Skip to content
hotloopdocs
GitHub

HotLoop core 4.17.0 release notes

Phase 2 of the automation base, UniFi read-only, and device passwords encrypted at rest. Coming from 4.16.0 it’s a plain helm upgrade, but your device passwords get encrypted on the first start, and from then on the key is part of your data. Read “Upgrading from 4.16.0” below before you touch a running plant.

The full notes are in the README: What changed in 4.17.0.

In short

Section titled “In short”
  • The automation base, phase 2. Helpers (the values the plant’s people own, refused and never clamped), the logbook (one timeline of state changes, writes, alarms, runs and config), condition, wait and stop steps and forSec on a state trigger, scripts (write the CIP cycle once, run it from anywhere), recipes (every setpoint for a grade goes out together or none do, read back from the device) and blueprints (a rule written once, filled in per pump, pinned to its version until somebody reviews the upgrade). MCP goes from 16 tools to 25.
  • UniFi Network, read-only. Switches, ports, PoE, WAN and clients as tags, one login per console, the certificate pinned. A quiet PLC’s drawer says which switch port it’s on and whether the link is up, and a stranger on a network marked OT raises an alarm. Proven read-only on real consoles. Not proven yet: a real cable pull on a watched device and a phone joining a network marked OT. Those two alarms are proven in the lab and nowhere else until somebody does both at the rack.
  • Device passwords are encrypted in the database and in backups, with a key the chart generates into <release>-secret-key and keeps.
  • Fixes a 4.16.0 plant can trip over: an Edge Relay from the chart or the Quadlet unit ignored every config push, and one with persistence off didn’t boot; a hand edit in the rule editor reset the rule’s run budget; the command prompt’s verdict could move Set out from under the click; a late update could put the Entities screen back in time; a rule that never ran said it ran 739887 days ago; App Store deploys carried no tenant.

API changes

Section titled “API changes”
  • A time that hasn’t happened is left out, not sent as 0001-01-01T00:00:00Z: lastRun, lastPoll, lastGood, clearedAt, ackedAt, shelvedUntil, raisedAt and the rest, on the live feed too.
  • New routes: /api/helpers, /api/logbook, /api/scripts, /api/recipes, /api/blueprints, POST /api/automations/{id}/blueprint-upgrade, /api/devices/{id}/network, /api/unifi/{id}/... and DELETE /api/fleet/{id}/config. All in docs/API.md.
  • New permissions, and the operator role has them: helpers.write, scripts.run, recipes.apply, blueprints.apply. Writing scripts, recipes and blueprints is admin.
  • Tags carry deviceClass; rules carry blueprintId, blueprintVersion and blueprintInputs.

Upgrading from 4.16.0

Section titled “Upgrading from 4.16.0”
  • helm upgrade <release> hotloop/hotloop --version 4.17.0 --reset-then-reuse-values. Not --reuse-values, which drops the new defaults and fails to render. Selectors and volume claims are unchanged; the only new object is the key’s Secret.
  • Migrations 0009 to 0015 run on start (helpers, logbook, scripts, tag device class, recipes, blueprints, UniFi). All additive. pg_dump first.
  • HOTLOOP_SECRET_KEY_FILE: the chart generates the key on this upgrade, and the Gateway encrypts every stored device password at that start. Without the key afterwards, those devices stay down with an error naming the key. A backup taken after the upgrade restores only with that key, or with --restore-keep-unreadable-credentials, which leaves those devices down until somebody enters the passwords again. Back the Secret up away from your backups. Going back to 4.16.0 means restoring your pre-upgrade dump.
  • Rendering the chart with helm template instead of installing it? Bring your own key in secretKey.existingSecret, or every render makes a new one.
  • Edge Relay: a pushed device file lives at /data/pushed-devices.json and wins over the chart’s devices while it exists; DELETE /api/fleet/{id}/config clears it. A push that failed on 4.16.0 is still retained on the broker and lands at the first 4.17.0 boot. Quadlet users take the new unit. persistence.enabled=false boots now and loses the forward queue, any pushed file and the OPC UA certificate every time the pod is replaced.