Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Unsolved
Collapse
Discussion Forum to share and further the development of home control and automation, independent of platforms.
  1. Home
  2. Software
  3. Multi-System Reactor
  4. MFA
MFA
T
Topic thumbnail image
Multi-System Reactor
Reverse proxy & API ACL
tunnusT
I'm trying to allow anonymous access from a local network to /api/v1/log, but the problem now with the reverse proxy configuration is that this access is open via proxy to the internet. At least I wasn't able to configure ACL so that only an access from a local network would be permitted. reactor.yaml: baseurl: "http://192.168.1.12:8111" proxy_baseurl: "https://external.com:30000" trusted_proxy: "192.168.1.12" Local traffic would originate from 192.168.1.0/24 network. Synology is acting as a reverse proxy and hosting MSR as a docker container (which has its own network and IP 172.18.0.5). MSR build is latest-26298-fbb75fb8 users.yaml: - url: "/api/v1/log" method: "GET" source_ip: 172.18.0.0/24 allow: true Using the above ACL works, but it enables access via proxy also. If I use source_ip: 192.168.1.0/24, then it doesn't work either locally or remotely. So I'm kinda lost what should I use as source_ip in this case?
Multi-System Reactor
Grouped devices
G
I've seen many of you using Dynamic Group Controller. I'm using it myself for monitoring device battery levels. I've read and re-read the Dynamic Group Controller docs and still cannot come to an answer for my question so let me paint my scenario: I've migrated from EchoSpeaks in Hubitat ('cause borked and seemingly unmaintained) to Alexa Devices in Home Assistant ('cause not borked in 2026.11.0) to be able to send TTS to my Echo devices. In EchoSpeaks I could create groups. Sweet. In Alexa Devices I don't seem to be able to do so. As such, my thought was "wait - isn't there a way in MSR?" Is this an effective scenario that Dynamic Group Controller can be used for?
Multi-System Reactor
Login protections
tunnusT
Topic thumbnail image
Multi-System Reactor
Reactor (Multi-System/Multi-Hub) Announcements
toggledbitsT
Build 21228 has been released. Docker images available from DockerHub as usual, and bare-metal packages here. Home Assistant up to version 2021.8.6 supported; the online version of the manual will now state the current supported versions; Fix an error in OWMWeatherController that could cause it to stop updating; Unify the approach to entity filtering on all hub interface classes (controllers); this works for device entities only; it may be extended to other entities later; Improve error detail in messages for EzloController during auth phase; Add isRuleSet() and isRuleEnabled() functions to expressions extensions; Implement set action for lock and passage capabilities (makes them more easily scriptable in some cases); Fix a place in the UI where 24-hour time was not being displayed.
Multi-System Reactor
Reactor Inspect - a small read-only helper panel for MSR
wmarcolinW
Topic thumbnail image
Multi-System Reactor
Reactor Build 26284 stuck at Loading Reactor UI
T
Topic thumbnail image
Multi-System Reactor
MSR with reverse proxy
tunnusT
I'm trying to use MSR via reserve proxy in Synology DSM, but MSR page does not load https://<public ip>:30000/reactor/en-US/ At the same time logging page loads normally https://<public ip>:30000/api/v1/log I thought maybe authentication was messing it up, but there was no deny entries in the log, and also disabling authentication did not make any difference. For this use case VPN is not an option (that works, but as said not an option for this particular use case). Any ideas what could cause this? MSR build latest-26242-28d69aa8, Chrome browser
Multi-System Reactor
Missing attribute after upgrade
3
Topic thumbnail image
Multi-System Reactor
[MSR] Native fan capabilty
therealdbT
Nothing more to add. I see we have hvac_blower, but, anyway, maybe a native fan on the same assumptions of the fan from HASS could be reasonable. I have a couple of them. ie, this is from ESPHome via HASS. x_hass.domain="fan" x_hass.entity_id="fan.kitchen_seashell_hood_ventilation_fan" x_hass.floor_id=null x_hass.services=["fan","esphome"] x_hass.source="esphome" x_hass.state="off" x_hass_attr.friendly_name="Seashell Hood Ventilation Fan" x_hass_attr.percentage=50 x_hass_attr.percentage_step=25 x_hass_attr.preset_mode="" x_hass_attr.preset_modes=[] x_hass_attr.supported_features=49 Thanks.
Multi-System Reactor
