homepage: read HA token from env var; stop committing it in plaintext

services.yaml now references key: "{{HOMEPAGE_VAR_HASS_TOKEN}}" instead of
the inline long-lived HA JWT (which was exposed in this public-fronted repo
and has been rotated + revoked). Secret now lives only in observability/.env
(untracked, mode 600). Add .gitignore for .env/secrets so this can't recur.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,13 @@
+# Secrets / credentials — never commit
+.env
+.env.*
+*.env
+secrets.yaml
+secrets.yml
+secrets.*.yaml
+*.key
+*.pem
+*.crt
+credentials
+*credentials*
+*.secret

ha/automations.yaml

@@ -78,3 +78,29 @@
         See RB-001 in runbooks/phase5-incident-log.md for recovery steps.
       priority: high
       tags: warning,house
+
+- id: frigate_disk_guard_stop
+  alias: Frigate Disk Guard – Stop Frigate when media partition low
+  description: >-
+    Universal low-space safety net. If the HAOS /media (sda8) partition free
+    space drops below threshold, stop the Frigate add-on so it can't fill the
+    system partition and take Core down. Fires regardless of VAULT1 CIFS state
+    (the mount sensor can be stale during exactly this crisis).
+  triggers:
+  - platform: numeric_state
+    entity_id: sensor.haos_media_partition_free
+    below: 50            # GB free — tune to taste
+    for: "00:02:00"
+  actions:
+  - action: hassio.addon_stop
+    data:
+      addon: ccab4aaf_frigate-fa     # confirm slug: Settings → Add-ons → Frigate → URL
+  - action: rest_command.ntfy_grafana_alerts
+    data:
+      title: "Frigate STOPPED – HAOS media partition low"
+      message: >-
+        Only {{ states('sensor.haos_media_partition_free') }} GB free on /media
+        (sda8). Frigate add-on stopped to protect the system partition. Check
+        whether VAULT1 CIFS dropped (RB-001), clear space, then restart Frigate.
+      priority: max
+      tags: rotating_light,house

ha/configuration.yaml

@@ -24,6 +24,17 @@ command_line:
       scan_interval: 300
       payload_on: "1"
       payload_off: "0"
+  - sensor:
+      name: "HAOS Media Partition Free"
+      unique_id: haos_media_partition_free
+      # df of /media reports the DATA partition (sda8) that fills when VAULT1
+      # CIFS falls through. When CIFS is healthy this reads sda8 free (~1.x TB),
+      # NOT the 3.6T CIFS share — that's your post-reload sanity check.
+      command: "df -P -k /media | awk 'NR==2{printf \"%.1f\", $4/1048576}'"
+      unit_of_measurement: "GB"
+      state_class: measurement
+      scan_interval: 300
+      value_template: "{{ value | float(0) }}"
 
 rest_command:
   ntfy_grafana_alerts:

homepage/services.yaml

@@ -200,7 +200,7 @@
         widget:
           type: homeassistant
           url: http://192.168.99.100:8123
-          key: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiI1MmRhODYzMzFkMDI0NzhiODcxYzhjYjE4MGNhMWEwMCIsImlhdCI6MTc3MDYwODA3MCwiZXhwIjoyMDg1OTY4MDcwfQ.Nwq2auBILpZXsZI1g7mbE8JIBa5XrUwo599oEVCp2QQ
+          key: "{{HOMEPAGE_VAR_HASS_TOKEN}}"
           fields: ["sensor.processor_use", "binary_sensor.update_available"]
 
 - Cloud & Storage: