMP_ARCH_AARCH64","SCMP_ARCH_ARM","SCMP_ARCH_LOONGARCH64","SCMP_ARCH_MIPS","SCMP_ARCH_MIPS64","SCMP_ARCH_MIPS64N32","SCMP_ARCH_MIPSEL","SCMP_ARCH_MIPSEL64","SCMP_ARCH_MIPSEL64N32","SCMP_ARCH_PPC","SCMP_ARCH_PPC64","SCMP_ARCH_PPC64LE","SCMP_ARCH_RISCV64","SCMP_ARCH_S390","SCMP_ARCH_S390X","SCMP_ARCH_X32","SCMP_ARCH_X86","SCMP_ARCH_X86_64"],"knownFlags":["SECCOMP_FILTER_FLAG_TSYNC","SECCOMP_FILTER_FLAG_SPEC_ALLOW","SECCOMP_FILTER_FLAG_LOG","SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV"],"supportedFlags":["SECCOMP_FILTER_FLAG_TSYNC","SECCOMP_FILTER_FLAG_SPEC_ALLOW","SECCOMP_FILTER_FLAG_LOG"]},"apparmor":{"enabled":true},"selinux":{"enabled":true},"intelRdt":{"enabled":true,"schemata":true,"monitoring":true},"memoryPolicy":{"modes":["MPOL_BIND","MPOL_DEFAULT","MPOL_INTERLEAVE","MPOL_LOCAL","MPOL_PREFERRED","MPOL_PREFERRED_MANY","MPOL_WEIGHTED_INTERLEAVE"],"flags":["MPOL_F_NUMA_BALANCING","MPOL_F_RELATIVE_NODES","MPOL_F_STATIC_NODES"]},"mountExtensions":{"idmap":{"enabled":true}},"netDevices":{"enabled":true}},"annotations":{"io.github.seccomp.libseccomp.version":"2.5.4","org.opencontainers.runc.checkpoint.enabled":"true","org.opencontainers.runc.commit":"v1.5.1-0-g8f2685a4","org.opencontainers.runc.version":"1.5.1"},"potentiallyUnsafeConfigAnnotations":["bundle","org.systemd.property.","org.criu.config"]}]}]
Default runtime: runc
Storage driver:  overlayfs
Root dir:        /var/lib/docker
Server version:  29.8.1

----- running containers -----
NAMES           IMAGE                                     STATUS                        PORTS
matter-server   ghcr.io/matter-js/matterjs-server:1.4.0   Up About a minute (healthy)   

----- all containers -----
NAMES           IMAGE                                     STATUS
matter-server   ghcr.io/matter-js/matterjs-server:1.4.0   Up About a minute (healthy)

----- networks -----
NAME      DRIVER    SCOPE
bridge    bridge    local
host      host      local
none      null      local

----- networks (external, non-default — worth knowing for compose external: true) -----

----- named volumes -----
VOLUME NAME   DRIVER

----- compose projects currently running -----
matter-server

===== COMPOSE FILES (/opt/docker/compose/) =====


>>> /opt/docker/compose/matter-server/compose.yaml
# matter-server — the Matter controller for Home Assistant, on esh-matter (CT 111
# on esh-pve, whose ONLY network leg is VLAN 90 / esh-iot, 10.0.90.20).
# Requested by ha-dev, operator-approved 2026-09-26.
#
# matter.js server (matter-js/matterjs-server), the drop-in successor to
# python-matter-server that HA has used since 2026.2. Same websocket API on
# :5580/ws. Pinned: 1.4.0 (stable, 2026-08-07) by digest.
#
# host networking is REQUIRED: Matter is IPv6 link-local and mDNS. The server must
# see eth0's Thread ULA and the border routers' RAs directly.
#
# ⚠ :5580 (websocket + dashboard) is UNAUTHENTICATED. The CT's nftables admits it
# only from HA at 10.0.50.46 (playbooks/esh-matter-lxc.yaml).
# ⚠ /data holds the Matter fabric ROOT CREDENTIALS. Losing it means re-commissioning
# every device. The whole CT is in esh-pve's vzdump job (PBS-ANA → PBS-NH3). Never
# put it in git.
name: matter-server
services:
  matter-server:
    image: ${MATTER_IMAGE}
    container_name: matter-server
    restart: unless-stopped
    network_mode: host
    volumes:
      - /opt/docker/data/matter-server:/data
    environment:
      - STORAGE_PATH=/data
      - PRIMARY_INTERFACE=eth0
      - TZ=America/Los_Angeles
      - LOG_LEVEL=${MATTER_LOG_LEVEL:-info}

===== CONFIG LAYOUT (/opt/docker/conf/ — top 200 entries) =====

/opt/docker/conf

===== LISTENING PORTS =====

*:22
*:50427
*:5580
127.0.0.1:25
[::1]:25

===== MODEL / HUGGINGFACE CACHES =====


===== DOCKER-ADJACENT SYSTEMD SERVICES =====

container-getty@1.service running
container-getty@2.service running
containerd.service running
docker.service running

===== DONE =====

Paste the above back into the chat, or pass a path as argv[1] to save.