[MSR] Rule do not fire
therealdbT
Topic thumbnail image
Multi-System Reactor
Rule condition shows TRUE in UI but Rule never transitions to SET — survives full restart
N
Build: latest-26221-b25bb3e3, Docker on Synology. Hi, I have a Rule whose Trigger/Constraints reference other Rules via Rule State ... is TRUE. At some point it stops firing. Expanding the rule's condition tree in the UI shows every Trigger and Constraint condition green/TRUE — confirmed live by walking into the room and watching Motion go true in real time. Rule History shows no new SET, just old reset entries. Tried, on the same rule, same evening: recreating the trigger conditions with fresh IDs, recreating the constraint conditions with fresh IDs (flat and wrapped in a new Group — wrapping in a Group produced one SET, but it didn't reproduce on repeat attempts with the same structure), and finally a full container restart with a verified-correct saved rule. Still no SET, even with a fresh live motion event right after the restart. Separately, I found that this rule (and its 10 per-room clones) share identical internal condition/group IDs with each other — leftover from a batch clone done months ago, never regenerated. Not sure if that's related, since fixing the IDs didn't reliably fix the symptom either. Has anyone seen a Rule State condition show TRUE in the UI without the Rule ever producing a SET, surviving a clean restart? Thanks in advance
Multi-System Reactor
DynamicGroupController and attributes
therealdbT
Hey @toggledbits I'm back to trying to optimize a couple of things based on dynamic group. First of all, I think I found a typo in the doc: primary_attribute: "binary_sensor.state" primary_attribute_value: | d = false; each id in members: d = getEntity(id)?.attributes?.power_switch?.state or d, d I think the correct code snippet is d = false, All that said, my use case for dynamic groups is to group 3 different climate devices, so I could easily command them at the same time. Commands are good, but sometimes I want to check if any of the devices are on, and that's easily done with a similar snippet as the one you have in the docs. But this is limited to the primary attribute, while I want to have any of the attributes in the group to be driven by a similar logic (while all are null in the group). ie, access hvac_control.mode and see if any of the unit is set to cool, or heat. Is that possible, without re-defining an expression in each of my rules? Thanks!
Multi-System Reactor
Unofficial thread for compatibility
tunnusT
As there are statements about compatibility for home assistant versions in MSR new version announcements (e.g. "HassController: Bless Hass to 2025.7.3"), I thought it would be good idea to track other controllers as well. As an example, I can confirm that build "latest-25208-c53e8513" works with Hubitat Elevation C-8 platform version 2.4.2.134 using Maker API. Updates: (the latest versions first in the list) OK: build "latest-25264-2fbe9217" with Hubitat C-8 platform v. 2.4.3.123
Multi-System Reactor
Ooops - Deleted Reactor Ex Machina II
R
I accidentally deleted Reactor Ex Machina II (REM II) from my Reactor rules. I tried to recover it by deleting the .json and .dval in the Rules subdirectory and then recreating it from Togglebits original posting, but that did not work. Does anyone know how to recover REM ll ?
Multi-System Reactor
Bail out of failed reaction?
T
Topic thumbnail image
Multi-System Reactor
Arming Envisalink panel from MSR
T
Topic thumbnail image
Multi-System Reactor
[Solved] DynamicGroupController updating members issue
CrilleC
Edit: Solved in latest-26221. Bare-metal latest-26193 I have this group: "OKforLarm": name: OK för Larm select: - include_controller: vera - include_capability: door_sensor filter_expression: entity.attributes.door_sensor.state It contains the entities I expect but behaves a bit odd. When I open vera>device_10097 the entity attribute door_sensor.state changes to true but it won't show up as member in the group, when I also open vera>device_10095 they both shows as members and when I close vera>device_10095 it disappear from the group but when I close vera>device_10097 it lingers in the group until I restart Reactor.
Multi-System Reactor
Upgrade Issues
T
Topic thumbnail image
Multi-System Reactor
[SOLVED] Conflicting Set Reaction Groups Appear to Fire Simultaneously in Single Rule Evaluation
G
Topic thumbnail image
Multi-System Reactor

