Skip to content

Multi-System Reactor

894 Topics 8.4k Posts
  • Deprecation Announcement: 32-bit ARM *docker* images

    Pinned until 8/1/27, 6:56 PM Locked
    1
    0 Votes
    1 Posts
    417 Views
    No one has replied
  • Category Topic Guide -- Read Before Posting

    Pinned Locked guidelines
    1
    8 Votes
    1 Posts
    2k Views
    No one has replied
  • Reactor (Multi-System/Multi-Hub) Announcements

    Pinned Locked announcements
    152
    5 Votes
    152 Posts
    155k Views
    toggledbitsT
    Reactor build 26298 SECURITY: Recent discovery of compromised intermediate certificates has been addressed with updated docker images for arm64 and amd64/x86_64. Bare-metal Reactor users are advised to upgrade their node install to at least (within each major version) 22.23.4, 24.22.1, or 26.12.1, and further update their CA certificates on the underlying operating system, as well as any affected packages (e.g. potentially python, OpenSSL, curl, wget, etc.). Any of the popular AIs should be able to provide useful specific guidance if you adequately describe your system configuration. Note that armv7l images cannot be fully patched at this time due to limitations in underlying packages. Upgrading to 64-bit is currently the only path. Security: Reactor Access Control now supports Multi-factor (Two-Factor) Authentication. Configuring MFA is highly recommended for users granting access to Reactor from outside their LANs (e.g. via reverse proxy or tunnel). See docs Security: Reactor Access Control now blocks host IP addresses for consecutive login failures (configurable, default: 4 failures within 3 hours gets blocked for 48 hours). See docs Security: docker images have an updated node version to address recent discovery of compromised eMudhra intermediate certificates, and others. The image OS certificate store has also been updated accordingly. ref ref ref HubitatController: New x_hubitat_sys.restart and x_hubitat_sys.reboot actions (on system entity); see docs HassController: Bless HA to 2026.10.4
  • Reverse proxy & API ACL

    9
    0 Votes
    9 Posts
    259 Views
    tunnusT
    @therealdb just to clarify that my reverse proxy setup works perfectly except for this one tiny issue of trying to allow (unauthenticated) /api/v1/log connections from the local lan but not via proxy. I tried the following Synology configuration: [image: 1793874094546-screenshot-2026-11-05-at-12.05.07.png] But it didn't have the effect I was looking for, so I reverted to the "minimum" working setup (and working setup meaning that I can at least access MSR UI): [image: 1793874140376-screenshot-2026-11-05-at-12.11.09.png] In the logs there's always Docker internal gw address instead of lan or remote IP (in this case the connection was allowed to demostrate the behavior / show gw IP): [latest-26298]2026-10-30T14:29:45.374Z <wsapi:INFO> wsapi: connection from "84.xxx.xxx.xxx" via proxy ::ffff:172.18.0.1 [latest-26298]2026-10-30T14:29:45.418Z <wsapi:INFO> wsapi#1 client "84.xxx.xxx.xxx#2" authorized ... [latest-26298]2026-10-30T14:48:02.743Z <httpapi:INFO> httpapi#1 API request from ::ffff:172.18.0.1: GET /api/v1/log false[latest-26298]2026-10-30T14:48:02.744Z <httpapi:null> httpapi#1 checking ACLs for /api/v1/log user anonymous authorization none false[latest-26298]2026-10-30T14:48:02.744Z <httpapi:null> httpapi#1 checking /api/v1/log against /api/v1/log ACL { "url": "/api/v1/log", "method": "GET", "source_ip": "172.18.0.0/24", "allow": true, "index": 3 } false[latest-26298]2026-10-30T14:48:02.759Z <httpapi:INFO> httpapi#1 request for /api/v1/log from ::ffff:172.18.0.1 user anonymous auth none matches /api/v1/log ACL (#3): { "url": "/api/v1/log", "method": "GET", "source_ip": "172.18.0.0/24", "allow": true, "index": 3 }
  • MFA

    28
    1
    0 Votes
    28 Posts
    869 Views
    T
    @toggledbits said in MFA: I'll take some responsibility here for not asking to see the entire file and just relying on snippets (hard to tell indent and relation to other data). No worries. At least it got solved. Funny thing is, I was looking for a sample user config file, like you have when you are setting up the reactor.yaml. If I had found that, it might have clued me in. And the whole MFA thing was just an extra layer of security. I keep Reactor accessible through my Cloudlfared tunnel, but I already have that security through another layer of MFA from Cloudflare. Anyone trying to hit my URL would have to get through that MFA layer first. This is just in case Cloudflare get's compromised somehow, then I still have an extra layer in place to keep my network secure.
  • Grouped devices

    3
    0 Votes
    3 Posts
    115 Views
    G
    @therealdb it does and the 2026.11.0 release of Ha fixes the AMZ changes they made that were after affecting login. Problem: AMZ only allows a device to appear in a single group. I worked on this last night and found I could write a script to create the groupings I wanted. In testing now.
  • Login protections

