dkaser/A_Instructions.md Secret

## A_Instructions.md

      
    Raw
  

              A_Instructions.md
            
          
    Home Assistant + CloudFlare Zero Trust + Alexa

Prerequisites


Have CloudFlare Zero Trust configured and working for your HA instance.

System Setup


Create a long-lived token from within Home Assistant (save to a temporary location for later use).
Create a service token within the CloudFlare dashboard for your skill to use (save to a temporary location for later use).
Add a new policy to the CloudFlare application:

Action must be set to "Service Auth"
Include "Service Token", add the token you created


AWS Configuration

Parameter Store


Within AWS Systems Manager, go to Parameter Store.
Create a new standard parameter:

Name: /ha-alexa/appConfig
Type: SecureString
Value: See SSM_Parameter.json, replacing values:

CF_CLIENT_ID: ID for the CloudFlare service token
CF_CLIENT_SECRET: Secret for the CloudFlare service token
HA_BASE_URL: URL to the CloudFlare application
HA_TOKEN: Long-lived token created within Home Assistant
WRAPPER_SECRET: Any random/arbitrary value, this will be used to protect calls to the authentication wrapper.


Follow the instructions to create an Alexa smart home skill, with the following adjustments:

When creating the IAM role, add AmazonSSMReadOnlyAccess in addition to AWSLambdaBasicExecutionRole.
When creating the Lambda function:

Use the code from Home_Assistant.py
Do not set environment variables for BASE_URL or LONG_LIVED_ACCESS_TOKEN
Create environment variable: APP_CONFIG_PATH set to /ha-alexa/


After creating the Lambda function from the guide, create a second Lambda function:

Use the code from Home_Assistant_Wrapper.py
Create environment variable: APP_CONFIG_PATH set to /ha-alexa/
Create a function URL, with auth type NONE. Save the function URL path for later use.


When setting up Account Linking in your Alexa skill:

Set Access Token URI to the function URL from the wrapper function.
Set Your Secret to the value of WRAPPER_SECRET in the configuration parameter.


## Home_Assistant.py
"""
Copyright 2019 Jason Hu <awaregit at gmail.com>

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
"""
import os, json, logging, urllib3, configparser, boto3, traceback

_debug = bool(os.environ.get('DEBUG'))

_logger = logging.getLogger('HomeAssistant-SmartHome')
_logger.setLevel(logging.DEBUG if _debug else logging.INFO)

# Initialize boto3 client at global scope for connection reuse
client = boto3.client('ssm')
app_config_path = os.environ['APP_CONFIG_PATH']
# Initialize app at global scope for reuse across invocations
app = None

class HA_Config:
    def __init__(self, config):
        """
        Construct new app with configuration
        :param config: application configuration
        """
        self.config = config

    def get_config(self):
        return self.config

def load_config(ssm_parameter_path):
    """
    Load configparser from config stored in SSM Parameter Store
    :param ssm_parameter_path: Path to app config in SSM Parameter Store
    :return: ConfigParser holding loaded config
    """
    configuration = configparser.ConfigParser()
    try:
        # Get all parameters for this app
        param_details = client.get_parameters_by_path(
            Path=ssm_parameter_path,
            Recursive=False,
            WithDecryption=True
        )

        # Loop through the returned parameters and populate the ConfigParser
        if 'Parameters' in param_details and len(param_details.get('Parameters')) > 0:
            for param in param_details.get('Parameters'):
                param_path_array = param.get('Name').split("/")
                section_position = len(param_path_array) - 1
                section_name = param_path_array[section_position]
                config_values = json.loads(param.get('Value'))
                config_dict = {section_name: config_values}
                configuration.read_dict(config_dict)
    except BaseException as err:
        print("Encountered an error loading config from SSM.")
        print(str(err))
    finally:
        return configuration

def lambda_handler(event, context):
    global app

    # Initialize app if it doesn't yet exist
    if app is None:
        print("Loading config and creating persistence object...")
        config = load_config(app_config_path)
        app = HA_Config(config)

