Document Z-Wave JS and Zigbee2MQTT on Docker host; drop Raspberry Pi docs

- raspi_zwave.md -> zwave_zigbee.md: zwavejs + zigbee2mqtt containers, Z-Net G8 ports 2001/2002
- Remove obsolete migratezwave.md plan
- Add containers to docker.md, MQTT/Zigbee notes to ha.md, component entry to CLAUDE.md

CLAUDE.md

@@ -22,9 +22,10 @@ Credentials live inline in each component's `.md` file under its **Access** sect
 - [ESXi Host](esxi.md) — HP server at 10.2.0.12, ESXi 8.0.3, 10 VMs (6 powered on), access via `govc` only (not SSH). **Read esxi.md for credentials and connection details.**
 - [Docker Server](docker.md) — Debian 13 at 10.100.0.35, Docker host for 21 containers (arr stack, Traefik, Semaphore/Ansible). **This is the local machine.**
 - [Plex Server](plex.md) — **container on the Docker host (10.100.0.35)** since 2026-09-16, Plex Media Server 1.43, NFS media from TrueNAS. Old Debian 11 VM decommissioned and deleted 2026-09-17.
-- [Home Assistant](ha.md) — HAOS at 10.100.0.40, HA 2026.2.2, 2,411 entities, smart home automation. API access only (no SSH).
+- [Home Assistant](ha.md) — HAOS at 10.100.0.40, HA 2026.9.4, 2,613 entities, smart home automation. API access only (no SSH).
 - [Ignition Gateway](ignition.md) — Debian 11 at 10.100.0.90, Ignition 8.3.3 (Maker), SCADA/IIoT platform with PostgreSQL 13
 - [Veeam Server](veeam.md) — Windows Server 2025 at 10.100.0.30, Veeam B&R 12.3, backup server. **Read veeam.md for credentials and connection details.**
 - [Desktop](desktop.md) — Windows PC, dual-homed on LAN_100 (10.100.0.49) and DATA_50 (10.50.0.49)
 - [Wonderware Dev VM](ww.md) — Windows 10 ESXi VM at 10.100.0.48, OpenSSH (passwordless)
+- [Z-Wave & Zigbee](zwave_zigbee.md) — HomeSeer Z-Net G8 at 10.200.0.106 hosts both radios (Z-Wave on :2001, SmartStick ZB on :2002). `zwavejs` (HA → ws://10.100.0.35:3100) and `zigbee2mqtt` (→ HA Mosquitto) containers on the Docker host, deployed via the playbook. Old Raspberry Pi is gone.
 - [Unifi Network](unifi.md) — UDM Pro gateway + USW Pro Aggregation central switch, API access via key

docker.md

@@ -100,6 +100,8 @@ All 21 containers running. Most are on the `traefik` network.
 | Container | Image | URL | Port | Purpose |
 |-----------|-------|-----|------|---------|
 | semaphore | semaphoreui/semaphore:latest | http://10.100.0.35:3000 | 3000 | Ansible UI |
+| zwavejs | zwavejs/zwave-js-ui:latest | zwave.dohertylan.com | 8091 (UI), 3100→3000 (HA websocket) | Z-Wave JS UI for HA — see [zwave_zigbee.md](zwave_zigbee.md) |
+| zigbee2mqtt | koenkk/zigbee2mqtt:latest | zigbee.dohertylan.com | 8080 (UI, Traefik only) | Zigbee coordinator → HA Mosquitto — see [zwave_zigbee.md](zwave_zigbee.md) |
 
 ### lmxopcua (carry `project=lmxopcua` label)
 
@@ -138,7 +140,7 @@ All compose files are under `/opt/<service>/docker-compose.yml`:
 /opt/tautulli/        /opt/nzbget/          /opt/vpn_downloads/
 /opt/uptime_kuma/     /opt/stash/           /opt/utilities/
 /opt/semaphore/       /opt/ilo_fan/
-/opt/plex/
+/opt/plex/            /opt/zwavejs/         /opt/zigbee2mqtt/
 /opt/otopcua-mssql/   /opt/otopcua-modbus/  /opt/otopcua-abcip/
 /opt/otopcua-s7/      /opt/otopcua-opcuaclient/
 ```

ha.md

@@ -7,6 +7,8 @@
 - **OS**: Home Assistant OS (reports as Oracle Linux 6 to ESXi)
 - **Web UI**: http://10.100.0.40:8123 / https://ha.dohertylan.com
 - **SSH**: Not available (Home Assistant OS — no direct shell access from this machine)
+- **Config files**: read/write `/homeassistant/*.yaml` via the File editor add-on's API over ingress — websocket `supervisor/api` POST `/ingress/session` → cookie `ingress_session`, then `GET <ingress_url>api/file?filename=…` / `POST <ingress_url>api/save` (form `filename`, `text`). Validate with `POST /api/config/core/check_config`.
