Emoncms self contained docker container and HomeAssistant Addon

borpin · 6 October 2023 06:16

Yes, that looks good and what I have tested seems to work

Can I be a pest and ask for the option to show in sidebar?

I’ll switch on auto-update - should that work?

alexandrecuer · 6 October 2023 07:45

Right now I dont know how to do it. To what I’ve understood, first the app has to have ingress enabled in order to be embedded inside HA.

borpin · 6 October 2023 08:15

Ok, a nice to have rather than essential

alexandrecuer · 6 October 2023 09:30

what you can do is to add to the sidebar a shortcut to the addons panel

#Add this to your configuration.yaml
panel_custom:
  - name: addons
    sidebar_title: Addons
    sidebar_icon: mdi:cog-transfer
    js_url: /api/hassio/app/entrypoint.js
    url_path: "hassio/dashboard"
    embed_iframe: true
    require_admin: true
    config:
      ingress: core_configurator

to edit the configuration.yaml with the HA gui, install the configurator add-on (here File editor)

For the new configuration to be online, you have to restart Home Assistant

Instead of linking to the addons panel, you can directly link to the emoncms panel

the url has to be something like that : hassio/addon/60ed1c84_emoncms/info

the sidebar is like that after :

alexandrecuer · 6 October 2023 09:43

For people who are not using home assistant, I wrote a small digest on how to take hands on docker :

alexandrecuer · 24 January 2024 16:24

Added a new build including emoncms version number, using the stable release

the latest docker image has got the following tag : alexjunk/emoncms:alpine3.18_emoncms11.4.5

docker pull alexjunk/emoncms:alpine3.18_emoncms11.4.5

nota : the docker image used in the home-assistant addon is right now the one without version number…

alexandrecuer · 1 February 2024 12:19

@borpin : I just been working implementing the ssl in the dockerfile.
a commit prototype is here :

I introduced some new vars and wanted your point of view on that :

CRT_FILE, for the public key
KEY_FILE, for the private key
CNAME, for the domain name

maybe I should add also CA_FILE, the public key for the certificate authority (CA) ? although it is not necessary with self signed certificates…

as far as docker is concerned, things are working, but I did not test on HA…

How do you run your HA with ssl ? You generate a certificate directly in command line using openssl ? and then modifying configuration.yaml ? you allow to browse on https(443) and http(80) or there is a redirection from 80 to 443, so when you try to browse with http it redirects automatically to https ?
I began searching the docs but as I you already experienced running HA in ssl, maybe you could tell me…

best

borpin · 3 February 2024 22:38

A long time since I got it working but, internally I have these 2 addons installed.

I have a domain I use solely for internal SSL certificates, from LetsEncrypt, authenticate through DNS Challenge with Cloudflare (as they are not routable) and then set Pi-Hole to do the lookup for those domains to fixed LAN IPs.

So internally, https://xxx.borpin.net just works

This does need an automation to trigger the LetsEncrypt addon as it only runs otherwise at restart.

I use Nabu Casa for remote access.

[edit]
You might try reaching out to Frenck on Discord if you get stuck as he has loads of add-ons that use SSL.

alexandrecuer · 6 February 2024 07:40

Thanks, I guess you are using this one :

I’ve tried another one which does not need any extra addons, and creates the let’s encrypt certificates :

I managed to make it work, it needs configuration.yaml to include an http section in order to define the reverse proxy to the rest of the network :

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.30.33.0/24

172.30.33.0 is the hassio network, you can check with docker network ls and docker network inspect hassio

Then adjust a NAT/PAT rule on your router so that the traffic on port 443 goes to the reverse proxy. In my case, I have an orange box, it is like that :

You can proceed to the ssl configuration :

Get a valid domain name / cname with duckdns for example, through your github access it will give you a token
When the nginx proxy manager addon is up, create a Lets’encrypt certificate, with the DNS Challenge method and fill the credentials with your duckdns token
Create a proxy host using the domain name, associate the certificate and choose the force SSL option

When accessing from outside through the domain name, all traffic is crypted
In my case local browsing stays uncrypted, probably because i dont have NAT Loopback (?) on my router

datoon · 6 February 2024 14:47

Sorry, a bit late to this - shouldn’t this be multiple containers, as such done through a docker-compose file?

alexandrecuer · 6 February 2024 22:34

@datoon : thanks, you mean multiple containers for the emoncms docker or for the nginx proxy ?
For the emoncms docker, self contained approach with s6-overlays is better In a multi container approach, it will be difficult to have all the features working because of the design of emoncms.

datoon · 7 February 2024 08:30

Sorry, maybe I misread home assistant as home assistant core.

I run HA with MQTT using docker compose.

alexandrecuer · 7 February 2024 10:47

It should work also on HA with MQTT using docker compose. It works both as an HA addon and as a standalone docker container…there is little difference…

@borpin : with the Nginx Proxy Manager (NPM) which is a reverse proxy, the addon in its current version works in https from the outside, but your remark was focused on internal network ? with the new version of the NPM addon, you dont need anymore automation. I dont know if/how certificates are automatically renewed ?

borpin · 10 February 2024 06:45

It is one of those things - ain’t broke; don’t fix.

