Some Alexa Questions

Configuration
1

First of all I run Home Assistant behind a pfSense firewall. To control HA from a remote location I VPN into my network which works great.

I picked up an Echo Dot and thought it might be fun to add Alexa functions to Home Assistant however best I can tell I need to expose the Home Assistant Raspberry Pi port (8123) to the internet. Is that a correct assumption?

I’m working through the config and am stumped at Domain List, Scope, and Privacy Policy URL on the developer page. Can’t get a green check mark there and pretty sure I have to be internet facing. Not sure I want to do that.

Any and all help appreciated.

2

I am facing the same dilemma. In order to have custom skills for Alexa, I need to open up my HA to the Internet. Without this, it will not work and I cannot any other way around this. I would love to know as well if there is any way to create custom skills for Alexa without exposing my HA to the Internet.

3

It’s a deal breaker for me at least at the moment. I’m dabbling around with various ESP8266 outlets, GE Switches, and wifi bulbs, not to mention multiple other IoT ESP8266 devices. I just don’t want to be internet facing. I’m on my primary network for now while I’m configuring all this and then I have to migrate over to my “guest” network.

I think I can have on and off functions with the emulated hue but not 100% sure about that. That will have to do for now. I’m not going internet facing.

4

It’s simply not possible for a custom skill to be available without being open to the internet because the AVS (Amazon Voice Service) needs to interpret what has been said and call the webhook. You could possibly create a proxy device which is open to the internet in your network tho. This way only this device would be “open” to the internet with port forwarding.

~Cheers

1 Like
5

No point in getting Alexa if you don’t want anything to face the internet. All you can do is turn on and off lights (unless that’s all you want). I’m not even sure if that will work if the echo isn’t connected to the internet.

With emulated hue you can control the thermostat as well as lights over your network, but I still think the echo needs internet connection.

6

I could be wrong but i think Alexa skills need to connect over HTTPS (port 443). You would need to port foward 443 on your router to HASS-IP:8123 on your LAN.

As long as you are password protected on your front end i dont see any worry to expose port 443 to the internet.

1 Like
7

This is correct, at least if you’re using Home Assistant as the web service for your own custom skill. Amazon says in their requirements for hosting a service that “The service must accept requests on port 443.” When you put in the URL for Alexa to contact, you cannot get around the port restriction by using https://example.com:8123. You need to use https://example.com (which will default to port 443 because it’s https), and then your router needs to forward port 443 requests to port 8123 on your Pi.

I don’t know what the restrictions are if you are only emulating a Hue Bridge. In that case you aren’t hosting a web service for a skill (you’re just controlling a device), so you might have more flexibility with ports. Amazon still needs some way to send commands from the internet to your Pi, though…

8

This! Nothing runs locally except the echo and HA.

The actual intent and things doing the work for the echo run on Amazon servers and needs to be able to talk to your HA instance, hence it has to be open to the internet.

But as others have said, a strong password with SSL and there isn’t much to worry about.

9

I cannot enable SSL in my HA. If I do that, my Google TTS via VLC media player will not work. I know this is different topic but somehow related.

10

If you cannot enable SSL, then unfortunately you cannot use custom Alexa intents, regardless of the internet facing dilemma.

Amazon specify that custom intents must be hosted over https on a standard https port.

1 Like
11

Are you sure that is the case? I’ve enabled SSL on HA, and in order to use google tts I simply had to add a base url to my http section of configuration.yaml per the note on this page.

12

May I know what kind of certificate are you using? FYI, I am using self-signed certificate.

13

I went with the DuckDNS / Let’s Encrypt approach listed in the getting started documentation, although I followed those steps as detailed by @darklyte 's awesome guide. Guide: How to set up DuckDNS, SSL, and Chrome Push Notifications

1 Like
14

As far as I can see for both Alexa and google home api.ai the requested address is to /api so I’d suggest that you run home assistant on 8123 and expose to the internet an apache or nginx on port 443 which redirects locally to http://localhost:8123/api/…

This will expose only the api and not the management interface.

I haven’t tried this yet but let me know what you thing.

Theo

2 Likes
15

Thanks. I believe Google TTS doesn’t work only on self-signed certificate. All external certificate with CA will work fine. Anyway, Im using Let’s Encrypt now.

Back to the topic. I still uncomfortable using Alexa custom skill because I have to write in my http component password.

16

I can understand that and I only see one way to prevent that…that is adding AWS IPs to your whitelist network. You can figure out the IPs AWS is using via this: http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html although this opens your HA up for all aws services. So this is actually imho a lot unsecurer than just entering your password there were only Amazon can see it.

Also to note: Your HTTP password will never be visible to anyone else except you and amazon. If you are using SSL the URL parameters are encrypted as well.

~Cheers

1 Like
17

Yeah. The problem is now whoever has my Amazon password will have access to my home and it is not uncommon for big corporations to lose their users passwords.

18

I personly don’t have a problem with that but I can see your concern. The only possible solutions for you I can see is using the hue_bridge which iirc operates locally but only works with original Echo devices, waiting for third party software echos to implement hue compatibilty or host your own local speech recognition service.

~Cheers

1 Like
19

Can you please explain on how to expose HA 8123 to the internet an apache or nginx on port 443 which redirects locally to http://localhost:8123/api/…

20

@PhyberApex I am running pfsense firewall and thanks to your reference link, have created an alias AWS_us_east_1 by importing the list of IPv4 address ranges from Get-AWSPublicIpAddressRange -region us-east-1 | where {$_.IpAddressFormat -eq "Ipv4"} | select IpPrefix and the Alexa Custom Skill can now access my HA devices and Alexa Actionable Notifications also works.
Thank you!