Announce: squeeze-alexa - DIY secure Alexa integration

[nickb]

squeeze-alexa 2.3 is now out.

• Stop transport better (#52) and unsubscribe in MQTT on disconnect
• Improve long ValueError Alexa reponse when transport goes wrong.
• Now Playing: Support multiple artists if LMS is configured for these (#90)
• Now Playing: Support composer for classical (#13)
• Update MQTT docs e.g. systemd and Raspberry Pi

[Hisma]

Thanks for your hard work on this. This clearly took a lot of time and effort. I will say though it is definitely a "techie only" setup for sure. I'm fairly savvie and it took me about 8 hours to finally get it working! It was mostly due to the quality of documentation though. While you do have pretty much everything covered, there are a lot of "holes" in the documentation that the user is expected to fill in and really messed me up. Also, because there are multiple ways to get this working (ssl, mqtt, aws iot etc) it was difficult to discern which way was specific.

I think spending a few hours on improving the documentation would go a very long way, and allow more "normal" users to adopt this great software. By the end I didn't find it too entirely difficult to set up (though definitely not easy!), but it was just a whole lot of steps.

Otherwise, I hope you continue to update and improve this, you have a very good project on your hands here. I am using ssl and it's lightning fast... commands are nearly instanenous, which is quite incredible since every other typical alexa command has a noticeable delay.

[nickb]

Thanks for your hard work on this. This clearly took a lot of time and effort. I will say though it is definitely a "techie only" setup for sure. I'm fairly savvie and it took me about 8 hours to finally get it working! It was mostly due to the quality of documentation though. While you do have pretty much everything covered, there are a lot of "holes" in the documentation that the user is expected to fill in and really messed me up. Also, because there are multiple ways to get this working (ssl, mqtt, aws iot etc) it was difficult to discern which way was specific.

I think spending a few hours on improving the documentation would go a very long way, and allow more "normal" users to adopt this great software. By the end I didn't find it too entirely difficult to set up (though definitely not easy!), but it was just a whole lot of steps.

Thanks, and yes. Documentation is always hard, and trust me I've spent quite a few hours on this . It's made a lot trickier by the diversity of people's setups (Windows / QNAP / Synology / RPi / other Linux) and the speed at which Amazon change their mind about Alexa management, and even AWS Lambda setup. Also, moving to a multi-lingual setup has made this necessarily more complicated now (most of which is hidden in my release process)

I started spending more time on automating the process as it was clear that scripting this was better than documenting every single bit, but I'd love some help on improving the docs, seeing as I set mine up ages ago now and the pain points are lost a little. Perhaps you have some ideas on how to improve this or at least which bits were harder?

Otherwise, I hope you continue to update and improve this, you have a very good project on your hands here. I am using ssl and it's lightning fast... commands are nearly instanenous, which is quite incredible since every other typical alexa command has a noticeable delay.

Great! Yes, I've been quite pleased at the low latency nature, outperforms all my "native" home automation commands by far.

[Hisma]

Thanks, and yes. Documentation is always hard, and trust me I've spent quite a few hours on this . It's made a lot trickier by the diversity of people's setups (Windows / QNAP / Synology / RPi / other Linux) and the speed at which Amazon change their mind about Alexa management, and even AWS Lambda setup. Also, moving to a multi-lingual setup has made this necessarily more complicated now (most of which is hidden in my release process)

I started spending more time on automating the process as it was clear that scripting this was better than documenting every single bit, but I'd love some help on improving the docs, seeing as I set mine up ages ago now and the pain points are lost a little. Perhaps you have some ideas on how to improve this or at least which bits were harder?




Great! Yes, I've been quite pleased at the low latency nature, outperforms all my "native" home automation commands by far.

I may actually be able to help you here a bit. I did document my process, as I have an internal wiki that I use, but I ran into so many issues that I wasn't sure I captured all my steps, as I would write something down expecting it to work, it wouldn't, so I'd go back to troubleshoot different things, and probably wasn't capturing everything.

But I exported my wiki page into a word doc, see here -
edit: send me a PM if you want it, just in case there's too much private info I didn't want to make it public

My setup was on a raspberry pi 3B+, which is probably a fairly common use-case. Unfortunately exporting it to word got rid of some of the "niceties" that come with a wiki page, but I wanted it to be an editible document, so you can add your own notes to it. Feel free to use it as you please.

Note that I COULD NOT get this working with stunnel. I think your instrunctions for setting it up confused me and I just couldn't get it working. The problem I was running in to was that stunnel was trying to listen on the same port as my nginx reverse proxy server, so the two conflicted. After spending a few hours trying to figure out what I was doing wrong, I gave up, ditched stunnel, and just used straight ssl with nginx. It may not be "safe", but all I'm exposing to the world is my LMS telnet IP, so I see it as harmless. Worst case someone screw up my music server I guess. But perhaps you can try to revise your notes to explain stunnel setup more clearly, and especially how to set up the ports correctly so nothing conflicts.