    appConfig = app.get_config()['appConfig']

    base_url = appConfig['HA_BASE_URL']
    cf_client_id = appConfig['CF_CLIENT_ID']
    cf_client_secret = appConfig['CF_CLIENT_SECRET']

    directive = event.get('directive')
    assert directive is not None, 'Malformatted request - missing directive'
    assert directive.get('header', {}).get('payloadVersion') == '3', \
        'Only support payloadVersion == 3'

    scope = directive.get('endpoint', {}).get('scope')
    if scope is None:
        # token is in grantee for Linking directive
        scope = directive.get('payload', {}).get('grantee')
    if scope is None:
        # token is in payload for Discovery directive
        scope = directive.get('payload', {}).get('scope')
    assert scope is not None, 'Malformatted request - missing endpoint.scope'
    assert scope.get('type') == 'BearerToken', 'Only support BearerToken'

    token = scope.get('token')
    if token is None and _debug:
        token = appConfig['HA_TOKEN']  # only for debug purpose

    verify_ssl = not bool(os.environ.get('NOT_VERIFY_SSL'))

    """Handle incoming Alexa directive."""
    _logger.debug('Event: %s', event)

    assert base_url is not None, 'Please set BASE_URL environment variable'
    base_url = base_url.strip("/")

    _logger.debug("Base url: {}".format(base_url))

    directive = event.get('directive')
    assert directive is not None, 'Malformatted request - missing directive'
    assert directive.get('header', {}).get('payloadVersion') == '3', \
        'Only support payloadVersion == 3'

    http = urllib3.PoolManager(
        cert_reqs='CERT_REQUIRED' if verify_ssl else 'CERT_NONE',
        timeout=urllib3.Timeout(connect=2.0, read=10.0)
    )

    api_path = '{}/api/alexa/smart_home'.format(base_url)

    response = http.request(
        'POST',
        api_path,
        headers={
            'Authorization': 'Bearer {}'.format(token),
            'Content-Type': 'application/json',
            'CF-Access-Client-Id': cf_client_id,
            'CF-Access-Client-Secret': cf_client_secret,
        },
        body=json.dumps(event).encode('utf-8'),
    )
    if response.status >= 400:
        return {
            'event': {
                'payload': {
                    'type': 'INVALID_AUTHORIZATION_CREDENTIAL'
                            if response.status in (401, 403) else "INTERNAL_ERROR {}".format(response.status),
                    'message': response.data.decode("utf-8"),
                }
            }
        }
    _logger.debug('Response: %s', response.data.decode("utf-8"))
    return json.loads(response.data.decode('utf-8'))

## Home_Assistant_Wrapper.py
"""
Copyright 2019 Jason Hu <awaregit at gmail.com>

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
"""
import os, json, logging, urllib3, configparser, boto3, traceback, base64, urllib

_debug = bool(os.environ.get('DEBUG'))

_logger = logging.getLogger('HomeAssistant-SmartHome')
_logger.setLevel(logging.DEBUG if _debug else logging.INFO)

# Initialize boto3 client at global scope for connection reuse
client = boto3.client('ssm')
app_config_path = os.environ['APP_CONFIG_PATH']
# Initialize app at global scope for reuse across invocations
app = None

class HA_Config:
    def __init__(self, config):
        """
        Construct new app with configuration
        :param config: application configuration
        """
        self.config = config

    def get_config(self):
        return self.config

def load_config(ssm_parameter_path):
    """
    Load configparser from config stored in SSM Parameter Store
    :param ssm_parameter_path: Path to app config in SSM Parameter Store
    :return: ConfigParser holding loaded config
    """
    configuration = configparser.ConfigParser()
    try:
        # Get all parameters for this app
        param_details = client.get_parameters_by_path(
            Path=ssm_parameter_path,
            Recursive=False,
            WithDecryption=True
        )

