# matter-server — the Matter controller for Home Assistant, on esh-matter (CT 111
# on esh-pve, whose ONLY network leg is VLAN 90 / esh-iot, 10.0.90.20).
# Requested by ha-dev, operator-approved 2026-09-26.
#
# matter.js server (matter-js/matterjs-server), the drop-in successor to
# python-matter-server that HA has used since 2026.2. Same websocket API on
# :5580/ws. Pinned: 1.4.0 (stable, 2026-08-07) by digest.
#
# host networking is REQUIRED: Matter is IPv6 link-local and mDNS. The server must
# see eth0's Thread ULA and the border routers' RAs directly.
#
# ⚠ :5580 (websocket + dashboard) is UNAUTHENTICATED. The CT's nftables admits it
# only from HA at 10.0.50.46 (playbooks/esh-matter-lxc.yaml).
# ⚠ /data holds the Matter fabric ROOT CREDENTIALS. Losing it means re-commissioning
# every device. The whole CT is in esh-pve's vzdump job (PBS-ANA → PBS-NH3). Never
# put it in git.
name: matter-server
services:
  matter-server:
    image: ${MATTER_IMAGE}
    container_name: matter-server
    restart: unless-stopped
    network_mode: host
    volumes:
      - /opt/docker/data/matter-server:/data
    environment:
      - STORAGE_PATH=/data
      - PRIMARY_INTERFACE=eth0
      - TZ=America/Los_Angeles
      - LOG_LEVEL=${MATTER_LOG_LEVEL:-info}