So i just started with HA (Hassbian on RPi). Got nearly everthing working: zones, IOS app, Known-devices etc etc.
The problem is i want to make it so that for example lights get triggerd by people leaving or coming home.
I have the HA IOS app and NMAP working, im using consider_home to prevent Nmap changing my status to not home.
Is there a way to track my phone without exposing my Pi + HA to the internet? I dont want to change or control stuff when im on the go. Ill do that when i get back home.
I also dont want a cloudservice were my data is stored on a server somewere.
I use owntracks -> mosquitto MQTT broker. I run 2 instances of mosquitto, one open (internal only) and 1 locked down (external) and they have a bridge connecting the external one to the internal one. Owntracks publishes to the external moquitto which forwards to the internal one. The external mosquitto requires a security certificate which must be put on the phone by hand so itâs pretty good security wise and not that hard to set up.
NO
MQTT you may use external server. In this configuration open Port not needed.
You can use your own AWS instance or something OR I think there are some brokers available for free
@VGE Yes - thatâs how I did it. There is a port forward, but I have it set at a very high port number so most of the dump scanners never ping it. That forwards to the secure mosquitto broker. I found instructions on the web for generating the certificate files, set up two different mosquitto config files and .service files (to start automatically). Owntracks docs have some of that info but not all. If you want to proceed down that path, let me know and Iâll post a detailed write up somewhere (I have some notes, but nothing you could follow). The cert instructions can be found here and the owntracks instructions are here. There is already an HA write up here.
Awesome! Something i dont get but maby you know the awnser: When i open a port do i expose all of the Rasberry to the web or is it just the component mosquitto?
The only caveat is that there are no vulnerabilities in the âweb frontendâ that they can exploit. This is rare, and not a very likely scenario, but know that it is possible to exist at some point.
If you are forwarding a port (letâs say port 8123) to your pi, and your Home Assistant is listening on 8123, the only thing they will see is the service on port 8123. They cannot see SSH on that port, because that port is not listening for SSH connections.
Exactly so if im running an older version or a newer version that has a unknown (know to the badguy) exploit, he could acces my HA and from there could enter my pi -> netwerk etc etc.
Zo why woud someone use a service like Mosquitto instead of the HA ios app? Or why would you use 2 mosquitto servers like the example above?
Just so that if the 1e mosquitto server gets compromised you stil need to go trough a second one?
well, not everyone uses or likes iOS. I have all Android devices, so the iOS app is worthless to me.
2 MQTT servers would be used so that ONE of them is public facing, and there is a bridge to your internal. On your internal network, on YOUR firewall, you would basically only allow MQTT traffic from your external MQTT server to your internal MQTT server. You would never have to technically open a port to the world.
Not really. You most likely arenât going to get anywhere from the public mqtt server. Thatâs not really how it works.
Itâs not âmovie hackingâ - both servers are on the same machine so you donât go through one to get to the other. The reason to have 2 mosquitto processes running is that the external one is locked down and requires login and a certificate before it will allow any connection. The internal one is open and allows anyone to connect which makes everything much simpler to configure and use internally. Itâs unlikely someone can âhackâ a certificate protected mosquitto server and most likely if there is some flaw, they could read your location and thatâs it (i.e. subscribe to your messages). Itâs also the minimum you need to expose to the internet to get the job done which is always the best policy.
I have all Android devices, so the iOS app is worthless to me.