cluster config moves to a PRIVATE repo (the recipe repo is public)

The public recipes repo must not carry [[clusters]] (private node IPs,
host keys, HA entity names). It now carries only recipes/ + docker-images/.
The cluster config lives in a private sm121/cluster-config repo, fetched
by the add-on entrypoint at boot (sm121_base_config + token options) and
used as the base config — a private repo may carry [home_assistant] /
[mikrotik]. Docs follow (AGENTS.md, add-on README, spec addendum).

AGENTS.md

@@ -802,9 +802,14 @@ config from the add-on options (env), drops the SSH key (base64 option),
 token is required) with a background re-sync loop
 (`SM121_REPO_RESYNC_MINUTES`). Its `custom_components/` custom-integration
 prototype is superseded (entities are a phase-2 nicety over the add-on's
-REST API). Per-install credentials that can't be flat options (e.g. a
-`[mikrotik]` block with its password) go in the `sm121_config_extra`
-option — raw TOML appended to the generated config, kept out of the log.
+REST API). The cluster definitions (private IPs — never in the public
+recipe repo) come from a **private** `sm121/cluster-config` git repo,
+fetched at boot via the `sm121_base_config` (+ `sm121_base_config_token`)
+options and used as the base config (it may carry `[home_assistant]` /
+`[mikrotik]` — a private repo can hold cluster-side secrets). Per-install
+credentials that can't be flat options (e.g. a `[mikrotik]` block with its
+password) can also go in the `sm121_config_extra` option — raw TOML
+appended to the generated config, kept out of the log.
 
 **Single-launcher rule** — the per-recipe run ledger (`.lock` in the
 recipe repo) is the serialization point: a second launcher that serves

specs/tech-architecture/ha-addon-recipe-repos.md

@@ -225,3 +225,15 @@ First boot is a full release build (minutes on a Pi 5, longer on a Pi 4;
 Supersedes the original multi-stage (binary baked in) image for the
 add-on flow; the smoke test compiles hermetically from a `file://`
 launcher checkout.
+
+## Addendum (2026-10-11, 2nd): the cluster config moves to a PRIVATE repo
+
+The recipe repo is **public** — so it must not carry the cluster
+config (`[[clusters]]` with private node IPs / host keys / HA entity
+names). It lives in a **private** `sm121/cluster-config` git repo,
+fetched by the entrypoint at boot (`sm121_base_config` URL +
+`sm121_base_config_token` Gitea PAT, token embedded in the clone URL and
+never logged) and used as the base config. Being private, that repo may
+carry the cluster-side secrets (`[home_assistant]` token,
+`[mikrotik]` password). The public recipe repo carries only
+`recipes/` + `docker-images/`.