Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Unsolved
Collapse
Discussion Forum to share and further the development of home control and automation, independent of platforms.
T

tamorgen

@tamorgen
Hubitat upgrade 2.5.3.123 may have broken login
3
Topic thumbnail image
Multi-System Reactor
Reactor Inspect - a small read-only helper panel for MSR
wmarcolinW
Topic thumbnail image
Multi-System Reactor
Reverse proxy & API ACL
tunnusT
I'm trying to allow anonymous access from a local network to /api/v1/log, but the problem now with the reverse proxy configuration is that this access is open via proxy to the internet. At least I wasn't able to configure ACL so that only an access from a local network would be permitted. reactor.yaml: baseurl: "http://192.168.1.12:8111" proxy_baseurl: "https://external.com:30000" trusted_proxy: "192.168.1.12" Local traffic would originate from 192.168.1.0/24 network. Synology is acting as a reverse proxy and hosting MSR as a docker container (which has its own network and IP 172.18.0.5). MSR build is latest-26298-fbb75fb8 users.yaml: - url: "/api/v1/log" method: "GET" source_ip: 172.18.0.0/24 allow: true Using the above ACL works, but it enables access via proxy also. If I use source_ip: 192.168.1.0/24, then it doesn't work either locally or remotely. So I'm kinda lost what should I use as source_ip in this case?
Multi-System Reactor
MFA
T
Topic thumbnail image
Multi-System Reactor
Grouped devices
G
I've seen many of you using Dynamic Group Controller. I'm using it myself for monitoring device battery levels. I've read and re-read the Dynamic Group Controller docs and still cannot come to an answer for my question so let me paint my scenario: I've migrated from EchoSpeaks in Hubitat ('cause borked and seemingly unmaintained) to Alexa Devices in Home Assistant ('cause not borked in 2026.11.0) to be able to send TTS to my Echo devices. In EchoSpeaks I could create groups. Sweet. In Alexa Devices I don't seem to be able to do so. As such, my thought was "wait - isn't there a way in MSR?" Is this an effective scenario that Dynamic Group Controller can be used for?
Multi-System Reactor
Login protections
tunnusT
Topic thumbnail image
Multi-System Reactor
Reactor (Multi-System/Multi-Hub) Announcements
toggledbitsT
Build 21228 has been released. Docker images available from DockerHub as usual, and bare-metal packages here. Home Assistant up to version 2021.8.6 supported; the online version of the manual will now state the current supported versions; Fix an error in OWMWeatherController that could cause it to stop updating; Unify the approach to entity filtering on all hub interface classes (controllers); this works for device entities only; it may be extended to other entities later; Improve error detail in messages for EzloController during auth phase; Add isRuleSet() and isRuleEnabled() functions to expressions extensions; Implement set action for lock and passage capabilities (makes them more easily scriptable in some cases); Fix a place in the UI where 24-hour time was not being displayed.
Multi-System Reactor
Reactor Build 26284 stuck at Loading Reactor UI
T
Topic thumbnail image
Multi-System Reactor
MSR with reverse proxy
tunnusT
I'm trying to use MSR via reserve proxy in Synology DSM, but MSR page does not load https://<public ip>:30000/reactor/en-US/ At the same time logging page loads normally https://<public ip>:30000/api/v1/log I thought maybe authentication was messing it up, but there was no deny entries in the log, and also disabling authentication did not make any difference. For this use case VPN is not an option (that works, but as said not an option for this particular use case). Any ideas what could cause this? MSR build latest-26242-28d69aa8, Chrome browser
Multi-System Reactor
Missing attribute after upgrade
3
Topic thumbnail image
Multi-System Reactor
Use of Google Gemini as an MSR and Hubitat configuration aid
R
I may be late to the AI party on this, but I recently ran into difficulty installing and configuring the Nexia Thermostat Manager on my Hubitat C8 Pro. Hoping for some immediate help I performed a Google search on my problem. I was a bit surprised to see Gemini jump into assist. Gemini walked me through the steps to clean up the failed install, followed by a script for successful installation and configuration. I would not have expected Gemini to "know" this much about Hubitat. Next I sought assistance MSR with the Entity Actions needed to set up the desired controls. I was unclear which of the attribute fields I should to set the cooling an heating temperatures. Once again, Gemini came back not with just a link to a possible explanation, but an easy to follow explanation instead. Once again, I did not expect Gemini to provide such detailed assistance with MSR. Gemini will be a key tool in my HA toolkit in the future.
How-To
[MSR] Native fan capabilty
therealdbT
Nothing more to add. I see we have hvac_blower, but, anyway, maybe a native fan on the same assumptions of the fan from HASS could be reasonable. I have a couple of them. ie, this is from ESPHome via HASS. x_hass.domain="fan" x_hass.entity_id="fan.kitchen_seashell_hood_ventilation_fan" x_hass.floor_id=null x_hass.services=["fan","esphome"] x_hass.source="esphome" x_hass.state="off" x_hass_attr.friendly_name="Seashell Hood Ventilation Fan" x_hass_attr.percentage=50 x_hass_attr.percentage_step=25 x_hass_attr.preset_mode="" x_hass_attr.preset_modes=[] x_hass_attr.supported_features=49 Thanks.
Multi-System Reactor
[MSR] Rule do not fire
therealdbT
Topic thumbnail image
Multi-System Reactor
Rule condition shows TRUE in UI but Rule never transitions to SET — survives full restart
N
Build: latest-26221-b25bb3e3, Docker on Synology. Hi, I have a Rule whose Trigger/Constraints reference other Rules via Rule State ... is TRUE. At some point it stops firing. Expanding the rule's condition tree in the UI shows every Trigger and Constraint condition green/TRUE — confirmed live by walking into the room and watching Motion go true in real time. Rule History shows no new SET, just old reset entries. Tried, on the same rule, same evening: recreating the trigger conditions with fresh IDs, recreating the constraint conditions with fresh IDs (flat and wrapped in a new Group — wrapping in a Group produced one SET, but it didn't reproduce on repeat attempts with the same structure), and finally a full container restart with a verified-correct saved rule. Still no SET, even with a fresh live motion event right after the restart. Separately, I found that this rule (and its 10 per-room clones) share identical internal condition/group IDs with each other — leftover from a batch clone done months ago, never regenerated. Not sure if that's related, since fixing the IDs didn't reliably fix the symptom either. Has anyone seen a Rule State condition show TRUE in the UI without the Rule ever producing a SET, surviving a clean restart? Thanks in advance
Multi-System Reactor
DynamicGroupController and attributes
therealdbT
Hey @toggledbits I'm back to trying to optimize a couple of things based on dynamic group. First of all, I think I found a typo in the doc: primary_attribute: "binary_sensor.state" primary_attribute_value: | d = false; each id in members: d = getEntity(id)?.attributes?.power_switch?.state or d, d I think the correct code snippet is d = false, All that said, my use case for dynamic groups is to group 3 different climate devices, so I could easily command them at the same time. Commands are good, but sometimes I want to check if any of the devices are on, and that's easily done with a similar snippet as the one you have in the docs. But this is limited to the primary attribute, while I want to have any of the attributes in the group to be driven by a similar logic (while all are null in the group). ie, access hvac_control.mode and see if any of the unit is set to cool, or heat. Is that possible, without re-defining an expression in each of my rules? Thanks!
Multi-System Reactor
Unofficial thread for compatibility
tunnusT
As there are statements about compatibility for home assistant versions in MSR new version announcements (e.g. "HassController: Bless Hass to 2025.7.3"), I thought it would be good idea to track other controllers as well. As an example, I can confirm that build "latest-25208-c53e8513" works with Hubitat Elevation C-8 platform version 2.4.2.134 using Maker API. Updates: (the latest versions first in the list) OK: build "latest-25264-2fbe9217" with Hubitat C-8 platform v. 2.4.3.123
Multi-System Reactor
Ooops - Deleted Reactor Ex Machina II
R
I accidentally deleted Reactor Ex Machina II (REM II) from my Reactor rules. I tried to recover it by deleting the .json and .dval in the Rules subdirectory and then recreating it from Togglebits original posting, but that did not work. Does anyone know how to recover REM ll ?
Multi-System Reactor
Bail out of failed reaction?
T
Topic thumbnail image
Multi-System Reactor
Arming Envisalink panel from MSR
T
Topic thumbnail image
Multi-System Reactor
[Solved] DynamicGroupController updating members issue
CrilleC
Edit: Solved in latest-26221. Bare-metal latest-26193 I have this group: "OKforLarm": name: OK för Larm select: - include_controller: vera - include_capability: door_sensor filter_expression: entity.attributes.door_sensor.state It contains the entities I expect but behaves a bit odd. When I open vera>device_10097 the entity attribute door_sensor.state changes to true but it won't show up as member in the group, when I also open vera>device_10095 they both shows as members and when I close vera>device_10095 it disappear from the group but when I close vera>device_10097 it lingers in the group until I restart Reactor.
Multi-System Reactor
About
Posts
253
Topics
47
Shares
0
Groups
0
Followers
0
Following
0

