Documentation
¶
Overview ¶
Package kombifynotify is the node-side custody of the opt-in "kombify notify" integration of Smart Home.
StackKits is the node's custody holder. When the owner turns on the kombify-notify workload setting, Apply creates two files next to the access manifest, in <workspace>/.stackkit/kombify-notify/:
- token holds the bearer secret that Home Assistant presents to the local Techstack agent. It is created once and never rotated by a re-apply.
- listen holds the single host:port the agent must bind. It is the gateway address of the Docker network Home Assistant is attached to, so the container can reach it and nothing else can.
Both files are written by StackKits and only read by the agent. The token reaches Home Assistant only through the owner-only secrets file that Apply bind-mounts; it never appears in a plan, receipt, state file, log, command line or generated configuration.
Index ¶
- Constants
- Variables
- func Ensure(workspace string, gateway netip.Addr) (string, error)
- func HomeAssistantPlatformYAML(gateway netip.Addr) (string, error)
- func HomeAssistantSecretsYAML(token string) string
- func ListenAddress(gateway netip.Addr) (string, error)
- func Load(workspace string) (string, error)
- func ValidateGateway(gateway netip.Addr) error
Constants ¶
const ( // Port is the node-local port the Techstack agent binds. Port = 18741 // DirectoryRelPath is the custody directory beside .stackkit/access.json. DirectoryRelPath = ".stackkit/kombify-notify" // TokenFile and ListenFile are the two files the agent reads. TokenFile = "token" ListenFile = "listen" )
const ( // RequestPath is the agent route Home Assistant posts to. RequestPath = "/v1/user-notifications" // SecretKey is the secrets.yaml key that holds the Authorization header. SecretKey = "kombify_notify_authorization" )
Variables ¶
var ErrCustodyMissing = errors.New("kombify notify token custody is missing")
ErrCustodyMissing means the owner enabled the integration but Apply has not created its token yet. Inspection never creates it.
Functions ¶
func Ensure ¶
Ensure creates the token when absent, never replaces an existing one, and publishes the listen address. It returns the token for the caller's owner-only secrets file.
func HomeAssistantPlatformYAML ¶
HomeAssistantPlatformYAML is the notify platform file for the gateway address. It names no secret: the Authorization header is a !secret reference that Home Assistant resolves from the secrets.yaml beside this file.
Home Assistant's REST notify sends {"text": <message>} and merges only the platform's own data_template, never a service call's data, so the template forwards exactly two author-set fields. The audience is "member" whenever a target is given (the target becomes member_username), the author's audience otherwise, and "me" when neither is set.
func HomeAssistantSecretsYAML ¶
HomeAssistantSecretsYAML is the secrets file beside the platform file. It is the one generated artifact besides the token file that holds the secret and is persisted owner-only; Home Assistant resolves the nearest secrets.yaml from the including file's directory upward, so the owner's own /config/secrets.yaml stays untouched.
func ListenAddress ¶
ListenAddress renders the exact host:port line the agent binds.
func ValidateGateway ¶
ValidateGateway admits only a private IPv4 address of a container bridge. A public, loopback, link-local or unspecified address would either expose the agent or be unreachable from a bridged container.
Types ¶
This section is empty.
Source Files