        # Loop through the returned parameters and populate the ConfigParser
        if 'Parameters' in param_details and len(param_details.get('Parameters')) > 0:
            for param in param_details.get('Parameters'):
                param_path_array = param.get('Name').split("/")
                section_position = len(param_path_array) - 1
                section_name = param_path_array[section_position]
                config_values = json.loads(param.get('Value'))
                config_dict = {section_name: config_values}
                configuration.read_dict(config_dict)
    except BaseException as err:
        print("Encountered an error loading config from SSM.")
        print(str(err))
    finally:
        return configuration

def lambda_handler(event, context):
    global app

    _logger.debug('Event: %s', event)

    # Initialize app if it doesn't yet exist
    if app is None:
        print("Loading config and creating persistence object...")
        config = load_config(app_config_path)
        app = HA_Config(config)

    appConfig = app.get_config()['appConfig']

    destination_url = appConfig['HA_BASE_URL']
    cf_client_id = appConfig['CF_CLIENT_ID']
    cf_client_secret = appConfig['CF_CLIENT_SECRET']
    wrapper_secret = appConfig['WRAPPER_SECRET']

    assert destination_url is not None, 'Please set BASE_URL parameter'
    destination_url = destination_url.strip("/")

    http = urllib3.PoolManager(
        cert_reqs='CERT_REQUIRED',
        timeout=urllib3.Timeout(connect=2.0, read=10.0)
    )

    req_body = base64.b64decode(event.get('body')) if event.get('isBase64Encoded') else event.get('body')

    _logger.debug(req_body)

    req_dict = urllib.parse.parse_qs(req_body)
    client_secret = req_dict[b'client_secret'][0].decode("utf-8")

    assert client_secret == wrapper_secret

    headers = {
        'Content-Type': 'application/x-www-form-urlencoded',
        'CF-Access-Client-Id': cf_client_id,
        'CF-Access-Client-Secret': cf_client_secret
    }

    response = http.request(
        'POST',
        '{}/auth/token'.format(destination_url),
        headers=headers,
        body=req_body
    )

    if response.status >= 400:
        _logger.debug("ERROR {} {}".format(response.status, response.data))
        return {
            'event': {
                'payload': {
                    'type': 'INVALID_AUTHORIZATION_CREDENTIAL'
                            if response.status in (401, 403) else "INTERNAL_ERROR {}".format(response.status),
                    'message': response.data.decode("utf-8"),
                }
            }
        }
    _logger.debug('Response: %s', response.data.decode("utf-8"))
    return json.loads(response.data.decode('utf-8'))

## SSM_Parameter.json
{
"CF_CLIENT_ID": "value.access",
"CF_CLIENT_SECRET": "value",
"HA_BASE_URL": "https://cloudflare.app.path",
"HA_TOKEN": "LongLivedTokenFromHA",
"WRAPPER_SECRET": "ClientSecret"
}
	"""
	Copyright 2019 Jason Hu <awaregit at gmail.com>

	Licensed under the Apache License, Version 2.0 (the "License");
	you may not use this file except in compliance with the License.
	You may obtain a copy of the License at

	http://www.apache.org/licenses/LICENSE-2.0

	Unless required by applicable law or agreed to in writing, software
	distributed under the License is distributed on an "AS IS" BASIS,
	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	See the License for the specific language governing permissions and
	limitations under the License.
	"""
	import os, json, logging, urllib3, configparser, boto3, traceback

	_debug = bool(os.environ.get('DEBUG'))

	_logger = logging.getLogger('HomeAssistant-SmartHome')
	_logger.setLevel(logging.DEBUG if _debug else logging.INFO)

	# Initialize boto3 client at global scope for connection reuse
	client = boto3.client('ssm')
	app_config_path = os.environ['APP_CONFIG_PATH']
	# Initialize app at global scope for reuse across invocations
	app = None

	class HA_Config:
	def __init__(self, config):
	"""
	Construct new app with configuration
	:param config: application configuration
	"""
	self.config = config

	def get_config(self):
	return self.config

	def load_config(ssm_parameter_path):
	"""
	Load configparser from config stored in SSM Parameter Store
	:param ssm_parameter_path: Path to app config in SSM Parameter Store
	:return: ConfigParser holding loaded config
	"""
	configuration = configparser.ConfigParser()
	try:
	# Get all parameters for this app
	param_details = client.get_parameters_by_path(
	Path=ssm_parameter_path,
	Recursive=False,
	WithDecryption=True
	)