Posts

Recent Best Controversial

  • MFA
    T tamorgen

    @toggledbits said in MFA:

    I'll take some responsibility here for not asking to see the entire file and just relying on snippets (hard to tell indent and relation to other data).

    No worries. At least it got solved.

    Funny thing is, I was looking for a sample user config file, like you have when you are setting up the reactor.yaml. If I had found that, it might have clued me in.

    And the whole MFA thing was just an extra layer of security. I keep Reactor accessible through my Cloudlfared tunnel, but I already have that security through another layer of MFA from Cloudflare. Anyone trying to hit my URL would have to get through that MFA layer first. This is just in case Cloudflare get's compromised somehow, then I still have an extra layer in place to keep my network secure.

    Multi-System Reactor

  • MFA
    T tamorgen

    @toggledbits said in MFA:

    The indenting of your groups section is very goofed up. api_allowed and everything below it should be outdented two spaces... same alignment as admin, not underneath it as you've shown. Also the two lines showing after applications under admin... no idea where that comes from or what it's supposed to do. Not sure what the intent was, but that's not anything Reactor will see or care about.

    proxy_baseurl and pass_all_proxy do not go in users.yaml.

    The indenting was the issue. Worked without any changes to the network source ( .1 vs .0). I must have looked at it 20 times and never caught it. Thanks.

    And I was also wondering where those two lines came from. I had commented them out, because I couldn't find them in the documentation. I must have copied it from somewhere, but not sure where right now.

    Thanks!

    Multi-System Reactor

  • MFA
    T tamorgen

    Okay, this is not making any sense. I'm trying directly from my local workstation, going to the local IP, and I'm still seeing no match on IP.