    2
    1
    0 Votes
    2 Posts
    163 Views
    toggledbitsT
    Interesting exercise. I decided that that alone wasn't sufficient, so I added MFA to the mix. I recommend using both with exposed Reactor systems, and in particular, enable required MFA for all users, so no accounts can accidentally be left open.
  • Reactor Inspect - a small read-only helper panel for MSR

    6
    1
    2 Votes
    6 Posts
    433 Views
    G
    @wmarcolin updated - thank you for this.
  • Reactor Build 26284 stuck at Loading Reactor UI

    16
    2
    0 Votes
    16 Posts
    2k Views
    T
    SOVLED: I forgot the pass_all_proxy: true line! Thank you much Patrick!
  • MSR with reverse proxy

    12
    0 Votes
    12 Posts
    791 Views
    tunnusT
    @toggledbits, did follow your instructions and now reverse proxy works like a charm, thanks! I'm using https on Synology and firewalling functionality (allowing based on geo-ip), further restrictions done in Access Control Profile that DSM offers in reverse proxy configuration. Obviously also using authentication in MSR.
  • Missing attribute after upgrade

    3
    1
    0 Votes
    3 Posts
    475 Views
    3
    @toggledbits said in Missing attribute after upgrade: If the hub stops sending that attribute at some point, the attribute lives on in Reactor, it just isn't touched. At some point, an update (build) that causes Reactor to rebuild the entity will start over with a clean slate of attributes. This makes total sense. With the Reactor upgrade before yesterday's update, there was no reboot of the HE hub, nor an update to the app. So I wouldn't expect the hub to stop sending the attribute to Reactor. But there very well could be some mixture of an update on the hub and an update of Reactor that when combined is the root cause. Yesterday's Reactor update did not cause any missing attributes. I will watch this closer. For now, my work around is to just restart Reactor again and all is right.
  • [MSR] Native fan capabilty

    3
    1 Votes
    3 Posts
    266 Views
    therealdbT
    Here we go. Sorry for the delay, crazy days at work: { "entity_id": "fan.kitchen_seashell_hood_ventilation_fan", "state": "off", "attributes": { "preset_modes": [], "percentage": 50, "percentage_step": 25, "preset_mode": "", "friendly_name": "Seashell Hood Ventilation Fan", "supported_features": 49 }, "last_changed": "2026-09-19T04:06:16.582977+00:00", "last_reported": "2026-09-19T04:06:16.582977+00:00", "last_updated": "2026-09-19T04:06:16.582977+00:00", "context": { "id": "01M2VXFV869XHBDKVKPFSSCC21", "parent_id": null, "user_id": null }, "source": { "domain": "esphome" } } Thanks.
  • [MSR] Rule do not fire

    4
    1
    0 Votes
    4 Posts
    386 Views
    therealdbT
    done. I'll test, but your logic makes sense, of course. anyway, part of the problem with complex rules is that I have a huge system and sometimes it's very, very difficult for me to find the right rule after a while. what could help me is a way to see all the rules a device is used into (triggers, constraints, actions, variables), and an advanced search, maybe, one can dream
  • 0 Votes
    8 Posts
    546 Views
    N
    @toggledbits Trigger OR was the problem and not identical internal condition/group ID as I suspected. AND is the fix. With the old OR setup, the problem was that the trigger had already fired, registering as "true" for a different reason (Lux), minutes earlier. So the photo captured by the trigger was outdated. Thanks again for the push in the right direction!
  • DynamicGroupController and attributes

    9
    1 Votes
    9 Posts
    602 Views
    toggledbitsT
    This is now available in build 26242. The config has changed slightly, so review the final documentation for correct usage and examples.
  • Unofficial thread for compatibility

    2
    2 Votes
    2 Posts
    906 Views
    tunnusT
    A while ago I got rid of my Hubitat, so I'm no longer updating this thread
  • Ooops - Deleted Reactor Ex Machina II

    2
    0 Votes
    2 Posts
    231 Views
    toggledbitsT
    No backup? Restore from backup (recommended) is the best way, of course. Beyond that, recreating it should not be difficult, but there have been key changes since that original post. Some detail beyond "did not work" is necessary here. Show your work and tell us about your environment.
  • Bail out of failed reaction?

    3
    1
    0 Votes
    3 Posts
    439 Views
    T
    @Crille, thanks. I never noticed that box. Simple fix!
  • Arming Envisalink panel from MSR

    7
    1
    0 Votes
    7 Posts
    759 Views
    T
    @vezinpi Thank you! That worked beautifully.
  • [Solved] DynamicGroupController updating members issue

    5
    0 Votes
    5 Posts
    499 Views
    CrilleC
    Thank you for the quick fix!

Recent Topics