From 46cf3b1fe84845485594155015c19dd6a8ac46b7 Mon Sep 17 00:00:00 2001 From: Roman Priesol Date: Wed, 30 Sep 2026 12:05:39 +0200 Subject: [PATCH] OTA: require encryption with the api key, plaintext + password only for migration allow_plaintext_upload lets the uploader give a device that doesn't encrypt yet its one migration install. Remove it together with the password once every device has been updated (the uploader says so). --- common/ota.yaml | 4 ++++ common/ota_esp32.yaml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/common/ota.yaml b/common/ota.yaml index 9b35495..8e04f57 100644 --- a/common/ota.yaml +++ b/common/ota.yaml @@ -2,3 +2,7 @@ ota: - platform: esphome password: !secret ota_password + # migration to encrypted OTA (api key): once every device encrypts, + # remove allow_plaintext_upload together with the password + encryption: + allow_plaintext_upload: true diff --git a/common/ota_esp32.yaml b/common/ota_esp32.yaml index 6b1cbd2..2f0990c 100644 --- a/common/ota_esp32.yaml +++ b/common/ota_esp32.yaml @@ -3,4 +3,8 @@ ota: - platform: esphome id: ota_esphome password: !secret ota_password + # migration to encrypted OTA (api key): once every device encrypts, + # remove allow_plaintext_upload together with the password + encryption: + allow_plaintext_upload: true allow_partition_access: true