moovy2 · pull · Jul 15, 2026 · Jul 15, 2026 · Jul 15, 2026
diff --git a/matter_server/CHANGELOG.md b/matter_server/CHANGELOG.md
@@ -1,8 +1,18 @@
 # Changelog
 
-## 9.0.4
+## 9.1.0
 
 - **⚠️ When upgrading from 8.x, please also consider the release notes for 9.0.0.**
+- Update [Matter Server from 1.1.7 to 1.2.6](https://github.com/matter-js/matterjs-server/blob/main/CHANGELOG.md)
+  - Supports Matter 1.6.0
+  - Synchronize Time to devices that support this
+  - Experimental Support for Battery Saving mode of ICD devices
+  - Many Optimizations and Fixes
+- Add `time_sync` option (`auto`/`on`/`off`, default `auto`) to push the current time to Matter devices via the Matter Server's `--enable-time-sync` flag. `auto` enables time sync only when the host clock is NTP synchronized; `on` always enables it (with a warning if NTP is not synchronized); `off` disables it.
+- Add `default_fabric_label` option to pin the fabric label via the Matter Server's `--default-fabric-label` flag. When set, changing the label via the WebSocket API is blocked.
+
+## 9.0.4
+
 - Update [Matter Server from 1.1.2 to 1.1.7](https://github.com/matter-js/matterjs-server/blob/main/CHANGELOG.md#117-2026-07-01) to address reported issues and optimize RAM and CPU usage (a lot)
 
 ## 9.0.3

diff --git a/matter_server/DOCS.md b/matter_server/DOCS.md
@@ -53,6 +53,8 @@ App configuration:
 | log_level            | Logging level of the Matter Server component.                                                           |
 | beta                 | Install the latest `matter-server` from npm on startup instead of the bundled version. On failure a warning is logged and the bundled version is started. |
 | enable_test_net_dcl  | Enable test-net DCL for PAA root certificates, OTA updates and other device information.                |
+| time_sync            | Whether the Matter Server pushes the current time to Matter devices: `auto` (default; on only when the host clock is NTP synchronized), `on` (always; warns if NTP is not synchronized), or `off`. |
+| default_fabric_label | Pin the fabric label (shown on Matter devices, max 32 characters) to this value. By default the Home Assistant home name is used. This is useful if the Matter Server is used from multiple Home Assistant instances, which otherwise each keep pushing their own home name as the label. When set, changing the label via the WebSocket API is blocked. |
 | ble_proxy            | Expose the BLE proxy endpoint so the Home Assistant Matter integration can drive BLE commissioning through Home Assistant's bluetooth stack. Mutually exclusive with `bluetooth_adapter_id`. |
 | bluetooth_adapter_id | **Deprecated** — use `ble_proxy` instead. Set BlueZ Bluetooth Controller ID (for local commissioning). Still works for now. |
 | matter_server_args   | Extra command-line arguments passed to the Matter Server at startup (advanced).                         |

diff --git a/matter_server/build.yaml b/matter_server/build.yaml
@@ -1,7 +1,7 @@
 ---
 build_from:
-  aarch64: ghcr.io/matter-js/matterjs-server:1.1.7
-  amd64: ghcr.io/matter-js/matterjs-server:1.1.7
+  aarch64: ghcr.io/matter-js/matterjs-server:1.2.6
+  amd64: ghcr.io/matter-js/matterjs-server:1.2.6
 args:
   BASHIO_VERSION: 0.17.1
   TEMPIO_VERSION: 2024.11.2

diff --git a/matter_server/config.yaml b/matter_server/config.yaml
@@ -1,5 +1,5 @@
 ---
-version: 9.0.4
+version: 9.1.0
 breaking_versions: [9.0.0]
 slug: matter_server
 name: Matter Server
@@ -28,10 +28,13 @@ options:
   log_level: info
   beta: false
   enable_test_net_dcl: false
+  time_sync: auto
 schema:
   log_level: list(debug|info|notice|warn|error|fatal|verbose|warning|critical)
   beta: bool?
   enable_test_net_dcl: bool?
+  time_sync: list(auto|on|off)
+  default_fabric_label: match(^.{1,32}$)?
   ble_proxy: bool?
   bluetooth_adapter_id: int?
   matter_server_args:

diff --git a/matter_server/rootfs/etc/s6-overlay/s6-rc.d/matter-server/run b/matter_server/rootfs/etc/s6-overlay/s6-rc.d/matter-server/run
@@ -131,6 +131,44 @@ if bashio::config.true "enable_test_net_dcl"; then
     extra_args+=('--ota-provider-dir' "/config/updates")
 fi
 