    This is the command I'm using in a browser, in incognito mode, after restarting my docker instance of reactor.

    https://192.168.1.70:8554/api/v1/mfa.add/tmorgenthaler?askauth=1

    [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 ACL no match: IP ::ffff:192.168.1.127 to source_ip:"127/8"
    [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api; reducing path
    

    The api_acl list has the whole /24 as allowed.

    api_acls:
      - url: "/api"
        group: api_allowed
        source_ip: 192.168.1.1/24
        allow: true
    
    [latest-26298]2026-11-04T12:43:45.776Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-04T12:43:45.777Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-04T12:43:45.801Z <wsapi:5:wsapi.js:152> (event handler) sending update for 4 entities
    [latest-26298]2026-11-04T12:43:45.804Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.127" via ::ffff:192.168.1.127 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-11-04T12:43:45.805Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
    [latest-26298]2026-11-04T12:43:45.817Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
    [latest-26298]2026-11-04T12:43:45.817Z <httpapi:INFO> httpapi#1 API request from ::ffff:192.168.1.127 (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
    [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 checking ACLs for /api/v1/mfa.add/tmorgenthaler user tmorgenthaler authorization basic
    [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1/mfa.add/tmorgenthaler; reducing path
    [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1/mfa.add; reducing path
    [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1; reducing path
    [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against /api ACL { "url": "/api", "group": "api_allowed", "source_ip": "192.168.1.1/24", "allow": true, "index": 0 }
    [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 ACL no match: user tmorgenthaler to group:api_allowed
    [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against /api ACL { "url": "/api", "source_ip": "127/8", "allow": true, "index": 6 }
    [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 ACL no match: IP ::ffff:192.168.1.127 to source_ip:"127/8"
    [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 no ACLs matched for /api; reducing path
    [latest-26298]2026-11-04T12:43:45.818Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against / ACL { "url": "/", "allow": false, "index": 7 }
    [latest-26298]2026-11-04T12:43:45.818Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.127 user tmorgenthaler auth basic matches / ACL (#7): { "url": "/", "allow": false, "index": 7 }
    [latest-26298]2026-11-04T12:43:46.137Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-04T12:43:46.138Z <wsapi:5:wsapi.js:169> (event handler): sending data
    

    My username is in the admin users group, and in the api_allowed users group. My workstation IP of 192.168.1.127 is in the 192.168.1.1/24 network range.

    What am I missing that the debug logs are telling me?

    Multi-System Reactor

  • MFA
    T tamorgen

    @toggledbits
    Okay, that was helpful. There was an error, and now I'm getting more information. I'm still getting Access Denied, for two separate reasons I think.

    [latest-26298]2026-11-03T16:50:01.487Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:50:01.488Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:50:01.510Z <wsapi:5:wsapi.js:152> (event handler) sending update for 5 entities
    [latest-26298]2026-11-03T16:50:01.669Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "69.255.234.254" via ::ffff:192.168.1.73 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-11-03T16:50:01.669Z <httpapi:5:httpapi.js:1135> httpapi#1 pass_all_proxy is set, passing proxy req from "69.255.234.254" via ::ffff:192.168.1.73
    [latest-26298]2026-11-03T16:50:01.669Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
    [latest-26298]2026-11-03T16:50:01.684Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
    [latest-26298]2026-11-03T16:50:01.685Z <httpapi:INFO> httpapi#1 API request from "69.255.234.254" (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
    [latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 checking ACLs for /api/v1/mfa.add/tmorgenthaler user tmorgenthaler authorization basic
    [latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1/mfa.add/tmorgenthaler; reducing path
    [latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1/mfa.add; reducing path
    [latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 no ACLs matched for /api/v1; reducing path
    [latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against /api ACL { "url": "/api", "group": "api_allowed", "source_ip": "192.168.1.1/24", "allow": true, "index": 0 }
    [latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 ACL no match: user tmorgenthaler to group:api_allowed
    [latest-26298]2026-11-03T16:50:01.685Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against /api ACL { "url": "/api", "source_ip": "127/8", "allow": true, "index": 6 }
    [latest-26298]2026-11-03T16:50:01.686Z <httpapi:null> httpapi#1 ACL no match: IP "69.255.234.254" to source_ip:"127/8"
    [latest-26298]2026-11-03T16:50:01.686Z <httpapi:null> httpapi#1 no ACLs matched for /api; reducing path
    [latest-26298]2026-11-03T16:50:01.686Z <httpapi:null> httpapi#1 checking /api/v1/mfa.add/tmorgenthaler against / ACL { "url": "/", "allow": false, "index": 7 }
    [latest-26298]2026-11-03T16:50:01.686Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from "69.255.234.254" user tmorgenthaler auth basic matches / ACL (#7): { "url": "/", "allow": false, "index": 7 }
    [latest-26298]2026-11-03T16:50:01.841Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:50:01.842Z <wsapi:5:wsapi.js:169> (event handler): sending data
    
    

    One, it looks like it's seeing my proxy address. I know I set up proxy access in the lastest version of the reactor.yaml file, but it looks like I may need to do the same here.

    From reactor.yaml

    # baseurl - The base URL to access the Reactor system. If you want to use
    #           HTTPS, please see the How-To section of the docs.
    baseurl: "https://192.168.1.70:8554"
    trusted_proxy: "192.168.1.73"
    proxy_baseurl: "https://reactor.notmydomain.com:443"  
    pass_all_proxy: true
    

    Do I need to put a proxy_baseurl and pass all proxy tag in the users.yaml as well?

    The users.yaml file contains the user, so I'm guessing it's hitting the trusted IP filter first?

    groups:
      # This section defines your user groups. Optionally, it defines application
      # and API access restrictions (ACLs) for the group. Users may belong to
      # more than one group. Again, no required or special groups here.
      admin:
        users:
          - admin
          - tmorgenthaler
        applications: true  # special form allows access to ALL applications
        api:
          default: allow
        api_allowed:
          users:
            - admin
            - tmorgenthaler
    
    api_acls:
      - url: "/api"
        group: api_allowed
        source_ip: 192.168.1.1/24
        allow: true
    
    
    Multi-System Reactor

  • MFA
    T tamorgen

    @toggledbits
    I changed the debug to true, this is what I'm seeing in the logs now:

    [latest-26298]2026-11-03T16:31:21.448Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:31:21.448Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:31:21.449Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:31:21.472Z <wsapi:5:wsapi.js:152> (event handler) sending update for 5 entities
    [latest-26298]2026-11-03T16:31:21.820Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "69.255.234.254" via ::ffff:192.168.1.73 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-11-03T16:31:21.820Z <httpapi:5:httpapi.js:1135> httpapi#1 pass_all_proxy is set, passing proxy req from "69.255.234.254" via ::ffff:192.168.1.73
    [latest-26298]2026-11-03T16:31:21.820Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
    [latest-26298]2026-11-03T16:31:21.829Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
    [latest-26298]2026-11-03T16:31:21.830Z <httpapi:INFO> httpapi#1 API request from "69.255.234.254" (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
    [latest-26298]2026-11-03T16:31:21.830Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from "69.255.234.254" user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
    [latest-26298]2026-11-03T16:31:21.834Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:31:21.834Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:31:21.835Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:31:21.835Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:31:21.836Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:31:21.836Z <wsapi:5:wsapi.js:169> (event handler): sending data
    
    

    I tried again using my local IP, and not using the Cloudflared tunnel

    [latest-26298]2026-11-03T16:34:36.924Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:34:36.924Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:34:36.949Z <wsapi:5:wsapi.js:152> (event handler) sending update for 5 entities
    [latest-26298]2026-11-03T16:34:36.987Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.127" via ::ffff:192.168.1.127 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-11-03T16:34:36.987Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
    [latest-26298]2026-11-03T16:34:36.996Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
    [latest-26298]2026-11-03T16:34:36.996Z <httpapi:INFO> httpapi#1 API request from ::ffff:192.168.1.127 (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
    [latest-26298]2026-11-03T16:34:36.996Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.127 user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
    [latest-26298]2026-11-03T16:34:36.997Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:34:36.998Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:34:36.998Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:34:36.999Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:34:37.023Z <wsapi:5:wsapi.js:152> (event handler) sending update for 2 entities
    [latest-26298]2026-11-03T16:34:37.099Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.127" via ::ffff:192.168.1.127 for GET /favicon.ico lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-11-03T16:34:37.237Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:34:37.237Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:34:37.238Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:34:37.238Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:34:37.238Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-03T16:34:37.239Z <wsapi:5:wsapi.js:169> (event handler): sending data
    
    
    Multi-System Reactor

  • MFA
    T tamorgen

    @toggledbits said in MFA:

    @tamorgen said in MFA:

    • url: "/api/"

    Remove the trailing slash.

    Just getting back to this.

    I removed the trailing slash, and I'm still getting the same result. I get prompted for my user name and password (same as before), but as soon as I put it in, I get Access Denied. I'm using Chrome incognito mode.

    4d1a6498-5b64-4cb8-b88a-f51ea0a989cd-image.png

    [latest-26298]2026-11-02T16:22:39.572Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-02T16:22:39.596Z <wsapi:5:wsapi.js:152> (event handler) sending update for 1 entities
    [latest-26298]2026-11-02T16:22:39.983Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.123" via ::ffff:192.168.1.123 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-11-02T16:22:39.984Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
    [latest-26298]2026-11-02T16:22:39.995Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
    [latest-26298]2026-11-02T16:22:39.995Z <httpapi:INFO> httpapi#1 API request from ::ffff:192.168.1.123 (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
    [latest-26298]2026-11-02T16:22:39.995Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.123 user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
    [latest-26298]2026-11-02T16:22:41.549Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-11-02T16:22:41.550Z <wsapi:5:wsapi.js:169> (event handler): sending data
    
    groups:
      api_allowed:
        users:
          - admin
          - tmorgenthaler
    
    api_acls:
      - url: "/api"
        group: api_allowed
        source_ip: 192.168.1.1/24
        allow: true
    
    Multi-System Reactor

  • MFA
    T tamorgen

    Still no joy. I'm still getting Access Denied after entering my username and password

    [latest-26298]2026-10-30T11:39:27.726Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-10-30T11:39:27.735Z <wsapi:5:wsapi.js:152> (event handler) sending update for 5 entities
    [latest-26298]2026-10-30T11:39:27.982Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.127" via ::ffff:192.168.1.127 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-10-30T11:39:27.982Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
    [latest-26298]2026-10-30T11:39:27.990Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
    [latest-26298]2026-10-30T11:39:27.991Z <httpapi:INFO> httpapi#1 API request from ::ffff:192.168.1.127 (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
    [latest-26298]2026-10-30T11:39:27.991Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.127 user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
    [latest-26298]2026-10-30T11:39:28.264Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-10-30T11:39:28.265Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-10-30T11:39:28.265Z <wsapi:5:wsapi.js:169> (event handler): sending data
    
    
    
    groups:
      api_allowed:
        users:
          - admin
          - tmorgenthaler
    
    api_acls:
      - url: "/api/"
        group: api_allowed
        source_ip: 192.168.1.1/24
        allow: true
    
    
    Multi-System Reactor

  • MFA
    T tamorgen

    DOH! I'll fix it and try again.

    Multi-System Reactor

  • MFA
    T tamorgen

    This is from a browser

    Multi-System Reactor

  • MFA
    T tamorgen

    @toggledbits

    @toggledbits said in MFA:

    The allowed list is separate from ACLs. It's just a first check. The ACLs are next.