+- **HTTP settings**: managed in UI (Settings → System → Network) since 2026.8; `http:` YAML block removed 2026-10-01. Reverse proxy: `use_x_forwarded_for`, `trusted_proxies: 10.100.0.0/24`.
 - **API Token**: `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiI3MDU4MDcwNWNjOTI0MmE5YTg1OTJmMWRmMWY0YTk5NSIsImlhdCI6MTc3MTE4NzM0NCwiZXhwIjoyMDg2NTQ3MzQ0fQ.RXzwb_xu9TQyIE2QABRJP5nXtb6FDyHY7Phu3vFJecw`
 
 ## Hardware (VM on ESXi)
@@ -26,7 +28,7 @@
 
 ## Home Assistant
 
-- **Version**: 2026.2.2
+- **Version**: 2026.9.4 (verified 2026-10-01)
 - **State**: RUNNING
 - **Location**: Syracuse, IN (41.41, -85.72)
 - **Time zone**: America/New_York
@@ -34,26 +36,40 @@
 
 ### Scale
 
-- **2,411 entities** across 76 service domains
-- Top entity types: sensor (746), number (285), switch (277), button (228), binary_sensor (219), select (157), device_tracker (110), light (97)
+- **2,613 entities** across 80 service domains (804 unavailable as of 2026-10-01 — 289 are stale `new_*` entities)
+- Top entity types: sensor (866), switch (297), number (283), button (251), binary_sensor (232), select (161), device_tracker (133), light (94)
 
 ### Key Integrations
 
 | Category | Integrations |
 |----------|-------------|
-| **Z-Wave / Zigbee / Matter** | zwave_js, matter |
-| **MQTT / ESPHome / Tasmota** | mqtt, esphome, tasmota |
-| **WiFi Devices** | shelly, yolink, ac_infinity, flair, midea_dehumidifier_lan, govee_ble |
+| **Z-Wave / Zigbee / Matter** | zwave_js, matter, Zigbee via Zigbee2MQTT over mqtt — see [zwave_zigbee.md](zwave_zigbee.md) |
+| **MQTT / ESPHome** | mqtt (Mosquitto broker add-on; logins `caffha`, `watermgr`, `zigbee2mqtt`), esphome |
+| **WiFi Devices** | shelly, ac_infinity, flair, midea_dehumidifier_lan, govee_ble |
 | **Appliances** | ge_home, roborock |
-| **Media** | sonos, apple_tv, cast, harmony, webostv |
-| **Network / Monitoring** | unifi, truenas, iotawatt, brother, ipp |
+| **Media** | sonos, apple_tv, cast, webostv |
+| **Network / Monitoring** | unifi, truenas, brother, ipp |
 | **Protocols** | homekit, homekit_controller, modbus, bthome, ibeacon, oralb |
 | **Voice / AI** | alexa, google_assistant, anthropic, openai_conversation, wyoming |
 | **Other** | hacs, cloud, go2rtc, droplet, isy994 |
 
+### Notable Devices
+
+- **PowerMonitorMain** — Aeotec Home Energy Meter 8 (ZWA046), Z-Wave JS node 42, firmware 1.7.7. Entities `sensor.powermonitormain_*` (consumption/production W, kWh, V, A, PF, kVar per channel). Manuals in [manuals/](manuals/). 2-clamp version; endpoints: EP1/EP2 clamp 1 consumption/production, EP3/EP4 clamp 2, EP5/EP6 sum of clamps, EP7/EP8 net.
+
+### Energy Dashboard
+
+- **Grid** (configured 2026-10-01): two import entries, one per leg of PowerMonitorMain:
+  - Leg 2: `sensor.powermonitormain_electric_consumption_kwh_3` / power `..._consumption_w_3` (EP3, clamp 2 consumption)
+  - Leg 1: `sensor.powermonitormain_electric_production_kwh` / power `..._production_w` (EP2, clamp 1 "production") — **clamp 1 is installed reversed**, so leg 1 load reports as production (no solar; it reads all night). EP1 consumption has never registered. If clamp 1 is ever flipped, switch this entry to `sensor.powermonitormain_electric_consumption_kwh` (EP1), or replace both with EP5 (`..._consumption_kwh_5`, sum of clamps).
+  - Don't use EP7 (net consumption) — with a reversed clamp it subtracts leg 1 instead of adding it.
