Matter Server
The matter-server Argo Application installs the maintained
home-assistant-matter-server chart from https://charts.derwitt.dev in default,
alongside Home Assistant. Its chart version in bootstrap/matter-server.yaml
is the canonical release selection; the upstream chart selects its images.
Home Assistant connects to ws://matter-server.default.svc.cluster.local/ws.
The server uses host networking for LAN multicast and IPv6 connectivity to
Matter devices. It has no node selector, fixed listen address, or fixed
interface name; Kubernetes can reschedule it with the same CephFS claim.
MetalLB allocates a LAN address for the WebSocket/dashboard Service. That
address covers API access, not Matter discovery or device traffic: the
node running the controller still needs working LAN IPv6 routes to the OTBR.
The cluster's Cilium pod network is IPv4-only, so a LoadBalancer Service
alone cannot replace host networking. The MikroTik OTBR remains the Thread
border router; Matter Server does not create another Thread network.
There is no public ingress. A single controller restarts during rescheduling;
this is recovery with preserved state, not uninterrupted active-active service.
The MikroTik-managed app-otbr container requires these startup sysctls in
its own network namespace: net.ipv6.conf.all.forwarding=1,
net.ipv6.conf.veth-app-otbr.accept_ra=2, and
net.ipv6.conf.veth-app-otbr.accept_ra_from_local=1. The persistent script
/data/lan-ipv6-init.sh applies them before exec /init; the RouterOS container
uses entrypoint=/bin/sh and cmd=/data/lan-ipv6-init.sh. Keeping the script
separate avoids RouterOS command-line quoting errors. Without accepting its own router advertisements,
the container advertises a LAN prefix but lacks the corresponding return
route; discovery works while IPv6 communication with Thread fails. Recheck
this entrypoint after changing or reinstalling the MikroTik App. RouterOS
does not expose accept_ra_rt_info_max_plen in this container kernel.
The Kubernetes node uses systemd-networkd's router advertisement handling;
its kernel accept_ra=0 does not mean IPv6 route learning is disabled.
BLE proxy commissioning is enabled. Home Assistant's Matter integration
connects to the server's /ble endpoint and supplies its Bluetooth adapters
or active ESPHome proxies, allowing commissioning without Google Play services.
The upstream prerequisites for ESPHome proxies are ESPHome 2026.5 or newer
and ESP-IDF 6.0.1 or newer. Verify the proxy firmware and Bluetooth range
before using this path; merely seeing BLE advertisements is not sufficient.
The controller must have the preferred Thread dataset before commissioning.
Devices still require their own Matter QR/manual setup code and pairing mode.
The chart creates data-matter-server-0, mounted at /data, on the retained
rook-cephfs-ec storage class. This contains authoritative Matter fabric keys
and device pairing state. Preserve the entire directory and its permissions
when restoring, stop the server during a filesystem copy, and never run two
controllers against the same data. Restore it to the same claim or an isolated
recovery claim before starting a replacement controller. Losing this state
can require commissioning every device again.
Backup gap: this new claim is not selected by apps/backup/ yet. Ceph
replication and the retained volume are not historical backups. No successful
external backup or restore exercise is claimed. Thread credentials on the
MikroTik and Home Assistant configuration are separate recovery material.