+# Resolve whether to enable time sync for nodes with the TimeSynchronization
+# cluster. The 'time_sync' option has three modes:
+#   - on:   always enable (warn if the host clock is not NTP synchronized)
+#   - off:  always leave disabled
+#   - auto: enable only when the host clock is NTP synchronized (default)
+time_sync_mode="$(bashio::string.lower "$(bashio::config 'time_sync' 'auto')")"
+ntp_synchronized="$(bashio::api.supervisor 'GET' '/host/info' '' '.dt_synchronized')"
+time_sync_enabled=false
+
+case "${time_sync_mode}" in
+  on)
+    time_sync_enabled=true
+    if [ "${ntp_synchronized}" != "true" ]; then
+        bashio::log.warning \
+          "Time sync is enabled but host NTP is not synchronized — time pushed to Matter devices may be inaccurate"
+    fi
+    ;;
+  off)
+    bashio::log.info "Time sync is disabled ('time_sync' set to off)."
+    ;;
+  *)
+    if [ "${ntp_synchronized}" = "true" ]; then
+        time_sync_enabled=true
+        bashio::log.info "Time sync 'auto': host NTP is synchronized, enabling time sync."
+    else
+        bashio::log.info "Time sync 'auto': host NTP is not synchronized, leaving time sync disabled."
+    fi
+    ;;
+esac
+
+if [ "${time_sync_enabled}" = "true" ]; then
+    extra_args+=('--enable-time-sync')
+fi
+
+if bashio::config.has_value "default_fabric_label"; then
+    extra_args+=('--default-fabric-label' "$(bashio::config 'default_fabric_label')")
+fi
+
 primary_interface="$(bashio::api.supervisor 'GET' '/network/info' '' 'first(.interfaces[] | select (.primary == true)) .interface')"
 
 # Try fallback method (e.g. in case NetworkManager is not available)
@@ -168,15 +206,14 @@ bashio::log.info "Using '${primary_interface}' as primary network interface."
 # shellcheck disable=SC2164
 cd /root
 
-# shellcheck disable=SC2206
 matter_server_args+=(
   '--storage-path' "/data"
   '--port' "${server_port}"
   '--log-level' "${log_level}"
   '--primary-interface' "${primary_interface}"
   '--fabricid' 2
   '--vendorid' 4939
-  ${extra_args[@]}
+  "${extra_args[@]}"
 )
 
 exec node --enable-source-maps "${server_entry}" "${matter_server_args[@]}"
diff --git a/matter_server/translations/en.yaml b/matter_server/translations/en.yaml
@@ -15,6 +15,23 @@ configuration:
       Enable PAA root certificates, software updates and other device
       information from test-net DCL. This is meant for development and testing
       purposes.
+  time_sync:
+    name: Time synchronization
+    description: >-
+      Control whether the Matter Server pushes the current time to Matter
+      devices. "auto" (default) enables it only when the host clock is NTP
+      synchronized; "on" always enables it (a warning is logged if the host
+      clock is not NTP synchronized, since the time sent to devices is only as
+      accurate as the host clock); "off" disables it.
+  default_fabric_label:
+    name: Default Fabric Label
+    description: >-
+      Pin the fabric label (shown on Matter devices for this controller, max
+      32 characters) to this value. By default the Home Assistant home name is
+      used. This is useful if the Matter Server is used from multiple Home
+      Assistant instances, which otherwise each keep pushing their own home
+      name as the label. When set, changing the label via the WebSocket API is
+      blocked.
   bluetooth_adapter_id:
     name: Bluetooth Adapter ID (deprecated)
     description: >-

diff --git a/samba/CHANGELOG.md b/samba/CHANGELOG.md
@@ -1,5 +1,8 @@
 # Changelog
 
+## 12.8.0
+- Add configuration option to disable NetBIOS. When disabled, the nmbd service is not started and only port 445 is allowed (port 139 is blocked.)
+
 ## 12.7.1
 
 - Enabled kernel oplocks in smb.conf to ensure changes made to files on disk are available immediately via SMBD. This covers all shares except backup, and media as the contents shouldn't be changed by the server once they're written in those shares.

diff --git a/samba/DOCS.md b/samba/DOCS.md
@@ -35,10 +35,9 @@ Directory | Description
 App configuration:
 
 ```yaml
-workgroup: WORKGROUP
-local_master: true
 username: homeassistant
 password: YOUR_PASSWORD
+workgroup: WORKGROUP
 enabled_shares:
   - addons
   - addon_configs
@@ -47,28 +46,26 @@ enabled_shares:
   - media
   - share
   - ssl
+compatibility_mode: false
+apple_compatibility_mode: true
+netbios: true
+local_master: true
+server_signing: "default"
+veto_files:
+  - ._*
+  - .DS_Store
+  - Thumbs.db
+  - icon?
+  - .Trashes
 allow_hosts:
   - 10.0.0.0/8
   - 172.16.0.0/12
   - 192.168.0.0/16
   - 169.254.0.0/16
   - fe80::/10
   - fc00::/7
-veto_files:
-  - "._*"
-  - ".DS_Store"
-  - Thumbs.db
-compatibility_mode: false
 ```
 
-### Option: `workgroup` (required)
-
-Change WORKGROUP to reflect your network needs.
-
-### Option: `local_master` (required)
-
-Enable to try and become a local master browser on a subnet.
-
 ### Option: `username` (required)
 
 The username you would like to use to authenticate with the Samba server.
@@ -77,6 +74,10 @@ The username you would like to use to authenticate with the Samba server.
 