    Okay, I added my /24 to the allowed api in users.yaml

    groups:
      api_allowed:
        users:
          - admin
          - tmorgenthaler
    
    api_acls:
      - url: "/api/"
        group: api_allowed
        source_IP: 192.168.1.1/24
        allow: true
    

    but I'm still not getting anywhere:

    [latest-26298]2026-10-28T18:22:12.362Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-10-28T18:22:12.379Z <wsapi:5:wsapi.js:152> (event handler) sending update for 20 entities
    [latest-26298]2026-10-28T18:22:13.139Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-10-28T18:22:13.164Z <wsapi:5:wsapi.js:152> (event handler) sending update for 1 entities
    root@docker:/home/tmorgenthaler/reactor/logs# cat httpapi.log | grep auth
    [latest-26298]2026-10-28T18:18:50.085Z <httpapi:CRIT> httpapi#1 ACLs Array(7) [{ "url": "/api/v1/authorize", "allow": true, "index": 0 }, { "url": "/api/v1/deauthorize", "allow": true, "index": 1 }, { "url": "/api/v1/systime", "allow": true, "index": 2 }, { "url": "/api/v1/alive", "allow": true, "index": 3 }, { "url": "/api/v1/lang", "allow": true, "index": 4 }, { "url": "/api", "source_ip": "127/8", "allow": true, "index": 5 }, { "url": "/", "allow": false, "index": 6 }]
    [latest-26298]2026-10-28T18:18:50.086Z <httpapi:CRIT> httpapi#1 ACL index Map(7) {"/api/v1/authorize": Array(1) [0], "/api/v1/deauthorize": Array(1) [1], "/api/v1/systime": Array(1) [2], "/api/v1/alive": Array(1) [3], "/api/v1/lang": Array(1) [4], "/api": Array(1) [5], "/": Array(1) [6] }
    [latest-26298]2026-10-28T18:18:52.748Z <httpapi:5:httpapi.js:820> httpapi#1 purging expired authorizations; default delay 7200000
    [latest-26298]2026-10-28T18:18:52.748Z <httpapi:5:httpapi.js:848> httpapi#1 setting timer for next authorization purge in 7200000ms
    [latest-26298]2026-10-28T18:19:12.395Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.123" via ::ffff:192.168.1.123 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-10-28T18:19:12.396Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
    [latest-26298]2026-10-28T18:19:12.407Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
    [latest-26298]2026-10-28T18:19:12.408Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.123 user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
    [latest-26298]2026-10-28T18:19:34.975Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.123" via ::ffff:192.168.1.123 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-10-28T18:19:34.975Z <httpapi:5:httpapi.js:1221> httpapi#1 askauth!
    [latest-26298]2026-10-28T18:19:47.485Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.123" via ::ffff:192.168.1.123 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-10-28T18:19:47.485Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
    [latest-26298]2026-10-28T18:19:47.495Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
    [latest-26298]2026-10-28T18:19:47.495Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.123 user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
    [latest-26298]2026-10-28T18:19:54.970Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.123" via ::ffff:192.168.1.123 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-10-28T18:19:54.970Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
    [latest-26298]2026-10-28T18:19:54.979Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
    [latest-26298]2026-10-28T18:19:54.979Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.123 user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
    [latest-26298]2026-10-28T18:20:01.600Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.123" via ::ffff:192.168.1.123 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-10-28T18:20:01.600Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
    [latest-26298]2026-10-28T18:20:01.607Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
    [latest-26298]2026-10-28T18:20:01.607Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.123 user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
    [latest-26298]2026-10-28T18:20:10.938Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.123" via ::ffff:192.168.1.123 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-10-28T18:20:10.938Z <httpapi:5:httpapi.js:1221> httpapi#1 askauth!
    [latest-26298]2026-10-28T18:20:54.025Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.123" via ::ffff:192.168.1.123 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-10-28T18:20:54.025Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
    [latest-26298]2026-10-28T18:20:54.040Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
    [latest-26298]2026-10-28T18:20:54.040Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.123 user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
    root@docker:/home/tmorgenthaler/reactor/logs# cat httpapi.log | grep 18:20:54
    [latest-26298]2026-10-28T18:20:54.025Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.123" via ::ffff:192.168.1.123 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-10-28T18:20:54.025Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
    [latest-26298]2026-10-28T18:20:54.040Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
    [latest-26298]2026-10-28T18:20:54.040Z <httpapi:INFO> httpapi#1 API request from ::ffff:192.168.1.123 (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
    [latest-26298]2026-10-28T18:20:54.040Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.123 user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
    [latest-26298]2026-10-28T18:20:54.042Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-10-28T18:20:54.042Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-10-28T18:20:54.067Z <wsapi:5:wsapi.js:152> (event handler) sending update for 2 entities
    [latest-26298]2026-10-28T18:20:54.749Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-10-28T18:20:54.775Z <wsapi:5:wsapi.js:152> (event handler) sending update for 1 entities
    [latest-26298]2026-10-28T18:20:54.836Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-10-28T18:20:54.836Z <wsapi:5:wsapi.js:169> (event handler): sending data
    [latest-26298]2026-10-28T18:20:54.861Z <wsapi:5:wsapi.js:152> (event handler) sending update for 2 entities
    
    Multi-System Reactor

  • MFA
    T tamorgen

    @toggledbits,

    This is what I see in my reactor.log file:

    [latest-26298]2026-10-28T16:27:53.505Z <httpapi:5:httpapi.js:1122> httpapi#1 starting request from "192.168.1.123" via ::ffff:192.168.1.123 for GET /api/v1/mfa.add/tmorgenthaler?askauth=1 lang en-US,en;q=0.9 (TLSv1.3)
    [latest-26298]2026-10-28T16:27:53.505Z <httpapi:5:httpapi.js:1154> httpapi#1 auth header Basic dG1vcmdlbnRoYWxlcjohUjNicjNhdGgzciE=
    [latest-26298]2026-10-28T16:27:53.517Z <httpapi:5:httpapi.js:1161> httpapi#1 auth accepted via HTTP Basic user tmorgenthaler
    [latest-26298]2026-10-28T16:27:53.517Z <httpapi:INFO> httpapi#1 API request from ::ffff:192.168.1.123 (TLSv1.3): GET /api/v1/mfa.add/tmorgenthaler
    [latest-26298]2026-10-28T16:27:53.517Z <httpapi:INFO> httpapi#1 request for /api/v1/mfa.add/tmorgenthaler from ::ffff:192.168.1.123 user tmorgenthaler auth basic matches / ACL (#6): { "url": "/", "allow": false, "index": 6 }
    
    

    I'm assuming the "allow": false is the deny.