MFA

Scheduled Pinned Locked Moved Multi-System Reactor
28 Posts 4 Posters 597 Views 4 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • T tamorgen

    Still no joy. I'm still getting Access Denied after entering my username and password

    [latest-26298]2026-10-30T11:39:27.726Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-10-30T11:39:27.735Z <wsapi:5:wsapi.js:152> (event handler) sending update for 5 entities
[latest-26298]2026-10-30T11:39:27.982Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.127" via ::ffff:192.168.1.127 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
[latest-26298]2026-10-30T11:39:27.982Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
[latest-26298]2026-10-30T11:39:27.990Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
[latest-26298]2026-10-30T11:39:27.991Z <httpapi:INFO> httpapi#1 API request from ::ffff:192.168.1.127 (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
[latest-26298]2026-10-30T11:39:27.991Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.127 user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
[latest-26298]2026-10-30T11:39:28.264Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-10-30T11:39:28.265Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-10-30T11:39:28.265Z <wsapi:5:wsapi.js:169> (event handler): sending data


    
groups:
  api_allowed:
    users:
      - admin
      - tmorgenthaler

api_acls:
  - url: "/api/"
    group: api_allowed
    source_ip: 192.168.1.1/24
    allow: true
    toggledbitsT Offline
    toggledbitsT Offline
    toggledbits
    wrote last edited by
    #17

    @tamorgen said in MFA:

    • url: "/api/"

    Remove the trailing slash.

    Author of Multi-system Reactor and Reactor, DelayLight, Switchboard, and about a dozen other plugins that run on Vera and openLuup.

    T 1 Reply Last reply
    0
    • toggledbitsT toggledbits

      @tamorgen said in MFA:

      • url: "/api/"

      Remove the trailing slash.

      T Online
      T Online
      tamorgen
      wrote last edited by tamorgen
      #18

      @toggledbits said in MFA:

      @tamorgen said in MFA:

      • url: "/api/"

      Remove the trailing slash.

      Just getting back to this.

      I removed the trailing slash, and I'm still getting the same result. I get prompted for my user name and password (same as before), but as soon as I put it in, I get Access Denied. I'm using Chrome incognito mode.

      4d1a6498-5b64-4cb8-b88a-f51ea0a989cd-image.png

      [latest-26298]2026-11-02T16:22:39.572Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-02T16:22:39.596Z <wsapi:5:wsapi.js:152> (event handler) sending update for 1 entities
[latest-26298]2026-11-02T16:22:39.983Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.123" via ::ffff:192.168.1.123 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
[latest-26298]2026-11-02T16:22:39.984Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
[latest-26298]2026-11-02T16:22:39.995Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
[latest-26298]2026-11-02T16:22:39.995Z <httpapi:INFO> httpapi#1 API request from ::ffff:192.168.1.123 (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
[latest-26298]2026-11-02T16:22:39.995Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.123 user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
[latest-26298]2026-11-02T16:22:41.549Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-02T16:22:41.550Z <wsapi:5:wsapi.js:169> (event handler): sending data

      groups:
  api_allowed:
    users:
      - admin
      - tmorgenthaler

api_acls:
  - url: "/api"
    group: api_allowed
    source_ip: 192.168.1.1/24
    allow: true
      1 Reply Last reply
      0
      • toggledbitsT Offline
        toggledbitsT Offline
        toggledbits
        wrote last edited by toggledbits
        #19

        Turn on ACL debug. The log will then show why your ACL isn't matched.

        Also look in your startup messages for any errors (specifically, search for "ignoring config").

        Author of Multi-system Reactor and Reactor, DelayLight, Switchboard, and about a dozen other plugins that run on Vera and openLuup.

        T 1 Reply Last reply
        0
        • toggledbitsT toggledbits

          Turn on ACL debug. The log will then show why your ACL isn't matched.

          Also look in your startup messages for any errors (specifically, search for "ignoring config").

          T Online
          T Online
          tamorgen
          wrote last edited by tamorgen
          #20

          @toggledbits
          I changed the debug to true, this is what I'm seeing in the logs now:

          [latest-26298]2026-11-03T16:31:21.448Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:31:21.448Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:31:21.449Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:31:21.472Z <wsapi:5:wsapi.js:152> (event handler) sending update for 5 entities
[latest-26298]2026-11-03T16:31:21.820Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "69.255.234.254" via ::ffff:192.168.1.73 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
[latest-26298]2026-11-03T16:31:21.820Z <httpapi:5:httpapi.js:1135> httpapi#1 pass_all_proxy is set, passing proxy req from "69.255.234.254" via ::ffff:192.168.1.73
[latest-26298]2026-11-03T16:31:21.820Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
[latest-26298]2026-11-03T16:31:21.829Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
[latest-26298]2026-11-03T16:31:21.830Z <httpapi:INFO> httpapi#1 API request from "69.255.234.254" (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
[latest-26298]2026-11-03T16:31:21.830Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from "69.255.234.254" user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
[latest-26298]2026-11-03T16:31:21.834Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:31:21.834Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:31:21.835Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:31:21.835Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:31:21.836Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:31:21.836Z <wsapi:5:wsapi.js:169> (event handler): sending data

