Due to HA not being configured to allow ADD-ONs, I’ve resorted to installing the NSPanel Manager software as a Docker container on my Mac (fine for now).
NSPanel Manager runs fine - is configured to connect to MQTT (on the Core) and that works great. The reflashed NSPanel also works and can be seen by the manager.
What I can’t get to work is the NSPanel Manager connecting to HA.
I’ve been working with the developer to understand why. Initially, he had no support for self-signed certs. He has asked for me to try the following with the expectation that JSON is returned - but it isn’t.
If I issue the curl command with the flag -L, it allows curl to follow the 302 redirect. It appears that I’m being taken to the SSO login screen (that’s the HTML that is being returned) - so it looks like HA API calls being made outside of Core are hitting the SSO login page as opposed to being ignored.
@nutcracker sorry, missed this, checking the config (/etc/nginx/sites-available/homeassistant) for port 18443, the SSO isn’t in the way:
server {
## Localhost configuration
##
listen 127.0.0.2:18443;
## Include shared defaults for all top-level sites on CORE
include snippets/shared.conf;
location / {
## Set environment variables for use with SSO
set $service_unit "podman-homeassistant";
set $service_name_pretty "Home Assistant";
proxy_pass http://127.0.0.1:8123/;
}
}
How does your section in that config file look like?
server {
## These shouldn't need to be changed
listen 18080;
return 302 https://$host$request_uri;
}
server {
## SSL configuration
##
listen 18443 ssl;
## certificate.conf is a symlink pointing to the actual cert-config
## The default certificate is a self-signed one
include snippets/certificate.conf;
include snippets/ssl-params.conf;
## Include shared defaults for all top-level sites on CORE
include snippets/shared.conf;
include sso/portal.conf;
location / {
## Set environment variables for use with SSO
set $service_unit "podman-homeassistant";
set $service_name_pretty "Home Assistant";
proxy_pass http://127.0.0.1:8123/;
include sso/auth.conf; # Activates SSO for specified route/location
include sso/proxy.conf; # Reverse proxy configuration
}
}
server {
## Localhost configuration
##
listen 127.0.0.2:18443;
## Include shared defaults for all top-level sites on CORE
include snippets/shared.conf;
location / {
## Set environment variables for use with SSO
set $service_unit "podman-homeassistant";
set $service_name_pretty "Home Assistant";
proxy_pass http://127.0.0.1:8123/;
}
}
# code: language=nginx insertSpaces=true tabSize=4
See post 1 above that shows the output from the CURL command which when I add the -L switch (post 3) I’m seeing HTML being returned that looks like the login screen.
Ok… of course would like to have SSO… so is it not possible to reconfigure either SSO and/or HA API calls to allow them to work side by side? The HA API calls are already passing a token.
server {
## SSL configuration
##
listen 18443 ssl;
## certificate.conf is a symlink pointing to the actual cert-config
## The default certificate is a self-signed one
include snippets/certificate.conf;
include snippets/ssl-params.conf;
## Include shared defaults for all top-level sites on CORE
include snippets/shared.conf;
include sso/portal.conf;
location /api {
proxy_pass http://127.0.0.1:8123/api;
}
location / {
## Set environment variables for use with SSO
set $service_unit "podman-homeassistant";
set $service_name_pretty "Home Assistant";
proxy_pass http://127.0.0.1:8123/;
include sso/auth.conf; # Activates SSO for specified route/location
include sso/proxy.conf; # Reverse proxy configuration
}
}
Try putting the API on a separate port, like 19443:
server {
## SSL configuration
##
listen 19443 ssl;
## certificate.conf is a symlink pointing to the actual cert-config
## The default certificate is a self-signed one
include snippets/certificate.conf;
include snippets/ssl-params.conf;
## Include shared defaults for all top-level sites on CORE
include snippets/shared.conf;
include sso/portal.conf;
location /api {
proxy_pass http://127.0.0.1:8123/api;
}
}
This may not be the ideal way of doing it, but it should work. There may exist a standard way to do this with HomeAssistant together with SSO, but I’m not a HA user so not sure where I’d find that information.
@markus so I’ve added the above as a new section and restarted nginx and I think its working. I can connect to HA via SSO with no issues and I can issue the CURL command (without -L) against the new 19443 port and I’m seeing JSON being returned.
I’m still having issues with NSPanel Manager being able to connect to HA using the new port. I presume this config would also allow wss web sockets against this setup?
Connecting to Home Assistant at wss://192.168.3.106:19443/api/websocket
I’ll feedback to the author of NSPanel Manager to see what they have to say.
The websocket forwarding probably requires a bit of additional entries to the nginx config, since that is an upgraded connection. From memory I think this is what would need to be added on port 19443 for the api section:
