[Announce] LMS-lite certified Smart Home skill for Alexa

[philchillbill]

I have written my own Alexa skill for LMS. It works but is not great. I used SSH to connect the skill to my LMS instance.

Nothing is recorded in my IIS log files. Not sure what to try next. I am open to suggestions.

Give ngrok a go. Full instructions on my website.


Sent from my iPhone using Tapatalk

[GeoffSoord]

Yep - I will give that a go and see what happens.... something for tomorrow.

[philchillbill]

Thing is, Letsencrypt certs are normally fine. Is there something odd about IIS that Amazon might not like, other than the cert? Is it reformatting JSON, for example? I’ve noticed that spaces in JSON result in rejected connections in the past.

[GeoffSoord]

It is possible that this is a problem with IIS. I have not used IIS with any other Alexa skills. When I have time I will see what options are available.

[philchillbill]

Rather than waste the voice commands for Rewind and FastForward that come 'for free' with the Smart Home voice model, I've now hijacked them so that they map to -60sec and +60sec within the current song. Beyond the beginning restarts at 0sec, as does beyond the end. You will have to redo smart home discovery for the new capabilities to surface for your players, but this usually happens every 6 hours or so anyway unbeknownst to the uninitiated

Alexa, rewind on device
Alexa, spule auf Gerät zurück
Alexa, reviens en arrière sur l'appareil

Alexa, fast forward on device
Alexa, spule auf dem Gerät vor
Alexa, mets en avance rapide l'appareil

Enjoy!

[ashceryth]

Hello @philchillbill,

The skill is working great so far! Thanks for the effort!

I'm using the approach with my own nginx reverse proxy for terminating and authenticating the sessions. As it isn't trivial to restrict the source IPs, I was wondering if it would be possible to use certificate-based authentication for additional security (as a bonus to basic auth). So like sending a client certificate for the HTTPS requests from the skill to the LMS which then can be verified by nginx. This way it would be possible to ensure that only the skill is allowed to talk to LMS. Would that even be possible with an Alexa skill?

Thanks!

[philchillbill]

I'm using the approach with my own nginx reverse proxy for terminating and authenticating the sessions. As it isn't trivial to restrict the source IPs, I was wondering if it would be possible to use certificate-based authentication for additional security (as a bonus to basic auth). So like sending a client certificate for the HTTPS requests from the skill to the LMS which then can be verified by nginx. This way it would be possible to ensure that only the skill is allowed to talk to LMS. Would that even be possible with an Alexa skill?

Glad you're enjoying it - did you also try the MediaServer skill with far more capabilities?

I'm afraid basic auth is all you can get with Alexa, but as it's over https your auth parameters can never be sniffed.

Make sure you configure your proxy to only accept https connections and also use e.g. a uuid in the proxied path name for obscurity (instead of proxying https://joebloggs.myddns.me to LMS, make it e.g. https://joebloggs.myddns.me/7c740ff1...4-c63f6fe36995). The /path is also TLS encrypted and untraceable.

[ashceryth]

Glad you're enjoying it - did you also try the MediaServer skill with far more capabilities?

I would love to, but I'm using the DE skill store. Unfortunately, the skill is not available Subscriptions are working with DE store, aren't they? However, I guess the skill isn't translated yet.

I'm afraid basic auth is all you can get with Alexa, but as it's over https your auth parameters can never be sniffed.

Pity! However, it should be secure enough with a decent password and fail2ban.

Make sure you configure your proxy to only accept https connections and also use e.g. a uuid in the proxied path name for obscurity (instead of proxying https://joebloggs.myddns.me to LMS, make it e.g. https://joebloggs.myddns.me/7c740ff1...4-c63f6fe36995). The /path is also TLS encrypted and untraceable.

Of course everything is HTTPS. I like the idea with the uuid - why didn't I think of that? Thanks for the suggestion!

[philchillbill]

Pity the German skill store only accepts de-DE skills. The language model is >6500 lines of JSON sample-utterance data so not trivial to translate.

I have 11 Echos and often test with 3 in the same room (1x en-US, 1x fr-FR and 1x de-DE) with different invocation names (Alexa, Amazon, Echo) so they don't bite each other. If you'd like the MediaServer functionality then get a cheap used Echo Dot 2nd gen and set it up to speak English with a different invocation name. You can switch to the en-GB store, install the skill, and switch back to de-DE and the skill will stay activated. Then use Alexa for regular German stuff and Amazon/Echo for English language requests.

Where there's a will there's a way...

[ashceryth]

Pity the German skill store only accepts de-DE skills. The language model is >6500 lines of JSON sample-utterance data so not trivial to translate.

Pity! However, let me know if you ever need someone to help with German translation

I modified my local server URL and tried to link the skill again today. However, it does not work anymore. I don't even see any requests coming from Amazon in my logs anymore. The account linking page is stuck on "checking connectivity". Everything works fine when tried manually. Utterly strange. Are there any restricted words that aren't allowed to be used within the URL or something like that?