56 lines
3.5 KiB
Markdown
56 lines
3.5 KiB
Markdown
# Matter Server
|
|
|
|
The `matter-server` Argo Application installs the maintained
|
|
`home-assistant-matter-server` chart from https://charts.derwitt.dev in `default`,
|
|
alongside Home Assistant. Its chart version in `bootstrap/matter-server.yaml`
|
|
is the canonical release selection; the upstream chart selects its images.
|
|
|
|
Home Assistant connects to `ws://matter-server.default.svc.cluster.local/ws`.
|
|
The server uses host networking for LAN multicast and IPv6 connectivity to
|
|
Matter devices. It has no node selector, fixed listen address, or fixed
|
|
interface name; Kubernetes can reschedule it with the same CephFS claim.
|
|
MetalLB allocates a LAN address for the WebSocket/dashboard Service. That
|
|
address covers API access, not Matter discovery or device traffic: the
|
|
node running the controller still needs working LAN IPv6 routes to the OTBR.
|
|
The cluster's Cilium pod network is IPv4-only, so a LoadBalancer Service
|
|
alone cannot replace host networking. The MikroTik OTBR remains the Thread
|
|
border router; Matter Server does not create another Thread network.
|
|
There is no public ingress. A single controller restarts during rescheduling;
|
|
this is recovery with preserved state, not uninterrupted active-active service.
|
|
|
|
The MikroTik-managed `app-otbr` container requires these startup sysctls in
|
|
its own network namespace: `net.ipv6.conf.all.forwarding=1`,
|
|
`net.ipv6.conf.veth-app-otbr.accept_ra=2`, and
|
|
`net.ipv6.conf.veth-app-otbr.accept_ra_from_local=1`. The persistent script
|
|
`/data/lan-ipv6-init.sh` applies them before `exec /init`; the RouterOS container
|
|
uses `entrypoint=/bin/sh` and `cmd=/data/lan-ipv6-init.sh`. Keeping the script
|
|
separate avoids RouterOS command-line quoting errors. Without accepting its own router advertisements,
|
|
the container advertises a LAN prefix but lacks the corresponding return
|
|
route; discovery works while IPv6 communication with Thread fails. Recheck
|
|
this entrypoint after changing or reinstalling the MikroTik App. RouterOS
|
|
does not expose `accept_ra_rt_info_max_plen` in this container kernel.
|
|
The Kubernetes node uses systemd-networkd's router advertisement handling;
|
|
its kernel `accept_ra=0` does not mean IPv6 route learning is disabled.
|
|
|
|
BLE proxy commissioning is enabled. Home Assistant's Matter integration
|
|
connects to the server's `/ble` endpoint and supplies its Bluetooth adapters
|
|
or active ESPHome proxies, allowing commissioning without Google Play services.
|
|
The upstream prerequisites for ESPHome proxies are ESPHome 2026.5 or newer
|
|
and ESP-IDF 6.0.1 or newer. Verify the proxy firmware and Bluetooth range
|
|
before using this path; merely seeing BLE advertisements is not sufficient.
|
|
The controller must have the preferred Thread dataset before commissioning.
|
|
Devices still require their own Matter QR/manual setup code and pairing mode.
|
|
|
|
The chart creates `data-matter-server-0`, mounted at `/data`, on the retained
|
|
`rook-cephfs-ec` storage class. This contains authoritative Matter fabric keys
|
|
and device pairing state. Preserve the entire directory and its permissions
|
|
when restoring, stop the server during a filesystem copy, and never run two
|
|
controllers against the same data. Restore it to the same claim or an isolated
|
|
recovery claim before starting a replacement controller. Losing this state
|
|
can require commissioning every device again.
|
|
|
|
Backup gap: this new claim is not selected by `apps/backup/` yet. Ceph
|
|
replication and the retained volume are not historical backups. No successful
|
|
external backup or restore exercise is claimed. Thread credentials on the
|
|
MikroTik and Home Assistant configuration are separate recovery material.
|