    The allowed list in my reactor.yaml covers that IP:

    allowed_ips:
    #  - "127.0.0.1"
    #  - "192.168.0."  # or whatever your local trusted subnet
      - "192.168.1.0/24"
    
    Multi-System Reactor

  • MFA
    T tamorgen

    @gwp1 said in MFA:

    I'm using Portainer inside Proxmox so it had... challenges... with what IP it was "seeing".

    I have the same setup, and I have my own Cloudflare domain, with a local LXC running Cloudflared for the tunnels, so yeah, I'm sure the authenticator is having issues with the IPs and the virtual networking. Please let me know what you did to get past it.

    Multi-System Reactor

  • MFA
    T tamorgen

    @toggledbits ,
    I didn't want to pile on to the Login protection thread, but it reminded me about the MFA authentication. I tried to set it up once, and I could never get it to work. I got the pop up to login, and it returns an Access Denied page.

    00e9d644-adc7-4a9a-8db1-4d5ebe3f9751-image.png

    I'm starting with a clean, newly opened browser window, and my credentials are correct.

    I'm using these directions, and using my URL and my username in place of UUUU

    https://notmyurl.com/api/v1/mfa.add/notmyuserid?askauth=1

    I tried it via my private IP as well, and I'm still receiving Access Denied. I'm unsure what the log file is that would provide the why.

    I'm running latest-26298-fbb75fb8

    Multi-System Reactor

  • Reactor Build 26284 stuck at Loading Reactor UI
    T tamorgen

    SOVLED: I forgot the pass_all_proxy: true line!

    Thank you much Patrick!

    Multi-System Reactor

  • Reactor Build 26284 stuck at Loading Reactor UI
    T tamorgen

    I just reread that last part about the different addresses. I changed the local 127.0.0.2 to 192.168.1.73 and restarted the service.

    # See the Reactor documentation at https://reactor.toggledbits.com/docs/
    # Template version 22127
    #
    # Try this browser-based YAML editor: https://onlineyamltools.com/edit-yaml
    # Here's a quick YAML checker: https://www.yamlchecker.com/
    ---
    reactor:
      # baseurl - The base URL to access the Reactor system. If you want to use
      #           HTTPS, please see the How-To section of the docs.
      baseurl: "https://192.168.1.70:8554"
      trusted_proxy: "192.168.1.73"
      proxy_baseurl: "https://reactor.xyz.org:443"
      pki_certfile: reactor1.crt
      pki_keyfile: reactor1.key
      #
      # allowed_ips - List (array) of IP addresses/prefixes allowed access.
      #               if empty (default, commented out), all IPs are allowed. If
      #               you wish to filter (recommended), uncomment the lines below
      #               and edit the addresses as needed to match your network.
      allowed_ips:
      #  - "127.0.0.1"
      #  - "192.168.0."  # or whatever your local trusted subnet
        - "192.168.1.0/24"
      #  - "174.172.AAA.BB" # MY_DYNAMIC_IP
        - "169.252.4.16/29"
        - "169.253.162.0/29"
    

    I am still getting access denied:

    [latest-26287]2026-10-17T14:40:32.708Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:32.733Z <wsapi:5:wsapi.js:538> (event handler) sending update for 1 entities
    [latest-26287]2026-10-17T14:40:32.959Z <wsapi:INFO> wsapi: SSL/TLS connection from "174.172.AAA.BB" via ::ffff:192.168.1.73 (TLSv1.3)
    [latest-26287]2026-10-17T14:40:32.960Z <wsapi:WARN> wsapi: rejecting request from "174.172.AAA.BB"; IP restriction
    [latest-26287]2026-10-17T14:40:33.028Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.029Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.029Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.030Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.030Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.054Z <wsapi:5:wsapi.js:538> (event handler) sending update for 5 entities
    [latest-26287]2026-10-17T14:40:33.342Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.343Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.344Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.368Z <wsapi:5:wsapi.js:538> (event handler) sending update for 3 entities
    [latest-26287]2026-10-17T14:40:33.454Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.479Z <wsapi:5:wsapi.js:538> (event handler) sending update for 1 entities
    [latest-26287]2026-10-17T14:40:33.516Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.517Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.542Z <wsapi:5:wsapi.js:538> (event handler) sending update for 1 entities
    [latest-26287]2026-10-17T14:40:33.736Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.737Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.737Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.738Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.738Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T14:40:33.761Z <wsapi:5:wsapi.js:538> (event handler) sending update for 5 entities
    [latest-26287]2026-10-17T14:40:33.893Z <wsapi:INFO> wsapi: SSL/TLS connection from "174.172.AAA.BB" via ::ffff:192.168.1.73 (TLSv1.3)
    [latest-26287]2026-10-17T14:40:33.893Z <wsapi:WARN> wsapi: rejecting request from "174.172.AAA.BB"; IP restriction
    
    Multi-System Reactor

  • Reactor Build 26284 stuck at Loading Reactor UI
    T tamorgen

    @toggledbits said in Reactor Build 26284 stuck at Loading Reactor UI:

    Restart Reactor. Launch a request from the remote side of the tunnel. There should be messages logged in httpapi.log for that request that say either httpapi#1 starting request from <ip> for... or httpapi#1 starting proxied request from <ip> via <ip> for....

    If the logged message is the first form, or it's the second form and the two IP addresses logged ("from" and "via") are identical, there is no stable internal (CloudFlare) address seen on the request from your tunnel. This means you can't use allowed_ips (at all) unless your external request address is stable and can be listed in it.

    If the logged message is the second form (<ip> via <ip>), and the two IP addresses are different, then the second address is the (detectable) inside address of the tunnel. In that case, you would replace the 127.0.0.2 in trusted_proxy with that ("via") IP address, and add pass_all_proxy: true to config/reactor.yaml.

