Add frame orchestrator

The previously-committed api encryption key must be rotated separately
and history scrubbed before publishing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -1 +1,5 @@
 secrets.yaml
+.esphome/
+__pycache__/
+*.pyc
+.DS_Store

frame-orchestrator.yaml

@@ -12,7 +12,7 @@ esp32:
     type: esp-idf
 
 dashboard_import:
-  package_import_url: https://git.zyberze.ro/zyberzero/esphome-devices/frame-orchestrator.yaml
+  package_import_url: "https://git.zyberze.ro/zyberzero/esphome-devices/frame-orchestrator.yaml@latest"
 
 external_components:
   - source:
@@ -37,7 +37,7 @@ logger:
 # Enable Home Assistant API
 api:
   encryption:
-    key: "Bitn3nScV6HNWChhDE0yqLXqzYgnjM9eAMYXKRi1uL0="
+    key: !secret api_encryption_key
 
 ota:
   - platform: esphome
@@ -46,16 +46,17 @@ ota:
 wifi:
   ssid: !secret wifi_ssid
   password: !secret wifi_password
+  use_address: frame-proxy.local
 
   # Enable fallback hotspot (captive portal) in case wifi connection fails
   ap:
     ssid: "Frame-Proxy Fallback Hotspot"
-    password: "ZWMxIQbFcCPV"
+    password: !secret ap_fallback_password
 
 captive_portal:
 mqtt:
   id: mqtt_client
-  broker: 172.16.4.22
+  broker: !secret mqtt_broker
   username: !secret mqtt_username
   password: !secret mqtt_password
   on_connect:

secrets.yaml.example

@@ -0,0 +1,39 @@
+# Copy this file to secrets.yaml and fill in your own values.
+# secrets.yaml is gitignored.
+
+# WiFi credentials
+wifi_ssid: "your-wifi-ssid"
+wifi_password: "your-wifi-password"
+
+# Static IP for the frame device — avoids DHCP delay on every refresh.
+static_ip: "192.168.1.249"
+gateway:   "192.168.1.1"
+subnet:    "255.255.255.0"
+dns1:      "192.168.1.1"
+
+# 10-byte (20 hex chars, no separators) prefix of the iBeacon UUID.
+# The full 16-byte UUID a frame device responds to is:
+#   <prefix><6-byte WiFi STA MAC of that device>.
+# Pick a random value — anyone who can BLE-sniff your home can read this
+# from the air, so don't reuse it as a credential elsewhere.
+ble_uuid_prefix: "00000000000000000000"
+
+# Image source prefix. Full URL fetched per refresh is:
+#   {image_url_prefix}/{wifi_sta_mac_lowercase_no_separators}.png
+image_url_prefix: "http://your-image-host.example/i"
+
+# MQTT broker the frame-orchestrator connects to.
+mqtt_broker: "192.168.1.10"
+mqtt_username: "your-mqtt-user"
+mqtt_password: "your-mqtt-password"
+
+# Frame-orchestrator AP fallback hotspot password (used if WiFi is unreachable).
+# 8+ chars.
+ap_fallback_password: "change-me-8-or-more"
+
+# ESPHome native API encryption key (32 bytes, base64).
+# Generate with: openssl rand -base64 32
+# (or use the "Generate" button in the ESPHome dashboard).
+# After changing, reconfigure the Home Assistant ESPHome integration
+# with the new value or the device will go unavailable.
+api_encryption_key: "REPLACE_WITH_BASE64_32_BYTE_KEY"