          I tried again using my local IP, and not using the Cloudflared tunnel

          [latest-26298]2026-11-03T16:34:36.924Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:34:36.924Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:34:36.949Z <wsapi:5:wsapi.js:152> (event handler) sending update for 5 entities
[latest-26298]2026-11-03T16:34:36.987Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.127" via ::ffff:192.168.1.127 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
[latest-26298]2026-11-03T16:34:36.987Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
[latest-26298]2026-11-03T16:34:36.996Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
[latest-26298]2026-11-03T16:34:36.996Z <httpapi:INFO> httpapi#1 API request from ::ffff:192.168.1.127 (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
[latest-26298]2026-11-03T16:34:36.996Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.127 user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
[latest-26298]2026-11-03T16:34:36.997Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:34:36.998Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:34:36.998Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:34:36.999Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:34:37.023Z <wsapi:5:wsapi.js:152> (event handler) sending update for 2 entities
[latest-26298]2026-11-03T16:34:37.099Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.127" via ::ffff:192.168.1.127 for GET /favicon.ico lang en-US,en;q=0.9 (TLSv1.3)
[latest-26298]2026-11-03T16:34:37.237Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:34:37.237Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:34:37.238Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:34:37.238Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:34:37.238Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:34:37.239Z <wsapi:5:wsapi.js:169> (event handler): sending data
          1 Reply Last reply
          0
          • toggledbitsT Offline
            toggledbitsT Offline
            toggledbits
            wrote last edited by
            #21

            As part of startup, you have two log messages: httpapi#1 ACLs and httpapi#1 ACL index, one after the other, both with additional data on the same line. Please post those. It looks like your custom ACL is not even being loaded. I would check your users.yaml file against yamllint.com or similar tool... I'm betting you have another error in the file and it's preventing the file from being loaded at all, so the last-known-good version of the configuration (without your ACL change) is being loaded.

            Author of Multi-system Reactor and Reactor, DelayLight, Switchboard, and about a dozen other plugins that run on Vera and openLuup.

            T 1 Reply Last reply
            0
            • toggledbitsT toggledbits

              As part of startup, you have two log messages: httpapi#1 ACLs and httpapi#1 ACL index, one after the other, both with additional data on the same line. Please post those. It looks like your custom ACL is not even being loaded. I would check your users.yaml file against yamllint.com or similar tool... I'm betting you have another error in the file and it's preventing the file from being loaded at all, so the last-known-good version of the configuration (without your ACL change) is being loaded.

              T Online
              T Online
              tamorgen
              wrote last edited by
              #22

              @toggledbits
              Okay, that was helpful. There was an error, and now I'm getting more information. I'm still getting Access Denied, for two separate reasons I think.

              [latest-26298]2026-11-03T16:50:01.487Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:50:01.488Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:50:01.510Z <wsapi:5:wsapi.js:152> (event handler) sending update for 5 entities
[latest-26298]2026-11-03T16:50:01.669Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "69.255.234.254" via ::ffff:192.168.1.73 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
[latest-26298]2026-11-03T16:50:01.669Z <httpapi:5:httpapi.js:1135> httpapi#1 pass_all_proxy is set, passing proxy req from "69.255.234.254" via ::ffff:192.168.1.73
[latest-26298]2026-11-03T16:50:01.669Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
[latest-26298]2026-11-03T16:50:01.684Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
[latest-26298]2026-11-03T16:50:01.685Z <httpapi:INFO> httpapi#1 API request from "69.255.234.254" (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
[latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 checking ACLs for /api/v1/mfa.add/tmorgenthaler user tmorgenthaler authorization basic
[latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1/mfa.add/tmorgenthaler; reducing path
[latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1/mfa.add; reducing path
[latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1; reducing path
[latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against /api ACL { "url": "/api", "group": "api_allowed", "source_ip": "192.168.1.1/24", "allow": true, "index": 0 }
[latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 ACL no match: user tmorgenthaler to group:api_allowed
[latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against /api ACL { "url": "/api", "source_ip": "127/8", "allow": true, "index": 6 }
[latest-26298]2026-11-03T16:50:01.686Z <httpapi:null> httpapi#1 ACL no match: IP "69.255.234.254" to source_ip:"127/8"
[latest-26298]2026-11-03T16:50:01.686Z <httpapi:null> httpapi#1 no ACLs matched for /api; reducing path
[latest-26298]2026-11-03T16:50:01.686Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against / ACL { "url": "/", "allow": false, "index": 7 }
[latest-26298]2026-11-03T16:50:01.686Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from "69.255.234.254" user tmorgenthaler auth basic matches / ACL (#7): { "url": "/", "allow": false, "index": 7 }
[latest-26298]2026-11-03T16:50:01.841Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-03T16:50:01.842Z <wsapi:5:wsapi.js:169> (event handler): sending data

