Rhasspy skills and mqtt ACL

razzo04 · May 13, 2021, 2:22pm

I had started this project about 4 5 months ago but unfortunately for lack of time I couldn’t continue, my initial plan was to share the project when I arrived at a semi-functional state but I had to stop for lack of time before starting to work again on it I wanted to know if someone is already working on avoiding doing double work. I tried to design it so it needs little changes to the Rhasspy code. All skills will connect to the MQTT server put in bridge mode in fact this will act as an intermediary between the skills and the MQTT server managing access through ACL.

Each skill receives a username and password as environment variables to access the MQTT bridge and thanks to these credentials the server determines the topics which it can access. By default, there are some basic topics but the developer can add others if he needs to access them. To install new skills for now there is no graphical interface but I think that I will do a CLI that interface thanks to a rest API which sends a compressed archive with Dockerfile, a manifest.json the intent, and other files needed to run the container. Once decompressed, the server reads the manifest.json in which it will find the skills name, the permissions, the extra topics etc… Once the docker image is built the container is created and the credentials are passed as environment variables which are then hashed and after that registered in the “database”. Once done the container is started. For now, some parts are still missing for example the code that will have to deal with the creation of mosquitto.conf for the configuration of the MQTT bridge but if no one is already working on a similar project I could continue and then share the code once it reaches a functional state. Let me know if anyone has any advice or needs clarification.

razzo04 · June 17, 2021, 4:25pm

After some work, I have published the source code. It is in alpha so some features are still missing but it is a good proof of concept. If someone wants to give feedback or suggestions I would be happy.

koan · June 18, 2021, 6:34am

This is great! I haven’t looked in detail at the code yet, but did you see Secure architecture for Rhasspy apps where this idea has been discussed before? Maybe this can you give you some additional ideas. For instance, I would run the apps in the Docker containers as unprivileged users instead of as root (the default), to further minimize risks.
I’ll find some time soon to try this.

razzo04 · June 19, 2021, 7:47am

Thanks for sharing the link because I missed the discussion but I already implemented some ideas by default skills can access only three topics:

hermes/intent/# (READ or SUBSCRIBE)
hermes/intent//# (READ or SUBSCRIBE)
hermes/dialogueManager/# (WRITE)

github.com

razzo04/rhasspy-skills/blob/main/app/routers/mqtt.py#L40

    
      
              response: Response,
              username: str = Form(None),
              topic: str = Form(""),
              acc: str = Form(""),
              db: DB = Depends(get_db),
          ):
              print(f" username: {username} topic {topic}, acc: {acc}")
              skill = db.get_skill(username)
              if skill == None:
                  raise HTTPException(status_code=404, detail="Skill not found")
              match_intent_old = re.match(r"^hermes/intent/([^/]+)", topic)
              if match_intent_old is not None:
                  #READ or SUBSCRIBE
                  if int(acc) == 1 or int(acc) == 4:
                      return Response(status_code=status.HTTP_204_NO_CONTENT)
              match_intent = re.match(f"^hermes/intent/{username}/([^/]+)", topic)
              if match_intent is not None:
                  #READ or SUBSCRIBE
                  if int(acc) == 1 or int(acc) == 4:
                      return Response(status_code=status.HTTP_204_NO_CONTENT)
              match_dialogue = re.match(r"hermes/dialogueManager/([^/]+)", topic)

every skill can’t access the internet but can talk with the MQTT bridge

github.com

razzo04/rhasspy-skills/blob/main/app/routers/skill.py#L135

    
      
          
          
try:
              # TODO separate in another file
              networks: List[Network] = docker.networks.list(
                  names=["mqtt-net"], greedy=True
              )
              self_container: Container = docker.containers.get(gethostname())
              if len(networks) == 0:
                  print("Creating network")
                  # TODO set static ip
                  network: Network = docker.networks.create(
                      "mqtt-net", driver="bridge", check_duplicate=True, internal=True
                  )
                  network.connect(self_container, aliases=["mqtt.server"])
              is_connected = False
              for net in networks:
                  for container in net.containers:
                      if container.id == self_container.id:
                          is_connected = True
                          break
              if not is_connected:

I will improve the docker permission management in fact in the main container everything is executed as root even mosquitto. Thanks for the suggestion

razzo04 · June 27, 2021, 7:32pm

I fixed the problem of permission management, now apps are executed as unprivileged users and I develop a CLI that interfaces with rhasspy skills so now to install a new skill it just needs to be typed.

rhskill install time_skill

The next feature I will work on is skill configuration so the ability to pass data to skills for example an API token.

razzo04 · July 10, 2021, 9:32am

After some work, the skill if declared in the manifest can access the internet and prompt the user some value such as API token. To demonstrate the new feature I have created a new weather skill this is only an example and luck of many functionalities.

rhskill install weather_example

The next step would be to refactor the code a bit and prepare for a more stable release.

arpagor62970 · July 12, 2021, 4:24am

Hello, on which platform did you compile your package?
I downloaded it but installing it on my PI4 gives me:

pip install rhasspy-skills-cli
Looking in indexes: https://pypi.org/simple, https://www.piwheels.org/simple
Collecting rhasspy-skills-cli
Could not find a version that satisfies the requirement rhasspy-skills-cli (from versions: )
No matching distribution found for rhasspy-skills-cli

ditto if I download it on PyPi the project in wheel format:

pip install /home/pi/rhasspy_skills_cli-0.2.1-py3-none-any.whl
rhasspy_skills_cli-0.2.1-py3-none-any.whl is not a supported wheel on this platform.

thank you in advance
Arpagor

razzo04 · July 12, 2021, 6:48pm

Which python version do you have?
Probably the error is caused by the python version I added for requirement python 3.8 but with version 0.2.2 I lowered it to 3.7. Let me know if this resolves the problem.

arpagor62970 · July 13, 2021, 5:21pm

I have a python 3
Python 3.7.3 (default, Jan 22 2021, 20:04:44)
[GCC 8.3.0] on linux
I just tried the installation again and the only warning I received is:

anyio 3.2.1 has requirement idna> = 2.8, but you’ll have idna 2.6 which is incompatible.

and a warning for the path:

The script rhskill is installed in ‘/home/pi/.local/bin’ which is not on PATH.
Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location.adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location.

It’s almost good

Arpagor

razzo04 · July 14, 2021, 3:26pm

I have just tested on Raspberry Pi OS Lite with the same python version and it works. To solve the warning for the path I used PATH=/home/pi/.local/bin:$PATH. The warning for the idna version probably is caused by another installed package that requires version 2.6 but even with this version rhskill works.

razzo04 · July 30, 2021, 8:07pm

After some testing and refactoring the rhasspy-skills is more stable and have some new features. At this moment there is no skill ready to be used but my plan is to create new skills for my personal need and the publishing them, this will require some time but I hope at the end to have multiple useful skills that can be installed with a single command. If someone in the meantime what to try to develop a skill feel free to ask any questions.

Fernando_Rodriguez · August 17, 2022, 11:31am

Hello, I am trying to install it on raspberry pi and get an error:
WARNING: The requested image’s platform (linux/amd64) does not match the detected host platform (linux/arm/v7) and no specific platform was requested
Thanks

giof94is · January 22, 2023, 12:12pm

Hello to everyone,
@razzo04 any news on this amazing idea?

The development is still in progress or you’ve abandoned the project for some reason?

Do you think it will work with a running instance of rhasspy as add-on of Home Assistant (the latter as rpi4 container)?

I have also another question, as from the github you say to run the docker with MQTT_PASSWORD and MQTT_USER: having set “internal” as Rhasppy MQTT setting, what are these values (if there are defaults) or how can I find them?

Thanks in advance for your help!