    Since your tunnel is not a reverse proxy, I suspect you're going to be in the former situation. I'm just hoping to be surprised.

    Okay, done.

    Here's what I'm seeing:

    [latest-26287]2026-10-17T13:50:39.179Z <wsapi:5:wsapi.js:538> (event handler) sending update for 5 entities
    [latest-26287]2026-10-17T13:50:39.332Z <wsapi:INFO> wsapi: SSL/TLS connection from "174.172.AAA.BB" via ::ffff:192.168.1.73 (TLSv1.3)
    [latest-26287]2026-10-17T13:50:39.333Z <wsapi:WARN> wsapi: rejecting request from "174.172.AAA.BB"; IP restriction
    [latest-26287]2026-10-17T13:50:39.377Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.378Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.379Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.379Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.380Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.402Z <wsapi:5:wsapi.js:538> (event handler) sending update for 5 entities
    [latest-26287]2026-10-17T13:50:39.545Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.546Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.547Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.547Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.571Z <wsapi:5:wsapi.js:538> (event handler) sending update for 4 entities
    [latest-26287]2026-10-17T13:50:39.696Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.697Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.697Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.698Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.722Z <wsapi:5:wsapi.js:538> (event handler) sending update for 4 entities
    [latest-26287]2026-10-17T13:50:39.945Z <wsapi:INFO> wsapi: SSL/TLS connection from "174.172.AAA.BB" via ::ffff:192.168.1.73 (TLSv1.3)
    [latest-26287]2026-10-17T13:50:39.945Z <wsapi:WARN> wsapi: rejecting request from "174.172.AAA.BB"; IP restriction
    [latest-26287]2026-10-17T13:50:39.955Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.956Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.957Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.957Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.958Z <wsapi:5:wsapi.js:555> (event handler): sending data
    [latest-26287]2026-10-17T13:50:39.970Z <wsapi:5:wsapi.js:555> (event handler): sending data
    

    It still appears to be seeing the my public facing IP, but it does say "via" the IP of my Cloudflared VM, which is covered in the allowed IP's via the 192.168.1.0/24.

    Uncommenting the hard coded public IP does work. Unless you can think of another work around, I see one of two options.

    • Leave it hard coded, and manually change it if I get the Access Denied page.
    • Have the crontab run daily in the middle of the night to check the IP and update the config as needed.

    I will say that I don't believe my public IP changes often, however, I don't know what that interval is for certain. It is not a static IP, and unless I'm a business, I don't believe Xfinity will give me one.

    Multi-System Reactor

  • Reactor Build 26284 stuck at Loading Reactor UI
    T tamorgen

    @toggledbits said in Reactor Build 26284 stuck at Loading Reactor UI:

    here is a line logged for httpapi prior to one you included that would be useful to see. I

    I'm not seeing anything in the logs when I perform a tail -f and reload the page, other than reactions prior to the httpapi warning.

    tmorgenthaler@docker:~/reactor/logs$ sudo tail -f reactor.log
    [latest-26287]2026-10-17T12:39:53.325Z <ZWaveJSController:5:ZWaveJSController.js:876> ZWaveJSController#zwavejs _apply_value dimming.level=1 force_update=false
    [latest-26287]2026-10-17T12:39:53.326Z <ZWaveJSController:5:ZWaveJSController.js:966> ZWaveJSController#zwavejs setting Light#zwavejs>263-0.x_zwave_values.Multilevel_Switch_currentValue to 99
    [latest-26287]2026-10-17T12:39:53.527Z <ZWaveJSController:5:ZWaveJSController.js:361> ZWaveJSController#zwavejs handling event message
    [latest-26287]2026-10-17T12:39:53.527Z <ZWaveJSController:5:ZWaveJSController.js:471> ZWaveJSController#zwavejs handling event { "source": "controller", "event": "statistics updated", "statistics": { "messagesTX": 21708, "messagesRX": 102412, "messagesDroppedRX": 27, "NAK": 0, "CAN": 0, "timeoutACK": 0, "timeoutResponse": 0, "timeoutCallback": 0, "messagesDroppedTX": 0, "backgroundRSSI": { "channel0": { "current": -105, "average": -105 }, "channel1": { "current": -106, "average": -106 }, "channel2": { "current": -106, "average": -106 }, "channel3": { "current": -92, "average": -93 }, "timestamp": 1792240767719 } } }
    [latest-26287]2026-10-17T12:39:53.547Z <ZWaveJSController:5:ZWaveJSController.js:361> ZWaveJSController#zwavejs handling event message
    [latest-26287]2026-10-17T12:39:53.547Z <ZWaveJSController:5:ZWaveJSController.js:471> ZWaveJSController#zwavejs handling event { "source": "node", "event": "statistics updated", "nodeId": 263, "statistics": { "commandsTX": 3154, "commandsRX": 3351, "commandsDroppedRX": 1, "commandsDroppedTX": 0, "timeoutResponse": 1, "lwr": { "protocolDataRate": 4, "repeaters": Array(0) [], "rssi": -66, "repeaterRSSI": Array(0) [] }, "lastSeen": "2026-10-17T12:39:53.315Z", "rtt": 43.9, "rssi": -60 } }
    [latest-26287]2026-10-17T12:39:53.547Z <ZWaveJSController:5:ZWaveJSController.js:486> ZWaveJSController#zwavejs handling node event statistics updated entity Light#zwavejs>263-0
    [latest-26287]2026-10-17T12:39:53.848Z <DynamicGroupController:INFO> DynamicGroupController#groups processing pending updates for Array(2) ["door_sensors", "interior_motion"]
    [latest-26287]2026-10-17T12:39:55.595Z <Rule:INFO> Alarm State (rule-grpq7soqaj in Home Modes) starting rule state evaluation; because predicate-state-changed Predicate#rule-grpq7soqaj/trig
    [latest-26287]2026-10-17T12:39:55.595Z <Rule:INFO> Alarm State (rule-grpq7soqaj in Home Modes) evaluated; rule state transition from RESET to 'SET'
    [latest-26287]2026-10-17T12:39:58.347Z <ZWaveJSController:5:ZWaveJSController.js:361> ZWaveJSController#zwavejs handling event message
    [latest-26287]2026-10-17T12:39:58.348Z <ZWaveJSController:5:ZWaveJSController.js:471> ZWaveJSController#zwavejs handling event { "source": "controller", "event": "statistics updated", "statistics": { "messagesTX": 21708, "messagesRX": 102413, "messagesDroppedRX": 27, "NAK": 0, "CAN": 0, "timeoutACK": 0, "timeoutResponse": 0, "timeoutCallback": 0, "messagesDroppedTX": 0, "backgroundRSSI": { "channel0": { "current": -105, "average": -105 }, "channel1": { "current": -106, "average": -106 }, "channel2": { "current": -106, "average": -106 }, "channel3": { "current": -92, "average": -93 }, "timestamp": 1792240767719 } } }
    [latest-26287]2026-10-17T12:39:58.597Z <ZWaveJSController:5:ZWaveJSController.js:361> ZWaveJSController#zwavejs handling event message
    [latest-26287]2026-10-17T12:39:58.597Z <ZWaveJSController:5:ZWaveJSController.js:471> ZWaveJSController#zwavejs handling event { "source": "controller", "event": "statistics updated", "statistics": { "messagesTX": 21709, "messagesRX": 102413, "messagesDroppedRX": 27, "NAK": 0, "CAN": 0, "timeoutACK": 0, "timeoutResponse": 0, "timeoutCallback": 0, "messagesDroppedTX": 0, "backgroundRSSI": { "channel0": { "current": -105, "average": -105 }, "channel1": { "current": -107, "average": -106 }, "channel2": { "current": -107, "average": -106 }, "channel3": { "current": -92, "average": -93 }, "timestamp": 1792240798344 } } }
    [latest-26287]2026-10-17T12:39:58.783Z <httpapi:WARN> httpapi#1 request from "174.172.AAA.BB" rejected (IP restriction)
    