It works fine for what I need (SSL inside my LAN) and external access provided by a Nuba Casa subscription.

alexandrecuer · 13 February 2024 07:11

I’ve produced a new version for the homeassistant addon, with ssl/https.

No real issues during the migration but as mariadb changed version, the container log was filling with warnings :

2024-02-11 21:22:56 701 [ERROR] Incorrect definition of table mysql.column_stats: expected column 'histogram' at position 10 to have type longblob, found type varbinary(255).
2024-02-11 21:23:01 702 [ERROR] Incorrect definition of table mysql.column_stats: expected column 'hist_type' at position 9 to have type enum('SINGLE_PREC_HB','DOUBLE_PREC_HB','JSON_HB'), found type enum('SINGLE_PREC_HB','DOUBLE_PREC_HB').

I had to alter the tables manually to remove them

MariaDB [(none)]> ALTER TABLE mysql.column_stats MODIFY histogram longblob;
Query OK, 0 rows affected (0.102 sec)              
Records: 0  Duplicates: 0  Warnings: 0

MariaDB [(none)]> ALTER TABLE mysql.column_stats MODIFY hist_type enum('SINGLE_PREC_HB','DOUBLE_PREC_HB','JSON_HB');
Query OK, 0 rows affected (0.033 sec)
Records: 0  Duplicates: 0  Warnings: 0

see migrating HA addon to version alpine3.18_emoncms11.4.11 - possible issues · Issue #7 · Open-Building-Management/emoncms · GitHub

alexandrecuer · 24 February 2024 21:58

@borpin : is it possible for me to edit the first messages of the topic, those created in June 2023 ?

I would like to modify things as they are linking to dockerfiles using supervisord which is not the way to go and some docker commands are using docker images I would like to delete on the docker hub ?

I’ve seen you modified the title in October 23

Robert.Wall · 24 February 2024 22:05

I don’t think you can, but the Moderators and Admins can. So if you let one of us know exactly what you want changing in a PM, or by flagging the post, or just post the edited version with a note that you want it to replace the old version (with a link to the old), we can make the changes for you.

[Edit: Done 25/02/2024]

Ashipa · 26 April 2024 11:08

Hello.

Firstly, THANK YOU SO MUCH FOR THIS ADDON. You don’t know how much it means to me and my friends to find this.

Secondly, bit of a noob so forgive me for my questions:

A. How to get MQTT data into this emoncms addon.

i presently have MQTT data getting sent into Home Assistant.

The publisher on the local network is at 192.168.1.101
topic prefix is: solar_assistant/#
no user/pass since its only local

i tried putting that 192.168.1.101 into the MQTT host box, and restart the add-on, but there’s no sign of the data as inputs

B. How to get emoncms published publicly

Tried following the convo above about NGINX above but frankly i’m lost

I have a domain which i use for Home Assistant itself via the Cloudflared add-on to make it accessible remotely

Thanks

alexandrecuer · 26 April 2024 17:13

For the A, see https://github.com/Open-Building-Management/emoncms/discussions/16#discussioncomment-9239523

For the B, dont know the cloudflare addon but to deal with access from outside with the nginx proxy manager, i wrote a small guide here :

github.com

Open-Building-Management/containers/blob/main/emoncms/alpine_persistent/secure_access_from_outside.md

# secure access from outside

In order to access to your application from the outside, you have to add a NAT/PAT rule on your internet router.

This involves specifying an internal port and an external port for a local IP. All traffic on your `router's public address:external port` will be routed to the `local IP address:internal port`. 

## about proxies and generating certificates

[NGINX PROXY MANAGER](https://nginxproxymanager.com/) is a reverse proxy, enabling you to access your services securely from the outside, even if these services only offer a non-secure connection. For example, the emoncms standalone docker container without ssl activated does not offer a secure connexion.

You can achieve something similar directling using [nginx](https://hub.docker.com/_/nginx), but nginx proxy manager offers an interface so you dont have to bother with conf files...

If you want to access your services securely from the outside, you need a valid domain name, which may be obtained via duckdns simply by logging in using a github account. This will provide you a token to be supplied when generating the associated certificates needed for securing the connection.

If your IP is fixed, the association with the domain name has to be done only once. If your IP is dynamic, for example if you use an m2m 4G simcard, you will have to manage the updates. Some services do this for free (duckdns) while others like noip require a payment....

The ssl certificates consist of a pair of public and private keys.

Nginx proxy manager runs the whole process for you, ie acts as a proxy and creates/updates the certificates automatically. If you dont use it, [acme.sh](https://github.com/acmesh-official/acme.sh/) is an alternative and probably the simpliest option to manage your certificates using the free solution let's encrypt and many others....

This file has been truncated. show original

Hope this will help