OpenHAB

This page is a collection of information around the OpenHAB installation here at ElectricBrain. During the installation process OpenHAB moved from version 2.5.9 to version 3.0.0 just before christmas 2020.  Then updated to OH31M5 (June 2021) with a minor issue. Updated to version 4.0.3 (October 2023)

The latest version now running in the new house (actually it's quite old house circa 1890's in Bendigo) is version 4.0.3. Previously two versions were installed at the Melbourne house and ran in parallel for about a month. However, with the deployment of the new lights, switch and GPOs OH2.5.9 wasn't updated with the new "things" and so was finally decommisioned Feb 2021 leaving only OH3.0.0 running. OH31M5 then running with OH30 decomissioned.

Information Privacy in your home automation system

Before proceeding, a word of explanation as to why Dockerization and Portainer? This question came up on one of the support lists regarding the "overly" complex dockerized implementation (now in 2023 docker is mainstream and no longer considered "overly" complex as it was back then):

Thanks Rich,

As previously stated (and I can't say it enough), none of the containers (i.e. pretty much virtual computers) has access to the physical network. Essentially whatever nasty software is compiled in to those applications they can't talk ouside their container boundaries except under very tight supervision.

A couple of the containers have fixed locations within the cluster (pins shown). Most are free to move about wherever Portainer/Docker-Swarm thinks they should go.

Portainerized installation

The main OpenHAB stack:

Another stack (the DMZ) is also involved in brokering access on and off the OpenHAB private virtual network (PVN) to resources such as

• the network LDAP authentication servers in RO mode (RabbitMQ - full LDAP authentication for all devices)

• an externally directed proxy (which can be one of TOR, VPN or Direct to wire)
• an authenticated inbound proxy controlling who can see PVN resources (i.e. OH web interface).
• Amazingly all this works and, I believe, provides unparallel security/privacy both from the app itself (we trust it right ?) and external/internal attackers.

Container OpenHAB

• EXTRA_JAVA_OPTS:
  • -Duser.timezone=Australia/Melbourne
  • -Dhttp.proxyHost=httpdproxy
  • -Dhttp.proxyPort=80
  • -Dhttps.proxyHost=httpdproxy
  • -Dhttps.proxyPort=80
  • -Dftp.proxyHost=httpdproxy
  • -Dftp.proxyPort=80"
• A container healthcheck was added in version OH31M5 . This needs to be disabled when proxies are used (check compose 3+ syntax):
  • healthcheck:
      disable:true
  • Ultimately the new healthcheck needs to have curl --no-proxy localhost added to make it work in all cases.
• Internet access via
  • httpd proxy dmz-external-network
  • ftp proxy dmz-openhab-network
  • Additional environment variables to get various internal container utilities to work via a proxy
    • http_proxy: "http://httpdproxy:80/"
    • https_proxy: "http://httpdproxy:80/"
    • ftp_proxy: "http://httpdproxy:80/"
• AddOn
  • JSONPath Transformation
  • RegEx Transformation
• Bindings
  • Fronius Binding
    • Link each Fronius Inverter channel to an item using the auto-naming. Again via a proxy isolating OH from directly talking to the inverter or other devices on that segment.
       
  • MQTT Binding
    • Talks to RabbitMQ which has two interfaces, PVN and Tasmota VLAN. This isolates OH from the possiblity of directly communicating with any device.
  • BOM Binding
    • Enhanced by the author to allow external proxying. There is no direct access to the outside world for OH or its plugins.

• Persistence

# the database url like 'jdbc:mysql://<host>:<port>/<database>' (without quotes)
#url=
url=jdbc:mysql://db.dmz-openhab-network:3306/openhab?useUnicode=true&useJDBCCompliantTimezoneShift=true&useLegacyDatetimeCode=false&serverTimezone=Australia/Melbourne

# the database user
#user=
user=openhab

# the database password
#password=
password=xxxxxxxxxxxxxxxx

# the reconnection counter
#reconnectCnt=

# the connection timeout (in seconds)
#waitTimeout=

# Use MySQL Server time to store item values (=false) or use openHAB Server time (=true).
# For new installations,
 its recommend to set "localtime=true".
# (optional,
 defaults to false)
#localtime=true

Container MySQL

Container phpMyAdmin

Container RabbitMQ

• enabled_plugins
  • advanced.config

• rabbitmq.conf

Tasmota

• Set TZ:
  Backlog TimeZone +11; timeDST 1,1,10,1,2,660; timeSTD 1,1,4,1,2,600
• WiFi - choose strongest on reboot:
  SetOption56 On
• Power on always:
  PowerOnState 4
  SetOption0 On (default)
  SetOption63 Off (default)