              One, it looks like it's seeing my proxy address. I know I set up proxy access in the lastest version of the reactor.yaml file, but it looks like I may need to do the same here.

              From reactor.yaml

              # baseurl - The base URL to access the Reactor system. If you want to use
#           HTTPS, please see the How-To section of the docs.
baseurl: "https://192.168.1.70:8554"
trusted_proxy: "192.168.1.73"
proxy_baseurl: "https://reactor.notmydomain.com:443"  
pass_all_proxy: true

              Do I need to put a proxy_baseurl and pass all proxy tag in the users.yaml as well?

              The users.yaml file contains the user, so I'm guessing it's hitting the trusted IP filter first?

              groups:
  # This section defines your user groups. Optionally, it defines application
  # and API access restrictions (ACLs) for the group. Users may belong to
  # more than one group. Again, no required or special groups here.
  admin:
    users:
      - admin
      - tmorgenthaler
    applications: true  # special form allows access to ALL applications
    api:
      default: allow
    api_allowed:
      users:
        - admin
        - tmorgenthaler

api_acls:
  - url: "/api"
    group: api_allowed
    source_ip: 192.168.1.1/24
    allow: true
              1 Reply Last reply
              0
              • T Online
                T Online
                tamorgen
                wrote last edited by tamorgen
                #23

                Okay, this is not making any sense. I'm trying directly from my local workstation, going to the local IP, and I'm still seeing no match on IP.

                This is the command I'm using in a browser, in incognito mode, after restarting my docker instance of reactor.

                https://192.168.1.70:8554/api/v1/mfa.add/tmorgenthaler?askauth=1

                [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 ACL no match: IP ::ffff:192.168.1.127 to source_ip:"127/8"
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api; reducing path

                The api_acl list has the whole /24 as allowed.

                api_acls:
  - url: "/api"
    group: api_allowed
    source_ip: 192.168.1.1/24
    allow: true

                [latest-26298]2026-11-04T12:43:45.776Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-04T12:43:45.777Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-04T12:43:45.801Z <wsapi:5:wsapi.js:152> (event handler) sending update for 4 entities
[latest-26298]2026-11-04T12:43:45.804Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.127" via ::ffff:192.168.1.127 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
[latest-26298]2026-11-04T12:43:45.805Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
[latest-26298]2026-11-04T12:43:45.817Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
[latest-26298]2026-11-04T12:43:45.817Z <httpapi:INFO> httpapi#1 API request from ::ffff:192.168.1.127 (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 checking ACLs for /api/v1/mfa.add/tmorgenthaler user tmorgenthaler authorization basic
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1/mfa.add/tmorgenthaler; reducing path
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1/mfa.add; reducing path
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1; reducing path
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against /api ACL { "url": "/api", "group": "api_allowed", "source_ip": "192.168.1.1/24", "allow": true, "index": 0 }
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 ACL no match: user tmorgenthaler to group:api_allowed
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against /api ACL { "url": "/api", "source_ip": "127/8", "allow": true, "index": 6 }
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 ACL no match: IP ::ffff:192.168.1.127 to source_ip:"127/8"
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api; reducing path
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against / ACL { "url": "/", "allow": false, "index": 7 }
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.127 user tmorgenthaler auth basic matches / ACL (#7): { "url": "/", "allow": false, "index": 7 }
[latest-26298]2026-11-04T12:43:46.137Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-04T12:43:46.138Z <wsapi:5:wsapi.js:169> (event handler): sending data

                My username is in the admin users group, and in the api_allowed users group. My workstation IP of 192.168.1.127 is in the 192.168.1.1/24 network range.

