DewGew/Domoticz-Google-Assistant

Avoid to expose settings page

SylvainPer opened this issue · 5 comments

SylvainPer commented

Is your feature request related to a problem? Please describe.
I don't want to expose unnecessary pages, especially settings one.

Describe the solution you'd like
Only expose the needed pages.

I've modified the auth.py file:

oauthGetMappings` = {"/gapi/oauth": OAuthReqHandler.oauth,
                    "/gapi/login": OAuthReqHandler.login,
                    "/login": OAuthReqHandler.login}

oauthPostMappings = {"/login": OAuthReqHandler.login_post,
                    "/gapi/login": OAuthReqHandler.login_post,
                     "/gapi/token": OAuthReqHandler.token_post}

This modification can be inserted with a new option in the configuration file.

I've also modified the nginx configuration:

        location ~ ^/assistant/(.*)$ {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Scheme $scheme;
                proxy_pass http://127.0.0.1:3030/gapi/$1$is_args$args; #Local ipno to dzga
                proxy_read_timeout  90;
        }

and for the google link, i'm using:

https://MYURL/assistant/oauth
https://MYURL/assistant/token
SylvainPer commented

I forgot the smarthome.py modification:

    smarthomeGetMappings = {"/gapi/smarthome": SmartHomeReqHandler.smarthome,
                            "/gapi/sync": SmartHomeReqHandler.syncDevices,
                            "/settings": SmartHomeReqHandler.settings,
                            "/restart": SmartHomeReqHandler.restartServer}

    smarthomePostMappings = {"/gapi/smarthome": SmartHomeReqHandler.smarthome_post,
                             "/settings": SmartHomeReqHandler.settings_post}

This config was before the latest updates, the new links are missing.

github-actions commented

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days

SylvainPer commented

@DewGew just to avoid to close it too early.

Catfriend1 commented

Hi,

I've found a workaround to this: With Sophos UTM Home free, you can use the firewall's reverse proxy - also called WAF - and set protection rules for your web server like "hardening = enabled; entry urls = /oauth, /token, /smarthome" . This prevents anyone from outside accessing the /settings point while you can still reach it from internal by going to http://server-ip-local:3030/settings. The firewall also takes care of managing letsEncrypt certificates for https including auto renewal. You only need a domain (or dyndns) for that.

SylvainPer commented

Hello @Catfriend1 , thanks for your answer but this solution is not available for rpi and lots of configurations are based on it.
My proposal is to update the paths configuration.

  • 👍1