home-assistant: its directories are placed, and it runs the build in use

The module stated /services/home-assistant/config and bound its route under /var/lib/mesh — novox's layout, a path no definition may carry (ADR 0112). The config dir and the module's state are now placed (${dir:config}, ${dir:state}); the route binds into ${dir:state}. The sidecar no longer mounts Home Assistant's config dir: nothing reads MESH_HOMEASSISTANT_CONFIG_DIR, and the mount handed it the auth store and secrets.yaml for nothing. The config dir loses owner 1000:1000 — the image runs as root, the uid was the predecessor's host-user convention. Two more listens that the software opens by default and LAN devices dial in on, which a converged filter would otherwise close: 1400 (Sonos event callback) and 18555 (bundled go2rtc WebRTC). Host network, so the machine port is the software's. Image pinned to the 2026.9.3 build ace's predecessor runs (2026-09-18); Home Assistant migrates its recorder schema, so older than running is unsafe. Verified: catalogue tests pass with MESH_CATALOGUE on this tree; the pinned image boots on a fresh root-owned 0700 config dir (manifest 200, API 401 without a token), and refuses X-Forwarded-For from an untrusted proxy (400).
2026-09-29 23:39:41 +02:00
3 changed files with 58 additions and 57 deletions
@@ -18,7 +18,21 @@
      "port": 8123,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "the dashboard and the API"
+      "why": "the dashboard, the API and the companion apps"
+    },
+    {
+      "name": "sonos-events",
+      "port": 1400,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the Sonos integration's event callback: speakers push their state changes here"
+    },
+    {
+      "name": "webrtc",
+      "port": 18555,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the bundled go2rtc's WebRTC port, which camera streams to a browser use"
    }
  ],
  "resources": [
@@ -28,24 +42,28 @@
      "path": "/var/lib/mesh/home-assistant",
      "mode": "0700"
    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
    {
      "id": "config",
      "type": "directory",
-      "path": "/services/home-assistant/config",
-      "mode": "0700",
-      "owner": "1000:1000"
+      "mode": "0700"
    },
    {
      "id": "server",
      "type": "container",
      "name": "home-assistant",
-      "image": "ghcr.io/home-assistant/home-assistant@sha256:14931c6b13756317849f46da1d01b45937a1150db66c081cfe529d48215943fe",
+      "image": "ghcr.io/home-assistant/home-assistant@sha256:d8922685169707fd91e8b9729902d975f06157d005e422874d201e0261dda196",
      "network": "host",
      "env": {
        "TZ": "Etc/UTC"
      },
      "volumes": [
-        "/services/home-assistant/config:/config"
+        "${dir:config}:/config"
      ]
    },
    {
@@ -64,15 +82,13 @@
      "volumes": [
        "/var/lib/mesh/home-assistant/broker:/run/secrets/broker:ro",
        "/var/lib/mesh/home-assistant/token:/run/secrets/token:ro",
-        "/var/lib/mesh/home-assistant/config.json:/run/config/config.json:ro",
-        "/services/home-assistant/config:/var/lib/home-assistant/config:ro"
+        "/var/lib/mesh/home-assistant/config.json:/run/config/config.json:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
        "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:8123",
        "MESH_HOMEASSISTANT_TOKEN_FILE": "/run/secrets/token",
-        "MESH_HOMEASSISTANT_CONFIG_FILE": "/run/config/config.json",
-        "MESH_HOMEASSISTANT_CONFIG_DIR": "/var/lib/home-assistant/config"
+        "MESH_HOMEASSISTANT_CONFIG_FILE": "/run/config/config.json"
      },
      "restart-on": [
        "runtime-config"
@@ -90,7 +106,7 @@
    }
  },
  "binds": {
-    "route": "/var/lib/mesh/home-assistant/route.json"
+    "route": "${dir:state}/route.json"
  },
  "build": {
    "on": [
@@ -24,13 +24,6 @@ function meshConfig(file?: string): Record<string, string> {
  catch { return {}; }
 }

-/** A secret delivered as a file, trimmed; undefined when there is none, so the caller can fall back. */
-function tokenFromFile(file?: string): string | undefined {
-  if (!file) return undefined;
-  try { return readFileSync(file, "utf8").trim() || undefined; }
-  catch { return undefined; }
-}
-
 export class InfluxDBClient {
  readonly baseUrl: string;