+  - Replaced `sensor.total_watts_wh` (old IoTaWatt at 10.100.0.62 — hardware removed; integration, device and 29 entities deleted from HA 2026-10-01). Meter statistics begin 2026-09-30.
+- **Water** (configured 2026-10-01): consumption `sensor.water_total_usage` (Riemann integral helper of the flow rate, gal, lifetime total; registry device_class override → `water`), flow rate `sensor.droplet_prefilter_flow_rate` (gal/min, `stat_rate`)
+- Droplet (utility room, pre-filter): `sensor.droplet_daily_water_usage` / `sensor.droplet_monthly_water_usage` are utility_meter helpers on `sensor.water_total_usage`. Don't use `sensor.droplet_prefilter_water` — it is a per-interval delta that goes negative, not a total.
+
 ### Automations
 
-- 23 automations configured
+- 22 automations configured
 
 ## Notes
 

migratezwave.md

@@ -1,79 +0,0 @@
-# Migrate Z-Wave JS from Raspberry Pi to Home Assistant
-
-## Context
-
-Z-Wave JS UI currently runs on a Raspberry Pi (10.200.0.190) as a Docker container, connecting to the Z-Net G8 controller at `tcp://10.200.0.106:2001`. Home Assistant then connects to the Raspi's websocket on port 3000. This adds an unnecessary hop and dependency on the Raspi. Since the Z-Net G8 is network-based, HA can connect to it directly.
-
-**Current**: HA → ws:3000 → Raspi (Z-Wave JS UI Docker) → tcp:2001 → Z-Net G8
-**Target**: HA → Z-Wave JS add-on (local) → tcp:2001 → Z-Net G8
-
-## Current State
-
-- **219 Z-Wave entities** in HA
-- **~23 Z-Wave nodes** with custom names (DownstairsBathroomFan, GarageSensor1, etc.)
-- **Security keys** (S0, S2 Auth/Unauth/Access Control, LR) configured in Z-Wave JS UI
-- Device pairings stored in Z-Net G8 NVM (persist regardless of software change)
-- Raspi also runs: zigbee2mqtt, portainer_agent, ouroboros (these stay on the Raspi)
-
-## Recommended Approach: Z-Wave JS UI Add-on on HAOS
-
-Install the **Z-Wave JS UI community add-on** on HAOS rather than the official Z-Wave JS add-on. Reasons:
-- Same software as current setup → minimal risk
-- Keeps the full web UI for network management
-- HomeSeer docs specifically recommend Z-Wave JS UI for Z-Net controllers
-- Security keys and node names can be migrated directly
-
-## Steps
-
-### 1. Backup current Z-Wave JS UI on Raspi
-- Create NVM backup from the Z-Wave JS UI web interface (http://10.200.0.190:8091)
-- Copy the store directory from the Raspi container: `sudo docker exec zwavejs2mqtt tar czf /tmp/zwave-store-backup.tar.gz /usr/src/app/store/`
-- Copy backup locally: `scp dohertj2@10.200.0.190:/tmp/zwave-store-backup.tar.gz ./`
-- Save the settings.json (contains security keys and TCP port config)
-
-### 2. Stop Z-Wave JS UI on Raspi
-- `ssh dohertj2@10.200.0.190 "sudo docker stop zwavejs2mqtt"`
-- This releases the TCP connection to the Z-Net G8 (only one client can hold it)
-
-### 3. Install Z-Wave JS UI add-on on HAOS
-- Via HA web UI: Settings → Add-ons → Add-on Store → search "Z-Wave JS UI" (community add-on)
-- OR via API if possible: add the community add-on repository and install
-
-### 4. Configure the add-on
-- Set serial port to `tcp://10.200.0.106:2001`
-- Enter the existing security keys:
-  - S2_Unauthenticated: `015BD790CCDB08172CBD12754C73E4D3`
-  - S2_AccessControl: `B3F99B99EE958BFAE813A84FD3586E2A`
-  - S0_Legacy: `FBF63F5E6515286C3AB8CC9E5F275B46`
-  - S2_Authenticated: `67E9ECD830733A1E1BEB22DC0EAA2739`
-  - S2_Authenticated_LR: `2176EE246C67320A42F2C0A23932E9B5`
-  - S2_AccessControl_LR: `E534F94FCD0BE8B42F056F2F3548002E`
-- Start the add-on
-
-### 5. Reconfigure HA Z-Wave JS integration
-- Remove the current zwave_js integration (pointing to ws://10.200.0.190:3000)
-- Re-add it pointing to the local add-on's websocket (ws://localhost:3000 or the add-on's internal URL)
