Network Security Wiki

HA


Installation

HomeAssist Docker Install

Source: home-assistant.io

  • Installation:
sudo docker run -d \
 --name homeassistant \
 --privileged \
 --restart=unless-stopped \
 -e TZ=Europe/Dublin \
 -v /home/pi/homeassist/config:/config \
 -v /run/dbus:/run/dbus:ro \
 --network=host \
 ghcr.io/home-assistant/home-assistant:stable

Install HACS

sudo docker exec -it homeassistant bash
wget -O - https://get.hacs.xyz | bash -

Portainer

Installation: 

sudo docker pull portainer/portainer-ce:latest
sudo docker run -d -p 9000:9000 --name=portainer --restart=always --privileged -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:latest

Access: 

http://192.168.1.2:9000

Certificates

Manual

Source: readthedocs.ioreadthedocs.io

Install Certbot: 

sudo apt install certbot

Request Certificate: 

sudo certbot certonly -d haos.uk.to


Install Certitficate: 

sudo nano configuration.yaml

http:
 ssl_certificate: /ssl/fullchain.pem
 ssl_key: /ssl/privkey.pem

Nginx Proxy Manager

Install Image: 

sudo docker run -d --name=nginx-proxy-manager --restart=unless-stopped --privileged -e TZ=Europe/Dublin -p 80:80 -p 443:443 -p 81:81 -v /home/pi/letsencrypt:/etc/letsencrypt -v /home/pi/data:/data jc21/nginx-proxy-manager:latest

Access App: 

http://192.168.1.2:81

Default Administrator User
Email:    admin@example.com
Password: changeme

Getting Certificates: 

SSL Certificates > Add SSL Certificate > Let's Encrypt > "Domain Name" > "Email ID" > "I Agree" > Save

Adding Proxy Config for HA: 

Hosts > Proxy Hosts > Add Proxy Host > "Domain Name" > "http" > "Local IP Address:Port" > "Enable WebSockets" > "Publically Accesible" > SSL > Select Certificate > Save

Configuring HA: 

http:
  ip_ban_enabled: true
  login_attempts_threshold: 5
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.17.0.3             # Nginx Proxy Manager - Docker Instance's IP Address

Upgrade Docker Instance

Source: home-assistant.io

  • Backup Config
  • Upgrade Instance:

If this returns Image is up-to-date, you can stop here: 

docker pull ghcr.io/home-assistant/home-assistant:stable

docker stop home-assistant
docker rm home-assistant
Start the Container
  • Regenarate SSH Keys
  • Install HACS


Upgrade using Portainer

Source: home-assistant.io

  • Backup Config
  • Upgrade Instance:
Containers > homeassistant > Container details > Recreate > Select Pull Image option > Recreate

ESPHome

Source: home-assistant.ioesphome.io

Download the Image: 

sudo docker pull ghcr.io/esphome/esphome

Start the Container 

sudo docker run -d --name=esphome --restart=unless-stopped --privileged --net=host -e TZ=Europe/Dublin -v /home/pi/esphome/config:/config esphome/esphome

BitWarden

Source pimylifeup.com 

sudo docker pull vaultwarden/server:latest
sudo docker run -d --name bitwarden \
   --restart=always \
   -v /bw-data/:/data/ \
   -p 127.0.0.1:8080:80 \
   -p 127.0.0.1:3012:3012 \
   vaultwarden/server:latest

Even though we have Bitwarden up and running now, it isn’t possible to use it until we set up HTTPS.

         This section is under construction.

OPNSense

Source: opnsense.org

         This section is under construction.

Calibre Web

Source hub.docker.com 

docker pull linuxserver/calibre-web

docker run -d \
 --name=calibre-web \
 -e PUID=1000 \
 -e PGID=1000 \
 -e TZ=Etc/UTC \
 -e DOCKER_MODS=linuxserver/mods:universal-calibre `#optional` \
 -e OAUTHLIB_RELAX_TOKEN_SCOPE=1 `#optional` \
 -p 8083:8083 \
 -v /path/to/data:/config \
 -v /path/to/calibre/library:/books \
 --restart unless-stopped \
 lscr.io/linuxserver/calibre-web:latest

JellyFin

Source: jellyfin.org

Pull Image: 

docker pull jellyfin/jellyfin

Install: 

docker run -d \
 --name jellyfin \
 --user uid:gid \
 --net=host \
 --volume /path/to/config:/config \ # Alternatively --volume jellyfin-config:/config
 --volume /path/to/cache:/cache \ # Alternatively --volume jellyfin-cache:/cache
 --mount type=bind,source=/path/to/media,target=/media \
 --restart=unless-stopped \
 jellyfin/jellyfin


  • Unlock Account:
sqlite3 /var/lib/jellyfin/data/jellyfin.db
sqlite> UPDATE Users SET InvalidLoginAttemptCount = 0 WHERE Username = 'jellyfin';
sqlite> UPDATE Permissions SET Value = 0 WHERE Kind = 2 AND UserId IN (SELECT Id FROM Users WHERE Username = 'jellyfin');
sqlite> .exit

Notifications

Telegram

####################################################
#                    Telegram                      #
####################################################

# Telegram Bot
telegram_bot:
  - platform: polling
    api_key: "xxxxxxxxx:xxxxxxxxxxxxxxxxxxxxxxxxx"
    allowed_chat_ids:
      - xxxxxxxx     # Rpiwz Personal Chat
      - -xxxxxxxx     # My Family Group Chat

# Notifier
notify:
  - platform: telegram
    name: "mychat"
    chat_id: xxxxxxxxxxx

  - platform: telegram
    name: "mygroup"
    chat_id: -xxxxxxxxx

Sensors

CPU Temperature

####################################################
#                  Command Line                    #
####################################################
# Pi Temperature
command_line:
  - sensor:
      command: "cat /sys/class/thermal/thermal_zone0/temp"
      name: HA CPU Temperature
      unit_of_measurement: "      C"
      value_template: '{{ value | multiply(0.001) | round(1) }}'



SSH Based Sensor

Goto Docker Container: 

sudo docker exec -it homeassistant bash

Enable Keyless SSH Access: 

ssh-keygen
ssh-copy-id -i ~/.ssh/id_ed25519.pub pi@192.168.1.2

Test SSH Keyless from container: 

ssh pi@192.168.1.2

Sensor Config: 

command_line:
  - sensor:
      command: "ssh pi@192.168.1.2 '/usr/bin/python3 /home/pi/homeassist/pmm_time_taken.py'"
      name: PMM Time Taken
      unit_of_measurement: "s"
      value_template: '{{ value }}'
      scan_interval: 86400


References





{{#widget:DISQUS |id=networkm |uniqid=HA |url=https://aman.awiki.org/wiki/HA }}

Retrieved from "https://aman.awiki.org/wiki/HA?oldid=4901"