ha-dev requested all three on esh-docker-vm (operator-authorized); the stack
had no canonical copy, so it is added to stacks/ rather than edited in place.
Pinned ghcr.io/esphome/esphome:2026.8.2 — it was bare, which is exactly how it
sat on 2025.8.2 for a year: docker pulled latest once at container creation
(2026-04-20, from a layer cached 2025-08-29) and never re-pulled. Every current
Everything Presence sensor failed config validation on that build. Verified
after: esphome version reports 2026.8.2 and the vendor's own Pro package now
validates clean (exit 0, 'Configuration is valid!'), which is the item that
unblocks the six waiting sensors.
Relocated /path/to/esphome/config (the upstream template placeholder, taken
literally by docker) to /opt/docker/conf/esphome, matching the mosquitto
pattern. Copied and checksum-verified all 5763 files before removing the
original, with a tarball kept at /root/pre-change-archive/.
Credentials moved off test/ChangeMe to the vaulted 32-char secret
(esh-docker-vm/esphome-dashboard), passed via a host-only .env so nothing
plaintext enters git.
Three things the job surfaced that were not in the request:
The directory is 538 MB, not the 3 KB reported — .esphome/platformio is
508 MB of PlatformIO toolchain and .esphome/build another 31 MB, both
regenerable. Relocating as-asked would have inflated restic's /opt/docker
source ~45x against its own ~12 MB budget, so both subtrees are excluded in
/etc/restic/profiles.yaml. The 3 KB of actual config is now covered, which
was the point.
2026.8.2 logs a DEPRECATION for the bare USERNAME/PASSWORD env names and says
they will stop working in a future release — a silent auth loss on some later
bump, on a privileged host-network container that can flash any ESP device on
the LAN. Switched to ESPHOME_USERNAME/ESPHOME_PASSWORD; the warning is gone.
Device Builder 1.0.0 opens a NEW listener on 0.0.0.0:6055 (remote-build
peer-link) that 2025.8.2 did not have.
Also fixes deploy-stack.sh: plain 'rsync -a' makes rsync chgrp the destination
as the deploy identity, which since the 2026-09-14 root:docker normalisation is
not root. It failed with 'Operation not permitted' and exit 23 AFTER
transferring content — a loud error on a deploy that had succeeded. --no-o
--no-g lets the setgid bit assign the group instead.
vh
d1769ed114