-- Verify all 219 entities are rediscovered with correct names/device assignments
-
-### 6. Verify
-- Check all Z-Wave nodes are online in the Z-Wave JS UI add-on
-- Confirm entity count matches (~219)
-- Test a few devices (turn a light on/off, check a sensor reading)
-- Verify automations that use Z-Wave devices still work
-
-### 7. Cleanup
-- Remove the zwavejs2mqtt container from the Raspi: `sudo docker rm zwavejs2mqtt`
-- Update `raspi_zwave.md` to reflect new architecture
-
-## Risk Mitigation
-
-- **Rollback**: If anything goes wrong, stop the HA add-on, restart the Raspi container, and re-point the integration back
-- **Entity IDs**: Removing and re-adding the integration may change entity IDs. HA should re-discover them with the same unique IDs from Z-Wave JS, but automations/dashboards may need updating if not
-- **Cross-VLAN**: HA (10.100.0.40, VLAN 100) must be able to reach Z-Net G8 (10.200.0.106, VLAN 200) on TCP port 2001 — confirmed allowed
-
-## Verification
-
-1. Entity count: `curl -s http://10.100.0.40:8123/api/template -d '{"template":"{{ integration_entities(\"zwave_js\") | list | length }}"}' ` should return ~219
-2. Z-Wave JS UI web interface accessible from HA add-on
-3. Test device control via HA
-4. Check HA logs for Z-Wave errors

raspi_zwave.md

@@ -1,55 +0,0 @@
-# Z-Wave Infrastructure
-
-## Architecture
-
-```
-HA (10.100.0.40) --ws:3000--> Raspberry Pi (10.200.0.190) --tcp:2001--> Z-Net G8 (10.200.0.106)
-                                 (Z-Wave JS UI)                          (Z-Wave radio controller)
-```
-
-## Z-Net G8 (Z-Wave Controller)
-
-- **Hostname**: Z-Net-G8
-- **IP**: 10.200.0.106 (IOT_200, VLAN 200)
-- **MAC**: 02:53:ec:d0:de:dd
-- **Manufacturer**: HomeSeer Technologies
-- **Role**: Z-Wave radio controller (Node 1), serial-over-TCP on port 2001
-
-## Raspberry Pi (Z-Wave JS UI Host)
-
-- **Hostname**: zwave
-- **IP**: 10.200.0.190 (IOT_200, VLAN 200)
-- **MAC**: e4:5f:01:02:3c:26
-- **Hardware**: Raspberry Pi (Raspberry Pi Trading Ltd)
-- **SSH**: `ssh dohertj2@10.200.0.190` (passwordless)
-- **Web UI**: http://10.200.0.190:8091
-- **Z-Wave JS websocket**: ws://10.200.0.190:3000
-
-### Docker Containers
-
-| Container | Image | Ports |
-|-----------|-------|-------|
-| zwavejs2mqtt | zwavejs/zwave-js-ui:latest | 3000 (websocket), 8091 (web UI) |
-| zigbee2mqtt | koenkk/zigbee2mqtt:latest | — |
-| portainer_agent | portainer/agent:2.21.5 | 9001 |
-| ouroboros | pyouroboros/ouroboros | — |
-
-### Z-Wave JS Config
-
-- **Serial port**: `tcp://10.200.0.106:2001` (Z-Net G8 over network)
-- **Z-Wave region**: 1 (US)
-- **Server port**: 3000 (websocket for HA)
-- **Status**: ready
-
-## Home Assistant Integration
-
-- **Integration**: zwave_js
-- **Connects to**: ws://10.200.0.190:3000
-- **Node 1**: HomeSeer Z-Wave Shield with External Antenna (Z-Net G8)
-
-## Notes
-
-- Both devices sit on the IoT VLAN (10.200.0.0/24)
-- HA connects cross-VLAN (LAN_100 -> IOT_200) to the Raspi websocket
-- The Raspi also runs Zigbee2MQTT (separate Zigbee network)
-- Tracked by Unifi as device_tracker.zwave (Raspi) and device_tracker.z_net_g8 (controller)

zwave_zigbee.md

@@ -0,0 +1,68 @@
+# Z-Wave & Zigbee Infrastructure
+
+## Architecture
+
+```
+Z-Wave: HA (10.100.0.40) --ws:3100--> Docker host (10.100.0.35) zwavejs     --tcp:2001--> Z-Net G8 (10.200.0.106) Z-Wave radio
+Zigbee: HA Mosquitto (10.100.0.40:1883) <--mqtt-- Docker host zigbee2mqtt   --tcp:2002--> Z-Net G8 SmartStick ZB (USB)
+```
+
+Both radios live on the Z-Net G8; both controller apps run as containers on the Docker host, deployed by the Ansible playbook (`~/playbook`, roles `zwavejs` and `zigbee2mqtt`).
