Add optional local network URL with fallback - #7
Conversation
Lets you set a LAN address for your Home Assistant instance alongside the existing URL. The bridge tries the local address first on every connection attempt and falls back to the primary URL when it isn't reachable (e.g. away from home). The local URL shares the primary URL's stored token rather than needing its own, since it's the same instance reached by a different address.
Two always-visible URL fields, each with its own plaintext warning, was more chrome than most users need for an optional field. Reuses the Demo mode toggle's visual pattern: collapsed by default, expands to reveal the field, starts expanded only if a local URL is already saved. Collapsing clears the draft so "off" means no local URL rather than a hidden stale value.
|
Thank you for your PR! This is definitely a useful improvement, however i have a security concern. Your implementation assumes that we always try to use local address first. On untrusted network there is a risk that we will send token to service that is opened on the same port and IP but is not our HA instance. I checked how it's implemented in official HA clients and internal address is used only when we are connected to trusted wifi address. Probably we should use the same approach, so plaintext local URLs should require trusted-network detection. wdyt? |
|
I fully agree! Will push an update! |
Trying the local URL unconditionally meant a laptop joining any Wi-Fi could send the access token to whatever answers at that address there, not just at home. Adds a trusted network name field next to the local URL. The bridge now checks the current Wi-Fi network name (via nmcli) before every attempt and only tries the local URL when it matches, exactly like the official Home Assistant apps do with their internal URL. Any failure to determine the current network fails closed to the primary URL.
|
Pushed a fix. Added a trusted network name field next to the local URL. The bridge checks the current Wi-Fi network name via nmcli before every connection attempt and only tries the local URL when it matches, same as the official HA apps do with their internal URL. If the network name can't be determined for any reason (no NetworkManager, nmcli error, not on Wi-Fi) it fails closed to the primary URL rather than assuming trust. Also enforced this in Service.applyConnection, not just the bridge, so a local URL can't be saved without a trusted network paired with it. Added three bridge tests for this: local URL skipped when the current network doesn't match, never used at all when no trusted network is set, and fails closed when the network can't be determined. |
A single name didn't cover routers that broadcast separate 2.4GHz and 5GHz SSIDs, or people who consider more than one location trusted. The field now takes a comma-separated list, matched against exactly, same as before just against more than one name.
|
Tested the branch on my side, noticed two things: 
|
The connection settings card has a fixed height, and the local URL fields pushed content past it with nothing to contain the overflow. Wrapped the form in a scrollable Flickable so this can't recur as more fields get added. Also suggests the currently connected Wi-Fi name as a one-click fill for the trusted network field, shown only while that field is empty. While building it, found that nmcli's default wifi list forces a multi-second radio scan, which would have blocked the bridge's single-threaded run loop on every reconnect attempt whenever a local URL is configured. Added --rescan no to both the bridge's check and the new suggestion, since neither needs a fresh scan of neighboring networks, only NetworkManager's already-cached state for the active connection.
|
Pushed fixes for both.
Tested both live against a real instance this time. |
|
@RolfKoenders thank you for your contribution! Merging. |
Thank you for the plugin! |
2 participants
Adds an optional local network URL, for people who reach their Home Assistant instance through two addresses: a LAN address at home and something else away from home (Nabu Casa, a reverse proxy, Tailscale, etc).
When it's set, the bridge tries the local address first on every connection attempt and falls back to the main URL if it's not reachable. It reuses the token from the main URL rather than needing its own, since it's the same instance.
The field is collapsed behind a toggle next to the main URL field, off by default, matching the existing Demo mode toggle.
Testing