    And here is the first area of reactor.yaml that pertains to proxy and permitted ips:

    # See the Reactor documentation at https://reactor.toggledbits.com/docs/
    # Template version 22127
    #
    # Try this browser-based YAML editor: https://onlineyamltools.com/edit-yaml
    # Here's a quick YAML checker: https://www.yamlchecker.com/
    ---
    reactor:
      # baseurl - The base URL to access the Reactor system. If you want to use
      #           HTTPS, please see the How-To section of the docs.
      baseurl: "https://192.168.1.70:8554"
      proxy_baseurl: "https://reactor.xyz.org:443"
      pki_certfile: reactor1.crt
      pki_keyfile: reactor1.key
      #
      # allowed_ips - List (array) of IP addresses/prefixes allowed access.
      #               if empty (default, commented out), all IPs are allowed. If
      #               you wish to filter (recommended), uncomment the lines below
      #               and edit the addresses as needed to match your network.
      allowed_ips:
      #  - "127.0.0.1"
      #  - "192.168.0."  # or whatever your local trusted subnet
        - "192.168.1.0/24"
      #  - "174.172.AAA.BB" # MY_DYNAMIC_IP
        - "169.252.4.16/29"
        - "169.253.162.0/29"
    
    Multi-System Reactor

  • Reactor Build 26284 stuck at Loading Reactor UI
    T tamorgen

    @toggledbits said in Reactor Build 26284 stuck at Loading Reactor UI:

    Must include port number

    I tried both 443 and 8554. When I go to the url in my browser, the port is simply 443. Cloudflare forwards the traffic to my local (Private) IP via the tunnel and port number. I tried using both port numbers, and neither works. I don't think my setup is so much a proxy in the way that reactor is expecting.

    So, when i try and access my reactor instance, I goto https://reactor.xyz.com (not xyz.com). Cloudflare has a tunnel established the a cloudflare client on my server, and the reactor.xyz.com has a service published of https://192.168.x.x:8554. Cloudflare establishes the SSL certificate for the domain.

    When I look in the logs, I see this

    [latest-26287]2026-10-17T00:12:07.524Z httpapi:WARN httpapi#1 request from "aaa.bbb.ccc.ddd" rejected (IP restriction)

    Which shows my public IP

    Multi-System Reactor

  • Reactor Build 26284 stuck at Loading Reactor UI
    T tamorgen

    I found the proxy section in the doc (search function works great).

    I added my cloudflare URL in a below baseurl and recommented by public IP.

    proxy_baselurl: https://reactor.xyz.com #not xyz.com

    I am now getting Access Denied.

    Edit: I also tried it with quotes around the URL. I'm not sure why, but in your documentation you have quotes around the baseurl URL and the proxy_baseurl with an IP, but in the next section with a FQDN, there is no quotes. Is that intentional, or does it matter?

    Multi-System Reactor

  • Reactor Build 26284 stuck at Loading Reactor UI
    T tamorgen

    @toggledbits said in Reactor Build 26284 stuck at Loading Reactor UI:

    I found two cases where proxy-handling behavior can be triggered even though Reactor isn't configured with proxy info. Build 26287 contains fixes for those.

    I updated to the 26287 build, commented out my public IP, and the behavior returned.

    I put removed the comment so it's working currently. As a work around, I set up a crontab that checks my public IP hourly, replaces the line with the IP (new or not), then reboots the docker instance. This is working but, I have a feeling the hourly restarts will bite me at some point.

    Multi-System Reactor
  • Login

  • Don't have an account? Register

  • Login or register to search.
  • First post
    Last post
0
  • Categories
  • Recent
  • Tags
  • Popular
  • Unsolved