	# Loop through the returned parameters and populate the ConfigParser
	if 'Parameters' in param_details and len(param_details.get('Parameters')) > 0:
	for param in param_details.get('Parameters'):
	param_path_array = param.get('Name').split("/")
	section_position = len(param_path_array) - 1
	section_name = param_path_array[section_position]
	config_values = json.loads(param.get('Value'))
	config_dict = {section_name: config_values}
	configuration.read_dict(config_dict)
	except BaseException as err:
	print("Encountered an error loading config from SSM.")
	print(str(err))
	finally:
	return configuration

	def lambda_handler(event, context):
	global app

	# Initialize app if it doesn't yet exist
	if app is None:
	print("Loading config and creating persistence object...")
	config = load_config(app_config_path)
	app = HA_Config(config)

	appConfig = app.get_config()['appConfig']

	base_url = appConfig['HA_BASE_URL']
	cf_client_id = appConfig['CF_CLIENT_ID']
	cf_client_secret = appConfig['CF_CLIENT_SECRET']

	directive = event.get('directive')
	assert directive is not None, 'Malformatted request - missing directive'
	assert directive.get('header', {}).get('payloadVersion') == '3', \
	'Only support payloadVersion == 3'

	scope = directive.get('endpoint', {}).get('scope')
	if scope is None:
	# token is in grantee for Linking directive
	scope = directive.get('payload', {}).get('grantee')
	if scope is None:
	# token is in payload for Discovery directive
	scope = directive.get('payload', {}).get('scope')
	assert scope is not None, 'Malformatted request - missing endpoint.scope'
	assert scope.get('type') == 'BearerToken', 'Only support BearerToken'

	token = scope.get('token')
	if token is None and _debug:
	token = appConfig['HA_TOKEN'] # only for debug purpose

	verify_ssl = not bool(os.environ.get('NOT_VERIFY_SSL'))

	"""Handle incoming Alexa directive."""
	_logger.debug('Event: %s', event)

	assert base_url is not None, 'Please set BASE_URL environment variable'
	base_url = base_url.strip("/")

	_logger.debug("Base url: {}".format(base_url))

	directive = event.get('directive')
	assert directive is not None, 'Malformatted request - missing directive'
	assert directive.get('header', {}).get('payloadVersion') == '3', \
	'Only support payloadVersion == 3'

	http = urllib3.PoolManager(
	cert_reqs='CERT_REQUIRED' if verify_ssl else 'CERT_NONE',
	timeout=urllib3.Timeout(connect=2.0, read=10.0)
	)

	api_path = '{}/api/alexa/smart_home'.format(base_url)

	response = http.request(
	'POST',
	api_path,
	headers={
	'Authorization': 'Bearer {}'.format(token),
	'Content-Type': 'application/json',
	'CF-Access-Client-Id': cf_client_id,
	'CF-Access-Client-Secret': cf_client_secret,
	},
	body=json.dumps(event).encode('utf-8'),
	)
	if response.status >= 400:
	return {
	'event': {
	'payload': {
	'type': 'INVALID_AUTHORIZATION_CREDENTIAL'
	if response.status in (401, 403) else "INTERNAL_ERROR {}".format(response.status),
	'message': response.data.decode("utf-8"),
	}
	}
	}
	_logger.debug('Response: %s', response.data.decode("utf-8"))
	return json.loads(response.data.decode('utf-8'))
	{
	"CF_CLIENT_ID": "value.access",
	"CF_CLIENT_SECRET": "value",
	"HA_BASE_URL": "https://cloudflare.app.path",
	"HA_TOKEN": "LongLivedTokenFromHA",
	"WRAPPER_SECRET": "ClientSecret"
	}