chore(hass): add one-off playbook to repoint tplink entries at IoT VLAN

The IoT WiFi moved from Default (192.168.1.x) to the IoT VLAN
(192.168.2.x) with fixed IPs reserved in UniFi. HA 2026.9.3's tplink
reconfigure flow ignores the entered host and reconnects to the stored
one, so this edits data.host in .storage/core.config_entries with HA
stopped, matching entries by MAC and refusing to write unless all 9
match. Backs up core.config_entries first and always restarts hass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/oneoff/files/hass_tplink_rehost.py

@@ -0,0 +1,50 @@
+"""Point HA's 9 TP-Link (Kasa) config entries at their new IoT VLAN addresses.
+
+Run on galactica as the podman user while HA is STOPPED:
+    python3 /tmp/fix_tplink.py          # dry run, prints what would change
+    python3 /tmp/fix_tplink.py apply    # writes the change (refuses unless all 9 match)
+
+Only data.host is changed; entries are matched by MAC (unique_id).
+"""
+import json
+import os
+import re
+import sys
+
+path = "/home/podman/.local/share/volumes/hass/config/.storage/core.config_entries"
+new = {
+    "54af970a5d01": "192.168.2.220",  # Printer Plug KP115
+    "788cb56955b4": "192.168.2.146",  # Driveway String Lights HS200
+    "2887ba1bd687": "192.168.2.199",  # Kitchen Wall Light KS230
+    "5ce9319dc5d6": "192.168.2.38",   # Kitchen Lights HS220
+    "5ce9319da5e0": "192.168.2.200",  # Dining Hall HS220
+    "5ce9319dd193": "192.168.2.159",  # Dining Room HS220
+    "5ce931a23a6e": "192.168.2.61",   # Bathroom Hallway HS220
+    "f0a731771227": "192.168.2.55",   # Stair Light KS230
+    "788cb5694e4a": "192.168.2.252",  # Bedroom Light HS200
+}
+apply = len(sys.argv) > 1 and sys.argv[1] == "apply"
+
+with open(path) as f:
+    d = json.load(f)
+
+n = 0
+for e in d["data"]["entries"]:
+    if e.get("domain") != "tplink":
+        continue
+    mac = re.sub(r"[^0-9a-f]", "", (e.get("unique_id") or "").lower())
+    ip = new.get(mac)
+    print(f'{e["title"]:<36} host={e["data"].get("host")} -> {ip}')
+    if ip:
+        e["data"]["host"] = ip
+        n += 1
+print("matched", n, "of 9")
+
+if apply:
+    if n != 9:
+        sys.exit("refusing to write: not all 9 matched")
+    tmp = path + ".tmp"
+    with open(tmp, "w") as f:
+        json.dump(d, f, indent=4, ensure_ascii=False)
+    os.replace(tmp, path)
+    print("written")

ansible/oneoff/hass-tplink-rehost.yml

@@ -0,0 +1,72 @@
+---
+# One-off: repoint Home Assistant's TP-Link (Kasa) config entries at their new
+# addresses after the IoT WiFi moved from the Default network to the IoT VLAN
+# (192.168.1.x -> 192.168.2.x, fixed IPs reserved in UniFi).
+#
+# HA 2026.9.3's tplink "Reconfigure" flow ignores the host entered in the form
+# and reconnects to the stored one, so it cannot be used to change the address.
+# Instead this edits data.host in .storage/core.config_entries while HA is
+# stopped. Entries are matched by MAC (unique_id); nothing else is touched.
+#
+# Run:
+#   .venv/bin/ansible-playbook -i ansible/inventories/home/hosts.yml \
+#     ansible/oneoff/hass-tplink-rehost.yml
+- name: Repoint HA tplink entries at the IoT VLAN
+  hosts: home.debyl.io
+  gather_facts: false
+  become: true
+  become_user: podman
+  vars:
+    hass_storage: /home/podman/.local/share/volumes/hass/config/.storage
+    hass_entries: "{{ hass_storage }}/core.config_entries"
+  tasks:
+    - name: Get podman uid for systemctl --user
+      ansible.builtin.command: id -u
+      register: podman_uid
+      changed_when: false
+
+    - name: Dry run - all 9 tplink entries must match before HA is stopped
+      ansible.builtin.script:
+        cmd: files/hass_tplink_rehost.py
+        executable: python3
+      register: dry_run
+      changed_when: false
+      failed_when: "'matched 9 of 9' not in dry_run.stdout"
+
+    - name: Show dry run
+      ansible.builtin.debug:
+        var: dry_run.stdout_lines
+
+    - name: Back up core.config_entries
+      ansible.builtin.copy:
+        src: "{{ hass_entries }}"
+        dest: "{{ hass_entries }}.bak-iot-vlan-20261001"
+        remote_src: true
+        mode: preserve
+        force: false
+
+    - name: Stop HA, rewrite hosts, start HA
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ podman_uid.stdout }}"
+      block:
+        - name: Stop hass
+          ansible.builtin.systemd:
+            name: hass.service
+            state: stopped
+            scope: user
+
+        - name: Rewrite tplink hosts
+          ansible.builtin.script:
+            cmd: files/hass_tplink_rehost.py apply
+            executable: python3
+          register: applied
+
+        - name: Show result
+          ansible.builtin.debug:
+            var: applied.stdout_lines
+      always:
+        - name: Start hass
+          ansible.builtin.systemd:
+            name: hass.service
+            state: started
+            scope: user