@@ -50,10 +43,8 @@ export class InfluxDBClient {
  static fromEnv(env: NodeJS.ProcessEnv = process.env): InfluxDBClient {
    const cfg = meshConfig(env.MESH_INFLUXDB_CONFIG_FILE);
    const url = cfg.url ?? env.MESH_INFLUXDB_URL ?? `http://127.0.0.1:${env.INFLUXDB_PORT ?? "8086"}`;
-    // The token reaches the process as a file (novox/hq ADR 0086); the environment variable stays
-    // only for a workstation running the tools by hand.
-    const token = cfg.token ?? tokenFromFile(env.MESH_INFLUXDB_TOKEN_FILE) ?? env.MESH_INFLUXDB_TOKEN;
-    if (!token) throw new Error("no InfluxDB token — set MESH_INFLUXDB_TOKEN_FILE");
+    const token = cfg.token ?? env.MESH_INFLUXDB_TOKEN;
+    if (!token) throw new Error("no InfluxDB token — set MESH_INFLUXDB_TOKEN");
    const org = cfg.org ?? env.MESH_INFLUXDB_ORG ?? "mesh";
    return new InfluxDBClient(url, token, org);
  }
@@ -13,7 +13,7 @@
      "port": 8086,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "queries, writes and the web UI, over http; a name is a route grant"
+      "why": "queries and writes, over http"
    }
  ],
  "resources": [
@@ -26,45 +26,46 @@
    {
      "id": "state",
      "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/influxdb-module",
+      "mode": "0700"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "/var/lib/influxdb-module/server.env",
+      "mode": "0600",
+      "content": "DOCKER_INFLUXDB_INIT_MODE=setup\nDOCKER_INFLUXDB_INIT_USERNAME=admin\nDOCKER_INFLUXDB_INIT_PASSWORD=${secret:admin}\nDOCKER_INFLUXDB_INIT_ADMIN_TOKEN=${secret:admin-token}\nDOCKER_INFLUXDB_INIT_ORG=mesh\nDOCKER_INFLUXDB_INIT_BUCKET=default\n"
    },
    {
      "id": "data",
      "type": "directory",
+      "path": "/services/influxdb/data",
      "mode": "0700",
      "owner": "1000:1000"
    },
    {
      "id": "config",
      "type": "directory",
+      "path": "/services/influxdb/config",
      "mode": "0700",
      "owner": "1000:1000"
    },
-    {
-      "id": "server-env",
-      "type": "file",
-      "path": "${dir:state}/server.env",
-      "mode": "0600",
-      "content": "DOCKER_INFLUXDB_INIT_MODE=setup\nDOCKER_INFLUXDB_INIT_USERNAME=admin\nDOCKER_INFLUXDB_INIT_PASSWORD_FILE=/run/secrets/admin\nDOCKER_INFLUXDB_INIT_ADMIN_TOKEN_FILE=/run/secrets/admin-token\nDOCKER_INFLUXDB_INIT_ORG=mesh\nDOCKER_INFLUXDB_INIT_BUCKET=default\n"
-    },
    {
      "id": "server",
      "type": "container",
      "name": "influxdb",
      "image": "influxdb@sha256:f75e48af0598e8aec7986e991a848d19a119101a7d563a2e5db1dfaac9c45daa",
      "env-file": [
-        "${dir:state}/server.env"
+        "/var/lib/influxdb-module/server.env"
      ],
      "ports": [
        "8086"
      ],
      "volumes": [
-        "${dir:data}:/var/lib/influxdb2",
-        "${dir:config}:/etc/influxdb2",
-        "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro"
-      ]
+        "/services/influxdb/data:/var/lib/influxdb2",
+        "/services/influxdb/config:/etc/influxdb2"
+      ],
+      "secrets-in-environment": "the image honours DOCKER_INFLUXDB_INIT_PASSWORD_FILE and _ADMIN_TOKEN_FILE; convertible, awaiting a bed that proves it"
    },
    {
      "id": "runtime-config",
@@ -82,13 +83,13 @@
      "volumes": [
        "/var/lib/mesh/influxdb/broker:/run/secrets/broker:ro",
        "/var/lib/mesh/influxdb/config.json:/run/config/config.json:ro",
-        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro"
+        "/services/influxdb/config:/var/lib/influxdb/config:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_INFLUXDB_URL": "http://127.0.0.1:${port:8086}",
+        "MESH_INFLUXDB_URL": "http://127.0.0.1:8086",
        "MESH_INFLUXDB_CONFIG_FILE": "/run/config/config.json",
-        "MESH_INFLUXDB_TOKEN_FILE": "/run/secrets/admin-token"
+        "MESH_INFLUXDB_CONFIG_DIR": "/var/lib/influxdb/config"
      },
      "restart-on": [
        "runtime-config"
@@ -96,22 +97,6 @@
      "artifact": "runtime"
    }
  ],
-  "requires": [
-    "route",
-    "secret"
-  ],
-  "contributes": {
-    "route": {
-      "label": "influxdb",
-      "endpoint": "api"
-    }
-  },
-  "secrets": {
-    "secret": {
-      "admin": "${dir:state}/admin.secret",
-      "admin-token": "${dir:state}/admin-token.secret"
-    }
-  },
  "build": {
    "on": [
      {
@@ -132,5 +117,14 @@
        "from": "Dockerfile"
      }
    ]
+  },
+  "requires": [
+    "secret"
+  ],
+  "secrets": {
+    "secret": {
+      "admin": "/var/lib/influxdb-module/admin.secret",
+      "admin-token": "/var/lib/influxdb-module/admin-token.secret"
+    }
  }
 }