From 7c0e0235f73ed551a6e8dc306aac0b26514ee8c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mateusz=20Gruszczy=C5=84ski?= Date: Wed, 16 Sep 2026 16:56:06 +0200 Subject: [PATCH] GREE Controller 0.14.14 --- gree-controller/CHANGELOG.md | 4 ++++ gree-controller/DOCS.md | 8 ++++---- gree-controller/translations/en.yaml | 2 +- gree-controller/translations/pl.yaml | 2 +- 4 files changed, 10 insertions(+), 6 deletions(-) diff --git a/gree-controller/CHANGELOG.md b/gree-controller/CHANGELOG.md index 825d238..b16533f 100644 --- a/gree-controller/CHANGELOG.md +++ b/gree-controller/CHANGELOG.md @@ -2,6 +2,10 @@ ## 0.14.14 +- Changes History → Custom Charts links to open a standalone chart-only page instead of the full dashboard. +- Persists chart shares behind random bearer URLs whose token is stored only as a hash; shared URLs do not expose metric/device selectors. +- In Supervisor mode, requires `app_token` for direct dashboard/API/WebSocket access on port `8787`, while trusted HA ingress remains automatic. +- Keeps only generated Custom Chart data public to the network; the add-on watchdog may call `/api/health` anonymously only from the Supervisor peer. - Makes the Home Assistant entity picker in `Reusable data -> Shared Flow input` explicit with a separate search box and selected `entity_id` field. - Filters the live Home Assistant entity catalog by friendly name, `entity_id`, current state, unit and device class while typing. - Keeps automatic Supervisor authentication, failed-test manual fallback and standalone Home Assistant behavior unchanged. diff --git a/gree-controller/DOCS.md b/gree-controller/DOCS.md index e0ad60d..352cfbb 100644 --- a/gree-controller/DOCS.md +++ b/gree-controller/DOCS.md @@ -55,7 +55,7 @@ Broadcast zwykle nie przechodzi przez router. Sterowanie unicast może działać | `poll_interval_seconds` | interwał odpytywania urządzeń | | `zone_interval_seconds` | interwał sterowania strefami/termostatem | | `discovery_timeout_ms` | timeout discovery UDP | -| `app_token` | opcjonalna ochrona bezpośredniego Web UI/API | +| `app_token` | token bezpośredniego Web UI/API; w trybie Supervisor pusty = direct access zablokowany | | `log_level` | `error`, `warn`, `info`, `debug`, `trace` | ### Home Assistant API @@ -64,7 +64,7 @@ Dodatek korzysta automatycznie z wewnętrznego proxy Home Assistant Core (`http: ### Dostęp, dane i bezpieczeństwo -Usługa słucha na TCP `8787`; ingress Home Assistant przekazuje Web UI na ten port. Jeżeli `8787` jest osiągalny z niezaufanej sieci, ustaw `app_token` albo zablokuj port firewallem. Baza jest zapisywana w `/data/gree-controller.db`; konfiguracja używa `backup: cold`, więc dane są objęte backupem dodatku. +Usługa słucha na TCP `8787`; ingress Home Assistant przekazuje Web UI na ten port. Gdy wykryty jest `SUPERVISOR_TOKEN`, bezpośredni dashboard/API na `:8787` wymaga `app_token`; przy pustym `app_token` bezpośredni dashboard jest zablokowany. Z sieci bez poświadczeń dostępny jest tylko publiczny widok i endpoint danych pojedynczego Custom Chart (`/charts/custom/`, `/api/public/charts/custom/`). Token udostępnienia jest losowy, jego skrót jest zapisywany w SQLite, a sam URL nie zawiera nazw urządzeń ani listy metryk. Link kopiowany z History → Custom chart omija HA ingress i wskazuje bezpośrednio host/IP dodatku na jego porcie HTTP (domyślnie `8787`). `/api/health` bez tokenu jest akceptowane tylko od peera Supervisora na potrzeby watchdoga; bezpośrednie żądanie sieciowe wymaga `app_token`. Baza jest zapisywana w `/data/gree-controller.db`; konfiguracja używa `backup: cold`, więc dane są objęte backupem dodatku. Watchdog sprawdza `/api/health`. Do diagnostyki sieci najpierw sprawdź `ha network info`, poprawność `gree_interface`, broadcast konkretnej podsieci i reguły UDP/firewalla. @@ -120,7 +120,7 @@ Broadcast normally does not cross routers. Unicast control may work through rout | `poll_interval_seconds` | device polling interval | | `zone_interval_seconds` | thermostat/zone control interval | | `discovery_timeout_ms` | UDP discovery timeout | -| `app_token` | optional protection for direct Web UI/API access | +| `app_token` | token for direct Web UI/API access; in Supervisor mode empty = direct access disabled | | `log_level` | `error`, `warn`, `info`, `debug`, `trace` | ### Home Assistant API @@ -129,6 +129,6 @@ The add-on automatically uses the internal Home Assistant Core proxy (`http://su ### Access, data and security -The service listens on TCP `8787`; Home Assistant ingress proxies the Web UI to that port. If `8787` is reachable from an untrusted network, configure `app_token` or block the port at the firewall. The database is stored in `/data/gree-controller.db`; `backup: cold` keeps it in the add-on backup. +The service listens on TCP `8787`; Home Assistant ingress proxies the Web UI to that port. When `SUPERVISOR_TOKEN` is detected, direct dashboard/API access on `:8787` requires `app_token`; with an empty `app_token`, direct dashboard access is disabled. From the network, the only unauthenticated application data is the single public Custom Chart view/data endpoint (`/charts/custom/`, `/api/public/charts/custom/`). The share token is random, only its hash is stored in SQLite, and the URL does not expose device names or metric selectors. Links copied from History → Custom chart bypass HA ingress and point directly to the add-on host/IP on its HTTP port (default `8787`). `/api/health` is accepted without a token only from the Supervisor peer for the add-on watchdog; direct network requests require `app_token`. The database is stored in `/data/gree-controller.db`; `backup: cold` keeps it in the add-on backup. The watchdog checks `/api/health`. For network troubleshooting, verify `ha network info`, `gree_interface`, the selected subnet broadcast, and UDP/firewall rules first. diff --git a/gree-controller/translations/en.yaml b/gree-controller/translations/en.yaml index 8574c36..37c0105 100644 --- a/gree-controller/translations/en.yaml +++ b/gree-controller/translations/en.yaml @@ -22,7 +22,7 @@ configuration: description: UDP discovery timeout in milliseconds. app_token: name: Application token - description: Optional token protecting direct Web UI/API access outside Home Assistant ingress. + description: Token required for direct dashboard/API access on port 8787. With SUPERVISOR_TOKEN active, an empty token disables direct access; only generated Custom Chart share links remain public. log_level: name: Log level description: Controller log verbosity. diff --git a/gree-controller/translations/pl.yaml b/gree-controller/translations/pl.yaml index 64e7fd2..5e972cd 100644 --- a/gree-controller/translations/pl.yaml +++ b/gree-controller/translations/pl.yaml @@ -22,7 +22,7 @@ configuration: description: Timeout wykrywania UDP w milisekundach. app_token: name: Token aplikacji - description: Opcjonalna ochrona bezpośredniego dostępu do Web UI/API poza ingressem Home Assistanta. + description: Token wymagany do bezpośredniego dostępu do dashboardu/API na porcie 8787. Przy aktywnym SUPERVISOR_TOKEN pusty token blokuje direct access; publiczne pozostają wyłącznie wygenerowane linki Custom Chart. log_level: name: Poziom logowania description: Szczegółowość logów kontrolera.