 The password that goes with the username configured for authentication.
 
+### Option: `workgroup` (required)
+
+Change WORKGROUP to reflect your network needs.
+
 ### Option: `enabled_shares` (required)
 
 List of Samba shares that will be accessible. Any shares removed or commented out of the list will not be accessible.
@@ -107,6 +108,19 @@ This can cause issues with file systems that do not support xattr such as exFAT.
 
 Defaults to `true`.
 
+### Option: `netbios`
+
+NetBIOS is a legacy network protocol for accessing SMB/CIFS shares. Enable for legacy clients older than Windows Vista (Windows 95/98/ME, Windows NT,
+Windows 2000, Windows XP and LanManager), or OS X 10.9 (Mavericks). This setting is enabled by default for compatibility; disable it on modern installations.
+
+Defaults to `true`.
+
+### Option: `local_master`
+
+When NetBIOS is enabled, try and become a local master browser on a subnet.
+
+Defaults to `true`.
+
 ### Option: `server_signing`
 
 Configure the SMB server signing requirement. This option can improve security by requiring message signing, which helps prevent man-in-the-middle attacks.

diff --git a/samba/Dockerfile b/samba/Dockerfile
@@ -19,3 +19,6 @@ COPY rootfs /
 
 HEALTHCHECK --start-period=3s \
     CMD smbclient -L '\\localhost' -U '%' -m SMB3
+
+ENV \
+    S6_STAGE2_HOOK=/etc/s6-overlay/scripts/enable-check.sh
diff --git a/samba/config.yaml b/samba/config.yaml
@@ -1,5 +1,5 @@
 ---
-version: 12.7.1
+version: 12.8.0
 slug: samba
 name: Samba share
 description: Expose Home Assistant folders with SMB/CIFS
@@ -23,7 +23,6 @@ options:
   username: homeassistant
   password: null
   workgroup: WORKGROUP
-  local_master: true
   enabled_shares:
     - addons
     - addon_configs
@@ -34,6 +33,8 @@ options:
     - ssl
   compatibility_mode: false
   apple_compatibility_mode: true
+  netbios: true
+  local_master: true
   server_signing: "default"
   veto_files:
     - ._*
@@ -52,11 +53,12 @@ schema:
   username: str
   password: password
   workgroup: str
-  local_master: bool
   enabled_shares:
     - "match(^(?i:(addons|addon_configs|backup|config|media|share|ssl))$)"
   compatibility_mode: bool
   apple_compatibility_mode: bool
+  netbios: bool
+  local_master: bool
   server_signing: list(default|auto|mandatory|disabled)
   veto_files:
     - str

diff --git a/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh b/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh
@@ -0,0 +1,12 @@
+#!/command/with-contenv bashio
+# shellcheck shell=bash
+# ==============================================================================
+# Enable/disable nmbd service per config
+# ==============================================================================
+if bashio::config.true 'netbios'; then
+    touch /etc/s6-overlay/s6-rc.d/user/contents.d/nmbd
+    bashio::log.info "Service nmbd enabled"
+else
+    rm -f /etc/s6-overlay/s6-rc.d/user/contents.d/nmbd
+    bashio::log.info "Service nmbd disabled"
+fi
diff --git a/samba/rootfs/usr/share/tempio/smb.gtpl b/samba/rootfs/usr/share/tempio/smb.gtpl
@@ -32,6 +32,10 @@
    vfs objects = catia fruit streams_xattr
    {{ end }}
 
+   {{ if not .netbios }}
+   smb ports = 445
+   {{ end }}
+
    server signing = {{ .server_signing }}
 
    kernel oplocks = yes

diff --git a/samba/translations/en.yaml b/samba/translations/en.yaml
@@ -11,9 +11,6 @@ configuration:
   workgroup:
     name: Workgroup
     description: Change WORKGROUP to reflect your network needs.
-  local_master:
-    name: Local master
-    description: Enable to try and become a local master browser on a subnet.
   enabled_shares:
     name: >-
       Enabled Shares - allowed values are:
@@ -33,6 +30,17 @@ configuration:
       Enable Samba configurations to improve interoperability with Apple
       devices. May cause issues with file systems that do not support xattr
       such as exFAT.
+  netbios:
+    name: Enable NetBIOS over IP
+    description: >-
+      Enable NetBIOS over IP for legacy SMB clients (Windows 95/98/ME, Windows
+      NT, Windows 2000, Windows XP and LanManager clients). Disable to improve
+      security and performance if you do not have legacy SMB clients.
+  local_master:
+    name: Local master
+    description: >-
+      When NetBIOS is enabled, try and become a local master browser on a
+      subnet.
   server_signing:
     name: Server signing
     description: >-