                What am I missing that the debug logs are telling me?

                tunnusT 1 Reply Last reply
                0
                • T tamorgen

                  Okay, this is not making any sense. I'm trying directly from my local workstation, going to the local IP, and I'm still seeing no match on IP.

                  This is the command I'm using in a browser, in incognito mode, after restarting my docker instance of reactor.

                  https://192.168.1.70:8554/api/v1/mfa.add/tmorgenthaler?askauth=1

                  [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 ACL no match: IP ::ffff:192.168.1.127 to source_ip:"127/8"
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api; reducing path

                  The api_acl list has the whole /24 as allowed.

                  api_acls:
  - url: "/api"
    group: api_allowed
    source_ip: 192.168.1.1/24
    allow: true

                  [latest-26298]2026-11-04T12:43:45.776Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-04T12:43:45.777Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-04T12:43:45.801Z <wsapi:5:wsapi.js:152> (event handler) sending update for 4 entities
[latest-26298]2026-11-04T12:43:45.804Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.127" via ::ffff:192.168.1.127 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
[latest-26298]2026-11-04T12:43:45.805Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
[latest-26298]2026-11-04T12:43:45.817Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
[latest-26298]2026-11-04T12:43:45.817Z <httpapi:INFO> httpapi#1 API request from ::ffff:192.168.1.127 (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 checking ACLs for /api/v1/mfa.add/tmorgenthaler user tmorgenthaler authorization basic
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1/mfa.add/tmorgenthaler; reducing path
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1/mfa.add; reducing path
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1; reducing path
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against /api ACL { "url": "/api", "group": "api_allowed", "source_ip": "192.168.1.1/24", "allow": true, "index": 0 }
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 ACL no match: user tmorgenthaler to group:api_allowed
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against /api ACL { "url": "/api", "source_ip": "127/8", "allow": true, "index": 6 }
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 ACL no match: IP ::ffff:192.168.1.127 to source_ip:"127/8"
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api; reducing path
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against / ACL { "url": "/", "allow": false, "index": 7 }
[latest-26298]2026-11-04T12:43:45.818Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.127 user tmorgenthaler auth basic matches / ACL (#7): { "url": "/", "allow": false, "index": 7 }
[latest-26298]2026-11-04T12:43:46.137Z <wsapi:5:wsapi.js:169> (event handler): sending data
[latest-26298]2026-11-04T12:43:46.138Z <wsapi:5:wsapi.js:169> (event handler): sending data

                  My username is in the admin users group, and in the api_allowed users group. My workstation IP of 192.168.1.127 is in the 192.168.1.1/24 network range.

                  What am I missing that the debug logs are telling me?

                  tunnusT Offline
                  tunnusT Offline
                  tunnus
                  wrote last edited by tunnus
                  #24

                  @tamorgen you could try the canonical CIDR notation of 192.168.1.0/24 and see if it makes any difference (replace last 1 with 0)

                  Using MSR on Docker (Synology NAS), having InfluxDB, Grafana & Home Assistant, Zigbee2MQTT & ZWA-2

                  1 Reply Last reply
                  0
                  • toggledbitsT Offline
                    toggledbitsT Offline
                    toggledbits
                    wrote last edited by
                    #25

                    The indenting of your groups section is very goofed up. api_allowed and everything below it should be outdented two spaces... same alignment as admin, not underneath it as you've shown. Also the two lines showing after applications under admin... no idea where that comes from or what it's supposed to do. Not sure what the intent was, but that's not anything Reactor will see or care about.

                    proxy_baseurl and pass_all_proxy do not go in users.yaml.

                    Author of Multi-system Reactor and Reactor, DelayLight, Switchboard, and about a dozen other plugins that run on Vera and openLuup.

                    T 1 Reply Last reply
                    0
                    • toggledbitsT toggledbits

                      The indenting of your groups section is very goofed up. api_allowed and everything below it should be outdented two spaces... same alignment as admin, not underneath it as you've shown. Also the two lines showing after applications under admin... no idea where that comes from or what it's supposed to do. Not sure what the intent was, but that's not anything Reactor will see or care about.

                      proxy_baseurl and pass_all_proxy do not go in users.yaml.

