# Questions — v4 (current round)

v3 closed 2026-09-02: Q1 answered in chat ("cloudron postgres solved —
wire up the remote access, hook first"). The deploy hook LANDED (#734,
E2E proven); the pairing hit a wrong premise and needs a fork ruling
below. Version up (v4 -> v5) on the next Q&A round.

## Active question channel (founder-directed)

`~/PTKR.md` — 12 open items: GLPI API key, AI-staff identities,
Vault-vs-Bitwarden for agent secrets, prometheus/grafana envs, VoIP carrier
decision, PMG MX cut-over window, SITES access, October hardware window
dates, Friday 2026-09-04 onsite coordination, #681 Cloudron 500s, nitrokey
purchase, Cloudron packaging session scope.

## Repo-local questions

### Q1 — HA instance pairing mechanism (blocks #626 family access; would like before Friday)

The 2025.7+ "built-in pairing" premise was WRONG — no such core
integration exists as of 2026.8.3 (verified on both instances + HA core +
docs; full research in #626 note). Options:

- **(A)** HACS custom `remote_homeassistant` on the Cloudron HA — full
  entity mirroring + control, matches the ruled architecture. Needs a
  founder file/HACS install on the Cloudron app (~30 min of your time;
  no agent API for Cloudron app files). Caveat: community reports of
  recent breakage (remote entities unavailable) — I'd vet the GitHub
  issues before committing.
- **(B)** One-way API bridge — pfv-bms pushes ~20 key family states
  (temps, UPS, garage/artroom) to the Cloudron HA REST API + I build
  family dashboards there via websocket. I can build it entirely
  tonight; family gets read-only visibility; no control.
- **(C)** MQTT broker on the VPS, both instances bridge — bidirectional,
  but a new always-on service + YAML on both sides.

Answer (A/B/C) + does family need to TOGGLE things at the property, or
just see status?

### Q2 — gitea webhook allowlist (1-line + restart; unlocks instant deploys)

gitea silently drops webhook deliveries to CGNAT-range targets (SSRF
`ALLOWED_HOST_LIST` default — no delivery attempt, no log line; restart
doesn't help; that's why hook #10 never fired). Until it opens, the
5-minute sha-watch net deploys everything reload-only — already live.

To open the instant path: Cloudron file manager → gitea app.ini →

```ini
[webhook]
ALLOWED_HOST_LIST = external,private
```

then restart gitea. Say the word when done — I'll verify hook #10 fires
end-to-end (it carries the full restart-mapping logic).