Hope my notes can help other newbs like me out. Haha!

[Hisma]

something else worth noting... you put your execution scripts in the bin folder, yet they only work correctly from the root folder (deploy.py & test.py). At least when using the .zip versions that are already pre-built. That took me some time to figure out and should probably be handled better.

Also, I couldn't get the translation script to work. It would simply fail saying it can't generate the *.mo files (forget exactly what it was saying). I lost a lot of time with that. And the deploy script fails without those translation files. So I finally tried to see what would happen if I just commented out that part of the script where it checks for the translation files, and I didn't have any issues. Since I'm American and I think EN_US is default, I guess I didn't need them. But you might want to go back and see if you can document that script better, and perhaps look at the code and see what can be done to improve it so it's not so flaky. Worst case, just include the translation files in a separate zip somewhere so that build step can be skipped (less steps the easier this all is right?)

Just some additional comments/suggestions.

[nickb]

But I exported my wiki page into a word doc, see here -
edit: send me a PM if you want it, just in case there's too much private info I didn't want to make it public

Done, thanks.

Note that I COULD NOT get this working with stunnel. I think your instrunctions for setting it up confused me and I just couldn't get it working. The problem I was running in to was that stunnel was trying to listen on the same port as my nginx reverse proxy server, so the two conflicted. After spending a few hours trying to figure out what I was doing wrong, I gave up, ditched stunnel, and just used straight ssl with nginx.

Yep, setting up tunnels is hard I've found. A lot of ports, a lot of ways of getting it wrong and not many good tools for debugging.

However if you've got SSL with Nginx working (I'm guessing you looked at https://github.com/declension/squeez...#with-nginx-19), then even better. It's newer and perhaps easier to configure for about the same performance, I'd estimate.

For security, you should just make sure it uses client certificates so that not anyone (with SSL) can connect to that CLI - this is what my example config does.

But perhaps you can try to revise your notes to explain stunnel setup more clearly, and especially how to set up the ports correctly so nothing conflicts.

Sure - anything in particular? Obviously no amount of documentation can let two processes bind to the same port; I guess could be more explicit about choosing stunnel or nginx or HAProxy

Hope my notes can help other newbs like me out. Haha!

Hopefully!

[Hisma]

Done, thanks.



Yep, setting up tunnels is hard I've found. A lot of ports, a lot of ways of getting it wrong and not many good tools for debugging.

However if you've got SSL with Nginx working (I'm guessing you looked at https://github.com/declension/squeez...#with-nginx-19), then even better. It's newer and perhaps easier to configure for about the same performance, I'd estimate.

For security, you should just make sure it uses client certificates so that not anyone (with SSL) can connect to that CLI - this is what my example config does.



Sure - anything in particular? Obviously no amount of documentation can let two processes bind to the same port; I guess could be more explicit about choosing stunnel or nginx or HAProxy



Hopefully!

I see, yes, your guide made it sound as though you needed to use both stunnel & nginx together. Which really confused me bc I didn't see the point of effectively having 2 reverse proxies. So I just settled on nginx alone, which I guess was actually the correct way. Yes, just be more explicit. The nginx setup wasn't difficult at all actually, the only challenge was that my pi didn't have the latest version, and the version of nginx in the pi repo didnt properly support your certs. So I had to follow a guide I found that forced apt to pull the latest version of nginx. Once I got nginx working I used exerpts from your nginx guide to setup my .conf file (but mine needed tweaking a bit).
It's all documented in the file I linked you .

[sharper9]

Just ordered echo 2nd Gen and a dot 3rd gen.
I have a couple of squeeze V3 running wonderfully using my QNAP NAS as storage with Flac and MP3 format.
Would like to get them hooked up.

What do I do next?

also posted here https://forums.slimdevices.com/showt...l=1#post926003

[nickb]

Just ordered echo 2nd Gen and a dot 3rd gen.
I have a couple of squeeze V3 running wonderfully using my QNAP NAS as storage with Flac and MP3 format.
Would like to get them hooked up.

What do I do next?

If you're technical, we've got an extensive squeeze-alexa HOWTO. It's not easy (but I'm automating more and more), and quite a few people have got this set up now.

[nickb]

squeeze-alexa 2.4 is now out.

• Handle old and disconnected players properly
• Handle now playing for tracks / streams with no artist
• Friendly error responses if transport is broken
• Update requests dependency for security
• Improvements to setup scripts
• Big improvements to SSL / howto guides
• Improvements to translations handling for Windows and MacOS mainly.