                      T Online
                      T Online
                      tamorgen
                      wrote last edited by
                      #26

                      @toggledbits said in MFA:

                      The indenting of your groups section is very goofed up. api_allowed and everything below it should be outdented two spaces... same alignment as admin, not underneath it as you've shown. Also the two lines showing after applications under admin... no idea where that comes from or what it's supposed to do. Not sure what the intent was, but that's not anything Reactor will see or care about.

                      proxy_baseurl and pass_all_proxy do not go in users.yaml.

                      The indenting was the issue. Worked without any changes to the network source ( .1 vs .0). I must have looked at it 20 times and never caught it. Thanks.

                      And I was also wondering where those two lines came from. I had commented them out, because I couldn't find them in the documentation. I must have copied it from somewhere, but not sure where right now.

                      Thanks!

                      1 Reply Last reply
                      0
                      • toggledbitsT Offline
                        toggledbitsT Offline
                        toggledbits
                        wrote last edited by
                        #27

                        I'll take some responsibility here for not asking to see the entire file and just relying on snippets (hard to tell indent and relation to other data).

                        BTW, the give-away was this:

                        [latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 ACL no match: user tmorgenthaler to group:api_allowed

                        It's saying that the user isn't in the group. But the group was in your config file... so this says it can't see your group... and the indenting explained why.

                        Author of Multi-system Reactor and Reactor, DelayLight, Switchboard, and about a dozen other plugins that run on Vera and openLuup.

                        T 1 Reply Last reply
                        0
                        • toggledbitsT toggledbits

                          I'll take some responsibility here for not asking to see the entire file and just relying on snippets (hard to tell indent and relation to other data).

                          BTW, the give-away was this:

                          [latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 ACL no match: user tmorgenthaler to group:api_allowed

                          It's saying that the user isn't in the group. But the group was in your config file... so this says it can't see your group... and the indenting explained why.

                          T Online
                          T Online
                          tamorgen
                          wrote last edited by tamorgen
                          #28

                          @toggledbits said in MFA:

                          I'll take some responsibility here for not asking to see the entire file and just relying on snippets (hard to tell indent and relation to other data).

                          No worries. At least it got solved.

                          Funny thing is, I was looking for a sample user config file, like you have when you are setting up the reactor.yaml. If I had found that, it might have clued me in.

                          And the whole MFA thing was just an extra layer of security. I keep Reactor accessible through my Cloudlfared tunnel, but I already have that security through another layer of MFA from Cloudflare. Anyone trying to hit my URL would have to get through that MFA layer first. This is just in case Cloudflare get's compromised somehow, then I still have an extra layer in place to keep my network secure.

                          1 Reply Last reply
                          0
                          Reply
                          • Reply as topic
                          Log in to reply
                          • Oldest to Newest
                          • Newest to Oldest
                          • Most Votes

                          Recent Topics

                          • MFA
                            T
                            tamorgen
                            0
                            28
                            597
                          • Reverse proxy & API ACL
                            toggledbitsT
                            toggledbits
                            0
                            8
                            121
                          • Grouped devices
                            G
                            gwp1
                            0
                            3
                            93
                          • Login protections
                            toggledbitsT
                            toggledbits
                            0
                            2
                            138
                          • Reactor (Multi-System/Multi-Hub) Announcements
                            toggledbitsT
                            toggledbits
                            5
                            152
                            152.4k
                          • Reactor Inspect - a small read-only helper panel for MSR
                            G
                            gwp1
                            2
                            6
                            402
                          • Reactor Build 26284 stuck at Loading Reactor UI
                            T
                            tamorgen
                            0
                            16
                            1.5k
                          • MSR with reverse proxy
                            tunnusT
                            tunnus
                            0
                            12
                            743
                          • Missing attribute after upgrade
                            3
                            3rdStng
                            0
                            3
                            440
                          • Use of Google Gemini as an MSR and Hubitat configuration aid
                            therealdbT
                            therealdb
                            0
                            2
                            262
                          • [MSR] Native fan capabilty
                            therealdbT
                            therealdb
                            1
                            3
                            250
                          • [MSR] Rule do not fire
                            therealdbT
                            therealdb
                            0
                            4
                            367
                          Powered by NodeBB | Contributors
                          Hosted freely by 10RUPTiV - Solutions Technologiques | Contact us
                          • Login
                          • Don't have an account? Register
                          • Login or register to search.
                          • First post
                            Last post
                          0
                          • Categories
                          • Recent
                          • Tags
                          • Popular
                          • Unsolved