From 504322ac51f7578f0b2d42c15ed76ff69b63a677 Mon Sep 17 00:00:00 2001 From: 0xFEEDC0DE64 Date: Fri, 6 Nov 2026 10:09:26 +0100 Subject: [PATCH] Document MikroTik OTBR return-route requirements --- apps/matter-server/README.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/apps/matter-server/README.md b/apps/matter-server/README.md index b1dcb58..2f6c9b9 100644 --- a/apps/matter-server/README.md +++ b/apps/matter-server/README.md @@ -11,6 +11,18 @@ LAN interface. The MikroTik OTBR remains the Thread border router; Matter Server does not create another Thread network. The WebSocket/dashboard port is LAN-only and has no public ingress. +The MikroTik-managed `app-otbr` container requires these startup sysctls in +its own network namespace: `net.ipv6.conf.all.forwarding=1`, +`net.ipv6.conf.veth-app-otbr.accept_ra=2`, and +`net.ipv6.conf.veth-app-otbr.accept_ra_from_local=1`. Its container entrypoint +applies them before `/init`. Without accepting its own router advertisements, +the container advertises a LAN prefix but lacks the corresponding return +route; discovery works while IPv6 communication with Thread fails. Recheck +this entrypoint after changing or reinstalling the MikroTik App. RouterOS +does not expose `accept_ra_rt_info_max_plen` in this container kernel. +The Kubernetes node uses systemd-networkd's router advertisement handling; +its kernel `accept_ra=0` does not mean IPv6 route learning is disabled. + The chart creates `data-matter-server-0`, mounted at `/data`, on the retained `rook-cephfs-ec` storage class. This contains authoritative Matter fabric keys and device pairing state. Preserve the entire directory and its permissions