vh
8e7ae0675d
For ha-dev (operator-approved 2026-09-26). CT 111 on esh-pve at 10.0.90.20: Matter/Thread IPv6 (Echo ULA + RA route-information) is link-only, so the server sits on esh-iot and HA reaches it over routed IPv4 ws :5580. - playbooks/esh-matter-lxc.yaml: kernel RA (accept_ra=1, rt_info_max_plen=64), forwarding off, Docker ip-forward/iptables off; nftables admits 5580 from HA 10.0.50.46 only and SSH from mgmt ranges; the CT is added to esh-pve's vzdump job (fabric credentials). - stacks/matter-server: ghcr.io/matter-js/matterjs-server:1.4.0 (digest), host networking, /data on the CT. - Acceptance: fdad:: SLAAC, ping6 thermostat, 2 Thread RIO routes learned, ws server_info from inside the HA container; 5580 refused from 10.0.50.45, nh3-dev and a temporary VLAN 90 netns vantage.
31 lines
1.2 KiB
YAML
31 lines
1.2 KiB
YAML
# matter-server — the Matter controller for Home Assistant, on esh-matter (CT 111
|
|
# on esh-pve, whose ONLY network leg is VLAN 90 / esh-iot, 10.0.90.20).
|
|
# Requested by ha-dev, operator-approved 2026-09-26.
|
|
#
|
|
# matter.js server (matter-js/matterjs-server), the drop-in successor to
|
|
# python-matter-server that HA has used since 2026.2. Same websocket API on
|
|
# :5580/ws. Pinned: 1.4.0 (stable, 2026-08-07) by digest.
|
|
#
|
|
# host networking is REQUIRED: Matter is IPv6 link-local and mDNS. The server must
|
|
# see eth0's Thread ULA and the border routers' RAs directly.
|
|
#
|
|
# ⚠ :5580 (websocket + dashboard) is UNAUTHENTICATED. The CT's nftables admits it
|
|
# only from HA at 10.0.50.46 (playbooks/esh-matter-lxc.yaml).
|
|
# ⚠ /data holds the Matter fabric ROOT CREDENTIALS. Losing it means re-commissioning
|
|
# every device. The whole CT is in esh-pve's vzdump job (PBS-ANA → PBS-NH3). Never
|
|
# put it in git.
|
|
name: matter-server
|
|
services:
|
|
matter-server:
|
|
image: ${MATTER_IMAGE}
|
|
container_name: matter-server
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
volumes:
|
|
- /opt/docker/data/matter-server:/data
|
|
environment:
|
|
- STORAGE_PATH=/data
|
|
- PRIMARY_INTERFACE=eth0
|
|
- TZ=America/Los_Angeles
|
|
- LOG_LEVEL=${MATTER_LOG_LEVEL:-info}
|