+
+The Raspberry Pi (10.200.0.190) that previously hosted Z-Wave JS UI is gone.
+
+## Z-Net G8 (Z-Wave Controller)
+
+- **Hostname**: Z-Net-G8
+- **IP**: 10.200.0.106 (IOT_200, VLAN 200)
+- **MAC**: 02:53:ec:d0:de:dd
+- **Manufacturer**: HomeSeer Technologies
+- **Role**: Z-Wave radio controller (Node 1), serial-over-TCP on port 2001
+- **Zigbee**: HomeSeer SmartStick ZB plugged into the Z-Net's USB, exposed on port **2002** (2003 is for older Sonoff ZBDongle-E revisions). Requires Z-Net firmware ≥ 1.0.27 (running 1.0.27).
+- **Web UI**: http://10.200.0.106/
+
+## Z-Wave JS UI (container on the Docker host)
+
+- **Host**: [Docker Server](docker.md) — `ssh dohertj2@10.100.0.35`
+- **Container**: `zwavejs` (`zwavejs/zwave-js-ui:latest`), restart `unless-stopped`, created 2026-07-03
+- **Compose file**: `/opt/zwavejs/docker-compose.yml` (templated by playbook role `zwavejs`)
+- **Store/data**: `/opt/zwavejs/store` → `/usr/src/app/store` (`settings.json`, `nodes.json`, `backups/`)
+- **Network**: `traefik`
+- **Web UI**: https://zwave.dohertylan.com (Traefik → port 8091, Authelia SSO; Z-Wave JS UI's own auth is disabled)
+- **Z-Wave JS websocket**: ws://10.100.0.35:3100 (host 3100 → container 3000)
+
+### Z-Wave JS Config
+
+- **Serial port**: `tcp://10.200.0.106:2001` (Z-Net G8 over network)
+- **Z-Wave region**: 1 (US)
+- **Server port**: 3000 in container (published as 3100)
+
+## Home Assistant Integration
+
+- **Integration**: zwave_js
+- **Connects to**: ws://10.100.0.35:3100
+- **Size**: 25 devices, 296 entities (2026-10-09)
+- **Node 1**: HomeSeer Z-Wave Shield with External Antenna (Z-Net G8)
+- Two stale `not_loaded` config entries remain (an old "Z-Wave JS" entry and a Silicon Labs CP2102N USB serial entry)
+
+## Zigbee2MQTT (container on the Docker host)
+
+- **Container**: `zigbee2mqtt` (`koenkk/zigbee2mqtt:latest`, 2.14.2 at deploy), restart `unless-stopped`, deployed 2026-10-09
+- **Playbook role**: `zigbee2mqtt` — `sudo ansible-playbook site.yml -i localhost, -c local --tags zigbee2mqtt --limit localhost` from `~/playbook` (Semaphore currently has no project configured)
+- **Compose file**: `/opt/zigbee2mqtt/docker-compose.yml`
+- **Data**: `/opt/zigbee2mqtt/data` → `/app/data` (`configuration.yaml` holds the generated network key — back it up; `coordinator_backup.json`)
+- **Config ownership**: `configuration.yaml` is seeded once by Ansible (never overwritten); MQTT, serial and frontend settings are enforced by `ZIGBEE2MQTT_CONFIG_*` env vars in the compose file
+- **Web UI**: https://zigbee.dohertylan.com (Traefik → port 8080, Authelia SSO)
+- **Coordinator**: `tcp://10.200.0.106:2002`, adapter `ember`, EmberZNet 7.4.3, IEEE 0x8c8b48fffe2dd481
+- **Network**: channel 25, PAN ID 64462 (0xFBCE) — new network formed 2026-10-09; all devices must be (re)paired
+- **MQTT**: HA's Mosquitto broker add-on at mqtt://10.100.0.40:1883, base topic `zigbee2mqtt`, HA discovery enabled
+  - **User**: `zigbee2mqtt` / **Password**: `Aywm6DjOR3bfSo9c7zDoWDxX` (login in the Mosquitto add-on options; also in the playbook role defaults)
+
+### Pairing devices
+
+Turn on **Permit join** in the Zigbee2MQTT web UI (or the `switch.zigbee2mqtt_bridge_permit_join` entity in HA), then reset/pair the device. It appears in HA automatically via MQTT discovery.
+
+## Notes
+
+- Z-Net G8 is on the IoT VLAN; the Docker host reaches it cross-VLAN (or via its IOT_200 interface 10.200.0.35)
+- Tracked by Unifi as device_tracker.z_net_g8