Announce: squeeze-alexa - DIY secure Alexa integration

[Freddy]

Hi,
I was about to give this another try since it seems amazing. But I have a really hard time to follow the README/HOWTO from start -> finish. I would like to use alexa-squeeze with the MQTT transporter.
Is it worth waiting for 2.0? Will that one be easier to setup?

EDIT; if I want to create an IAM user just for this, which access groups should I apply

[caplam]

Hi,

I'm also interested in giving it a try and i'm also struggling to understand how it works. I've not started for now but i'm thinking on how to do it.
My lms is installed in a esxi5.5 debian8 vm. I'd like to use alexa to control lms but i'd also like to have echo seen as a regular lms player (not with squeeze-alexia i think).

I already have a mqtt broker on my network (on a synology nas) but having read howto i don't know what solution too choose.
I have domain names and I have lets encrypt certificates for these domains on a synology nas.
Apparently i can not use syno reverse proxy as it's based on nginx which doesn't support non http traffic over tls
I'd rather use a lets encrypt certificate i already have.
If i succeed i'll post here.

[Freddy]

Hi,

I'm also interested in giving it a try and i'm also struggling to understand how it works. I've not started for now but i'm thinking on how to do it.
My lms is installed in a esxi5.5 debian8 vm. I'd like to use alexa to control lms but i'd also like to have echo seen as a regular lms player (not with squeeze-alexia i think).

I already have a mqtt broker on my network (on a synology nas) but having read howto i don't know what solution too choose.
I have domain names and I have lets encrypt certificates for these domains on a synology nas.
Apparently i can not use syno reverse proxy as it's based on nginx which doesn't support non http traffic over tls
I'd rather use a lets encrypt certificate i already have.
If i succeed i'll post here.

Great, please do.
I also run LetsEncrypt, NGINX and a MQTT broker but to my understanding the latter is of no use for this setup since we must use Amazons IOT broker?

[caplam]

don't be happy too soon i'm not very skilled especially in security.

[Freddy]

don't be happy too soon i'm not very skilled especially in security.

No worries, would be amazing to get this to work

I wonder if 2.0 will have a setup-script

[nickb]

Hi,
I was about to give this another try since it seems amazing. But I have a really hard time to follow the README/HOWTO from start -> finish.

Great, please give it a go. Sorry you're finding it difficult - it is definitely a complex setup. I've been adding to the docs more and more, but sometimes think the extra detail is making it more complicated.

Definitely the fact there are entirely different networking modes does - but I had to do that as I've personally switched to 4G internet, and the existing setup didn't work. Necessity is the mother of all invention, etc

Is there anything in particular?

I would like to use alexa-squeeze with the MQTT transporter.

That's great. I don't know of anyone else who's tried it yet so please do, and file issues (or PRs if that's your thing) if there are any missing sections, or you learned anything.

Is it worth waiting for 2.0? Will that one be easier to setup?

Not really -- 2.0 is practically what's in master right now. I've just not got round to the release work, I'll try and do that soon.

But I've been thinking around (more) automation to set this stuff up. The thing is automation tooling (aws cli, scripts etc) are generally suited to going through a process many times, which makes the extra setup worth it. But here I suspect most people just want to set it up once and leave it.

But I'm happy to hear to any ideas here... The self-diagnostics are quite good on the SSL side, some stuff like this for MQTT would be cool I guess.

EDIT; if I want to create an IAM user just for this, which access groups should I apply

I don't use a user, just a role. But so long as the Lambda user has the right permissions (in addition to the normal Alexa / Lambda ones e.g. AWSLambdaBasicExecutionRole) it should be fine AIUI. Have a look here: https://github.com/declension/squeez...am-policy.json

mqtt-squeeze doesn't need any IAMs, as it connects (currently at least) with TLS cert-based authentication, though I did create an IOT thing to model the server itself (don't think this was necessary, just part of the exploratory phase... I think...)

HTH
Nick (aka declension)

[nickb]

I also run LetsEncrypt, NGINX and a MQTT broker but to my understanding the latter is of no use for this setup since we must use Amazons IOT broker?

That's right, at least for now.

Conceptually you've still got an unsolved problem if you use your own broker - of how to connect to this broker and on what port etc (and Lambda means no persistent connections of course). The use-case for the MQTT transport mode was networking / firewalls that don't allow any NAT (so no port mapping etc)

Plus Amazon's one is near-free, always up, close to the Lambda and relatively easy / consistent to configure, I guess.

[nickb]

Hi,
My lms is installed in a esxi5.5 debian8 vm. I'd like to use alexa to control lms but i'd also like to have echo seen as a regular lms player (not with squeeze-alexia i think).

No, but see https://github.com/declension/squeeze-alexa/issues/25

I already have a mqtt broker on my network (on a synology nas) but having read howto i don't know what solution too choose.
I have domain names and I have lets encrypt certificates for these domains on a synology nas.

Sounds perfect - ignore MQTT for now, I'd go for SSL with your existing certificate, and get stunnel working - it's old but rock-solid and very lightweight.

The diagnostics (local_test.py) and FAQ should provide quite a lot of help with this route, just make sure your networking makes sense internally (LAN-side) and externall (WAN) side, but sounds like you have most of that working for the cert anyway.

[nickb]

Featuring MQTT support, new settings system, French language, and various fixes:

squeeze-alexa 2.0

[caplam]

Sounds perfect - ignore MQTT for now, I'd go for SSL with your existing certificate, and get stunnel working - it's old but rock-solid and very lightweight.

The diagnostics (local_test.py) and FAQ should provide quite a lot of help with this route, just make sure your networking makes sense internally (LAN-side) and externall (WAN) side, but sounds like you have most of that working for the cert anyway.

thank you for your answer.
For now my concern is to find out how to treat the incoming traffic from amazon. If my understanding is right, it's not http traffic so i can't use synology reverse proxy.
(I have several servers like jeedom which i can join on jeedom.mydomain.fr for example ). Probably i need to open another port and cannot proxify this service.