From b964bc540fc3aaa8223a634ae229b9f6b651205d Mon Sep 17 00:00:00 2001
From: tschottd <t.schottdorf@gmail.com>
Date: Tue, 19 May 2026 01:31:58 +0200
Subject: [PATCH] chore(esphome): parameterize OTA password (preserve current
 default)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Promote the hardcoded `password: "apolloautomation"` literal to a
`${ota_password}` substitution in `Core.yaml`, defaulting to the same value
so existing consumers see no behavior change. Consumers who want a
per-device password can override via `substitutions:` in their device YAML
and stop sharing a fleet-wide credential.

Why
----
Every AIR-1 worldwide currently boots with the same OTA password (introduced
in #34, "Fix ota password", to make OTA upgrades work after the prior
no-password attempts in #20 / #27). Consumers who include this file via
`packages:` cannot override from their device YAML because ESPHome packages
extend list-valued keys (a second `ota: - platform: esphome` block produces
a duplicate-platform validation error) and `ota: !remove` cannot be paired
with a top-level redeclaration in the same YAML doc. Newer Apollo product
configs (MSR-2, MTR-1, PWR-1, TEMP-1, PLT-1, BTN-1, RLY-1, H-1, H-2, PUMP-1)
already avoid the literal — this brings AIR-1 in line.

Backwards compat
----------------
100% — devices that don't set `ota_password` get `apolloautomation` exactly
as today. CI / firmware builds unchanged.

Override example (in a consumer device YAML):

    substitutions:
      ota_password: !secret living_room_air_1_ota_password

    packages:
      ApolloAutomation.AIR-1: github://ApolloAutomation/AIR-1/Integrations/ESPHome/AIR-1.yaml
---
 Integrations/ESPHome/AIR-1.yaml     | 2 +-
 Integrations/ESPHome/AIR-1_BLE.yaml | 2 +-
 Integrations/ESPHome/Core.yaml      | 4 ++++
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/Integrations/ESPHome/AIR-1.yaml b/Integrations/ESPHome/AIR-1.yaml
index 60ffefa..454b4ce 100644
--- a/Integrations/ESPHome/AIR-1.yaml
+++ b/Integrations/ESPHome/AIR-1.yaml
@@ -37,7 +37,7 @@ logger:
 ota:
   - platform: esphome
     id: ota_esphome
-    password: "apolloautomation"
+    password: ${ota_password}
 
 wifi:
   ap:
diff --git a/Integrations/ESPHome/AIR-1_BLE.yaml b/Integrations/ESPHome/AIR-1_BLE.yaml
index 5ec6d3c..424fd2f 100644
--- a/Integrations/ESPHome/AIR-1_BLE.yaml
+++ b/Integrations/ESPHome/AIR-1_BLE.yaml
@@ -33,7 +33,7 @@ dashboard_import:
 
 ota:
   - platform: esphome
-    password: "apolloautomation"
+    password: ${ota_password}
     id: ota_esphome
 
 bluetooth_proxy:
diff --git a/Integrations/ESPHome/Core.yaml b/Integrations/ESPHome/Core.yaml
index 64a2eba..721a5da 100644
--- a/Integrations/ESPHome/Core.yaml
+++ b/Integrations/ESPHome/Core.yaml
@@ -2,6 +2,10 @@ substitutions:
   name: apollo-air-1
   version: "26.3.2.1"
   device_description: ${name} made by Apollo Automation - version ${version}.
+  # Default OTA password. Override in your device YAML by re-declaring
+  # `substitutions: { ota_password: !secret <name>_ota_password }` so each
+  # device on your network uses a unique secret instead of the shared default.
+  ota_password: "apolloautomation"
 
 esp32:
   variant: esp32c3